{"id":20697415,"url":"https://github.com/epomatti/aws-ubuntu-landscape","last_synced_at":"2026-06-19T18:32:13.185Z","repository":{"id":262367729,"uuid":"865600911","full_name":"epomatti/aws-ubuntu-landscape","owner":"epomatti","description":"Ubuntu Landscape environment","archived":false,"fork":false,"pushed_at":"2025-03-04T14:17:00.000Z","size":19402,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-08-21T18:40:34.108Z","etag":null,"topics":["aws","cis","cis-benchmark","ec2","landscape","newrelic","rdp","terraform","ubuntu","ubuntu-landscape","ubuntu-one","ubuntu-pro","xrdp"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/epomatti.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2024-09-30T19:53:45.000Z","updated_at":"2025-03-04T14:17:03.000Z","dependencies_parsed_at":"2025-08-21T17:36:04.699Z","dependency_job_id":"a4a85a0b-7e51-47bb-a499-bde053674378","html_url":"https://github.com/epomatti/aws-ubuntu-landscape","commit_stats":null,"previous_names":["epomatti/aws-ubuntu-landscape"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/epomatti/aws-ubuntu-landscape","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/epomatti%2Faws-ubuntu-landscape","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/epomatti%2Faws-ubuntu-landscape/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/epomatti%2Faws-ubuntu-landscape/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/epomatti%2Faws-ubuntu-landscape/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/epomatti","download_url":"https://codeload.github.com/epomatti/aws-ubuntu-landscape/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/epomatti%2Faws-ubuntu-landscape/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34544403,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-19T02:00:06.005Z","response_time":61,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","cis","cis-benchmark","ec2","landscape","newrelic","rdp","terraform","ubuntu","ubuntu-landscape","ubuntu-one","ubuntu-pro","xrdp"],"created_at":"2024-11-17T00:17:56.039Z","updated_at":"2026-06-19T18:32:13.168Z","avatar_url":"https://github.com/epomatti.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Ubuntu Landscape\n\n## Create the AWS resources\n\nSecurely connect to your profile with SSO:\n\n```sh\nexport AWS_PROFILE=\"\u003cPROFILE\u003e\"\naws sso login\n```\n\nCreate the `.auto.tfvars` variables file:\n\n```sh\ncp config/template.tfvars .auto.tfvars\n```\n\nChoose a current AMI from the [Canonical SSM index](https://documentation.ubuntu.com/aws/en/latest/aws-how-to/instances/find-ubuntu-images/). Example:\n\n```sh\naws ssm get-parameters --names \\\n   /aws/service/canonical/ubuntu/pro-server/24.04/stable/current/arm64/hvm/ebs-gp3/ami-id\n```\n\nSet the required variables:\n\n- `landscape_server_fqdn` - Internet FQDN for the Landscape server.\n- `landscape_certbot_email` - Required while setting `certbot` certificates.\n\nCreate the infrastructure:\n\n```sh\nterraform init\nterraform apply -auto-approve\n```\n\n## Setup the Ubuntu Landscape server\n\nThis project currently uses the `quickstart` mode for installation. The following are references for such configuration:\n\n- [Ubuntu Pro Dashboard][1]\n- [Landscape quickstart deployment][2]\n- [Landscape self-hosted documentation][3]\n- [Landscape self-hosted setup][4]\n\nElevate your privileges in the server session:\n\n```sh\nsudo su -\n```\n\nMake sure cloud init executed properly\n\n```sh\ncloud-init status\n```\n\n\u003e [!IMPORTANT]\n\u003e  Make sure you don't skip the next step. Change the \"example.com\" to your owned domain of choice.\n\nSetup your domain registry for the `landscape.example.com` to the public IP or AWS EC2 instance name.