# Linux Administration (Filesystem, Permissions, systemd, LVM, Networking & Shell) > Core Linux systems engineering mastery for RHCSA, LPIC-1, and CKA prerequisites covering the Filesystem Hierarchy Standard (FHS), inodes and links, permissions and special bits (SUID/SGID/Sticky), ACLs, SELinux/AppArmor, systemd and journalctl, LVM storage, process signals, Linux networking, and Bash shell piping. - **Canonical URL:** https://flashcards.world/flashcards/sets/c3de089c-4490-4419-adb6-69f7b655f6b0/ - **Markdown URL:** https://flashcards.world/flashcards/sets/c3de089c-4490-4419-adb6-69f7b655f6b0.md - **Level:** basic - **Languages:** en → en - **Total Cards:** 32 ## Flashcards (32 Cards) | # | Front (Term / Prompt) | Back (Definition / Answer) | Example | Multiple-Choice Options | | :--- | :--- | :--- | :--- | :--- | | 1 | Compare the Linux signals `SIGHUP` (1), `SIGINT` (2), `SIGTERM` (15), `SIGKILL` (9), and `SIGSTOP` (19). | `SIGHUP` (1): Hangup; tells daemons (like NGINX/sshd) to reload their configuration files without dropping connections. `SIGINT` (2): Interrupt (`Ctrl+C` in terminal). `SIGTERM` (15, default of `kill `): Graceful termination request; the process can catch/trap the signal, flush buffers, close DB connections, and exit cleanly. `SIGKILL` (9, `kill -9`): Immediate kernel termination; CANNOT be caught, blocked, or ignored by the process. `SIGSTOP` (19): Pauses process execution (`Ctrl+Z` sends catchable `SIGTSTP` 20). | | | | 2 | What is the order of hostname resolution on a Linux machine, and what files control it? | Controlled by the `hosts:` line in `/etc/nsswitch.conf` (Name Service Switch), which typically specifies `files dns myhostname` (or `files systemd`): 1. `files`: Checks static local mappings in `/etc/hosts` first; 2. `dns`: Queries the DNS nameservers (`nameserver `) and search domains configured in `/etc/resolv.conf` (or managed by `systemd-resolved` via `resolvectl status`); 3. `myhostname`: Resolves the local system hostname (`hostnamectl`). | | | | 3 | Explain the difference between `cmd > file 2>&1` and `cmd 2>&1 > file` in Bash redirection. | Redirections in Bash are evaluated strictly from left to right! In `cmd > file 2>&1` (or shorthand `&> file`), first `stdout` (FD 1) is pointed to `file`, and then `stderr` (FD 2) is duplicated to wherever FD 1 currently points (`file`)—so BOTH `stdout` and `stderr` go into `file`. In `cmd 2>&1 > file`, FD 2 is pointed to where FD 1 originally pointed (the terminal screen), and THEN FD 1 is redirected to `file`—so `stderr` still prints to the terminal while only `stdout` goes to `file`! | | | | 4 | What are the modern `iproute2` commands that replace legacy `net-tools` (`ifconfig`, `route`, `netstat`, `arp`)? | `ip addr show` (`ip a`) replaces `ifconfig` for viewing IP/MAC addresses; `ip link set eth0 up/down` manages interface state; `ip route show` (`ip r`) and `ip route get 8.8.8.8` replace `route -n` for routing tables; `ip neigh` replaces `arp -a` for ARP/NDP cache; `ss -tulpn` replaces `netstat -tulpn` for inspecting listening TCP (`-t`) and UDP (`-u`) sockets (`-l`) with process PIDs (`-p`) and numeric ports (`-n`). | | | | 5 | What are the most useful `journalctl` flags for filtering `systemd-journald` logs during live Linux troubleshooting? | `journalctl -u nginx.service` filters by systemd unit; `-f` follows live log output (like `tail -f`); `-e` jumps to the end of the journal; `-b` shows logs from the current boot (`-b -1` shows the previous boot prior to a crash); `-p err` (or `-p 3`) shows only error, critical, alert, and emergency priority messages; `--since '1 hour ago' --until '10 minutes ago'` filters by time window; `-k` shows only kernel (`dmesg`) messages. | | | | 6 | Why should production Bash scripts start with `set -euo pipefail`? | `set -e` (`errexit`): Exit the script immediately if any simple command exits with a non-zero status. `set -u` (`nounset`): Treat unset/undefined variables as an error and exit