STIGhubSTIGhub
STIGsSearchCompareAbout

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • VPAT
  • DISA STIG Library
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide

Version

V1R5

Benchmark ID

CAN_Ubuntu_24-04_STIG

Total Checks

194

Tags

linux
CAT I: 16CAT II: 161CAT III: 17

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSON

Checks (194)

V-270645LOWUbuntu 24.04 LTS must not have the "systemd-timesyncd" package installed.V-270646LOWUbuntu 24.04 LTS must not have the "ntp" package installed.V-270647HIGHUbuntu 24.04 LTS must not have the telnet package installed.V-270648HIGHUbuntu 24.04 LTS must not have the rsh-server package installed.V-270649MEDIUMUbuntu 24.04 LTS must use a file integrity tool to verify correct operation of all security functions.V-270650MEDIUMUbuntu 24.04 LTS must configure AIDE to perform file integrity checking on the file system if installed.V-270651MEDIUMUbuntu 24.04 LTS must be configured so that the script which runs each 30 days or less to check file integrity is the default one.V-270652MEDIUMUbuntu 24.04 LTS must notify designated personnel if baseline configurations are changed in an unauthorized manner. The file integrity tool must notify the system administrator (SA) when changes to the baseline configuration or anomalies in the operation of any security functions are discovered.V-270653MEDIUMUbuntu 24.04 LTS must be configured to preserve log records from failure events.V-270654MEDIUMUbuntu 24.04 LTS must have an application firewall installed in order to control remote access methods.V-270655MEDIUMUbuntu 24.04 LTS must enable and run the Uncomplicated Firewall (ufw).V-270656MEDIUMUbuntu 24.04 LTS must have the "auditd" package installed.V-270657MEDIUMUbuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.V-270658LOWUbuntu 24.04 LTS audit event multiplexor must be configured to offload audit logs onto a different system or storage media from the system being audited.V-270659MEDIUMUbuntu 24.04 LTS must have AppArmor installed.V-270660MEDIUMUbuntu 24.04 LTS must be configured to use AppArmor.V-270661MEDIUMUbuntu 24.04 LTS must have the "libpam-pwquality" package installed.V-270662MEDIUMUbuntu 24.04 LTS must have the "SSSD" package installed.V-270663MEDIUMUbuntu 24.04 LTS must use the "SSSD" package for multifactor authentication services.V-270664LOWUbuntu 24.04 LTS must have the "chrony" package installed.V-270665HIGHUbuntu 24.04 LTS must have SSH installed.V-270666HIGHUbuntu 24.04 LTS must use SSH to protect the confidentiality and integrity of transmitted information.V-270667MEDIUMUbuntu 24.04 LTS must configure the SSH daemon to use FIPS 140-3 approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.V-270668MEDIUMUbuntu 24.04 LTS must configure the SSH daemon to use Message Authentication Codes (MACs) employing FIPS 140-3 approved cryptographic hashes to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.V-270669MEDIUMUbuntu 24.04 LTS SSH server must be configured to use only FIPS 140-3 validated key exchange algorithms.V-270670MEDIUMUbuntu 24.04 LTS must configure the SSH client to use FIPS 140-3 approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.V-270671MEDIUMUbuntu 24.04 LTS SSH client must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms.V-270672MEDIUMUbuntu 24.04 LTS must accept Personal Identity Verification (PIV) credentials.V-270673MEDIUMUbuntu 24.04 LTS must accept Personal Identity Verification (PIV) credentials managed through the Privileged Access Management (PAM)  framework.V-270674MEDIUMUbuntu 24.04 LTS must allow users to directly initiate a session lock for all connection types.V-270675HIGHUbuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes.V-270676MEDIUMUbuntu 24.04 LTS must initiate session audits at system startup.V-270677LOWUbuntu 24.04 LTS must limit the number of concurrent sessions to 10 for all accounts and/or account types.V-270678MEDIUMUbuntu 24.04 LTS must initiate a graphical session lock after 10 minutes of inactivity.V-270679MEDIUMUbuntu 24.04 LTS must prevent a user from overriding the disabling of the graphical user interface automount function.V-270680MEDIUMUbuntu 24.04 LTS must automatically terminate a user session after inactivity timeouts have expired.V-270681MEDIUMUbuntu 24.04 LTS must monitor remote access methods.V-270682MEDIUMUbuntu 