\n\n\u003e [!NOTE]\n\u003e The project is created with an Elastic IP, therefore the public IP address will not change.\n\nMake sure that the DNS has replicated successfully before continuing:\n\n```sh\ndig landscape.example.com\n```\n\nAttach the server to your Ubuntu Pro subscription. You're currently allowed 5 machines in the Personal free subscription.\n\n\u003e [!TIP]\n\u003e Don't need to attach again when using cloud Ubuntu Pro image\n\n```sh\npro attach\n```\n\nSet the session variables:\n\n```sh\nexport FQDN=$(aws ssm get-parameter --name \"landscape-server-fqdn\" --query \"Parameter.Value\" --output text)\nexport CERTBOT_EMAIL=$(aws ssm get-parameter --name \"landscape-server-certbot-email\" --query \"Parameter.Value\" --output text)\n```\n\nSet your hostname using variables:\n\n```sh\nhostnamectl set-hostname \"$FQDN\"\n```\n\nIt would be a good idea to reboot after changing the hostname:\n\n```sh\nreboot\n```\n\nInstall Landscape:\n\n```sh\napt update \u0026\u0026 DEBIAN_FRONTEND=noninteractive apt-get install -y landscape-server-quickstart\n```\n\nInstall your certificate:\n\n\u003e [!IMPORTANT]\n\u003e Make sure that after these steps the certificate is correctly issued and installed. This will required by the landscape client configuration later\n\n\u003e [!TIP]\n\u003e If you rebooted, make sure to re-enter the required variables\n\n```sh\ncertbot --non-interactive --apache --no-redirect --agree-tos --email $CERTBOT_EMAIL --domains $FQDN\n```\n\nYour server should be ready for use at `https://landscape.example.com`.\n\nAccess the server and create your administrator account.\n\nIn case this come in handy, these are the commands to manage the Landscape Server CTL:\n\n```sh\nlsctl status\nlsctl restart\n```\n\n## Ubuntu Pro Server\n\n\u003e [!NOTE]\n\u003e As of this writing, USG is not yet available for [24.04](https://ubuntu.com/security/certifications/docs/usg/cis).\n\nIf you want to enable Ubuntu Pro for the created instance, just flip the variable switch:\n\n```terraform\ncreate_ubuntu_pro_server = true\n```\n\nCheck the pro licensing status:\n\n\u003e [!NOTE]\n\u003e USG and the Landscape client should already be installed. USG should already be enabled.\n\n\u003e [!WARNING]\n\u003e Livepatch is currently [not supported](https://ubuntu.com/security/livepatch/docs/livepatch/explanation/which-are-the-supported-architectures) for ARM64 systems\n\n```sh\nsudo pro status --all\n```\n\nLink the instance to Landscape SaaS and then approve the registration:\n\n```sh\n# sudo is required to read /etc/landscape/client.conf\nsudo landscape-config --computer-title \"aws-ubuntu-pro-server\" \\\n  --account-name \"\u003cACCOUNT\u003e\" \\\n  --http-proxy=\"\" \\\n  --https-proxy=\"\" \\\n  --script-users=\"root,landscape,nobody\" \\\n  --tags=\"server,aws\"\n```\n\nEnable script execution:\n\n```sh\nsudo landscape-config --include-manager-plugins=ScriptExecution --script-users=root,landscape,nobody\n```\n\nRestart the service:\n\n```sh\nsudo service landscape-client restart\n```\n\nApply a profile:\n\n```sh\nsudo usg fix cis_level1_server\n```\n\n## Ubuntu Desktop\n\nThis project uses a locally deployed bear metal remote Ubuntu 22.04 Desktop. Create a [Ubuntu image][5]. The recommended burning tool is [Balena][6].\n\n\u003e [!NOTE]\n\u003e Using Ubuntu 22.04 as of the time of this project Ubuntu Pro des not support 24.04 USG, which is part of this scope of experimentation.\n\nMake sure all packages are updated:\n\n```sh\nsudo apt update\nsudo apt upgrade -y\n```\n\nSet up XRDP to manage your machine remotely. This project follows this Digital Ocean's article.