Linux Administration Practice Exam

Question 1 Linux Administration

How does grep search for patterns in files?

grep searches text using patterns.
Usage: grep [options] pattern [file...]
Key flags:

-i case-insensitive
-r recursive search
-n show line numbers
-v invert match
-E extended regex (same as egrep)

Symbolic notation uses letters to modify permissions:
Who: u (user/owner), g (group), o (others), a (all)
Action: + (add), - (remove), = (set exactly)
Permission: r (read), w (write), x (execute)

Examples:
chmod u+x script.sh — make executable for owner
chmod go-w file — remove write for group and others
chmod a=r file — read-only for everyone By default the journal lives in /run/log/journal/ and is lost on reboot.
Persist:
1. mkdir -p /var/log/journal
2. systemctl restart systemd-journald
3. (Optional) chown -R systemd-journal:systemd-journal /var/log/journal
Journal data is owned by the systemd-journal group, readable by members.
Set retention: in /etc/systemd/journald.conf:
SystemMaxUse=500M
MaxRetentionSec=30day
Then systemctl restart systemd-journald.
View members: getent group systemd-journal. nftables is the modern Linux firewall (replacing iptables).
Basic table+chain:
nft add table inet filter
nft add chain inet filter input { type filter hook input priority 0 \; policy drop \; }
nft add rule inet filter input iif lo accept
nft add rule inet filter input ct state established,related accept
nft add rule inet filter input tcp dport 22 accept
Persistence: nft list ruleset > /etc/nftables.conf, then enable nftables.service.
Modern front-ends: ufw (Ubuntu), firewalld (RHEL).

Question 2 Linux Administration

What is the difference between ext4, xfs, and btrfs?

df — disk free space on filesystems:
df -h — human-readable sizes
df -T — show filesystem type
df -i — show inode usage

du — disk usage of files/directories:
du -sh /var/log — summary of directory size
du -h --max-depth=1 / — size of top-level dirs
du -ah | sort -rh | head -20 — find largest files/dirs

Use ncdu for an interactive disk usage browser. ext4: mature, default on many distros. Supports extents, journaling, max 1 EiB. Online resize and defragmentation (e4defrag).
XFS: high-performance 64-bit journaling FS, default on RHEL. Excellent for large files, parallel I/O, online defragmentation. Cannot shrink filesystem, only grow.
btrfs: copy-on-write FS with built-in subvolumes, snapshots, compression, RAID. Tools: btrfs subvolume create, btrfs filesystem defragment, btrfs scrub.
Tune ext4: tune2fs -o journal_data_writeback /dev/sda1, list with tune2fs -l.
XFS admin: xfs_info, xfs_repair.
Snapshot tool independent of FS: LVM snapshots. TLS (Transport Layer Security) encrypts a TCP stream. Sysadmins care about:
• Issuing certificates with Let's Encrypt via certbot: certbot --nginx -d example.com
• Cert locations: /etc/letsencrypt/live/, /etc/ssl/certs/
• Inspect: openssl s_client -connect example.com:443 -servername example.com
• View cert: openssl x509 -in cert.pem -text -noout
• Generate private keys: openssl genrsa -out key.pem 2048 or openssl genpkey -algorithm ed25519
• Create CSR: openssl req -new -key key.pem -out csr.pem
• Self-signed: openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365
• Test config: openssl s_client -showcerts Symbolic notation uses letters to modify permissions:
Who: u (user/owner), g (group), o (others), a (all)
Action: + (add), - (remove), = (set exactly)
Permission: r (read), w (write), x (execute)

Examples:
chmod u+x script.sh — make executable for owner
chmod go-w file — remove write for group and others
chmod a=r file — read-only for everyone

Question 3 Linux Administration

How do you troubleshoot GRUB boot problems?

ping — test connectivity and latency:
ping -c 4 google.com

traceroute — show the path packets take:
traceroute google.com (shows each hop)

dig — DNS lookup tool:
dig example.com — query A record
dig example.com MX — mail records
dig @8.8.8.8 example.com — use specific DNS server
dig +short example.com — concise output

nslookup is a simpler alternative to dig. Recovery:
• Boot from a Live USB.
• Mount root: mount /dev/sda2 /mnt
• Mount boot: mount /dev/sda1 /mnt/boot
• mount --bind /dev /mnt/dev and same for /proc, /sys.
• chroot /mnt
• Reinstall GRUB: grub-install /dev/sda
• Regenerate config: grub-mkconfig -o /boot/grub/grub.cfg
In GRUB menu press e to edit a boot entry; add single or init=/bin/bash for shell.
Persistent: /etc/default/grub holds kernel parameters; GRUB_TIMEOUT, GRUB_CMDLINE_LINUX_DEFAULT. MBR (Master Boot Record): 4 primary partitions, max 2 TiB disk, BIOS boot.
GPT (GUID Partition Table): 128 partitions, 8 ZiB max, required for UEFI, stores backup header + partition table at disk end for redundancy.
Tools: fdisk (MBR & GPT now), gdisk (GPT), parted (both).
Check: fdisk -l /dev/sda shows "Disklabel type: gpt" or "dos".
Convert: gdisk /dev/sda can convert MBR→GPT; always back up first.
UEFI systems require an ESP (EFI System Partition) — FAT32, ~256-512 MB, flagged as esp. kill sends signals to processes by PID.
Common signals:

kill PID or kill -15 PID — SIGTERM (graceful shutdown)
kill -9 PID — SIGKILL (force kill, cannot be caught)
kill -1 PID — SIGHUP (reload configuration)
kill -19 PID — SIGSTOP (pause process)
kill -18 PID — SIGCONT (resume process)

Use kill -l to list all signals.

Question 4 Linux Administration

How do you use the ip command for network configuration?

ip replaces older ifconfig and route.
Common usage:

ip addr show — show IP addresses
ip link show — show network interfaces
ip route show — show routing table
ip addr add 10.0.0.5/24 dev eth0 — add IP
ip link set eth0 up — bring interface up
ip neigh show — show ARP table

systemd-resolved provides local DNS caching and validation.
It listens on 127.0.0.53:53 and may symlink or stub /etc/resolv.conf to /run/systemd/resolve/stub-resolv.conf.
Tools: resolvectl status, resolvectl query example.com, resolvectl dns eth0 8.8.8.8.
Config: /etc/systemd/resolved.conf with DNS=, FallbackDNS=, DNSSEC=yes.
Disable if you run a custom resolver (dnsmasq, unbound): systemctl disable --now systemd-resolved and write a static /etc/resolv.conf. VLANs segment a Layer 2 network. 802.1Q tags frames with a 12-bit VLAN ID (1–4094).
Create a tagged interface: ip link add link eth0 name eth0.10 type vlan id 10
Assign IP: ip addr add 10.10.0.1/24 dev eth0.10
The base interface eth0 can carry multiple VLANs side-by-side.
Delete: ip link delete eth0.10
Show: ip -d link show eth0.10.
Persistent: in /etc/network/interfaces or via NetworkManager with vlan.id connection property.
VLAN IDs 0 and 4095 are reserved. tcpdump -i eth0 — capture on interface
tcpdump -i any port 80 — any iface, port 80
tcpdump -w file.pcap host 10.0.0.5 — save to file (open in Wireshark)
tcpdump -r file.pcap — read pcap
tcpdump -nn -A port 443 and host api.example.com — name resolution off, ASCII payload
tcpdump -nn -s 0 -c 1000 -w cap.pcap — full packet, 1000 packets
Privileged: requires root or CAP_NET_RAW.
For deeper analysis: tshark (CLI Wireshark) or ngrep for pattern matching.

Question 5 Linux Administration

How do you view and manage processes with ps and top?

If/elif/else:
if [ "$x" -eq 5 ]; then
  echo "five"
elif [ "$x" -gt 5 ]; then
  echo "greater"
else
  echo "less"
fi

Test operators:

-f file — file exists
-d dir — directory exists
-z "$str" — string is empty
-n "$str" — string is not empty
= — string equality

Use [[ ]] for advanced pattern matching. ss (modern) and netstat (legacy) display socket statistics.
ss examples:
ss -tuln — TCP/UDP listening ports with numbers
ss -tp — TCP connections with process info
ss -s — summary statistics

netstat equivalents:
netstat -tuln — listening ports
netstat -anp — all connections with PIDs

ss is faster and recommended over netstat on modern systems. apt manages packages on Debian-based systems.
Commands:

apt update — refresh package index
apt upgrade — upgrade installed packages
apt install nginx — install a package
apt remove nginx — remove (keep config)
apt purge nginx — remove with config
apt search keyword — search packages
apt list --installed — list installed

dpkg -i package.deb installs local .deb files. ps shows a snapshot of processes:
ps aux — all processes, detailed
ps -ef — full-format listing
ps -u username — processes by user

top shows a real-time dynamic view:

k — kill a process
M — sort by memory
P — sort by CPU
q — quit

htop is an enhanced interactive alternative.

Question 6 Linux Administration

How do conditionals and if statements work in bash?

perf is the Linux profiling subsystem.
Profile a command: perf stat ls / (counters), perf record -F 99 -a -g ls / (sample at 99 Hz, call graph).
View: perf report.
Top-like: perf top.
Tracepoints: perf list shows events; perf trace -e 'syscalls:sys_enter_openat' ls.
CPU-specific: perf record -c 100000 -e cycles:u ls.
Compare baseline vs patched: perf record -b ./baseline; perf record -b ./patched; perf diff.
Requires linux-tools package and usually root. tar bundles files into an archive.
Create:
tar -czf archive.tar.gz dir/ — gzip compressed
tar -cjf archive.tar.bz2 dir/ — bzip2 compressed

Extract:
tar -xzf archive.tar.gz — extract gzip
tar -xzf archive.tar.gz -C /dest/ — extract to directory

List contents:
tar -tzf archive.tar.gz

Flags: c=create, x=extract, t=list, z=gzip, j=bzip2, f=file, v=verbose If/elif/else:
if [ "$x" -eq 5 ]; then
  echo "five"
elif [ "$x" -gt 5 ]; then
  echo "greater"
else
  echo "less"
fi

Test operators:

-f file — file exists
-d dir — directory exists
-z "$str" — string is empty
-n "$str" — string is not empty
= — string equality

Use [[ ]] for advanced pattern matching. 1. Generate on client: ssh-keygen -t ed25519 -C "alice@laptop" (default path ~/.ssh/id_ed25519). Optionally add a passphrase.
2. Install a passphrase agent: eval $(ssh-agent -s); ssh-add ~/.ssh/id_ed25519.
3. Copy public key to server: ssh-copy-id -i ~/.ssh/id_ed25519.pub user@host (appends to ~/.ssh/authorized_keys, mode 600, dir 700).
4. Test: ssh user@host — no password prompt.
5. Disable password auth in /etc/ssh/sshd_config: PasswordAuthentication no, then systemctl restart sshd.

Question 7 Linux Administration

What are environment variables and how do you manage them?