24.04 LTS must automatically remove or disable emergency accounts after 72 hours.V-270683MEDIUMUbuntu 24.04 LTS must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.V-270684MEDIUMUbuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.V-270685MEDIUMUbuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.V-270686MEDIUMUbuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.V-270687MEDIUMUbuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.V-270688MEDIUMUbuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.V-270689MEDIUMUbuntu 24.04 LTS must prevent all software from executing at higher privilege levels than users executing the software and the audit system must be configured to audit the execution of privileged functions.V-270690LOWUbuntu 24.04 LTS must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts have been made.V-270691MEDIUMUbuntu 24.04 LTS must display the Standard Mandatory DOD Notice and Consent Banner before granting access to via an SSH logon.V-270692MEDIUMUbuntu 24.04 LTS must enable the graphical user logon banner to display the Standard Mandatory DOD Notice and Consent Banner before granting local access to the system via a graphical user logon.V-270693MEDIUMUbuntu 24.04 LTS must display the Standard Mandatory DOD Notice and Consent Banner before granting local access to the system via a graphical user logon.V-270694MEDIUMUbuntu 24.04 LTS must be configured to enforce the acknowledgement of the Standard Mandatory DOD Notice and Consent Banner for all SSH connections.V-270695LOWUbuntu 24.04 LTS Advance Package Tool (APT) must be configured to prevent the installation of patches, service packs, device drivers, or Ubuntu 24.04 LTS components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.V-270696MEDIUMUbuntu 24.04 LTS library files must have mode 0755 or less permissive.V-270697MEDIUMUbuntu 24.04 LTS library files must be owned by root.V-270698MEDIUMUbuntu 24.04 LTS library directories must be owned by root.V-270699MEDIUMUbuntu 24.04 LTS library files must be group-owned by root or a system account.V-270700MEDIUMUbuntu 24.04 LTS library directories must be group-owned by root.V-270701MEDIUMUbuntu 24.04 LTS must have system commands set to a mode of 0755 or less permissive.V-270702MEDIUMUbuntu 24.04 LTS must have system commands owned by root or a system account.V-270703MEDIUMUbuntu 24.04 LTS must have system commands group-owned by root or a system account.V-270704MEDIUMUbuntu 24.04 LTS must prevent the use of dictionary words for passwords.V-270705MEDIUMUbuntu 24.04 LTS must be configured so that when passwords are changed or new passwords are established, pwquality must be used.V-270706LOWUbuntu 24.04 LTS must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.V-270707MEDIUMUbuntu 24.04 LTS must require users to reauthenticate for privilege escalation or when changing roles.V-270708HIGHUbuntu 24.04 LTS must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements.V-270709MEDIUMUbuntu 24.04 LTS SSH daemon must prevent remote hosts from connecting to the proxy display.V-270711HIGHUbuntu 24.04 LTS must disable the x86 Ctrl-Alt-Delete key sequence if a graphical user interface is installed.V-270712HIGHUbuntu 24.04 LTS must disable the x86 Ctrl-Alt-Delete key sequence.V-270713HIGHUbuntu 24.04 LTS must not have accounts configured with blank or null passwords.V-270714HIGHUbuntu 24.04 LTS must not allow accounts configured in Pluggable Authentication Modules (PAM) with blank or null passwords.V-270715MEDIUMUbuntu 24.04 LTS must generate audit records for all events that affect the systemd journal files.V-270716MEDIUMUbuntu 24.04 LTS default filesystem permissions must be defined in such a way that all authenticated users can read and modify only their own files.V-270717HIGHUbuntu 24.04 LTS must not allow unattended or automatic login via SSH.V-270718MEDIUMUbuntu 24.04 LTS must disable automatic mounting of Universal Serial Bus (USB) mass storage driver.V-270719MEDIUMUbuntu 24.04 LTS must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL) and vulnerability assessments.V-270720MEDIUMUbuntu 24.04 LTS must uniquely identify interactive users.V-270721MEDIUMUbuntu 24.04 LTS must implement smart card logins for multifactor authentication for local and network access to privileged and nonprivileged