\n\n```sh\nsudo apt install xfce4 xfce4-goodies -y\nsudo apt install xrdp -y\nsudo systemctl status xrdp\n```\n\nOnce logged into your Ubuntu Desktop workstation, attach the machine for Ubuntu landscape management.\n\nThe `ubuntu-pro-client` should already be installed. Just make sure it is updated:\n\n```sh\n# This will update the client ot the latest version \nsudo apt install -y ubuntu-pro-client\n```\n\n\u003e [!NOTE]\n\u003e You should be using a Let's Encrypt certificated issued earlier in this documentation. In for some reason you're opting for a self-signed approach, check how to [set it up in the client][8].\n\nAttach the Ubuntu Desktop machine to a license:\n\n```sh\nsudo pro attach\n```\n\nNow, from your Ubuntu Landscape Server, follow the instructions on how to register a computer vi the menu. The path should be something like this:\n\n```\nhttps://landscape.example.com/account/standalone/how-to-register\n```\n\nThese are examples of commands to be executed in the Ubuntu Desktop client machine:\n\n```sh\nsudo apt-get update\nsudo apt-get install -y landscape-client\n# Replace the domain\nsudo landscape-config --computer-title \"MyUbuntuDesktop\" --account-name standalone  --url https://landscape.example.com/message-system --ping-url http://landscape.example.com/ping\n```\n\n\u003e [!NOTE]\n\u003e Make sure to check Ubuntu Pro status in Landscape to confirm it has been properly registered.\n\n\n### Enable script execution (administrator)\n\nIn case script execution needs to be enabled.\n\n```sh\nsudo -u landscape bash -x /opt/canonical/landscape/scripts/update_security_db.sh\n```\n\nConfiguration file:\n\n```sh\n/etc/landscape/client.conf\n```\n\nRestarting the client:\n\n```sh\nsudo service landscape-client restart\n```\n\n## Ubuntu Hardening\n\nUbuntu Pro supports [Ubuntu Security Guide (USG)][9]. For quick guide, the [tutorial][14] can be o good starting point.\n\nFollowing the [installation guide][10]:\n\n\u003e [!NOTE]\n\u003e This is already covered by the previous steps already executed\n\n1. Install the UA client\n2. Attach the subscription\n\nEnable and install USG:\n\n```sh\nsudo ua enable usg\nsudo apt install usg\n```\n\nThis project uses CIS benchmarks, for which there are different [profiles][11]:\n\n\u003e [!TIP]\n\u003e Check the [CIS Benchmark publications][12] for in-depth details about each profile\n\n- Level 1: Balanced\n- Level 2: Restrictive\n\nTo apply the benchmark, select one of the profiles:\n\n```sh\n# Profiles: cis_level1_workstation, cis_level2_workstation\nsudo usg fix \u003cPROFILE\u003e\n```\n\nA system `reboot` is required after this point.\n\nThen, run the audit command:\n\n\u003e [!TIP]\n\u003e Once the audit below is completed, access the HTML page for analysis\n\n```sh\n# Profiles: cis_level1_workstation, cis_level2_workstation\nsudo usg audit \u003cPROFILE\u003e\n```\n\nTo access the file from another user:\n\n```sh\ncp usg-report-xxx.html /home/user/Desktop/\nchown \u003cuser\u003e: /home/\u003cuser\u003e/Desktop/usg-report-20241110.1302.html\n```\n\nTo apply for a set of systems:\n\n```sh\nsudo usg generate-fix \u003cPROFILE\u003e --output fix.sh\n```\n\nIf required, explore the [customization][13] options.\n\nOther references include the [Ubuntu engagement][15] page, and the [CIS Benchmark Ubuntu][16] page.