Namespaces (man namespaces) provide isolation: pid (process IDs), net (network), mount, uts (hostname), ipc, user (UID mapping), cgroup.
cgroups provide resource limits.
Together they form the basis of containers: each container has its own PID, network, mount, and UID namespaces plus cgroup-enforced CPU/memory limits.
Tools: unshare --pid --fork bash enters a new PID namespace; nsenter -t 1 -m -u -i -n -p bash enters host's namespaces.
Inspect container: cat /proc/1/cgroup, ls -l /proc/1/ns/.
Container runtimes: runc, crun, containerd. Special permission bits:

SUID (4xxx) — file executes as the file owner. Example: chmod 4755 file. Shown as -rwsr-xr-x
SGID (2xxx) — file executes as the group owner; on directories, new files inherit the group. chmod 2755 dir
Sticky bit (1xxx) — only file owner can delete files in the directory. chmod 1777 /tmp. Shown as drwxrwxrwt

Environment variables are key-value pairs available to processes.
View: env or printenv
Set temporarily: export VAR="value"
Set for one command: VAR=value command

Important variables:

PATH — executable search directories
HOME — user home directory
USER — current username
SHELL — current shell
LANG — locale setting

Persist in ~/.bashrc or /etc/environment. Three common approaches:
ss -tulnp 'sport = :80' — modern, shows PID/program
lsof -i :80 — list open files including sockets
fuser 80/tcp — show PIDs using the port
netstat -tlnp — legacy equivalent of ss -tlnp
On systems without -p visibility, run as root or the user owning the process. ss reads kernel data directly via netlink and is faster than parsing /proc/net/tcp.

Question 8 Linux Administration

What is logrotate and how is it configured?

/etc/fstab lists filesystems to mount at boot.
Columns: device|spec mount-point fs-type options dump pass
Example:
UUID=abc... /home ext4 defaults,noatime 0 2
tmpfs /tmp tmpfs defaults,noexec,nosuid 0 0
• dump: 0=ignore, 1=use dump
• pass: 0=skip fsck, 1=root, 2=other
Test before reboot: mount -a (mount all).
Prefer UUID= over /dev/sdX (stable across boots).
Get UUIDs: blkid, lsblk -f. Environment variables are key-value pairs available to processes.
View: env or printenv
Set temporarily: export VAR="value"
Set for one command: VAR=value command

Important variables:

PATH — executable search directories
HOME — user home directory
USER — current username
SHELL — current shell
LANG — locale setting

Persist in ~/.bashrc or /etc/environment. ip replaces older ifconfig and route.
Common usage:

ip addr show — show IP addresses
ip link show — show network interfaces
ip route show — show routing table
ip addr add 10.0.0.5/24 dev eth0 — add IP
ip link set eth0 up — bring interface up
ip neigh show — show ARP table

logrotate rotates, compresses, and prunes log files.
Config: /etc/logrotate.conf + per-service files in /etc/logrotate.d/.
Example (/etc/logrotate.d/nginx):

/var/log/nginx/*.log { daily; rotate 14; compress; delaycompress; missingok; notifempty; create 0640 www-data adm; sharedscripts; postrotate [ -f /var/run/nginx.pid ] && kill -USR1 $(cat /var/run/nginx.pid); endscript }

Test: logrotate -d /etc/logrotate.conf (debug, no changes).
Run: logrotate -f /etc/logrotate.conf.
Daily cron: /etc/cron.daily/logrotate.

Question 9 Linux Administration

What is the load average and how should it be interpreted?

Edit /etc/sudoers with visudo (NEVER edit directly — it validates syntax).
Syntax: user host=(runas) commands
Examples:
root ALL=(ALL:ALL) ALL
%sudo ALL=(ALL:ALL) ALL — all members of group sudo
alice ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx — passwordless for one command
alice ALL=(ALL) NOPASSWD: ALL
Place custom rules in /etc/sudoers.d/.
Defaults: Defaults env_reset, Defaults timestamp_timeout=5, Defaults log_input, log_output.
Audit: journalctl -u sudo or grep sudo /var/log/auth.log. Load average is the average number of runnable + uninterruptible tasks over 1, 5, and 15 minutes, shown by uptime, top, and /proc/loadavg.
Interpretation:
• On a system with N CPU cores, a load of N means full utilization; above N means a queue is forming.
• Uninterruptible (D state) processes — usually blocked on I/O — count toward load even though they consume no CPU.
• A consistently rising load with stable CPU usage typically indicates I/O or memory pressure, not CPU saturation. A process has its own virtual address space, file descriptors, and signal handlers. A thread (POSIX pthread) is a unit of execution within a process that shares memory, file descriptors, and most resources with sibling threads but has its own stack and registers. Linux implements threads as lightweight tasks sharing the same task_struct group (visible as separate PIDs in /proc/[pid]/task/). ps -eLf shows threads; htop shows them under their process. systemd-resolved provides local DNS caching and validation.
It listens on 127.0.0.53:53 and may symlink or stub /etc/resolv.conf to /run/systemd/resolve/stub-resolv.conf.
Tools: resolvectl status, resolvectl query example.com, resolvectl dns eth0 8.8.8.8.
Config: /etc/systemd/resolved.conf with DNS=, FallbackDNS=, DNSSEC=yes.
Disable if you run a custom resolver (dnsmasq, unbound): systemctl disable --now systemd-resolved and write a static /etc/resolv.conf.

Question 10 Linux Administration

How do you manage file ownership with chown and chgrp?

Targets are systemd's replacement for SysV runlevels. They group units into system states.
Common targets:

poweroff.target — halt (runlevel 0)
rescue.target — single user (runlevel 1)
multi-user.target — multi-user, no GUI (runlevel 3)
graphical.target — with GUI (runlevel 5)
reboot.target — reboot (runlevel 6)

systemctl get-default — view default target
systemctl set-default multi-user.target — change it chown changes file owner and/or group:
chown user file — change owner
chown user:group file — change both
chown :group file — change group only
chown -R user:group dir/ — recursive

chgrp changes group only:
chgrp developers file
Only root can change file ownership; group members can use chgrp. /etc/fstab lists filesystems to mount at boot.
Columns: device|spec mount-point fs-type options dump pass
Example:
UUID=abc... /home ext4 defaults,noatime 0 2
tmpfs /tmp tmpfs defaults,noexec,nosuid 0 0
• dump: 0=ignore, 1=use dump
• pass: 0=skip fsck, 1=root, 2=other
Test before reboot: mount -a (mount all).
Prefer UUID= over /dev/sdX (stable across boots).
Get UUIDs: blkid, lsblk -f. tr — translate/delete characters:
echo "hello" | tr 'a-z' 'A-Z' → HELLO
echo "a::b" | tr -s ':' → a:b (squeeze repeats)
tr -d '\r' < file — remove carriage returns

xargs — build commands from stdin:
find . -name "*.log" | xargs rm
cat urls.txt | xargs -I{} curl {}
find . -name "*.txt" | xargs -P4 gzip — parallel processing (4 jobs)

Question 11 Linux Administration

What is strace and how do you use it for debugging?

Edit /etc/sudoers with visudo (NEVER edit directly — it validates syntax).
Syntax: user host=(runas) commands
Examples:
root ALL=(ALL:ALL) ALL
%sudo ALL=(ALL:ALL) ALL — all members of group sudo
alice ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx — passwordless for one command
alice ALL=(ALL) NOPASSWD: ALL
Place custom rules in /etc/sudoers.d/.
Defaults: Defaults env_reset, Defaults timestamp_timeout=5, Defaults log_input, log_output.
Audit: journalctl -u sudo or grep sudo /var/log/auth.log. strace traces system calls a process makes.
Attach to a running process: strace -p <pid>
Trace a new command: strace -f -o trace.log ls /tmp (-f follows forks).
Filter to specific calls: strace -e openat,read,write ls /
Time each call: strace -ttt -T command (-ttt epoch µs, -T duration).
Count calls: strace -c command.
Common use: "why is this hanging?" → strace -p PID to see if it's blocked on futex, read, connect.
Use ltrace for library calls; perf trace for high-performance tracing. rsync -avz -e ssh /data/ user@backup:/backups/data/
Flags:
-a — archive (recursive, preserve perms, symlinks, times)
-v — verbose
-z — compress during transfer
--progress — show progress
--delete — remove extra files at destination (mirroring)
--exclude='*.tmp'
--dry-run — preview
Trailing / on source: /data/ copies contents; /data copies the directory itself.
Resume partial files (default since 2.6.4+).
Bandwidth limit: --bwlimit=5000 (KB/s).
Hard-link backups: rsync -a --link-dest=/prev /data/ backup:current/. ip replaces older ifconfig and route.
Common usage:

ip addr show — show IP addresses
ip link show — show network interfaces
ip route show — show routing table
ip addr add 10.0.0.5/24 dev eth0 — add IP
ip link set eth0 up — bring interface up
ip neigh show — show ARP table

Question 12 Linux Administration

What is perf and how do you sample CPU performance?

perf is the Linux profiling subsystem.
Profile a command: perf stat ls / (counters), perf record -F 99 -a -g ls / (sample at 99 Hz, call graph).
View: perf report.
Top-like: perf top.
Tracepoints: perf list shows events; perf trace -e 'syscalls:sys_enter_openat' ls.
CPU-specific: perf record -c 100000 -e cycles:u ls.
Compare baseline vs patched: perf record -b ./baseline; perf record -b ./patched; perf diff.
Requires linux-tools package and usually root. Swap is disk space used to extend virtual memory when RAM is full. It can be a partition or a file.
Create a swap file:
fallocate -l 2G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
Persistence: add to /etc/fstab.
Check: swapon --show, free -h.
Set swappiness (/proc/sys/vm/swappiness, default 60): lower values prefer keeping pages in RAM. Modern advice: size swap to RAM+2 GB for suspend, or skip it on servers with abundant RAM. tail -f: tail -f /var/log/syslog
Multiple files: tail -F /var/log/{syslog,auth.log} (-F survives log rotation).
less equivalent: less +F /var/log/syslog (Shift+F to stop, F to resume).
multitail: multitail /var/log/syslog /var/log/auth.log — split-screen viewer.
lnav: lnav /var/log/ — advanced log navigator with SQL-like queries and histograms.
On systemd: journalctl -f.
For long-term aggregation use a log shipper (rsyslog, promtail, fluentd). ss (modern) and netstat (legacy) display socket statistics.
ss examples:
ss -tuln — TCP/UDP listening ports with numbers
ss -tp — TCP connections with process info
ss -s — summary statistics

netstat equivalents:
netstat -tuln — listening ports
netstat -anp — all connections with PIDs

ss is faster and recommended over netstat on modern systems.

Question 13 Linux Administration

How does the Linux firewall (nftables) work?

systemd-resolved provides local DNS caching and validation.
It listens on 127.0.0.53:53 and may symlink or stub /etc/resolv.conf to /run/systemd/resolve/stub-resolv.conf.
Tools: resolvectl status, resolvectl query example.com, resolvectl dns eth0 8.8.8.8.
Config: /etc/systemd/resolved.conf with DNS=, FallbackDNS=, DNSSEC=yes.
Disable if you run a custom resolver (dnsmasq, unbound): systemctl disable --now systemd-resolved and write a static /etc/resolv.conf. nftables is the modern Linux firewall (replacing iptables).
Basic table+chain:
nft add table inet filter
nft add chain inet filter input { type filter hook input priority 0 \; policy drop \; }
nft add rule inet filter input iif lo accept
nft add rule inet filter input ct state established,related accept
nft add rule inet filter input tcp dport 22 accept
Persistence: nft list ruleset > /etc/nftables.conf, then enable nftables.service.
Modern front-ends: ufw (Ubuntu), firewalld (RHEL). mdadm manages software RAID.
Levels:
• RAID 0: striping, no redundancy, fastest
• RAID 1: mirroring, 50% capacity, 1 disk failure tolerated
• RAID 5: striping + single parity, (N-1) capacity, 1 disk failure tolerated
• RAID 6: double parity, (N-2) capacity, 2 failures tolerated
• RAID 10: striped mirrors, 50% capacity, fast + redundant
Create: mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sdb /dev/sdc
Status: cat /proc/mdstat, mdadm --detail /dev/md0
Save config: mdadm --detail --scan >> /etc/mdadm/mdadm.conf /dev/null is a special file that discards all data written to it and returns EOF when read.
Common uses:
command > /dev/null — suppress stdout
command 2> /dev/null — suppress stderr
command > /dev/null 2>&1 — suppress all output
if command > /dev/null 2>&1; then ... — check if command succeeds silently
Often called the "bit bucket" or "black hole".

