Search
30 results for “linux”
Search results
Linux Filesystem Hierarchy & Permissions
Why /etc, /var, /usr, and /opt exist as separate, standardized directories under the Filesystem Hierarchy Standard, and how chmod's octal mode and umask actually decide a new file's permissions.
Linux Fundamentals
The core command-line building blocks - navigation, permissions, processes, networking, and services - that every other Linux topic on this site (filesystem hierarchy, storage, users, networking) assumes you already have.
Linux Logging & Monitoring with journald
Why journald's default "auto" storage mode can quietly discard logs across a reboot on a fresh system, and how journalctl's unit and priority filters actually narrow down a live incident.
Linux Networking
How ip and ss replaced ifconfig and netstat as the modern tools for interfaces and sockets, what TCP socket states like LISTEN and TIME-WAIT actually mean, and how nftables organizes firewall rules into tables and chains.
Linux Process Management & systemd
Why SIGKILL can't be caught or ignored the way SIGTERM can, how systemd's Type= actually decides when a service counts as "started," and the difference between the ps command's BSD and UNIX option styles.
Linux Storage & LVM
How physical volumes, volume groups, and logical volumes let LVM pool multiple disks and resize storage without repartitioning, and what mount and /etc/fstab actually do to attach a filesystem to the directory tree.
Linux Users, Groups & sudo
How /etc/passwd and /etc/shadow split identity from password storage, why a UID (not a username) is what the kernel actually checks, and how a sudoers rule's who/where/as-whom/what structure grants privileges.
Linux Engineer Roadmap
From the filesystem hierarchy and permissions through users, networking, process management, storage, and logging, the core path for a working Linux engineer, linked into Cloud Tech by Victor topic references.
Linux Security & Hardening: Permissions, SSH, Firewalls, and System Protection
How Linux Protects Itself and How Administrators Make It Safer.
Linux Processes & Networking: Monitoring, Signals, Ports, and Connectivity
How Linux Runs, Communicates, and Stays Alive.
Linux Storage & Filesystems: Disks, Partitions, Mounts, and Disk Usage
How Linux Stores Data, Mounts Disks, and Survives Failures.
Linux Beginner Labs: Foundations (Understand Linux, Not Just Commands)
This lab helps you understand how Linux works internally, not just type commands. By the end of these labs, Linux will feel logical, not intimidating. Before You Start The Lab (Very Important). What You Need You can use any Linux environment : Ubuntu Desktop / Server Linux VM Cloud VM WSL (Windows…
Linux Foundations (Beginner): How Linux Really Works - Not Just Commands
Most beginners learn Linux backwards.
Linux Core Operations: Full Hands‑On Practical Labs for Users, Permissions, sudo, Packages & Services
Linux Core Operations: Full Practical Labs (Beginner → Intermediate)
Why does Linux split user information across /etc/passwd and /etc/shadow instead of keeping everything, including the password hash, in one file?
/etc/passwd has to be world-readable, ordinary tools and commands need to map UIDs to usernames and look up home directories or login shells for every user on the system. If password hashes lived there too, every local user could copy them out and run an offline cracking attempt. /etc/shadow holds the actual encrypted password (and related aging data) and is readable only by root, while /etc/passwd keeps a placeholder character (commonly `x`) in the password field, preserving the UID-lookup functionality everything else depends on without exposing anything crackable.
Mastering Nano, Vim & NeoVim on Linux: From Beginner Editing to Pro-Level Terminal Workflows
Nano vs Vim vs Neovim: Which Linux Text Editor Should Engineers Actually Use?
Mastering Linux Core Operations: Users, Permissions, sudo, Packages & Services (Beginner → Intermediate)
Linux remains one of the most essential skills for cloud engineers, DevOps practitioners, and system administrators. Every automation pipeline, container platform, and cloud workload eventually touches Linux. Instead of memorizing commands, the most effective way to learn is through structured, han…
What is the Filesystem Hierarchy Standard, and why does it matter that /etc, /var, and /usr are separate directories rather than one flat structure?
The FHS is a specification for where files belong on a Unix-like system, so that any compliant distribution places configuration, variable data, and installed software in predictable locations regardless of vendor. Separating them matters operationally: /etc holds host-specific configuration that should be backed up and version-controlled, /var holds logs, caches, and other data that grows and changes constantly and often lives on its own disk or partition for capacity/IO reasons, and /usr holds installed programs and libraries that are typically read-only at runtime and can be shared or mounted the same way across many machines. Collapsing them into one flat structure would make it much harder to back up only what matters, mount storage with the right characteristics per use case, or reason about what's safe to wipe and reinstall.
What do the three digits in a chmod octal mode like 644 or 755 actually mean, and what does a leading fourth digit add?
Each of the three digits is a sum of read (4), write (2), and execute (1), in order for the owner, the group, and everyone else; 644 means the owner gets read+write (4+2), while group and others get read-only (4). 755 means the owner gets read+write+execute (4+2+1), and group/others get read+execute (4+1), the common mode for an executable or a directory that others need to traverse. An optional leading fourth digit sets setuid (4), setgid (2), and the sticky bit (1); setuid/setgid make a program run with its owner's or group's privileges rather than the caller's, and the sticky bit on a directory (classically 1777 on /tmp) restricts file deletion to each file's own owner even though the directory itself is world-writable.
