Local Setup

Security learning is destructive: you will set world-writable files, expose services, install questionable setuid binaries, and hand out reckless sudo rights on purpose. None of that belongs on a machine you care about. A disposable virtual machine gives you a clean, isolated system you can wreck and reset in seconds. This page gets you a working lab VM and, just as important, a snapshot to roll back to.

Choosing A Distro

The lab uses Ubuntu 24.04 LTS. Long Term Support means five years of security updates, so the packages and kernel behavior stay stable while you learn. It ships systemd, AppArmor as the enforcing LSM, and the standard GNU userland, which matches the majority of production Linux and matches every command in this foundation.

You can adapt the exercises to Debian, Fedora, or RHEL derivatives, but expect small differences: Fedora and RHEL use SELinux instead of AppArmor, dnf instead of apt, and wheel instead of sudo as the admin group. Where a command is distro-specific this foundation says so. If you are new, stay on Ubuntu 24.04 for the least friction.

VM Options Per Platform

The default launcher is Multipass, which gives you an Ubuntu VM with one command on macOS, Windows, or Linux. Alternatives exist if you cannot use it.

Option	Best for	Notes
Multipass	Any host, fastest path	Ubuntu images only; CLI-driven; snapshots built in
UTM	Apple Silicon Macs	Native ARM VMs; graphical; good for GUI work
VirtualBox	Windows and Intel Linux/Mac	Mature GUI; heavier; broad OS support
Cloud free tier	No local resources	AWS/GCP/Azure micro instance; watch billing and exposure

Pick one. The rest of this foundation assumes Multipass names but works on any of them once you have a shell on Ubuntu 24.04.

Multipass (Default)

Install Multipass from your platform’s package manager or the official installer, then launch and enter the VM.

multipass launch --name lab --cpus 2 --memory 2G --disk 10G 24.04
multipass shell lab

Expected output:

Launched: lab
Welcome to Ubuntu 24.04.2 LTS (GNU/Linux 6.8.0-45-generic x86_64)

  System information as of Mon Jul  6 09:14:02 UTC 2026

  System load:  0.08   Processes:      98
  Usage of /:   28.1%  Users logged in: 0

ubuntu@lab:~$

You are now the ubuntu user inside the VM, with sudo available. Type exit to return to your host; the VM keeps running until you stop it.

UTM, VirtualBox, Or Cloud

For UTM or VirtualBox, download the Ubuntu 24.04 LTS Server ISO, create a VM (2 CPU, 2 GB RAM, 10 GB disk is plenty), and install with a single user account. For a cloud free tier, launch the smallest Ubuntu 24.04 instance the provider offers and SSH in. In every case, confirm the release before continuing:

lsb_release -d

Expected output:

Description:	Ubuntu 24.04.2 LTS

Snapshots: Start Every Exercise Clean

The single most useful habit in this foundation is snapshotting before you experiment. A snapshot freezes the whole VM state so you can undo anything, even a change that breaks login. With Multipass you stop the VM, snapshot, then restore later by name.

multipass stop lab
multipass snapshot lab --name clean-baseline
multipass start lab

Expected output:

Snapshot taken: lab.clean-baseline

To reset after an exercise goes sideways:

multipass stop lab
multipass restore lab.clean-baseline
multipass start lab

Expected output:

Restored: lab.clean-baseline

UTM and VirtualBox both offer snapshots from their GUI (a camera or “Take Snapshot” control). Cloud providers use images or volume snapshots, which are slower and may cost money, so prefer a local VM if you can. Whatever the tool, the rule is the same: snapshot clean before the exercise, roll back after.

Related pages continue from here. See Explore The System for your first tour of the running box, and Verify The Environment to confirm the VM has the kernel features and tools the later sections need.

Practical Guidance

1. Never run these exercises on a machine with real data; the lab exists so mistakes are free.
2. Take the clean-baseline snapshot immediately after launching, before you change anything.
3. Give the VM modest resources (2 CPU, 2 GB RAM); security exercises are not compute-heavy.
4. Roll back to the clean snapshot at the start of each new exercise so results are reproducible.
5. If you use a cloud instance, restrict its firewall to your own IP and destroy it when done to avoid a real exposed host.
6. Keep the launcher command in a note so rebuilding the lab from scratch is a one-liner.