Question 14 Linux Administration

What is the /proc filesystem in Linux?

The ssh-agent keeps decrypted private keys in memory so you don't re-enter passphrases. Start with eval $(ssh-agent), add keys with ssh-add.
Agent forwarding (ssh -A user@host) lets the remote server use your local agent when you SSH onward. Risky: anyone with root on the intermediate host can use your agent.
Safer alternative: ProxyJump (ssh -J jumphost target) or ~/.ssh/config with ProxyCommand.
Confirm: ssh-add -l, SSH_AUTH_SOCK env var. chown changes file owner and/or group:
chown user file — change owner
chown user:group file — change both
chown :group file — change group only
chown -R user:group dir/ — recursive

chgrp changes group only:
chgrp developers file
Only root can change file ownership; group members can use chgrp. /proc is a virtual filesystem that provides an interface to kernel data structures.
Key entries:

/proc/cpuinfo — CPU details
/proc/meminfo — memory usage
/proc/[PID]/ — per-process info
/proc/loadavg — system load averages
/proc/filesystems — supported filesystems

It exists only in memory, not on disk. logrotate rotates, compresses, and prunes log files.
Config: /etc/logrotate.conf + per-service files in /etc/logrotate.d/.
Example (/etc/logrotate.d/nginx):

/var/log/nginx/*.log { daily; rotate 14; compress; delaycompress; missingok; notifempty; create 0640 www-data adm; sharedscripts; postrotate [ -f /var/run/nginx.pid ] && kill -USR1 $(cat /var/run/nginx.pid); endscript }

Test: logrotate -d /etc/logrotate.conf (debug, no changes).
Run: logrotate -f /etc/logrotate.conf.
Daily cron: /etc/cron.daily/logrotate.

Question 15 Linux Administration

What is the difference between cron and at?

cron runs tasks repeatedly on a schedule (e.g., every day at midnight).
at runs a task once at a specified future time.
Usage of at:
at 14:30 → enter commands, then Ctrl+D
at now + 2 hours
at 10:00 AM tomorrow
atq — list pending at jobs
atrm 3 — remove job #3
Service must be running: systemctl status atd PATH is a colon-separated list of directories where the shell searches for executables.
Temporary (current session):
export PATH="$PATH:/new/directory"

Permanent (for user):
Add to ~/.bashrc or ~/.profile:
export PATH="$PATH:$HOME/bin"
Then: source ~/.bashrc

Check: echo $PATH
which command — shows which PATH entry is used Key directories:

/etc — system configuration files
/var — variable data (logs, spools, caches)
/home — user home directories
/usr — user programs and read-only data
/tmp — temporary files (cleared on reboot)
/proc — virtual filesystem for process/kernel info
/dev — device files (block and character devices)

A zombie is a terminated process whose exit status has not been reaped. It appears as Z in ps or top STAT column. Zombies consume only a task_struct entry — no CPU or memory — but waste a PID slot. The parent must call wait() to reap the child. To clean up: send SIGCHLD to the parent (kill -s SIGCHLD <parent_pid>), or kill the parent process. Init (PID 1) automatically reaps adopted orphans.

Question 16 Linux Administration

How do you use tar to create and extract archives?

Both are RAM-based filesystems, but:
• tmpfs can use both RAM and swap, has a size limit, supports chmod/chown, and is visible in df.
• ramfs has no size limit and can grow until memory is exhausted (no swap backing), offering no accountability.
Mount tmpfs: mount -t tmpfs -o size=512m tmpfs /mnt/tmp
Common tmpfs mounts: /run, /tmp, /dev/shm.
Use ramfs only when unbounded growth is genuinely safe (rare). tar bundles files into an archive.
Create:
tar -czf archive.tar.gz dir/ — gzip compressed
tar -cjf archive.tar.bz2 dir/ — bzip2 compressed

Extract:
tar -xzf archive.tar.gz — extract gzip
tar -xzf archive.tar.gz -C /dest/ — extract to directory

List contents:
tar -tzf archive.tar.gz

Flags: c=create, x=extract, t=list, z=gzip, j=bzip2, f=file, v=verbose mdadm manages software RAID.
Levels:
• RAID 0: striping, no redundancy, fastest
• RAID 1: mirroring, 50% capacity, 1 disk failure tolerated
• RAID 5: striping + single parity, (N-1) capacity, 1 disk failure tolerated
• RAID 6: double parity, (N-2) capacity, 2 failures tolerated
• RAID 10: striped mirrors, 50% capacity, fast + redundant
Create: mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sdb /dev/sdc
Status: cat /proc/mdstat, mdadm --detail /dev/md0
Save config: mdadm --detail --scan >> /etc/mdadm/mdadm.conf sort — sort lines:
sort file, sort -n (numeric), sort -r (reverse), sort -k2 (by column 2)

uniq — remove adjacent duplicates:
sort file | uniq, uniq -c (count occurrences)

wc — count lines/words/chars:
wc -l file (lines), wc -w (words), wc -c (bytes)

cut — extract fields:
cut -d: -f1 /etc/passwd — first field, colon-delimited

Question 17 Linux Administration

How do Linux file permissions work with chmod?

A process has its own virtual address space, file descriptors, and signal handlers. A thread (POSIX pthread) is a unit of execution within a process that shares memory, file descriptors, and most resources with sibling threads but has its own stack and registers. Linux implements threads as lightweight tasks sharing the same task_struct group (visible as separate PIDs in /proc/[pid]/task/). ps -eLf shows threads; htop shows them under their process. ss (modern) and netstat (legacy) display socket statistics.
ss examples:
ss -tuln — TCP/UDP listening ports with numbers
ss -tp — TCP connections with process info
ss -s — summary statistics

netstat equivalents:
netstat -tuln — listening ports
netstat -anp — all connections with PIDs

ss is faster and recommended over netstat on modern systems. Permissions have three sets: owner, group, others, each with r(4), w(2), x(1).
Numeric: chmod 755 file → rwxr-xr-x
Symbolic: chmod u+x file → add execute for owner
chmod g-w file → remove write for group
chmod o=r file → set others to read only
chmod -R 644 dir/ → recursive Resolution order on most systems: /etc/nsswitch.conf hosts: line → usually files dns, so /etc/hosts first, then DNS.
DNS configuration files:
/etc/resolv.conf — nameservers and search domains:
nameserver 8.8.8.8
search example.com
options ndots:2 timeout:2
Tools: dig example.com, host example.com, nslookup example.com.
On systemd, NetworkManager or systemd-resolved can overwrite /etc/resolv.conf.
Check status: resolvectl status.

Question 18 Linux Administration

How do you manage users in Linux?

Variables in bash:
NAME="Linux" — assign (no spaces around =)
echo $NAME or echo "${NAME}" — use variable
readonly PI=3.14 — constant

Special variables:

$0 — script name
$1, $2... — positional arguments
$# — number of arguments
$? — last exit code
$@ — all arguments
$$ — current PID

TCP (Transmission Control Protocol) is connection-oriented, reliable, ordered, with flow and congestion control. Used for HTTP, SSH, SMTP, databases. Header overhead ~20 bytes; overhead from handshakes and ACKs.
UDP (User Datagram Protocol) is connectionless, unreliable, unordered, but fast and lightweight. Header 8 bytes. Used for DNS, NTP, VoIP, video streaming, gaming.
Check open ports: ss -tuln shows both.
Services can run over either (HTTP/3 uses QUIC/UDP). User management commands:

useradd -m -s /bin/bash john — create user with home dir
passwd john — set password
usermod -aG sudo john — add to sudo group
userdel -r john — delete user and home dir
id john — show UID, GID, groups
whoami — current user

User info stored in /etc/passwd, passwords in /etc/shadow. Hard link: ln file hardlink
Points directly to the same inode on disk. Shares the same data; deleting the original doesn't affect the link. Cannot cross filesystems or link to directories.

Symbolic (soft) link: ln -s file symlink
Points to the file path (like a shortcut). Can cross filesystems and link to directories. Breaks if the target is deleted.

Check with: ls -li (shows inode numbers) or stat file.

Question 19 Linux Administration

How do sort, uniq, wc, and cut process text?

TCP (Transmission Control Protocol) is connection-oriented, reliable, ordered, with flow and congestion control. Used for HTTP, SSH, SMTP, databases. Header overhead ~20 bytes; overhead from handshakes and ACKs.
UDP (User Datagram Protocol) is connectionless, unreliable, unordered, but fast and lightweight. Header 8 bytes. Used for DNS, NTP, VoIP, video streaming, gaming.
Check open ports: ss -tuln shows both.
Services can run over either (HTTP/3 uses QUIC/UDP). sort — sort lines:
sort file, sort -n (numeric), sort -r (reverse), sort -k2 (by column 2)

uniq — remove adjacent duplicates:
sort file | uniq, uniq -c (count occurrences)

wc — count lines/words/chars:
wc -l file (lines), wc -w (words), wc -c (bytes)

cut — extract fields:
cut -d: -f1 /etc/passwd — first field, colon-delimited AppArmor (default on Ubuntu) is path-based MAC, simpler and more tractable than SELinux's label-based model. Profiles live in /etc/apparmor.d/.
Commands:
aa-status — current state
aa-complain /usr/bin/firefox — log but don't enforce
aa-enforce /usr/bin/firefox — enforce profile
apparmor_parser -r /etc/apparmor.d/usr.bin.firefox — reload profile
Profiles are easier to author: /usr/bin/firefox { /home/*/Downloads/** r, }.
AppArmor is one process confinement tool of several; SELinux also covers kernel-level objects and is more granular. LVM (Logical Volume Manager) layers abstraction over disks: PV (Physical Volume) → VG (Volume Group) → LV (Logical Volume).
Setup:
pvcreate /dev/sdb
vgcreate vg0 /dev/sdb
lvcreate -L 50G -n data vg0
mkfs.ext4 /dev/vg0/data
mount /dev/vg0/data /mnt
Operations:
lvextend -L +10G -r /dev/vg0/data — grow with filesystem resize (-r)
vgextend vg0 /dev/sdc — add disk
vgreduce vg0 /dev/sdb — remove disk
Status: pvs, vgs, lvs.
LVMs can be snapshotted (lvcreate -s) and resized online.

Question 20 Linux Administration

How do you use the find command to locate files?

Hard link: ln file hardlink
Points directly to the same inode on disk. Shares the same data; deleting the original doesn't affect the link. Cannot cross filesystems or link to directories.

Symbolic (soft) link: ln -s file symlink
Points to the file path (like a shortcut). Can cross filesystems and link to directories. Breaks if the target is deleted.