accounts.V-270722MEDIUMUbuntu 24.04 LTS must implement smart card logins for multifactor authentication for local and network access to privileged and nonprivileged accounts over SSH.V-270723MEDIUMUbuntu 24.04 LTS must electronically verify Personal Identity Verification (PIV) credentials.V-270724MEDIUMUbuntu 24.04 LTS must prevent direct login to the root account.V-270725MEDIUMUbuntu 24.04 LTS must store only encrypted representations of passwords.V-270726MEDIUMUbuntu 24.04 LTS must enforce password complexity by requiring that at least one uppercase character be used.V-270727MEDIUMUbuntu 24.04 LTS must enforce password complexity by requiring that at least one lowercase character be used.V-270728MEDIUMUbuntu 24.04 LTS must enforce password complexity by requiring that at least one numeric character be used.V-270729MEDIUMUbuntu 24.04 LTS must require the change of at least eight characters when passwords are changed.V-270730MEDIUMUbuntu 24.04 LTS must enforce 24 hours/1 day as the minimum password lifetime. Passwords for new users must have a 24 hours/1 day minimum password lifetime restriction.V-270731MEDIUMUbuntu 24.04 LTS must enforce a 60-day maximum password lifetime restriction. Passwords for new users must have a 60-day maximum password lifetime restriction.V-270732MEDIUMUbuntu 24.04 LTS must enforce a minimum 15-character password length.V-270733MEDIUMUbuntu 24.04 LTS must enforce password complexity by requiring that at least one special character be used.V-270734LOWUbuntu 24.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day.V-270735MEDIUMUbuntu 24.04 LTS, for PKI-based authentication, SSSD must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.V-270736HIGHUbuntu 24.04 LTS must map the authenticated identity to the user or group account for PKI-based authentication.V-270737MEDIUMUbuntu 24.04 LTS, for PKI-based authentication, Privileged Access Management (PAM) must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.V-270738MEDIUMUbuntu 24.04 LTS for PKI-based authentication, must implement a local cache of revocation data in case of the inability to access revocation information via the network.V-270739MEDIUMUbuntu 24.04 LTS must encrypt all stored passwords with a FIPS 140-3 approved cryptographic hashing algorithm.V-270740MEDIUMUbuntu 24.04 LTS must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions, and other system-level access.V-270741MEDIUMUbuntu 24.04 LTS must use strong authenticators in establishing nonlocal maintenance and diagnostic sessions.V-270742MEDIUMUbuntu 24.04 LTS must immediately terminate all network connections associated with SSH traffic after a period of inactivity.V-270743MEDIUMUbuntu 24.04 LTS must immediately terminate all network connections associated with SSH traffic at the end of the session or after 10 minutes of inactivity.V-270744HIGHUbuntu 24.04 LTS must implement NIST FIPS-validated cryptography to protect classified information and for the following: To provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.V-270745MEDIUMUbuntu 24.04 LTS must use DOD PKI-established certificate authorities (CAs) for verification of the establishment of protected sessions.V-270746MEDIUMUbuntu 24.04 LTS must disable kernel core dumps.V-270747MEDIUMUbuntu 24.04 LTS handling data requiring "data at rest" protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.V-270748HIGHUbuntu 24.04 LTS must ensure only users who need access to security functions are part of sudo group.V-270749LOWUbuntu 24.04 LTS must restrict access to the kernel message buffer.V-270750MEDIUMUbuntu 24.04 LTS must set a sticky bit on all public directories to prevent unauthorized and unintended information transferred via shared system resources.V-270751LOWUbuntu 24.04 LTS must compare internal information system clocks at least every 24 hours with an authoritative time server.V-270752LOWUbuntu 24.04 LTS must synchronize internal information system clocks to the authoritative time source when the time difference is greater than one second.V-270753MEDIUMUbuntu 24.04 LTS must be configured to use TCP syncookies.V-270754MEDIUMUbuntu 24.04 LTS must configure the uncomplicated firewall to rate-limit impacted network interfaces.V-270755MEDIUMUbuntu 24.04 LTS must disable all wireless network adapters.V-270756MEDIUMUbuntu 24.04 LTS must generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.V-270757MEDIUMUbuntu 24.04 LTS must generate system journal entries without revealing information that could be exploited by adversaries.V-270758MEDIUMUbuntu 24.04 LTS must be configured so that the "journalctl" command is not accessible by unauthorized users.V-270759MEDIUMUbuntu 24.04 LTS must be configured so that the "journalctl" command is owned by "root".V-270760MEDIUMUbuntu 24.04 LTS must be configured so that the "journalctl" command is group-owned by "root".V-270761MEDIUMUbuntu 24.04 LTS must configure the directories used by the system journal to be group-owned by "systemd-journal".V-270762MEDIUMUbuntu 24.04 LTS must configure the files used by the system journal to be group-owned by "systemd-journal".V-270763MEDIUMUbuntu 24.04 LTS must configure the directories used by the system journal to be owned by "root".V-270764MEDIUMUbuntu 24.04 LTS must configure the files used by the system journal to be owned by "root"V-270765MEDIUMUbuntu 24.04 LTS must configure the /var/log directory to be group-owned by syslog.V-270766MEDIUMUbuntu 24.04 LTS must configure the /var/log directory to be owned by root.V-270767MEDIUMUbuntu 24.04 LTS must configure the /var/log directory to have mode "0755" or less permissive.V-270768MEDIUMUbuntu 24.04 LTS must configure the /var/log/syslog file to be group-owned by adm.V-270769MEDIUMUbuntu 24.04 LTS must configure /var/log/syslog file to be owned by syslog.V-270770MEDIUMUbuntu 24.04 LTS must configure /var/log/syslog file with mode "0640" or less permissive.V-270771MEDIUMUbuntu 24.04 LTS must implement nonexecutable data to protect its memory from unauthorized code execution.V-270772MEDIUMUbuntu 24.04 LTS must implement address space layout randomization to protect its memory from unauthorized code execution.V-270773MEDIUMUbuntu 24.04 LTS must be configured so that Advance Package Tool (APT) removes all software components after updated versions have been installed.V-270775MEDIUMUbuntu 24.04 LTS must be configured so that audit configuration files are not write-accessible by unauthorized users.V-270776MEDIUMUbuntu 24.04 LTS must permit only authorized accounts to own the audit configuration files.V-270777MEDIUMUbuntu 24.04 LTS must permit only authorized groups to own the audit configuration files.V-270778MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the su command.V-270779MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chfn command.V-270780MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the mount command.V-270781MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the umount command.V-270782MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the ssh-agent command.V-270783MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the ssh-keysign command.V-270784MEDIUMUbuntu 24.04 LTS must generate audit records for any use of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.V-270785MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chown, fchown, fchownat, and lchown system calls.V-270786MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chmod, fchmod, and fchmodat system calls.V-270787MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the creat, open, openat, open_by_handle_at, truncate, and ftruncate system calls.V-270788MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the sudo command.V-270789MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the sudoedit command.V-270790MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chsh command.V-270791MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the newgrp command.V-270792MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chcon command.V-270793MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the apparmor_parser command.V-270794MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the setfacl command.V-270795MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chacl command.V-270796MEDIUMUbuntu 24.04 LTS must generate audit records for the use and modification of faillog file.V-270797MEDIUMUbuntu 24.04 LTS must generate audit records for the use and modification of the lastlog file.V-270798MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the passwd command.V-270799MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the unix_update