immediately (prevents catastrophic bugs like `rm -rf $UNSET_VAR/`). `set -o pipefail`: By default, a pipeline `cmd1 \| cmd2 \| cmd3` returns the exit code of ONLY the last command (`cmd3`), masking failures in `cmd1`; `pipefail` sets the pipeline's return code to the rightmost command that exited with a non-zero status. | | | | 7 | What do the three numbers in Linux Load Average (from `uptime` or `top`) represent? | The exponentially damped moving averages over the last 1 minute, 5 minutes, and 15 minutes of the number of threads in the system that are either: 1. Currently executing on a CPU or waiting in the runnable queue (`R` state), OR 2. Stuck in Uninterruptible Sleep (`D` state, typically waiting on synchronous Disk I/O or hung NFS mounts). A load average equal to the number of vCPUs indicates full CPU saturation (unless inflated by `D`-state I/O wait). | | | | 8 | How do you recover root access on a RHEL/Rocky/AlmaLinux (`systemd` + `GRUB2`) server if the root password is lost? | 1. Reboot and press `e` at the GRUB2 boot menu to edit the kernel command line; 2. Append `rd.break` to the end of the `linux` line and press `Ctrl+X` to boot into the `initramfs` shell before the root filesystem is pivoted; 3. Remount `/sysroot` as read-write: `mount -o remount,rw /sysroot`; 4. Enter the root environment: `chroot /sysroot`; 5. Run `passwd root` to set a new password; 6. CRITICAL for SELinux: run `touch /.autorelabel` (because `/etc/shadow` was modified outside SELinux); 7. Type `exit` twice to reboot. | | | | 9 | How do `iptables` tables (`filter`, `nat`, `mangle`, `raw`) and chains (`PREROUTING`, `INPUT`, `FORWARD`, `OUTPUT`, `POSTROUTING`) process network packets? | Packets arriving from the network hit `PREROUTING` (used for DNAT / port forwarding in the `nat` table) before a routing decision. If destined for the local host, the packet traverses `INPUT` -> Local Process -> `OUTPUT` -> `POSTROUTING`. If destined for another host (router/K8s node), it traverses `FORWARD` -> `POSTROUTING` (used for SNAT / `MASQUERADE`). Note: Modern Linux distributions (RHEL 8/9, Debian 10+, Ubuntu 20.04+) use `nftables` in the kernel as the unified successor to `iptables`/`ip6tables`/`arptables`/`ebtables`. | | | | 10 | What does an uppercase `S` or `T` (instead of lowercase `s` or `t`) mean in the output of `ls -l`? | It indicates that the special bit (SUID/SGID `S` or Sticky Bit `T`) is set, but the underlying standard execute bit (`x`) for that category is NOT set (e.g., `chmod 1666 dir` produces `drw-rw-rwT`, whereas `chmod 1777 dir` produces `drwxrwxrwt`). | | | | 11 | Why should you use `semanage fcontext` + `restorecon` instead of `chcon` when fixing SELinux file contexts (e.g., for a custom Apache/NGINX web root)? | `chcon -t httpd_sys_content_t /web` changes the SELinux type label directly on the file's extended attributes, but does NOT update the system SELinux policy database—meaning a future `restorecon` or filesystem relabel will wipe out your change! Instead, run `semanage fcontext -a -t httpd_sys_content_t '/web(/.*)?'` to register the rule in the policy database, then run `restorecon -Rv /web` to apply the default policy labels. | | | | 12 | What is the difference between `systemctl disable ` and `systemctl mask `? | `systemctl disable ` removes the symlinks from the target's `.wants/` directory so the service will not start automatically at boot, but it can still be started manually (`systemctl start`) or triggered as a dependency by another unit. `systemctl mask ` symlinks the unit file in `/etc/systemd/system/` to `/dev/null`, making it impossible to start manually or automatically until `systemctl unmask ` is run. | | | | 13 | How do the `r` (4), `w` (2), and `x` (1) permission bits behave differently on a Linux Directory compared to a Regular File? | On a Regular File: `r` allows reading file contents; `w` allows modifying file contents; `x` allows executing the file as a program. On a Directory: `r` allows