There are many ways to skin the cat for centralized login in Linux, including using Samba-AD or just LDAP.

Patching is IMO less fun. Landscape can work for Ubuntu but it’s finicky, and I haven’t really found anything satisfactory (FOSS) for patch management if multiple Debian systems. Setting up “unattended-upgrades” does tend to handle most of it but that doesn’t give centralized control or visibility.

Or they won’t buy it won’t matter anyway, because being a “citizen” isn’t much help when you’ve been black-bagged, shaved, and carted of to some damn prison and without access to a lawyer and without anyone actually knowing what happened to you…