\n\n## VirtualBox\n\nSimplest way might be to use VirtualBox with Vagrant:\n\n\u003e [!NOTE]\n\u003e USG currently not supported for 24.04\n\n```sh\nmkdir -p vagrant/ubuntu-jammy\ncd vagrant/ubuntu-jammy\n\nvagrant init ubuntu/jammy64\nvagrant up\nvagrant ssh\n```\n\nTo increase the VM performance, set custom values:\n\n```ruby\nconfig.vm.provider \"virtualbox\" do |vb|\n  vb.memory = \"2048\"\n  vb.cpus = \"2\"\nend\n```\n\nSetup Ubuntu Pro:\n\n```sh\nsudo apt update \u0026\u0026 sudo apt upgrade -y\nsudo apt install -y ubuntu-advantage-tools\n```\n\nAttach to a subscription:\n\n```sh\nsudo pro attach\n```\n\nEnable and install USG, the Landscape Client:\n\n```sh\nsudo pro enable usg\nsudo apt install -y usg landscape-client\n```\n\nSet up the configuration file `/etc/landscape/client.conf`:\n\n\u003e [!TIP]\n\u003e The [documentation](https://ubuntu.com/landscape/docs/configure-landscape-client) have guidelines for CM tools such as Puppet or Ansible.\n\n```\n[client]\nlog_level = info \nurl = https://{FQDN}/message-system\nping_url = http://{FQDN}/ping\ndata_path = /var/lib/landscape/client\nregistration_key = {REGISTRATION_KEY}\ncomputer_title = {COMPUTER_TITLE}\naccount_name = {ACCOUNT_NAME}\ninclude_manager_plugins = ScriptExecution\nscript_users = root,landscape,nobody\n```\n\nWith the file set, register the machine:\n\n```sh\nsudo landscape-config\n```\n\n\u003e [!WARNING]\n\u003e If you run into a \"twisted.internet\" error it might be due to [this bug](https://bugs.launchpad.net/landscape-client/+bug/1868730). Check the ownership of the `/var/lib/landscape/client` structure, it should have `landscape` ownership. If necessary, fix it by running `sudo chown -R landscape:landscape /var/lib/landscape/client`.\n\nApply a USG a profile:\n\n```sh\nsudo usg fix cis_level1_server\n```\n\n## Tuning\n\nThe client can read several variables to adjust the behavior.\n\nAn example is provided in the [repository](https://github.com/canonical/landscape-client/blob/main/example.conf), and this is a sample [question](https://answers.launchpad.net/landscape-client/+question/403745).\n\nConfiguration can be changed in the `client.conf` file:\n\n```\n/etc/landscape/client.conf\n```\n\nFor local debugging this might might be useful:\n\n```conf\n# The number of seconds between server exchanges\nexchange_interval = 900 # 15 minutes\n\n# The number of seconds between urgent exchanges with the server.\nurgent_exchange_interval = 60 # 1 minute\n\n# The number of seconds between pings.\nping_interval = 30\n\n# The number of seconds between apt update calls.\napt_update_interval = 21600\n\n# The number of seconds between package monitor runs.\npackage_monitor_interval = 1800\n\n# The number of seconds between snap monitor runs.\nsnap_monitor_interval = 1800\n```\n\nChanging this configuration will require a client restart:\n\n```sh\nsudo service landscape-client restart\n```\n\n## Troubleshooting\n\nMake sure to run scripts with the right user `landscape`, or if `root` is used, apply the correct permissions.\n\n```sh\nsudo cat /etc/sudoers\ngroups landscape\n```\n\nAn example with the docker list:\n\n```sh\nstat /etc/apt/sources.list.d/docker.list\nchmod -v o+r /etc/apt/sources.list.d/docker.list\n```\n\n## Monitoring\n\n### New Relic\n\nHere's a New Relic example setup with log [forwarding](https://docs.newrelic.com/docs/logs/forward-logs/forward-your-logs-using-infrastructure-agent/#manual):\n\nConfiguration is declared in the `logging.yml` file:\n\n```\n/etc/newrelic-infra/logging.d/logging.yml\n```\n\nForward all the Landscape client logs:\n\n```yaml\nlogs:\n  - name: landscape-client-logs\n    file: /var/log/landscape/*.log\n    attributes:\n      logtype: landscape-client\n      environment: sandbox\n```\n\nQuick commands to manage the agents:\n\n```sh\nsudo systemctl \u003cstart|stop|restart|status\u003e newrelic-infra\nsudo service landscape-client restart\n```\n\n### Grafana\n\n[Register a Linux server](https://epomatti.grafana.net/connections/add-new-connection/linux-node) with [Alloy](https://grafana.com/docs/alloy/latest/get-started/configuration-syntax/) to Grafana.