The Linux family tree: Red Hat, Debian, SUSE and more

Open two terminal windows next to each other, one on rocky01 and one on ubu01, and run each step on both. Everything is read-only, so nothing here can break your servers. At the end you’ll have your own cheat sheet of the differences.

Log in with ssh -p 2211 student@127.0.0.1 (rocky01) and ssh -p 2221 student@127.0.0.1 (ubu01). Counts and version numbers will be a little different on your VMs.

1Which distribution, which family?

Run this on both servers:

grep -E '^(ID|ID_LIKE|VERSION_ID)=' /etc/os-release
. /etc/os-release; echo "$ID $VERSION_ID family: $ID_LIKE"

On rocky01 you should see this:

ID="rocky"
ID_LIKE="rhel centos fedora"
VERSION_ID="10.2"
rocky 10.2 family: rhel centos fedora

On ubu01:

VERSION_ID="26.04"
ID=ubuntu
ID_LIKE=debian
ubuntu 26.04 family: debian

/etc/os-release is a list of shell variables, so a script can load it with . (source) and use $ID and $ID_LIKE. ID_LIKE lists the distributions this one is built from or compatible with, and it’s the line to test when you want “any RHEL-like system”.

✅ Checkpoint: You can say which family each server belongs to, using ID_LIKE.

2The older release files

On rocky01:

cat /etc/redhat-release

You should see this:

Rocky Linux release 10.2 (Red Quartz)

On ubu01:

cat /etc/debian_version

You should see this:

forky/sid

Before os-release existed, scripts read these files, and many vendor installers still do. The Ubuntu answer surprises people: Ubuntu 26.04 was built from Debian’s development branch at a time when the next Debian (“forky”) was still in progress, and “sid” is Debian’s name for its permanently unstable branch. It’s a reminder that Ubuntu is downstream of Debian.

✅ Checkpoint: Both files print a line, and you can explain why Ubuntu’s mentions forky.

3Package format and package count

On rocky01:

rpm -qf /usr/bin/bash
rpm -qa | wc -l

You should see something like this:

bash-5.2.26-6.el10.x86_64
512

On ubu01:

dpkg -S /usr/bin/bash
dpkg -l | grep -c '^ii'

You should see something like this:

bash: /usr/bin/bash
689

Same question, two tools. RPM names the package with its full version and architecture, dpkg just names the package. The counts tell you how much is installed; a lower count is a smaller attack surface and less to patch.

✅ Checkpoint: You found the package that owns bash on both servers.

4Where do the packages come from?

On rocky01:

ls /etc/yum.repos.d/
dnf repolist

You should see something like this:

rocky-addons.repo  rocky-devel.repo  rocky-extras.repo  rocky.repo
repo id                        repo name
appstream                      Rocky Linux 10 - AppStream
baseos                         Rocky Linux 10 - BaseOS
extras                         Rocky Linux 10 - Extras

On ubu01:

grep -v -e '^#' -e '^$' /etc/apt/sources.list.d/ubuntu.sources

You should see something like this:

Types: deb
URIs: http://archive.ubuntu.com/ubuntu/
Suites: resolute resolute-updates resolute-backports
Components: main restricted universe multiverse
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
Types: deb
URIs: http://security.ubuntu.com/ubuntu/
Suites: resolute-security
Components: main restricted universe multiverse
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg

Rocky uses .repo files in INI style, with BaseOS (the core OS) and AppStream (applications and languages) enabled, plus Extras. Ubuntu 24.04 and later use the deb822 format in ubuntu.sources instead of the old one-line /etc/apt/sources.list. Lessons 35 and 36 go deep into both.

✅ Checkpoint: You can name the enabled repositories on rocky01 and the suites on ubu01.

5Which security layer is switched on?

On rocky01:

getenforce
sudo firewall-cmd --state

You should see this:

Enforcing
running

On ubu01:

sudo aa-status | head -n 3
sudo ufw status

You should see something like this:

apparmor module is loaded.
118 profiles are loaded.
41 profiles are in enforce mode.
Status: inactive

The RHEL family uses SELinux, which labels every file and process, and firewalld is running from the first boot. Ubuntu uses AppArmor, which confines programs by path, and ships ufw switched off. Try getenforce on ubu01 and you’ll see that the SELinux tools aren’t even installed:

Command 'getenforce' not found, but can be installed with:
sudo apt install selinux-utils

A port that works on ubu01 and is blocked on rocky01 is very often one of these two layers. Lesson 34 covers firewalls and Lesson 41 SELinux.

✅ Checkpoint: You know which mandatory access control system and which firewall each server uses, and whether they are on.

6Init, admin group and main log file

On rocky01:

ps -p 1 -o comm=
getent group wheel
ls /var/log/messages

You should see something like this:

systemd
wheel:x:10:student
/var/log/messages

On ubu01:

ps -p 1 -o comm=
getent group sudo
ls /var/log/syslog

You should see something like this:

systemd
sudo:x:27:student
/var/log/syslog

Both run systemd as process 1, so systemctl and journalctl work the same everywhere. Admin rights come from the wheel group on the RHEL family and the sudo group on Ubuntu, and the main text log is /var/log/messages on one and /var/log/syslog on the other.

✅ Checkpoint: You can fill in this table from memory for both servers.