Check with: ls -li (shows inode numbers) or stat file. tail -f: tail -f /var/log/syslog
Multiple files: tail -F /var/log/{syslog,auth.log} (-F survives log rotation).
less equivalent: less +F /var/log/syslog (Shift+F to stop, F to resume).
multitail: multitail /var/log/syslog /var/log/auth.log — split-screen viewer.
lnav: lnav /var/log/ — advanced log navigator with SQL-like queries and histograms.
On systemd: journalctl -f.
For long-term aggregation use a log shipper (rsyslog, promtail, fluentd). find searches the directory tree.
Examples:
find /home -name "*.txt" — find by name
find . -type f -mtime -7 — files modified in last 7 days
find / -size +100M — files larger than 100MB
find . -perm 755 — find by permissions
find . -name "*.log" -exec rm {} \; — execute command on results Unmount first, then run fsck:
fsck /dev/sda1 — checks ext family
fsck.ext4 /dev/sda1 — explicit
xfs_repair /dev/sda1 — for XFS
btrfs scrub start /mnt — read+verify all data on btrfs
Boot-time fsck is controlled by the pass column in /etc/fstab (1 = root first, 2 = parallel).
Force on next boot: touch /forcefsck (legacy) or systemctl reboot --firmware-setup.
Recover from bad superblock on ext: mkfs.ext4 -n /dev/sda1 lists backup superblocks, then fsck.ext4 -b 32768 /dev/sda1.

Question 21 Linux Administration

How do you configure sudo and sudoers safely?

1. BIOS/UEFI runs POST, then locates a boot device.
2. Bootloader (GRUB) loads: /boot/grub/grub.cfg (BIOS) or /boot/efi/EFI/... (UEFI).
3. Kernel + initramfs (initial RAM filesystem) are loaded into memory. initramfs provides early modules (storage drivers, LVM, LUKS).
4. Kernel executes /sbin/init (always PID 1) → systemd.
5. systemd reads its targets, mounts filesystems from /etc/fstab, brings up networking, starts services in dependency order.
6. getty (or display manager) spawns a login prompt on TTYs.
Debug: journalctl -b, dmesg, edit GRUB line and append init=/bin/bash or systemd.unit=rescue.target. Edit /etc/sudoers with visudo (NEVER edit directly — it validates syntax).
Syntax: user host=(runas) commands
Examples:
root ALL=(ALL:ALL) ALL
%sudo ALL=(ALL:ALL) ALL — all members of group sudo
alice ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx — passwordless for one command
alice ALL=(ALL) NOPASSWD: ALL
Place custom rules in /etc/sudoers.d/.
Defaults: Defaults env_reset, Defaults timestamp_timeout=5, Defaults log_input, log_output.
Audit: journalctl -u sudo or grep sudo /var/log/auth.log. scp — simple secure copy:
scp file.txt user@host:/path/
scp -r dir/ user@host:/path/

rsync — advanced sync with delta transfer:
rsync -avz src/ user@host:/dest/
Key flags: -a archive, -v verbose, -z compress, --delete remove extra files

rsync is preferred because it only transfers changed data, supports resume, and is much faster for large/repeated transfers. Time accuracy matters for logs, certs, and distributed systems.
Read hardware clock: hwclock -r
Sync from NTP:
• systemd-timesyncd: timedatectl, timedatectl set-ntp true
• chrony: chronyc tracking, chronyc sources — better for VMs and intermittent connectivity
• ntpd: legacy, ntpq -p
Time zones: timedatectl list-timezones, timedatectl set-timezone Europe/Zagreb. /etc/localtime is symlinked to /usr/share/zoneinfo/....
date -s "2026-01-01 12:00" sets system time; usually avoided in favor of NTP.

Question 22 Linux Administration

What is a TCP three-way handshake and how is it observed?

tail -f: tail -f /var/log/syslog
Multiple files: tail -F /var/log/{syslog,auth.log} (-F survives log rotation).
less equivalent: less +F /var/log/syslog (Shift+F to stop, F to resume).
multitail: multitail /var/log/syslog /var/log/auth.log — split-screen viewer.
lnav: lnav /var/log/ — advanced log navigator with SQL-like queries and histograms.
On systemd: journalctl -f.
For long-term aggregation use a log shipper (rsyslog, promtail, fluentd). Symbolic notation uses letters to modify permissions:
Who: u (user/owner), g (group), o (others), a (all)
Action: + (add), - (remove), = (set exactly)
Permission: r (read), w (write), x (execute)

Examples:
chmod u+x script.sh — make executable for owner
chmod go-w file — remove write for group and others
chmod a=r file — read-only for everyone AppArmor (default on Ubuntu) is path-based MAC, simpler and more tractable than SELinux's label-based model. Profiles live in /etc/apparmor.d/.
Commands:
aa-status — current state
aa-complain /usr/bin/firefox — log but don't enforce
aa-enforce /usr/bin/firefox — enforce profile
apparmor_parser -r /etc/apparmor.d/usr.bin.firefox — reload profile
Profiles are easier to author: /usr/bin/firefox { /home/*/Downloads/** r, }.
AppArmor is one process confinement tool of several; SELinux also covers kernel-level objects and is more granular. The handshake opens a TCP connection:
1. SYN — client sends SYN to server
2. SYN-ACK — server replies
3. ACK — client acknowledges
After this, data flows. Termination uses FIN-ACK-FIN-ACK (or RST for abrupt close).
Observe with:
tcpdump -i eth0 port 80 -nn
ss -tin (timer state column)
Connection states visible in /proc/net/tcp (ESTABLISHED=01, SYN_SENT=02, SYN_RECV=03, TIME_WAIT=06, CLOSE_WAIT=08).
Time-wait: net.ipv4.tcp_fin_timeout (default 60s).

Question 23 Linux Administration

How do you define variables and use them in shell scripts?

umask sets the default permission mask for newly created files and directories.
It subtracts permissions from the maximum (666 for files, 777 for dirs).
Example: umask 022 → new files get 644, new dirs get 755
umask 077 → new files get 600, new dirs get 700
View current: umask or umask -S (symbolic)
Set in ~/.bashrc or /etc/profile for persistence. PATH is a colon-separated list of directories where the shell searches for executables.
Temporary (current session):
export PATH="$PATH:/new/directory"

Permanent (for user):
Add to ~/.bashrc or ~/.profile:
export PATH="$PATH:$HOME/bin"
Then: source ~/.bashrc

Check: echo $PATH
which command — shows which PATH entry is used Variables in bash:
NAME="Linux" — assign (no spaces around =)
echo $NAME or echo "${NAME}" — use variable
readonly PI=3.14 — constant

Special variables:

$0 — script name
$1, $2... — positional arguments
$# — number of arguments
$? — last exit code
$@ — all arguments
$$ — current PID

A timer unit (*.timer) activates a service at intervals.
Example: /etc/systemd/system/backup.timer
[Unit]
Description=Nightly backup
[Timer]
OnCalendar=*-*-* 02:00:00
Persistent=true
[Install]
WantedBy=timers.target
Pair with backup.service containing ExecStart=/usr/local/bin/backup.sh.
Commands: systemctl list-timers, systemctl start backup.timer, systemctl enable backup.timer.
OnCalendar format: Mon..Sun, *-*-*, hourly, daily.
Advantages over cron: integrated logging, dependencies, missed-run catch-up (Persistent=true), monotonic timers (OnBootSec).

Question 24 Linux Administration

How do you add a directory to the PATH variable?

VLANs segment a Layer 2 network. 802.1Q tags frames with a 12-bit VLAN ID (1–4094).
Create a tagged interface: ip link add link eth0 name eth0.10 type vlan id 10
Assign IP: ip addr add 10.10.0.1/24 dev eth0.10
The base interface eth0 can carry multiple VLANs side-by-side.
Delete: ip link delete eth0.10
Show: ip -d link show eth0.10.
Persistent: in /etc/network/interfaces or via NetworkManager with vlan.id connection property.
VLAN IDs 0 and 4095 are reserved. PATH is a colon-separated list of directories where the shell searches for executables.
Temporary (current session):
export PATH="$PATH:/new/directory"

Permanent (for user):
Add to ~/.bashrc or ~/.profile:
export PATH="$PATH:$HOME/bin"
Then: source ~/.bashrc

Check: echo $PATH
which command — shows which PATH entry is used chown changes file owner and/or group:
chown user file — change owner
chown user:group file — change both
chown :group file — change group only
chown -R user:group dir/ — recursive

chgrp changes group only:
chgrp developers file
Only root can change file ownership; group members can use chgrp. tail -f: tail -f /var/log/syslog
Multiple files: tail -F /var/log/{syslog,auth.log} (-F survives log rotation).
less equivalent: less +F /var/log/syslog (Shift+F to stop, F to resume).
multitail: multitail /var/log/syslog /var/log/auth.log — split-screen viewer.
lnav: lnav /var/log/ — advanced log navigator with SQL-like queries and histograms.
On systemd: journalctl -f.
For long-term aggregation use a log shipper (rsyslog, promtail, fluentd).

Question 25 Linux Administration

How do Linux capabilities replace the root binary?

Capabilities split root's all-or-nothing power into discrete privileges (CAP_NET_BIND_SERVICE, CAP_SYS_ADMIN, CAP_DAC_OVERRIDE, ~40 total).
Examples:
setcap cap_net_bind_service=+ep /usr/bin/python3 — allow binding port 80 without root
getcap /usr/bin/python3 — show capabilities
getpcaps <pid> — show process capabilities
Use cases: bind low ports, mount, change ownership, raw sockets. Capabilities are inheritable, permitted, effective, bounding, ambient. sshd drops most capabilities in /etc/ssh/sshd_config via the PermitUserEnvironment + AmbientCapabilities mechanism. ACLs (Access Control Lists) provide per-user and per-group permissions beyond owner/group/others.
Enable on filesystem: mount -o acl /dev/sda1 /mnt (often default on ext4).
Commands:
getfacl file — view ACL
setfacl -m u:alice:rw file — grant user alice read+write
setfacl -m g:dev:rwx dir/ — grant group dev full access on dir
setfacl -d -m u:alice:r dir/ — default ACL (inherited by new files)
setfacl -x u:alice file — remove an entry
setfacl -b file — remove all ACLs
When any ACL is set, ls -l shows a + after the mode. Function definition:
greet() {
echo "Hello, $1!"
return 0
}
greet "World"

Key points:

Arguments accessed via $1, $2, ...
return sets exit status (0–255)
Use local for local variables: local name="value"
Capture output: result=$(greet "World")

Functions must be defined before they are called. ping — test connectivity and latency:
ping -c 4 google.com

traceroute — show the path packets take:
traceroute google.com (shows each hop)

dig — DNS lookup tool:
dig example.com — query A record
dig example.com MX — mail records
dig @8.8.8.8 example.com — use specific DNS server
dig +short example.com — concise output

nslookup is a simpler alternative to dig.

Question 26 Linux Administration

How do you configure a Linux host as a router?

journalctl queries the systemd journal:
journalctl -u nginx — logs for a specific unit
journalctl -f — follow (like tail -f)
journalctl --since "1 hour ago" — time-based filter
journalctl -p err — filter by priority (emerg, alert, crit, err, warning)
journalctl -b — logs from current boot
journalctl --disk-usage — check journal size
journalctl --vacuum-size=500M — clean up 1. Enable forwarding: sysctl -w net.ipv4.ip_forward=1; persist in /etc/sysctl.d/router.conf.
2. Configure interfaces: assign IPs to each subnet.
3. Add firewall/NAT: with nft:
nft add table ip nat
nft add chain ip nat postrouting { type nat hook postrouting priority 0 \; }
nft add rule ip nat postrouting oifname "eth0" ip saddr 10.0.0.0/24 masquerade
4. On clients, set this host as default gateway.
5. Optionally run dnsmasq for DHCP+DNS and kea for IPv6.
Verify routes: ip route show, traceroute from a client. /proc is a virtual filesystem that provides an interface to kernel data structures.
Key entries:

/proc/cpuinfo — CPU details
/proc/meminfo — memory usage
/proc/[PID]/ — per-process info
/proc/loadavg — system load averages
/proc/filesystems — supported filesystems

It exists only in memory, not on disk. nice sets process priority (niceness: -20 to 19, lower = higher priority):
nice -n 10 command — start with lower priority
renice -n 5 -p PID — change running process priority

nohup runs a command immune to hangup signals:
nohup command & — continues after terminal closes
Output goes to nohup.out by default.
Combine: nohup nice -n 10 long_task &

Question 27 Linux Administration

What is swap space and when should it be used?