\n\nConfiguration is derived from the following template files:\n\n- https://storage.googleapis.com/cloud-onboarding/alloy/scripts/install-linux.sh\n- https://storage.googleapis.com/cloud-onboarding/alloy/config/config.alloy\n\nYou can [configure Alloy](https://grafana.com/docs/alloy/latest/configure/) after it's installation:\n\n```sh\n/etc/alloy/config.alloy\n```\n\nCheckout the Linux [detailed configuration](https://grafana.com/docs/alloy/latest/configure/linux/) page for instructions.\n\nCommands to manage Alloy:\n\n```sh\nsudo systemctl reload alloy\nsudo systemctl restart alloy\n```\n\nFor troubleshooting, enable the UI by passing [additional command-line flags](https://grafana.com/docs/alloy/latest/configure/linux/#pass-additional-command-line-flags).\n\nReference:\n\n- [Introducing Grafana Alloy, A Distribution of the OTel Collector | GrafanaCON 2024 | Grafana](https://youtu.be/d9zLeFuIFIk)\n- [Collect logs with Grafana Alloy](https://grafana.com/docs/grafana-cloud/send-data/logs/collect-logs-with-alloy/)\n\n\n## Mirrors / Repositories\n\nThis section will cover mirror configuration. Check out the [repository mirroring](https://ubuntu.com/landscape/docs/explanation-about-repository-mirroring) and [mirror management](https://ubuntu.com/landscape/docs/manage-repositories-web-portal) articles.\n\n### EBS Modifications\n\n\u003e [!CAUTION]\n\u003e Watch out for EBS modifications rate limit\n\nBe mindful that there might be a 6 hour rate-limit for EBS.\n\nIf you reach the limit, then try this [resolution](https://repost.aws/knowledge-center/ebs-resolve-modify-volume-issues) procedure that involves attaching the instance to a new volume from a snapshot.\n\n### CloudWatch\n\nThe CloudWatch Agent has been configured and installed by Terraform. Check its status, and [troubleshoot it](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/troubleshooting-CloudWatch-Agent.html) if necessary:\n\n```sh\nsudo systemctl status amazon-cloudwatch-agent\nsudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -m ec2 -a status\n```\n\n### Mirror GPG Key Generation\n\n\u003e [!NOTE]\n\u003e You have to give a real name and email so that he key is generated, otherwise it won't. Check [this video](https://youtu.be/yduAcCqi2z0?list=PLnrmLjoInKWgQdNpMxuMC7rrdoDUgz6YZ) for reference.\n\n\u003e [!IMPORTANT]\n\u003e Landscape mirror keys must not have passwords\n\n```sh\n# Install and run rngd to improve the efficiency of generating the GPG key\nsudo apt-get install rng-tools \u0026\u0026 sudo rngd -r /dev/urandom\n\n# Either 2 years, or never expire\ngpg --gen-key \ngpg --full-gen-key\n\n# List the public or secret keys\ngpg -K\ngpg --list-keys\ngpg --list-secret-keys\n\n# Export it\ngpg -a --export-secret-keys {SECRET_KEY_ID} \u003e mirror-key.asc\n```\n\nJust in case deleting a key is required:\n\n```sh\ngpg --delete-secret-key {SECRET_KEY_ID}\ngpg --delete-key {SECRET_KEY_ID}\n```\n\n### RabbitMQ Timeout\n\n\u003e [!TIP]\n\u003e Consider changing the [timeout](https://ubuntu.com/landscape/docs/configure-rabbitmq-for-landscape) for RabbitMQ\n\n```sh\nsudo touch /etc/rabbitmq/rabbitmq\n# Add this (5 hours): consumer_timeout = 18000000\nsudo vim /etc/rabbitmq/rabbitmq\nsudo rabbitmq-diagnostics environment | grep consumer_timeout\n```\n\n### Create and Sync the Mirror\n\n#### Volume Space\n\nPackages are going to be downloaded to `/var/lib/landscape/landscape-repository/standalone/` by default.\n\nFollow up the size with `du`:\n\n```sh\ndu -h --max-depth=1 | sort -hr\n```\n\n#### Pockets\n\nIt's important to understand this bit of the [documentation](https://ubuntu.com/landscape/docs/manage-repositories-with-the-API#heading--add-pockets-to-the-repository-profile):\n\n\u003e Landscape will take over the client's apt sources. The original `sources.list` file will be moved aside and only the ones enabled in Landscape will work.