listing the filenames inside the directory (`ls`); `w` allows creating, renaming, or deleting files inside the directory (even if you don't own the file, unless Sticky bit is set!) ONLY IF `x` is also set; `x` (traverse/search bit) allows `cd`-ing into the directory and accessing known files/inodes inside it. | | | | 14 | What occurs when a user holds an open file descriptor to a huge 50 GB log file and you delete the file with `rm /var/log/app.log`? | `rm` unlinks the filename from the directory (`link count` drops to `0`), so `ls` and `du -sh` no longer see the file, YET `df -h` shows the 50 GB of disk space is STILL NOT freed! The kernel only frees an inode's data blocks when BOTH the link count is `0` AND the open file descriptor count is `0`. Find the process holding the deleted file with `lsof +L1` (or `lsof \| grep deleted`), then either restart/reload that process or truncate the file in-place (`truncate -s 0 /proc//fd/`). | | | | 15 | Compare the `find`, `grep`, `awk`, and `sed` command patterns every Linux/DevOps engineer needs for log and file processing. | `find /var/log -type f -name '*.log' -mtime +7 -size +100M -delete` locates and deletes `.log` files modified >7 days ago larger than 100 MB. `grep -rnE 'ERROR\|FATAL' /var/log/` searches recursively with line numbers using extended regex (`grep -v` inverts match). `awk -F':' '$3 >= 1000 {print $1, $3}' /etc/passwd` splits by delimiter `:` and prints fields matching conditions. `sed -i 's/old_val/new_val/g' config.yaml` performs in-place stream substitution. | | | | 16 | How do you extend a mounted Logical Volume and resize its filesystem online for `ext4` vs. `XFS`? | First extend the Logical Volume block device: `lvextend -L +10G /dev/vg_data/lv_app`. Then grow the filesystem online: For `ext4`, run `resize2fs /dev/vg_data/lv_app` (`ext4` supports both online growing and offline shrinking). For `XFS`, run `xfs_growfs /mount/point` (`XFS` can be grown online while mounted, but CANNOT be shrunk!). Tip: Pass `-r` (`--resizefs`) to `lvextend -r -L +10G ...` to resize both the LV and any filesystem in one atomic command. | | | | 17 | What are the five time fields of a Linux `crontab` entry, and how do `/etc/crontab` and `crontab -e` differ? | From left to right: 1. Minute (`0-59`), 2. Hour (`0-23`), 3. Day of Month (`1-31`), 4. Month (`1-12`), 5. Day of Week (`0-7`, where `0` and `7` are Sunday). Example: `30 2 * * 1-5` runs at 02:30 AM Monday through Friday. `crontab -e` edits a per-user crontab stored in `/var/spool/cron/` (5 time fields + command). System-wide `/etc/crontab` and `/etc/cron.d/*` files include an extra 6th field (`username`) between Day-of-Week and the command. | | | | 18 | Compare Hard Links (`ln source link`) and Symbolic/Soft Links (`ln -s target link`) in Linux. | Hard Link: Points directly to the exact same Inode number and disk data blocks as the original file; increments the inode's link count; cannot cross filesystem/partition boundaries; cannot link directories; data persists until the last hard link is deleted (and no process holds an open file descriptor). Symbolic (Soft) Link: Creates a new inode with file type `l` storing the text path string to the target; can cross filesystems and link directories; becomes a broken ('dangling') link if the target is moved or deleted. | | | | 19 | How does `umask` work in Linux, and what default permissions result from `umask 0022` vs. `umask 0027`? | The `umask` (user file-creation mode mask) clears permission bits from the system base creation modes: `0666` for new regular files (Linux never grants execute by default on new files) and `0777` for new directories (calculated via bitwise `BASE & ~UMASK`). With `umask 0022`, new files get `0644` (`rw-r--r--`) and directories get `0755` (`rwxr-xr-x`). With `umask 0027`, new files get `0640` (`rw-r-----`) and directories get `0750` (`rwxr-x---`). | | | | 20 | Explain the three Linux special permission bits: SUID (`4000`), SGID (`2000`), and