Swap is disk space used to extend virtual memory when RAM is full. It can be a partition or a file.
Create a swap file:
fallocate -l 2G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
Persistence: add to /etc/fstab.
Check: swapon --show, free -h.
Set swappiness (/proc/sys/vm/swappiness, default 60): lower values prefer keeping pages in RAM. Modern advice: size swap to RAM+2 GB for suspend, or skip it on servers with abundant RAM. Job control manages background/foreground processes:
command & — start in background
Ctrl+Z — suspend foreground process
jobs — list current jobs with job numbers
bg %1 — resume job 1 in background
fg %1 — bring job 1 to foreground
disown %1 — detach job from shell (survives logout)
Job states: Running, Stopped, Done. An inode stores file metadata (permissions, timestamps, block pointers) except the name. Each file consumes one inode.
Check usage: df -i (inodes) vs df -h (blocks).
Find directories using many inodes: find / -xdev -type d -exec sh -c 'echo $(find "$1" | wc -l) "$1"' _ {} \; then | sort -rn | head
When inodes are exhausted you cannot create new files even with free blocks. Causes: millions of empty files (mail spools, session dirs, cache). Fix by removing small files or reformatting with a smaller bytes-per-inode ratio (mkfs.ext4 -i 8192). A timer unit (*.timer) activates a service at intervals.
Example: /etc/systemd/system/backup.timer
[Unit]
Description=Nightly backup
[Timer]
OnCalendar=*-*-* 02:00:00
Persistent=true
[Install]
WantedBy=timers.target
Pair with backup.service containing ExecStart=/usr/local/bin/backup.sh.
Commands: systemctl list-timers, systemctl start backup.timer, systemctl enable backup.timer.
OnCalendar format: Mon..Sun, *-*-*, hourly, daily.
Advantages over cron: integrated logging, dependencies, missed-run catch-up (Persistent=true), monotonic timers (OnBootSec).

Question 28 Linux Administration

What are cgroups and how do they relate to systemd?

Namespaces (man namespaces) provide isolation: pid (process IDs), net (network), mount, uts (hostname), ipc, user (UID mapping), cgroup.
cgroups provide resource limits.
Together they form the basis of containers: each container has its own PID, network, mount, and UID namespaces plus cgroup-enforced CPU/memory limits.
Tools: unshare --pid --fork bash enters a new PID namespace; nsenter -t 1 -m -u -i -n -p bash enters host's namespaces.
Inspect container: cat /proc/1/cgroup, ls -l /proc/1/ns/.
Container runtimes: runc, crun, containerd. cgroups (control groups) organize processes into hierarchies and apply resource limits — CPU shares, memory caps, I/O weights, PIDs max.
systemd auto-creates a cgroup per service at /sys/fs/cgroup/systemd.slice/<name>.service/.
In a unit file:
[Service]
CPUQuota=50%
MemoryMax=512M
IOWeight=500
TasksMax=100
Inspect: systemd-cgtop (top-like), systemctl status myservice shows cgroup path, cat /proc/<pid>/cgroup.
cgroups v2 (unified hierarchy) is the default on modern distros; enable with systemd.unified_cgroup_hierarchy=1 kernel param. 1. Generate on client: ssh-keygen -t ed25519 -C "alice@laptop" (default path ~/.ssh/id_ed25519). Optionally add a passphrase.
2. Install a passphrase agent: eval $(ssh-agent -s); ssh-add ~/.ssh/id_ed25519.
3. Copy public key to server: ssh-copy-id -i ~/.ssh/id_ed25519.pub user@host (appends to ~/.ssh/authorized_keys, mode 600, dir 700).
4. Test: ssh user@host — no password prompt.
5. Disable password auth in /etc/ssh/sshd_config: PasswordAuthentication no, then systemctl restart sshd. User management commands:

useradd -m -s /bin/bash john — create user with home dir
passwd john — set password
usermod -aG sudo john — add to sudo group
userdel -r john — delete user and home dir
id john — show UID, GID, groups
whoami — current user

User info stored in /etc/passwd, passwords in /etc/shadow.

Question 29 Linux Administration

How do you find which process is using the most resources?

CPU: top -c (then P to sort), ps -eo pid,user,pcpu,comm --sort=-pcpu | head, pidstat -u 1 (per-CPU).
Memory: ps -eo pid,user,pmem,rss,comm --sort=-rss | head, smem -rs rss for PSS (more accurate).
Disk I/O: iotop, pidstat -d 1.
Open files: lsof -p <pid>.
File descriptors: lsof -p <pid> | wc -l.
Network: nethogs (per-process bandwidth).
Aggregate: atop records historical system state. grep searches text using patterns.
Usage: grep [options] pattern [file...]
Key flags:

-i case-insensitive
-r recursive search
-n show line numbers
-v invert match
-E extended regex (same as egrep)

Key directories:

/etc — system configuration files
/var — variable data (logs, spools, caches)
/home — user home directories
/usr — user programs and read-only data
/tmp — temporary files (cleared on reboot)
/proc — virtual filesystem for process/kernel info
/dev — device files (block and character devices)

The kernel ring buffer holds boot and kernel log messages in memory.
View it with:
dmesg — full buffer
dmesg -T — human-readable timestamps
dmesg -w — follow new messages (like tail -f)
dmesg -l err — filter by severity (emerg, alert, crit, err, warn, info, debug)
journalctl -k shows the same data on systemd systems. The buffer is circular — old messages are overwritten when full.

Question 30 Linux Administration

How do you find which process is listening on a port?

A zombie is a terminated process whose exit status has not been reaped. It appears as Z in ps or top STAT column. Zombies consume only a task_struct entry — no CPU or memory — but waste a PID slot. The parent must call wait() to reap the child. To clean up: send SIGCHLD to the parent (kill -s SIGCHLD <parent_pid>), or kill the parent process. Init (PID 1) automatically reaps adopted orphans. Edit /etc/sudoers with visudo (NEVER edit directly — it validates syntax).
Syntax: user host=(runas) commands
Examples:
root ALL=(ALL:ALL) ALL
%sudo ALL=(ALL:ALL) ALL — all members of group sudo
alice ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx — passwordless for one command
alice ALL=(ALL) NOPASSWD: ALL
Place custom rules in /etc/sudoers.d/.
Defaults: Defaults env_reset, Defaults timestamp_timeout=5, Defaults log_input, log_output.
Audit: journalctl -u sudo or grep sudo /var/log/auth.log. Three common approaches:
ss -tulnp 'sport = :80' — modern, shows PID/program
lsof -i :80 — list open files including sockets
fuser 80/tcp — show PIDs using the port
netstat -tlnp — legacy equivalent of ss -tlnp
On systems without -p visibility, run as root or the user owning the process. ss reads kernel data directly via netlink and is faster than parsing /proc/net/tcp. 1. BIOS/UEFI runs POST, then locates a boot device.
2. Bootloader (GRUB) loads: /boot/grub/grub.cfg (BIOS) or /boot/efi/EFI/... (UEFI).
3. Kernel + initramfs (initial RAM filesystem) are loaded into memory. initramfs provides early modules (storage drivers, LVM, LUKS).
4. Kernel executes /sbin/init (always PID 1) → systemd.
5. systemd reads its targets, mounts filesystems from /etc/fstab, brings up networking, starts services in dependency order.
6. getty (or display manager) spawns a login prompt on TTYs.
Debug: journalctl -b, dmesg, edit GRUB line and append init=/bin/bash or systemd.unit=rescue.target.

Question 31 Linux Administration

What are SUID, SGID, and the sticky bit?

Pipes (|) send stdout of one command to stdin of another:
cat file | grep "error" | wc -l

Redirection:

> file — redirect stdout (overwrite)
>> file — redirect stdout (append)
< file — redirect stdin from file
2> file — redirect stderr
2>&1 — redirect stderr to stdout
&> file — redirect both stdout and stderr
cmd > /dev/null 2>&1 — discard all output

The initramfs (initial RAM filesystem) is a compressed cpio archive loaded by the kernel before the real root. It contains modules and scripts to mount root, unlock LUKS, assemble RAID, activate LVM.
Rebuild:
Debian/Ubuntu: update-initramfs -u (current kernel) or -c (new).
RHEL: dracut -f or dracut --force /boot/initramfs-$(uname -r).img $(uname -r).
Inspect contents: lsinitramfs /boot/initrd.img-$(uname -r) (Debian) or dracut --list.
Force mkinitcpio rebuild (Arch): mkinitcpio -P.
Build config: /etc/initramfs-tools/initramfs.conf (Debian), /etc/dracut.conf.d/. Group management:
groupadd developers — create group
groupdel developers — delete group
usermod -aG developers john — add user to group
gpasswd -d john developers — remove user from group
groups john — list user's groups

Key files:

/etc/group — group definitions
/etc/gshadow — group passwords

A user has one primary group and can belong to multiple supplementary groups. Special permission bits:

SUID (4xxx) — file executes as the file owner. Example: chmod 4755 file. Shown as -rwsr-xr-x
SGID (2xxx) — file executes as the group owner; on directories, new files inherit the group. chmod 2755 dir
Sticky bit (1xxx) — only file owner can delete files in the directory. chmod 1777 /tmp. Shown as drwxrwxrwt

Question 32 Linux Administration

What is a Linux rescue/initramfs and how do you rebuild it?

The initramfs (initial RAM filesystem) is a compressed cpio archive loaded by the kernel before the real root. It contains modules and scripts to mount root, unlock LUKS, assemble RAID, activate LVM.
Rebuild:
Debian/Ubuntu: update-initramfs -u (current kernel) or -c (new).
RHEL: dracut -f or dracut --force /boot/initramfs-$(uname -r).img $(uname -r).
Inspect contents: lsinitramfs /boot/initrd.img-$(uname -r) (Debian) or dracut --list.
Force mkinitcpio rebuild (Arch): mkinitcpio -P.
Build config: /etc/initramfs-tools/initramfs.conf (Debian), /etc/dracut.conf.d/. Job control manages background/foreground processes:
command & — start in background
Ctrl+Z — suspend foreground process
jobs — list current jobs with job numbers
bg %1 — resume job 1 in background
fg %1 — bring job 1 to foreground
disown %1 — detach job from shell (survives logout)
Job states: Running, Stopped, Done. grep searches text using patterns.
Usage: grep [options] pattern [file...]
Key flags:

-i case-insensitive
-r recursive search
-n show line numbers
-v invert match
-E extended regex (same as egrep)

Resolution order on most systems: /etc/nsswitch.conf hosts: line → usually files dns, so /etc/hosts first, then DNS.
DNS configuration files:
/etc/resolv.conf — nameservers and search domains:
nameserver 8.8.8.8
search example.com
options ndots:2 timeout:2
Tools: dig example.com, host example.com, nslookup example.com.
On systemd, NetworkManager or systemd-resolved can overwrite /etc/resolv.conf.
Check status: resolvectl status.

