Learning Nmap in My Home Lab: Open Ports, SSH, and a Few Wrong Assumptions

The Linux clue you spotted most likely came from the SSH server describing itself, not from any OS detection. With -sV, Nmap connects to port 22 and reads the greeting OpenSSH sends back, and Ubuntu's build puts "Ubuntu" in that greeting. Nmap's version detection docs say OS and device type found this way are reported on the Service Info line under the port table, separate from anything -O would tell you.

You can test that in your lab the same way you tested SSH: change one thing and rescan. Ubuntu's security docs show how to turn the distro part off: put DebianBanner no in a file under /etc/ssh/sshd_config.d/ and reload ssh. Rescan with -sV and watch what happens to the version string and the Linux hint, even though the OS hasn't changed. Running nc 192.168.1.12 22 from Kali before and after shows you the raw line Nmap is reading.