\n\nPurpose for package management:\n\n- `release` - Official release\n- `security` - Critical security updates\n- `updates` - Bug fixes and stability improvements. Tested and approved before being released.\n\nThe pockets `proposed` and `backports` do not receive as much testing as `updates`.\n\nThis is a common recommendation:\n\n```\ndeb http://archive.ubuntu.com/ubuntu jammy main restricted universe multiverse\ndeb http://archive.ubuntu.com/ubuntu jammy-updates main restricted universe multiverse\ndeb http://security.ubuntu.com/ubuntu jammy-security main restricted universe multiverse\n```\n\n#### Components\n\nComponents breakdown:\n\n- `main` - Officially supported free software.\n- `restricted` - Proprietary drivers and firmware supported by Ubuntu.\n- `universe` - Community-maintained open-source packages.\n- `multiverse` - Non-free software that Ubuntu does not officially support.\n\n#### PostgreSQL Mirror\n\nOn Landscape, add the distribution and the mirror. Example for PostgreSQL:\n\n| Configuration | Value                                    |\n|---------------|------------------------------------------|\n| Name          | postgres                                 |\n| URI           | https://apt.postgresql.org/pub/repos/apt |\n| Series name   | `jammy-pgs`                              |\n| Pockets       | `release`                                |\n| Components    | `main`                                   |\n| Architectures | `amd64`                                  |\n\nNow sync the mirror.\n\nCreate a repository profile and save to the clients:\n\n```sh\nsudo ls -l /etc/apt/sources.list.d/\n```\n\n### PPA\n\nTo configure PPA repositories we need to deconstruct the configuration process.\n\n#### PPA Key\n\nGo to https://launchpad.net/ and find the repository in the format `ppa:example/ppa`.\n\nThis example will use `ppa:graphics-drivers/ppa`.\n\nIf the key is not visible in there, manually create the following URL:\n\n```\nhttps://launchpad.net/~graphics-drivers/+archive/ubuntu/ppa\n```\n\nDownload the key manually. Use the `0x` prefix with followed by the last **16 digits** of the key, which are the key id:\n\n```sh\ncurl -L \"https://keyserver.ubuntu.com/pks/lookup?op=get\u0026search=0xFCAE110B1118213C\" -o graphics-drivers-ppa.asc\n```\n\nDearmor the key and copy it:\n\n\u003e [!NOTE]\n\u003e Either `/etc/apt/keyrings/` or `/etc/apt/trusted.gpg.d/` could be used based on security requirements.\n\n```sh\nsudo gpg --dearmor -o /etc/apt/trusted.gpg.d/graphics-drivers-ppa.gpg graphics-drivers-ppa.asc\nsudo chmod 644 /etc/apt/trusted.gpg.d/graphics-drivers-ppa.gpg\n```\n\nConfirm that the key is correctly installed:\n\n```sh\nsudo gpg --no-default-keyring --keyring /etc/apt/trusted.gpg.d/graphics-drivers-ppa.gpg --list-keys\n```\n\n#### PPA APT Sources\n\nIn the cause of `graphics-drivers`, these are the examples for APT sources.\n\nWhen storing the keys in `/etc/apt/trusted.gpg.d/`, the key should be trusted:\n\n```\ndeb http://ppa.launchpad.net/graphics-drivers/ppa/ubuntu jammy main\n```\n\nIf storing it under `/etc/apt/keyrings/`, then an explicit declaration is required:\n\n```\ndeb [signed-by=/etc/apt/keyrings/graphics-drivers-ppa.asc] http://ppa.launchpad.net/graphics-drivers/ppa/ubuntu jammy main\n```\n\n#### Testing\n\nCheck if the package is available:\n\n```sh\napt-cache search nvidia-driver-535\n```\n\nOr installed if necessary:\n\n```sh\napt install nvidia-driver-535\n```\n\n### Issues with APT\n\n```sh\nsudo dpkg -r \u003cpackage\u003e # or sudo dpkg -P \u003cprogram\u003e\nsudo apt purge \u003cpackage\u003e\nsudo apt clean\nsudo apt --fix-broken install\nsudo apt autoremove\n```\n\nIn some scenarios, a direct and / or forced removal might be necessary:\n\n\u003e [!NOTE]\n\u003e This can happen for example with this PostgreSQL [package conflict](https://github.com/saltstack-formulas/postgres-formula/issues/327).