Question 33 Linux Administration

What are systemd targets and how do they relate to runlevels?

logrotate rotates, compresses, and prunes log files.
Config: /etc/logrotate.conf + per-service files in /etc/logrotate.d/.
Example (/etc/logrotate.d/nginx):

/var/log/nginx/*.log { daily; rotate 14; compress; delaycompress; missingok; notifempty; create 0640 www-data adm; sharedscripts; postrotate [ -f /var/run/nginx.pid ] && kill -USR1 $(cat /var/run/nginx.pid); endscript }

Test: logrotate -d /etc/logrotate.conf (debug, no changes).
Run: logrotate -f /etc/logrotate.conf.
Daily cron: /etc/cron.daily/logrotate. ip replaces older ifconfig and route.
Common usage:

ip addr show — show IP addresses
ip link show — show network interfaces
ip route show — show routing table
ip addr add 10.0.0.5/24 dev eth0 — add IP
ip link set eth0 up — bring interface up
ip neigh show — show ARP table

Three common approaches:
ss -tulnp 'sport = :80' — modern, shows PID/program
lsof -i :80 — list open files including sockets
fuser 80/tcp — show PIDs using the port
netstat -tlnp — legacy equivalent of ss -tlnp
On systems without -p visibility, run as root or the user owning the process. ss reads kernel data directly via netlink and is faster than parsing /proc/net/tcp. Targets are systemd's replacement for SysV runlevels. They group units into system states.
Common targets:

poweroff.target — halt (runlevel 0)
rescue.target — single user (runlevel 1)
multi-user.target — multi-user, no GUI (runlevel 3)
graphical.target — with GUI (runlevel 5)
reboot.target — reboot (runlevel 6)

systemctl get-default — view default target
systemctl set-default multi-user.target — change it

Question 34 Linux Administration

What is the PID 1 special role in Linux?

PID 1 is the init process — the first userspace process started by the kernel after boot. It becomes the ancestor of every other process and adopts orphaned children. On modern systems this is systemd. PID 1 receives SIGCHLD and any orphaned signals (unlike other processes, which ignore them). It cannot be killed even with kill -9 — it must be re-executed or the system will halt. ps -p 1 -o comm= shows the init binary. SELinux (Security-Enhanced Linux) is a MAC (Mandatory Access Control) system using type enforcement to confine processes.
Modes: enforcing, permissive (log only), disabled.
Check status: getenforce, sestatus
Set mode: setenforce 0|1 (permissive or enforcing), or in /etc/selinux/config for persistence.
Tools:
ps -eZ — show process context
ls -lZ — show file context
chcon -t httpd_sys_content_t /var/www/html/file — change type
restorecon -R /var/www/html — reset to policy default
sealert -a /var/log/audit/audit.log — analyze denials
audit2why and audit2allow — generate policy from denials. The handshake opens a TCP connection:
1. SYN — client sends SYN to server
2. SYN-ACK — server replies
3. ACK — client acknowledges
After this, data flows. Termination uses FIN-ACK-FIN-ACK (or RST for abrupt close).
Observe with:
tcpdump -i eth0 port 80 -nn
ss -tin (timer state column)
Connection states visible in /proc/net/tcp (ESTABLISHED=01, SYN_SENT=02, SYN_RECV=03, TIME_WAIT=06, CLOSE_WAIT=08).
Time-wait: net.ipv4.tcp_fin_timeout (default 60s). A bridge (virtual switch) connects multiple interfaces at Layer 2.
Create: ip link add br0 type bridge
Add iface: ip link set eth0 master br0
Bring up: ip link set br0 up
Assign IP to bridge: ip addr add 10.0.0.1/24 dev br0
This is the default for VMs (libvirt, VirtualBox) and containers (Docker uses docker0).
Show forwarding database: bridge fdb show
VLAN-aware bridges: ip link add br0 type bridge vlan_filtering 1, then bridge vlan add dev eth0 vid 10.

Question 35 Linux Administration

What is the difference between hard links and symbolic links?

Swap is disk space used to extend virtual memory when RAM is full. It can be a partition or a file.
Create a swap file:
fallocate -l 2G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
Persistence: add to /etc/fstab.
Check: swapon --show, free -h.
Set swappiness (/proc/sys/vm/swappiness, default 60): lower values prefer keeping pages in RAM. Modern advice: size swap to RAM+2 GB for suspend, or skip it on servers with abundant RAM. Hard link: ln file hardlink
Points directly to the same inode on disk. Shares the same data; deleting the original doesn't affect the link. Cannot cross filesystems or link to directories.

Symbolic (soft) link: ln -s file symlink
Points to the file path (like a shortcut). Can cross filesystems and link to directories. Breaks if the target is deleted.

Check with: ls -li (shows inode numbers) or stat file. LVM (Logical Volume Manager) layers abstraction over disks: PV (Physical Volume) → VG (Volume Group) → LV (Logical Volume).
Setup:
pvcreate /dev/sdb
vgcreate vg0 /dev/sdb
lvcreate -L 50G -n data vg0
mkfs.ext4 /dev/vg0/data
mount /dev/vg0/data /mnt
Operations:
lvextend -L +10G -r /dev/vg0/data — grow with filesystem resize (-r)
vgextend vg0 /dev/sdc — add disk
vgreduce vg0 /dev/sdb — remove disk
Status: pvs, vgs, lvs.
LVMs can be snapshotted (lvcreate -s) and resized online. cgroups (control groups) organize processes into hierarchies and apply resource limits — CPU shares, memory caps, I/O weights, PIDs max.
systemd auto-creates a cgroup per service at /sys/fs/cgroup/systemd.slice/<name>.service/.
In a unit file:
[Service]
CPUQuota=50%
MemoryMax=512M
IOWeight=500
TasksMax=100
Inspect: systemd-cgtop (top-like), systemctl status myservice shows cgroup path, cat /proc/<pid>/cgroup.
cgroups v2 (unified hierarchy) is the default on modern distros; enable with systemd.unified_cgroup_hierarchy=1 kernel param.

Question 36 Linux Administration

What important log files are in /var/log?

Time accuracy matters for logs, certs, and distributed systems.
Read hardware clock: hwclock -r
Sync from NTP:
• systemd-timesyncd: timedatectl, timedatectl set-ntp true
• chrony: chronyc tracking, chronyc sources — better for VMs and intermittent connectivity
• ntpd: legacy, ntpq -p
Time zones: timedatectl list-timezones, timedatectl set-timezone Europe/Zagreb. /etc/localtime is symlinked to /usr/share/zoneinfo/....
date -s "2026-01-01 12:00" sets system time; usually avoided in favor of NTP. strace traces system calls a process makes.
Attach to a running process: strace -p <pid>
Trace a new command: strace -f -o trace.log ls /tmp (-f follows forks).
Filter to specific calls: strace -e openat,read,write ls /
Time each call: strace -ttt -T command (-ttt epoch µs, -T duration).
Count calls: strace -c command.
Common use: "why is this hanging?" → strace -p PID to see if it's blocked on futex, read, connect.
Use ltrace for library calls; perf trace for high-performance tracing. MBR (Master Boot Record): 4 primary partitions, max 2 TiB disk, BIOS boot.
GPT (GUID Partition Table): 128 partitions, 8 ZiB max, required for UEFI, stores backup header + partition table at disk end for redundancy.
Tools: fdisk (MBR & GPT now), gdisk (GPT), parted (both).
Check: fdisk -l /dev/sda shows "Disklabel type: gpt" or "dos".
Convert: gdisk /dev/sda can convert MBR→GPT; always back up first.
UEFI systems require an ESP (EFI System Partition) — FAT32, ~256-512 MB, flagged as esp. Key log files:

/var/log/syslog (or messages) — general system log
/var/log/auth.log (or secure) — authentication events
/var/log/kern.log — kernel messages
/var/log/dmesg — boot/hardware messages
/var/log/apt/ — package manager logs
/var/log/nginx/ — web server logs

View: tail -f /var/log/syslog
journalctl is the modern alternative on systemd systems.

Question 37 Linux Administration

What is a zombie process and how do you clean it up?

chown changes file owner and/or group:
chown user file — change owner
chown user:group file — change both
chown :group file — change group only
chown -R user:group dir/ — recursive

chgrp changes group only:
chgrp developers file
Only root can change file ownership; group members can use chgrp. A zombie is a terminated process whose exit status has not been reaped. It appears as Z in ps or top STAT column. Zombies consume only a task_struct entry — no CPU or memory — but waste a PID slot. The parent must call wait() to reap the child. To clean up: send SIGCHLD to the parent (kill -s SIGCHLD <parent_pid>), or kill the parent process. Init (PID 1) automatically reaps adopted orphans. Load average is the average number of runnable + uninterruptible tasks over 1, 5, and 15 minutes, shown by uptime, top, and /proc/loadavg.
Interpretation:
• On a system with N CPU cores, a load of N means full utilization; above N means a queue is forming.
• Uninterruptible (D state) processes — usually blocked on I/O — count toward load even though they consume no CPU.
• A consistently rising load with stable CPU usage typically indicates I/O or memory pressure, not CPU saturation. scp — simple secure copy:
scp file.txt user@host:/path/
scp -r dir/ user@host:/path/

rsync — advanced sync with delta transfer:
rsync -avz src/ user@host:/dest/
Key flags: -a archive, -v verbose, -z compress, --delete remove extra files

rsync is preferred because it only transfers changed data, supports resume, and is much faster for large/repeated transfers.

Question 38 Linux Administration

How do you set up SSH key-based authentication?

1. Generate on client: ssh-keygen -t ed25519 -C "alice@laptop" (default path ~/.ssh/id_ed25519). Optionally add a passphrase.
2. Install a passphrase agent: eval $(ssh-agent -s); ssh-add ~/.ssh/id_ed25519.
3. Copy public key to server: ssh-copy-id -i ~/.ssh/id_ed25519.pub user@host (appends to ~/.ssh/authorized_keys, mode 600, dir 700).
4. Test: ssh user@host — no password prompt.
5. Disable password auth in /etc/ssh/sshd_config: PasswordAuthentication no, then systemctl restart sshd. chown changes file owner and/or group:
chown user file — change owner
chown user:group file — change both
chown :group file — change group only
chown -R user:group dir/ — recursive

chgrp changes group only:
chgrp developers file
Only root can change file ownership; group members can use chgrp. Key directories:

/etc — system configuration files
/var — variable data (logs, spools, caches)
/home — user home directories
/usr — user programs and read-only data
/tmp — temporary files (cleared on reboot)
/proc — virtual filesystem for process/kernel info
/dev — device files (block and character devices)

tail -f: tail -f /var/log/syslog
Multiple files: tail -F /var/log/{syslog,auth.log} (-F survives log rotation).
less equivalent: less +F /var/log/syslog (Shift+F to stop, F to resume).
multitail: multitail /var/log/syslog /var/log/auth.log — split-screen viewer.
lnav: lnav /var/log/ — advanced log navigator with SQL-like queries and histograms.
On systemd: journalctl -f.
For long-term aggregation use a log shipper (rsyslog, promtail, fluentd).

Question 39 Linux Administration

What is the difference between vmstat, iostat, and mpstat?