Sticky Bit (`1000`). | SUID (`4000`, `u+s`, shown as `s` in owner execute): When set on an executable binary (like `/usr/bin/passwd`), the process runs with the Effective UID of the file OWNER (e.g., `root`) rather than the user who ran it. SGID (`2000`, `g+s`): On an executable, runs with the file's Group GID; on a DIRECTORY, any new files/subdirectories created inside automatically inherit the directory's Group GID instead of the creator's primary group. Sticky Bit (`1000`, `o+t`, shown as `t` on `/tmp`): On a shared writable directory, prevents users from deleting or renaming files owned by other users. | | | | 21 | In a `systemd` `.service` unit file, what are the roles of the `[Unit]`, `[Service]`, and `[Install]` sections, and how do `Wants=` vs. `Requires=` vs. `After=` differ? | `[Unit]` holds metadata, descriptions, and dependency ordering; `[Service]` defines execution parameters (`Type=`, `ExecStart=`, `User=`, `Restart=on-failure`, `EnvironmentFile=`); `[Install]` defines how `systemctl enable` hooks the unit into boot targets (`WantedBy=multi-user.target`). `Wants=` is a weak dependency (if the dependency fails, this unit still starts); `Requires=` is a strict dependency (if dependency fails, this unit stops/fails); `After=`/`Before=` control startup ORDER independently of dependency! | | | | 22 | What information is stored inside a Linux filesystem Inode, and what is NOT stored inside the Inode? | Stored in the Inode: File metadata including file type, POSIX permissions (`mode`), Owner UID, Group GID, file size in bytes, link count, timestamps (`atime`, `mtime`, `ctime`, `crtime`), and pointers to the data blocks on disk. NOT stored in the Inode: The filename itself! Filenames are stored in directory entries (`dentries`) which map human-readable filenames to Inode numbers. | | | | 23 | How do you harden an OpenSSH server (`/etc/ssh/sshd_config`) against brute-force and unauthorized access? | Set `PermitRootLogin no` (or `prohibit-password`), `PasswordAuthentication no` (enforcing Ed25519/RSA key-based or certificate authentication only), `PubkeyAuthentication yes`, `PermitEmptyPasswords no`, `MaxAuthTries 3`, `X11Forwarding no`, restrict allowed principals via `AllowUsers` or `AllowGroups`, validate syntax with `sshd -t`, and reload via `systemctl reload sshd`. | | | | 24 | Explain the Logical Volume Manager (LVM) architecture layers and the step-by-step commands to create and mount an LVM volume. | LVM has 3 layers: Physical Volumes (PVs: raw disks/partitions) -> Volume Groups (VGs: pooled storage across PVs) -> Logical Volumes (LVs: virtual partitions carved from a VG). Commands: 1. `pvcreate /dev/sdb /dev/sdc`; 2. `vgcreate vg_data /dev/sdb /dev/sdc`; 3. `lvcreate -L 20G -n lv_app vg_data` (or `-l 100%FREE`); 4. `mkfs.xfs /dev/vg_data/lv_app` (or `mkfs.ext4`); 5. Add UUID entry to `/etc/fstab` and run `mount -a`. | | | | 25 | What are the roles of `/etc`, `/var`, `/proc`, `/sys`, `/boot`, and `/usr` in the Linux Filesystem Hierarchy Standard (FHS)? | `/etc`: Host-specific system-wide configuration files. `/var`: Variable data files that change continuously during normal operation (logs in `/var/log`, spools, databases, container layers). `/proc`: Virtual pseudo-filesystem in RAM exposing kernel and process runtime state (`/proc/`, `/proc/cpuinfo`, `/proc/sys`). `/sys`: Virtual sysfs filesystem exposing kernel device/driver topology and cgroups. `/boot`: Kernel (`vmlinuz`), `initramfs`, and GRUB bootloader. `/usr`: Read-only userland binaries, libraries, and documentation. | | | | 26 | Compare the three SELinux operational modes (`Enforcing`, `Permissive`, `Disabled`) and the commands to inspect or switch them. | `Enforcing`: SELinux Mandatory Access Control (MAC) policy is enforced and unauthorized actions are blocked and logged as `AVC denied` in `/var/log/audit/audit.log`. `Permissive`: SELinux does not block access, but logs all policy violations that would have been denied (ideal