\n\n```sh\nsudo dpkg -i --force-overwrite /var/cache/apt/archives/postgresql-client-common_272.pgdg22.04+1_all.deb\nsudo apt --fix-broken install\n```\n\nOther commands that can be used ([SO reference](https://askubuntu.com/questions/525088/how-to-delete-broken-packages-in-ubuntu)):\n\n```sh\nsudo dpkg --purge nodejs-legacy\n```\n\n## Profiles\n\nThis [YouTube video](https://youtu.be/LreS6DhboYM) gives a run through the Profiles feature.\n\nDemonstrate the usage of the [Profiles](https://ubuntu.com/landscape/docs/explanation-package-profile) feature:\n\n- Repository\n- Packages\n- [Upgrade](https://ubuntu.com/landscape/docs/managing-computers#heading--manage-upgrade-profiles)\n- Removal\n\n## API\n\nDirect interaction with the API is possible via [API Endpoints](https://ubuntu.com/landscape/docs/make-rest-api-requests), such as with the [Packages API](https://ubuntu.com/landscape/docs/api-rest-packages).\n\n## Postfix Email\n\nFollowing the official [documentation](https://ubuntu.com/landscape/docs/configure-postfix-for-emails) but for Google's [SMTP Relay](https://support.google.com/a/answer/2956491?sjid=4703699716623319216-SA).\n\nThe SMTP Host will be the Gmail URL:\n\n```\nsmtp.gmail.com\n```\n\nTo generate the credentials, one way is to use the [App Password](https://myaccount.google.com/apppasswords) feature. Reference from [linode](https://www.linode.com/docs/guides/configure-postfix-to-send-mail-using-gmail-and-google-workspace-on-debian-or-ubuntu/).\n\nFor deep dive details and troubleshooting, check the Ubuntu Server documentation [page](https://documentation.ubuntu.com/server/how-to/mail-services/install-postfix/).\n\nCheck for errors on both files:\n\n```sh\nsudo tail -f /var/log/mail.log\nsudo tail -f /var/log/mail.err\n```\n\nYou may also want to check the `syslog`:\n\n```sh\nsudo tail -f /var/log/syslog\n```\n\n## Miscellaneous\n\nGeneral configurations of various types: https://ubuntu.com/landscape/docs/other-classic-web-portal-tasks\n\n[1]: https://ubuntu.com/pro/dashboard\n[2]: https://ubuntu.com/landscape/docs/quickstart-deployment\n[3]: https://ubuntu.com/landscape/docs/self-hosted-landscape\n[4]: https://ubuntu.com/landscape/install\n[5]: https://ubuntu.com/tutorials/create-a-usb-stick-on-windows\n[6]: https://etcher.balena.io/\n[7]: https://www.digitalocean.com/community/tutorials/how-to-enable-remote-desktop-protocol-using-xrdp-on-ubuntu-22-04\n[8]: https://askubuntu.com/a/906249\n[9]: https://ubuntu.com/security/certifications/docs/usg\n[10]: https://ubuntu.com/security/certifications/docs/disa-stig/installation\n[11]: https://ubuntu.com/security/certifications/docs/2204/usg/cis/compliance\n[12]: https://downloads.cisecurity.org/#/\n[13]: https://ubuntu.com/security/certifications/docs/2204/usg/cis/customization\n[14]: https://ubuntu.com/tutorials/comply-with-cis-or-disa-stig-on-ubuntu#1-overview\n[15]: https://ubuntu.com/engage/a-guide-to-infrastructure-hardening\n[16]: https://www.cisecurity.org/benchmark/ubuntu_linux\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fepomatti%2Faws-ubuntu-landscape","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fepomatti%2Faws-ubuntu-landscape","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fepomatti%2Faws-ubuntu-landscape/lists"}