Unmount first, then run fsck:
fsck /dev/sda1 — checks ext family
fsck.ext4 /dev/sda1 — explicit
xfs_repair /dev/sda1 — for XFS
btrfs scrub start /mnt — read+verify all data on btrfs
Boot-time fsck is controlled by the pass column in /etc/fstab (1 = root first, 2 = parallel).
Force on next boot: touch /forcefsck (legacy) or systemctl reboot --firmware-setup.
Recover from bad superblock on ext: mkfs.ext4 -n /dev/sda1 lists backup superblocks, then fsck.ext4 -b 32768 /dev/sda1. AppArmor (default on Ubuntu) is path-based MAC, simpler and more tractable than SELinux's label-based model. Profiles live in /etc/apparmor.d/.
Commands:
aa-status — current state
aa-complain /usr/bin/firefox — log but don't enforce
aa-enforce /usr/bin/firefox — enforce profile
apparmor_parser -r /etc/apparmor.d/usr.bin.firefox — reload profile
Profiles are easier to author: /usr/bin/firefox { /home/*/Downloads/** r, }.
AppArmor is one process confinement tool of several; SELinux also covers kernel-level objects and is more granular. vmstat: virtual memory, CPU, I/O, system. vmstat 1 5 — sampled every second, 5 times. Columns: r runnable, b blocked, si/so swap in/out, bi/bo blocks in/out, us/sy/id/wa/st CPU percentages.
iostat: per-device disk I/O. iostat -xz 1 (extended, hide zero-utilization devices).
mpstat: per-CPU stats. mpstat -P ALL 1 shows all cores.
All part of sysstat: install sysstat package.
Persistent: enable sysstat service and edit /etc/sysstat/sysstat to set HISTORY retention. ACLs (Access Control Lists) provide per-user and per-group permissions beyond owner/group/others.
Enable on filesystem: mount -o acl /dev/sda1 /mnt (often default on ext4).
Commands:
getfacl file — view ACL
setfacl -m u:alice:rw file — grant user alice read+write
setfacl -m g:dev:rwx dir/ — grant group dev full access on dir
setfacl -d -m u:alice:r dir/ — default ACL (inherited by new files)
setfacl -x u:alice file — remove an entry
setfacl -b file — remove all ACLs
When any ACL is set, ls -l shows a + after the mode.

Question 40 Linux Administration

How do you connect to a remote server with SSH?

tcpdump -i eth0 — capture on interface
tcpdump -i any port 80 — any iface, port 80
tcpdump -w file.pcap host 10.0.0.5 — save to file (open in Wireshark)
tcpdump -r file.pcap — read pcap
tcpdump -nn -A port 443 and host api.example.com — name resolution off, ASCII payload
tcpdump -nn -s 0 -c 1000 -w cap.pcap — full packet, 1000 packets
Privileged: requires root or CAP_NET_RAW.
For deeper analysis: tshark (CLI Wireshark) or ngrep for pattern matching. cat — display entire file: cat file.txt
cat -n file.txt — with line numbers

head — first N lines: head -n 20 file.txt

tail — last N lines: tail -n 20 file.txt
tail -f /var/log/syslog — follow new lines in real time

tee — write to file AND stdout simultaneously:
command | tee output.log
command | tee -a output.log — append mode MBR (Master Boot Record): 4 primary partitions, max 2 TiB disk, BIOS boot.
GPT (GUID Partition Table): 128 partitions, 8 ZiB max, required for UEFI, stores backup header + partition table at disk end for redundancy.
Tools: fdisk (MBR & GPT now), gdisk (GPT), parted (both).
Check: fdisk -l /dev/sda shows "Disklabel type: gpt" or "dos".
Convert: gdisk /dev/sda can convert MBR→GPT; always back up first.
UEFI systems require an ESP (EFI System Partition) — FAT32, ~256-512 MB, flagged as esp. ssh provides encrypted remote access.
Basic: ssh user@hostname
With port: ssh -p 2222 user@host
Key-based auth:
ssh-keygen -t ed25519 — generate key pair
ssh-copy-id user@host — copy public key
Config file (~/.ssh/config):
Host myserver
  HostName 10.0.0.1
  User admin
  IdentityFile ~/.ssh/id_ed25519

Question 41 Linux Administration

What is a Linux cgroup and namespace and how do containers use them?

TCP (Transmission Control Protocol) is connection-oriented, reliable, ordered, with flow and congestion control. Used for HTTP, SSH, SMTP, databases. Header overhead ~20 bytes; overhead from handshakes and ACKs.
UDP (User Datagram Protocol) is connectionless, unreliable, unordered, but fast and lightweight. Header 8 bytes. Used for DNS, NTP, VoIP, video streaming, gaming.
Check open ports: ss -tuln shows both.
Services can run over either (HTTP/3 uses QUIC/UDP). 1. Enable forwarding: sysctl -w net.ipv4.ip_forward=1; persist in /etc/sysctl.d/router.conf.
2. Configure interfaces: assign IPs to each subnet.
3. Add firewall/NAT: with nft:
nft add table ip nat
nft add chain ip nat postrouting { type nat hook postrouting priority 0 \; }
nft add rule ip nat postrouting oifname "eth0" ip saddr 10.0.0.0/24 masquerade
4. On clients, set this host as default gateway.
5. Optionally run dnsmasq for DHCP+DNS and kea for IPv6.
Verify routes: ip route show, traceroute from a client. Swap is disk space used to extend virtual memory when RAM is full. It can be a partition or a file.
Create a swap file:
fallocate -l 2G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
Persistence: add to /etc/fstab.
Check: swapon --show, free -h.
Set swappiness (/proc/sys/vm/swappiness, default 60): lower values prefer keeping pages in RAM. Modern advice: size swap to RAM+2 GB for suspend, or skip it on servers with abundant RAM. Namespaces (man namespaces) provide isolation: pid (process IDs), net (network), mount, uts (hostname), ipc, user (UID mapping), cgroup.
cgroups provide resource limits.
Together they form the basis of containers: each container has its own PID, network, mount, and UID namespaces plus cgroup-enforced CPU/memory limits.
Tools: unshare --pid --fork bash enters a new PID namespace; nsenter -t 1 -m -u -i -n -p bash enters host's namespaces.
Inspect container: cat /proc/1/cgroup, ls -l /proc/1/ns/.
Container runtimes: runc, crun, containerd.

Question 42 Linux Administration

How do cron jobs work and what is crontab syntax?

By default the journal lives in /run/log/journal/ and is lost on reboot.
Persist:
1. mkdir -p /var/log/journal
2. systemctl restart systemd-journald
3. (Optional) chown -R systemd-journal:systemd-journal /var/log/journal
Journal data is owned by the systemd-journal group, readable by members.
Set retention: in /etc/systemd/journald.conf:
SystemMaxUse=500M
MaxRetentionSec=30day
Then systemctl restart systemd-journald.
View members: getent group systemd-journal. cron schedules recurring tasks. Edit with crontab -e.
Format: MIN HOUR DOM MON DOW command
Examples:
0 2 * * * /backup.sh — daily at 2:00 AM
*/15 * * * * /check.sh — every 15 minutes
0 9 * * 1-5 /report.sh — weekdays at 9 AM
@reboot /startup.sh — run at boot
crontab -l — list current user's cron jobs sort — sort lines:
sort file, sort -n (numeric), sort -r (reverse), sort -k2 (by column 2)

uniq — remove adjacent duplicates:
sort file | uniq, uniq -c (count occurrences)

wc — count lines/words/chars:
wc -l file (lines), wc -w (words), wc -c (bytes)

cut — extract fields:
cut -d: -f1 /etc/passwd — first field, colon-delimited fail2ban monitors log files (e.g., /var/log/auth.log, /var/log/nginx/error.log) and bans IPs with too many failed attempts using firewall rules.
Install: apt install fail2ban.
Configure: /etc/fail2ban/jail.local overriding jail.conf:
[sshd]
enabled = true
maxretry = 3
findtime = 600
bantime = 3600
Commands: fail2ban-client status, fail2ban-client status sshd, fail2ban-client unban <ip>.
Default action uses iptables; on modern systems configure with nftables or ufw.

Question 43 Linux Administration

What does umask control and how do you set it?

The initramfs (initial RAM filesystem) is a compressed cpio archive loaded by the kernel before the real root. It contains modules and scripts to mount root, unlock LUKS, assemble RAID, activate LVM.
Rebuild:
Debian/Ubuntu: update-initramfs -u (current kernel) or -c (new).
RHEL: dracut -f or dracut --force /boot/initramfs-$(uname -r).img $(uname -r).
Inspect contents: lsinitramfs /boot/initrd.img-$(uname -r) (Debian) or dracut --list.
Force mkinitcpio rebuild (Arch): mkinitcpio -P.
Build config: /etc/initramfs-tools/initramfs.conf (Debian), /etc/dracut.conf.d/. umask sets the default permission mask for newly created files and directories.
It subtracts permissions from the maximum (666 for files, 777 for dirs).
Example: umask 022 → new files get 644, new dirs get 755
umask 077 → new files get 600, new dirs get 700
View current: umask or umask -S (symbolic)
Set in ~/.bashrc or /etc/profile for persistence. Job control manages background/foreground processes:
command & — start in background
Ctrl+Z — suspend foreground process
jobs — list current jobs with job numbers
bg %1 — resume job 1 in background
fg %1 — bring job 1 to foreground
disown %1 — detach job from shell (survives logout)
Job states: Running, Stopped, Done. Recovery:
• Boot from a Live USB.
• Mount root: mount /dev/sda2 /mnt
• Mount boot: mount /dev/sda1 /mnt/boot
• mount --bind /dev /mnt/dev and same for /proc, /sys.
• chroot /mnt
• Reinstall GRUB: grub-install /dev/sda
• Regenerate config: grub-mkconfig -o /boot/grub/grub.cfg
In GRUB menu press e to edit a boot entry; add single or init=/bin/bash for shell.
Persistent: /etc/default/grub holds kernel parameters; GRUB_TIMEOUT, GRUB_CMDLINE_LINUX_DEFAULT.

Question 44 Linux Administration

What is fail2ban and how does it protect services?

Key directories:

/etc — system configuration files
/var — variable data (logs, spools, caches)
/home — user home directories
/usr — user programs and read-only data
/tmp — temporary files (cleared on reboot)
/proc — virtual filesystem for process/kernel info
/dev — device files (block and character devices)

scp — simple secure copy:
scp file.txt user@host:/path/
scp -r dir/ user@host:/path/

rsync — advanced sync with delta transfer:
rsync -avz src/ user@host:/dest/
Key flags: -a archive, -v verbose, -z compress, --delete remove extra files

rsync is preferred because it only transfers changed data, supports resume, and is much faster for large/repeated transfers. fail2ban monitors log files (e.g., /var/log/auth.log, /var/log/nginx/error.log) and bans IPs with too many failed attempts using firewall rules.
Install: apt install fail2ban.
Configure: /etc/fail2ban/jail.local overriding jail.conf:
[sshd]
enabled = true
maxretry = 3
findtime = 600
bantime = 3600
Commands: fail2ban-client status, fail2ban-client status sshd, fail2ban-client unban <ip>.
Default action uses iptables; on modern systems configure with nftables or ufw. A process has its own virtual address space, file descriptors, and signal handlers. A thread (POSIX pthread) is a unit of execution within a process that shares memory, file descriptors, and most resources with sibling threads but has its own stack and registers. Linux implements threads as lightweight tasks sharing the same task_struct group (visible as separate PIDs in /proc/[pid]/task/). ps -eLf shows threads; htop shows them under their process.