for troubleshooting). `Disabled`: SELinux is completely off (switching from Disabled to Enforcing requires a full filesystem relabel via `/.autorelabel` on reboot). Use `getenforce`/`sestatus` to check, `setenforce 0\|1` to toggle runtime mode, and `/etc/selinux/config` for persistent boot config. | | | | 27 | Why can a Linux filesystem fail with `No space left on device` when `df -h` shows plenty of free gigabytes? | The filesystem has exhausted its Inode table (100% `IUse%`), typically caused by millions of tiny or zero-byte files (e.g., uncleaned session files, mail queues, or cache files). Verify with `df -i` and locate the directory containing the highest file count to delete unnecessary files. | | | | 28 | How do you view and configure POSIX Access Control Lists (ACLs) on Linux files and directories using `getfacl` and `setfacl`? | `getfacl ` displays standard and extended ACL entries (indicated by a `+` at the end of `ls -l` permissions). `setfacl -m u:alice:rw file.txt` grants user `alice` read/write access; `setfacl -m d:g:devs:rwx /shared` sets a Default ACL on a directory so all future files created inside inherit that ACL; `setfacl -x u:alice file.txt` removes a specific entry; `setfacl -b file.txt` strips all extended ACL entries. | | | | 29 | What are the six fields of `/etc/fstab` and why should you always test edits with `mount -a` before rebooting? | 1. Device (`UUID=...` from `blkid`, `LABEL=...`, or `/dev/mapper/...`—prefer `UUID` as `/dev/sdX` letters can shift across reboots); 2. Mount point (`/data`); 3. Filesystem type (`xfs`, `ext4`, `nfs`, `swap`); 4. Mount options (`defaults`, `noatime`, `nosuid`, `_netdev`, `nofail`); 5. Dump backup flag (`0`); 6. `fsck` pass order (`0` do not check, `1` root filesystem, `2` other local filesystems). A syntax error or missing disk without `nofail` will drop the server into an unbootable emergency shell; `mount -a` validates the file immediately. | | | | 30 | How do you modify Linux kernel runtime parameters (`sysctl`) both immediately and persistently across reboots (e.g., for Kubernetes networking)? | To modify immediately in RAM: `sysctl -w net.ipv4.ip_forward=1` (which writes directly to `/proc/sys/net/ipv4/ip_forward`). To persist across reboots: create a drop-in configuration file such as `/etc/sysctl.d/99-k8s.conf` containing `net.ipv4.ip_forward = 1` and `net.bridge.bridge-nf-call-iptables = 1`, then apply all drop-in files immediately using `sysctl --system`. | | | | 31 | What is a Zombie Process (`Z` state in `ps`/`top`) vs. an Orphan Process in Linux, and how do you eliminate a Zombie Process? | An Orphan Process is a running process whose parent has exited; it is automatically re-parented to `PID 1` (`systemd` / `init`). A Zombie (``) Process is a process that has ALREADY terminated (`exit()`), consuming zero CPU or RAM, but its entry remains in the kernel process table holding its exit status code because its parent process has not yet called `wait()`/`waitpid()` to reap it. Because a zombie is already dead, `kill -9 ` does nothing! You must send `SIGCHLD` to the parent (`kill -s SIGCHLD `) or terminate/restart the buggy parent process so `PID 1` adopts and reaps the zombie. | | | | 32 | Where are `systemd` unit files located in order of precedence, and what command must you run after editing a unit file? | From highest to lowest precedence: 1. `/etc/systemd/system/` (local administrator overrides and custom units); 2. `/run/systemd/system/` (runtime transient units); 3. `/usr/lib/systemd/system/` or `/lib/systemd/system/` (vendor/package default units—never edit directly; use `systemctl edit ` to create a drop-in override in `/etc/systemd/system/.d/override.conf`). Always run `systemctl daemon-reload` after modifying unit files. | | | --- Study this deck interactively with FSRS-6 spaced repetition, audio review, and multiple-choice mode at [Flashcards World](https://flashcards.world/flashcards/sets/c3de089c-4490-4419-adb6-69f7b655f6b0/).