command.V-270800MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the gpasswd command.V-270801MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chage command.V-270802MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the usermod command.V-270803MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the crontab command.V-270804MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the pam_timestamp_check command.V-270805MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the init_module and finit_module syscalls.V-270806MEDIUMUbuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the delete_module syscall.V-270807MEDIUMUbuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to modify the /etc/sudoers file occur.V-270808MEDIUMUbuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to modify the /etc/sudoers.d directory occur.V-270809MEDIUMUbuntu 24.04 LTS must generate audit records for any successful/unsuccessful use of unlink, unlinkat, rename, renameat, and rmdir system calls.V-270810MEDIUMUbuntu 24.04 LTS must generate audit records for the /var/log/wtmp file.V-270811MEDIUMUbuntu 24.04 LTS must generate audit records for the /var/run/utmp file.V-270812MEDIUMUbuntu 24.04 LTS must generate audit records for the /var/log/btmp file.V-270813MEDIUMUbuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to use modprobe command.V-270814MEDIUMUbuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to use the kmod command.V-270815MEDIUMUbuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to use the fdisk command.V-270816LOWUbuntu 24.04 LTS must allocate audit record storage capacity to store at least one week's worth of audit records, when audit records are not immediately sent to a central audit record storage facility.V-270817LOWUbuntu 24.04 LTS must have a crontab script running weekly to offload audit events of standalone systems.V-270818LOWUbuntu 24.04 LTS must immediately notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.V-270819LOWUbuntu 24.04 LTS must alert the system administrator (SA) and information system security officer (ISSO) (at a minimum) in the event of an audit processing failure.V-270820LOWUbuntu 24.04 LTS must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).V-270821MEDIUMUbuntu 24.04 LTS must configure audit tools with a mode of "0755" or less permissive.V-270822MEDIUMUbuntu 24.04 LTS must configure audit tools to be owned by root.V-270823MEDIUMUbuntu 24.04 LTS must configure the audit tools to be group owned by root.V-270824MEDIUMUbuntu 24.04 LTS must have directories that contain system commands set to a mode of "0755" or less permissive.V-270825MEDIUMUbuntu 24.04 LTS must have directories that contain system commands owned by root.V-270826MEDIUMUbuntu 24.04 LTS must have directories that contain system commands group-owned by root.V-270827MEDIUMUbuntu 24.04 LTS must be configured so that audit log files are not read or write-accessible by unauthorized users.V-270828MEDIUMUbuntu 24.04 LTS must be configured to permit only authorized users ownership of the audit log files.V-270829MEDIUMUbuntu 24.04 LTS must permit only authorized groups ownership of the audit log files.V-270830MEDIUMUbuntu 24.04 LTS must be configured so that the audit log directory is not write-accessible by unauthorized users.V-270831MEDIUMUbuntu 24.04 LTS must use cryptographic mechanisms to protect the integrity of audit tools.V-270832MEDIUMUbuntu 24.04 LTS audit system must protect auditing rules from unauthorized change.V-274868MEDIUMUbuntu 24.04 LTS must require users to provide a password for privilege escalation.V-274869MEDIUMUbuntu 24.04 LTS must restrict privilege elevation to authorized personnel.V-274870MEDIUMUbuntu 24.04 LTS must audit any script or executable called by cron as root or by any privileged user.V-274871MEDIUMUbuntu 24.04 LTS must conceal, via the session lock, information previously visible on the display with a publicly viewable image.V-274872MEDIUMUbuntu 24.04 LTS must prevent a user from overriding the disabling of the graphical user interface autorun function.V-274873MEDIUMUbuntu 24.04 LTS must prevent a user from overriding the disabling of the graphical user smart card removal action.V-278917HIGHUbuntu 24.04 LTS must be a vendor-supported release.V-279938HIGHUbuntu 24.04 LTS must not have the nfs-kernel-server package installed.