Question 45 Linux Administration

How do systemd timers replace cron?

awk is a powerful text-processing language that operates on fields and records.
Examples:
awk '{print $1, $3}' file — print columns 1 and 3
awk -F: '{print $1}' /etc/passwd — set delimiter to colon
awk '$3 > 100 {print $0}' data.txt — conditional filtering
Built-in variables: NR (record number), NF (number of fields), FS (field separator) scp — simple secure copy:
scp file.txt user@host:/path/
scp -r dir/ user@host:/path/

rsync — advanced sync with delta transfer:
rsync -avz src/ user@host:/dest/
Key flags: -a archive, -v verbose, -z compress, --delete remove extra files

rsync is preferred because it only transfers changed data, supports resume, and is much faster for large/repeated transfers. MBR (Master Boot Record): 4 primary partitions, max 2 TiB disk, BIOS boot.
GPT (GUID Partition Table): 128 partitions, 8 ZiB max, required for UEFI, stores backup header + partition table at disk end for redundancy.
Tools: fdisk (MBR & GPT now), gdisk (GPT), parted (both).
Check: fdisk -l /dev/sda shows "Disklabel type: gpt" or "dos".
Convert: gdisk /dev/sda can convert MBR→GPT; always back up first.
UEFI systems require an ESP (EFI System Partition) — FAT32, ~256-512 MB, flagged as esp. A timer unit (*.timer) activates a service at intervals.
Example: /etc/systemd/system/backup.timer
[Unit]
Description=Nightly backup
[Timer]
OnCalendar=*-*-* 02:00:00
Persistent=true
[Install]
WantedBy=timers.target
Pair with backup.service containing ExecStart=/usr/local/bin/backup.sh.
Commands: systemctl list-timers, systemctl start backup.timer, systemctl enable backup.timer.
OnCalendar format: Mon..Sun, *-*-*, hourly, daily.
Advantages over cron: integrated logging, dependencies, missed-run catch-up (Persistent=true), monotonic timers (OnBootSec).

Question 46 Linux Administration

How do you send signals to processes with kill?

AppArmor (default on Ubuntu) is path-based MAC, simpler and more tractable than SELinux's label-based model. Profiles live in /etc/apparmor.d/.
Commands:
aa-status — current state
aa-complain /usr/bin/firefox — log but don't enforce
aa-enforce /usr/bin/firefox — enforce profile
apparmor_parser -r /etc/apparmor.d/usr.bin.firefox — reload profile
Profiles are easier to author: /usr/bin/firefox { /home/*/Downloads/** r, }.
AppArmor is one process confinement tool of several; SELinux also covers kernel-level objects and is more granular. /dev/null is a special file that discards all data written to it and returns EOF when read.
Common uses:
command > /dev/null — suppress stdout
command 2> /dev/null — suppress stderr
command > /dev/null 2>&1 — suppress all output
if command > /dev/null 2>&1; then ... — check if command succeeds silently
Often called the "bit bucket" or "black hole". sysctl reads/writes /proc/sys/:
sysctl -a — list all parameters
sysctl net.ipv4.ip_forward — read one
sysctl -w net.ipv4.ip_forward=1 — set at runtime
Persist by editing /etc/sysctl.d/*.conf and running sysctl --system or sysctl -p /etc/sysctl.conf.
Common tunings: net.ipv4.tcp_tw_reuse=1, vm.swappiness=10, fs.file-max=100000.
Add a runtime sysctl via /proc/sys/ or by writing to /sys/module/.../parameters/ for some modules. kill sends signals to processes by PID.
Common signals:

kill PID or kill -15 PID — SIGTERM (graceful shutdown)
kill -9 PID — SIGKILL (force kill, cannot be caught)
kill -1 PID — SIGHUP (reload configuration)
kill -19 PID — SIGSTOP (pause process)
kill -18 PID — SIGCONT (resume process)

Use kill -l to list all signals.

Question 47 Linux Administration

What is systemd-resolved split DNS?

Split DNS returns different answers per source network.
Configure per-link DNS in /etc/systemd/resolved.conf or via resolvectl dns eth0 10.0.0.1.
Route specific domains to specific servers: /etc/systemd/resolved.conf.d/split.conf:
[Resolve]
DNS=10.0.0.1 1.1.1.1
Domains=~internal — tilde means "and subdomains"
Then systemctl restart systemd-resolved. Queries for *.internal go to 10.0.0.1, others to 1.1.1.1.
Verify: resolvectl query host.internal (shows which server answered). cgroups (control groups) organize processes into hierarchies and apply resource limits — CPU shares, memory caps, I/O weights, PIDs max.
systemd auto-creates a cgroup per service at /sys/fs/cgroup/systemd.slice/<name>.service/.
In a unit file:
[Service]
CPUQuota=50%
MemoryMax=512M
IOWeight=500
TasksMax=100
Inspect: systemd-cgtop (top-like), systemctl status myservice shows cgroup path, cat /proc/<pid>/cgroup.
cgroups v2 (unified hierarchy) is the default on modern distros; enable with systemd.unified_cgroup_hierarchy=1 kernel param. /dev/null is a special file that discards all data written to it and returns EOF when read.
Common uses:
command > /dev/null — suppress stdout
command 2> /dev/null — suppress stderr
command > /dev/null 2>&1 — suppress all output
if command > /dev/null 2>&1; then ... — check if command succeeds silently
Often called the "bit bucket" or "black hole". Edit /etc/ssh/sshd_config, then systemctl restart sshd (or reload).
Recommended:
Protocol 2 (implicit in modern versions)
PermitRootLogin no — disable root SSH
PasswordAuthentication no — keys only
PubkeyAuthentication yes
AllowUsers alice bob or AllowGroups sshusers
Port 2222 — change default port (security through obscurity, but reduces noise)
MaxAuthTries 3
LoginGraceTime 30
ClientAliveInterval 300
ClientAliveCountMax 2 — disconnects idle sessions
AllowTcpForwarding no if not needed
X11Forwarding no
Test config: sshd -t.

Question 48 Linux Administration

How do you manage groups in Linux?

Service units (*.service) define how a long-running daemon is started, stopped, and supervised (ExecStart, Restart=, Type=simple|notify|forking|oneshot).
Target units (*.target) are synchronization points grouping other units — they have no process of their own. Targets express "the system is at state X." Examples: multi-user.target, graphical.target, network-online.target.
Targets list their members via WantedBy= / RequiredBy=. Requires= enforces hard deps (failure aborts), Wants= is best-effort (most common). Group management:
groupadd developers — create group
groupdel developers — delete group
usermod -aG developers john — add user to group
gpasswd -d john developers — remove user from group
groups john — list user's groups

Key files:

/etc/group — group definitions
/etc/gshadow — group passwords

A user has one primary group and can belong to multiple supplementary groups. After seeing kernel logs and the emergency shell:
1. systemctl --failed — list failed units.
2. journalctl -xb -p err — boot logs filtered to errors.
3. Drop to rescue.target: at kernel cmdline, append systemd.unit=rescue.target or boot into single-user mode.
4. From rescue, mount -o remount,rw /, then systemctl default to attempt boot, or fix the failing unit and systemctl daemon-reload.
5. emergency.target is even more minimal: read-only root, no init scripts.
6. Common culprits: broken /etc/fstab, missing initramfs modules, full disk, broken network service blocking dependency. A bridge (virtual switch) connects multiple interfaces at Layer 2.
Create: ip link add br0 type bridge
Add iface: ip link set eth0 master br0
Bring up: ip link set br0 up
Assign IP to bridge: ip addr add 10.0.0.1/24 dev br0
This is the default for VMs (libvirt, VirtualBox) and containers (Docker uses docker0).
Show forwarding database: bridge fdb show
VLAN-aware bridges: ip link add br0 type bridge vlan_filtering 1, then bridge vlan add dev eth0 vid 10.

Question 49 Linux Administration

What is the purpose of the /sys filesystem?

ps shows a snapshot of processes:
ps aux — all processes, detailed
ps -ef — full-format listing
ps -u username — processes by user

top shows a real-time dynamic view:

k — kill a process
M — sort by memory
P — sort by CPU
q — quit

htop is an enhanced interactive alternative. /sys (sysfs) is a virtual filesystem exposing kernel objects (devices, drivers, buses, kernel parameters).
Examples:
/sys/class/net/eth0/ — network interface details
/sys/block/sda/ — block device info
/sys/kernel/debug/ — debug info (mount with -t debugfs)
Writing to certain files changes kernel state: echo 1 > /sys/class/leds/led0/brightness.
Many tools (lsblk, ip) read from /sys instead of calling ioctls. Never edit files unless you know what they do — the kernel offers no undo. TLS (Transport Layer Security) encrypts a TCP stream. Sysadmins care about:
• Issuing certificates with Let's Encrypt via certbot: certbot --nginx -d example.com
• Cert locations: /etc/letsencrypt/live/, /etc/ssl/certs/
• Inspect: openssl s_client -connect example.com:443 -servername example.com
• View cert: openssl x509 -in cert.pem -text -noout
• Generate private keys: openssl genrsa -out key.pem 2048 or openssl genpkey -algorithm ed25519
• Create CSR: openssl req -new -key key.pem -out csr.pem
• Self-signed: openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365
• Test config: openssl s_client -showcerts Edit /etc/ssh/sshd_config, then systemctl restart sshd (or reload).
Recommended:
Protocol 2 (implicit in modern versions)
PermitRootLogin no — disable root SSH
PasswordAuthentication no — keys only
PubkeyAuthentication yes
AllowUsers alice bob or AllowGroups sshusers
Port 2222 — change default port (security through obscurity, but reduces noise)
MaxAuthTries 3
LoginGraceTime 30
ClientAliveInterval 300
ClientAliveCountMax 2 — disconnects idle sessions
AllowTcpForwarding no if not needed
X11Forwarding no
Test config: sshd -t.

Question 50 Linux Administration

What is the purpose of /etc/fstab and what is its syntax?

1. Enable forwarding: sysctl -w net.ipv4.ip_forward=1; persist in /etc/sysctl.d/router.conf.
2. Configure interfaces: assign IPs to each subnet.
3. Add firewall/NAT: with nft:
nft add table ip nat
nft add chain ip nat postrouting { type nat hook postrouting priority 0 \; }
nft add rule ip nat postrouting oifname "eth0" ip saddr 10.0.0.0/24 masquerade
4. On clients, set this host as default gateway.
5. Optionally run dnsmasq for DHCP+DNS and kea for IPv6.
Verify routes: ip route show, traceroute from a client. /etc/fstab lists filesystems to mount at boot.
Columns: device|spec mount-point fs-type options dump pass
Example:
UUID=abc... /home ext4 defaults,noatime 0 2
tmpfs /tmp tmpfs defaults,noexec,nosuid 0 0
• dump: 0=ignore, 1=use dump
• pass: 0=skip fsck, 1=root, 2=other
Test before reboot: mount -a (mount all).
Prefer UUID= over /dev/sdX (stable across boots).
Get UUIDs: blkid, lsblk -f. ufw (Uncomplicated Firewall) is a front-end to nftables on Ubuntu.
Usage:
ufw status
ufw allow 22/tcp
ufw allow from 10.0.0.0/24 to any port 3306
ufw deny 23
ufw default deny incoming
ufw default allow outgoing
ufw enable / ufw disable
ufw delete allow 80
ufw reset — clear all rules
Enable logging: ufw logging on (logs to /var/log/ufw.log).
Rules stored in /etc/ufw/. The initramfs (initial RAM filesystem) is a compressed cpio archive loaded by the kernel before the real root. It contains modules and scripts to mount root, unlock LUKS, assemble RAID, activate LVM.
Rebuild:
Debian/Ubuntu: update-initramfs -u (current kernel) or -c (new).
RHEL: dracut -f or dracut --force /boot/initramfs-$(uname -r).img $(uname -r).
Inspect contents: lsinitramfs /boot/initrd.img-$(uname -r) (Debian) or dracut --list.
Force mkinitcpio rebuild (Arch): mkinitcpio -P.
Build config: /etc/initramfs-tools/initramfs.conf (Debian), /etc/dracut.conf.d/.