A process creates a file requesting mode 0666, but the file ends up with permissions 0644. What decided that, and would the outcome change if the parent directory had a default ACL?
The process's umask is what changed the requested mode: umask 022 turns off the write bit for group and others from any requested mode, so 0666 (rw-rw-rw-) becomes 0666 & ~022 = 0644 (rw-r--r--). The umask is applied by the kernel at file/directory creation time, not by the application deciding to be conservative. If the parent directory has a default ACL set, that changes the outcome: default ACL inheritance takes precedence over the umask entirely, so the new file's permissions would instead be derived from the ACL, not from applying umask to the requested mode.
What is the difference between killing a process with SIGTERM and SIGKILL?
`kill <pid>` sends SIGTERM by default, a request asking the process to shut down, which well-behaved programs catch to close files, finish in-flight work, and exit cleanly. `kill -9 <pid>` sends SIGKILL, which the kernel delivers directly and a process cannot catch, ignore, or clean up after; it is terminated immediately, mid-instruction if necessary. SIGKILL is a last resort for a genuinely hung process; reaching for it by default risks corrupted files or orphaned resources that a graceful SIGTERM shutdown would have avoided.
Why does `ping` succeeding not guarantee an application on that host is reachable?
ping tests only ICMP echo reachability at the network layer; it confirms a host responds to the network, nothing about any specific service running on it. An application listening on a TCP port can be down, crashed, or blocked by a firewall rule that specifically targets that port while still allowing ICMP through, or conversely ICMP itself can be blocked while the actual service is reachable. Confirming an application is actually up requires testing the application layer directly, e.g. `curl` against its port or `ss -tulpn` to confirm something is listening at all.
What does `systemctl enable` actually do, and how is it different from `systemctl start`?
`systemctl start <service>` runs the service right now, in the current boot session only; it will not come back after a reboot. `systemctl enable <service>` creates the symlinks systemd uses to decide what to launch automatically during the boot sequence, so the service starts on every future boot, but does not start it immediately. The two are independent and commonly used together (`systemctl enable --now <service>`) precisely because neither one implies the other.
What is the difference between journald's "volatile", "persistent", and "auto" storage modes, and which one is the default?
"Volatile" keeps the journal only in `/run/log/journal`, which is memory-backed and wiped on every reboot, nothing survives a restart. "Persistent" writes to `/var/log/journal` on disk, so entries survive reboots (falling back to volatile only during very early boot or if the disk is unavailable). "Auto" is the actual default, and it behaves like "persistent" only if `/var/log/journal` already exists, otherwise it behaves like "volatile", so whether logs survive a reboot on a given system depends entirely on whether that directory happens to have been created, not on any setting an administrator consciously chose.
What does journalctl -u myservice actually show you, beyond just log lines the service itself printed?
`-u`/`--unit=` expands into a filter that captures more than the service's own stdout/stderr, it includes messages logged about the unit by systemd itself (start, stop, failure notifications) and associated coredump information if the process crashed, correlated by the unit's identity rather than by manually grepping a shared log file for its name. This is more reliable than text-searching a combined log, since it's scoped by the actual unit metadata the journal records, not by whatever string happens to appear in a log line.
During a live incident, what does journalctl -f -u myservice -p err do, and why combine those specific options?
`-f` follows the journal in real time, printing new entries as they're appended, `-u myservice` scopes that stream to just the one unit under investigation, and `-p err` filters to only entries at the "err" priority or more severe (more important), suppressing informational noise. Combined, this gives a live, scoped, severity-filtered view of exactly one service's serious problems as they happen, rather than watching an unfiltered firehose of every unit's routine log output and trying to manually spot the relevant failure.
What is the difference between ss and the older netstat command, and why would you reach for ss first?
Both report socket/connection information, but ss reads directly from kernel data structures and can display considerably more TCP and socket state detail than netstat, including fine-grained state groupings like every "connected" state (everything except listening and closed) or every "synchronized" state, which makes targeted filtering much easier. netstat has been effectively superseded across current Linux distributions, and ss is the tool actively maintained as part of the iproute2 suite alongside ip, which is why it is the modern default for socket inspection rather than a mere alternative.
A socket shows up in the LISTEN state versus ESTABLISHED. What is actually different about what that socket is doing?
LISTEN means a server-side socket is bound to a port and passively waiting to accept incoming connection requests, it isn't attached to any specific remote peer yet. ESTABLISHED means a full connection has completed its handshake and is actively associated with a specific remote address and port, data can flow in both directions. Seeing a service you expect to be running not show a LISTEN socket on its expected port is usually the very first, most direct signal that the service isn't actually up or isn't bound where you think it is.
How does nftables organize firewall rules, and what actually changed compared to iptables?
nftables organizes rules into tables (containers with no inherent semantics of their own) which hold chains, and chains hold the actual rules; a chain becomes active by being attached to a kernel hook such as input, output, forward, prerouting, or postrouting, which is the point in packet processing where its rules actually get evaluated. The structural change from iptables is consolidation: instead of separate tools for IPv4, IPv6, ARP, and bridge filtering (iptables, ip6tables, arptables, ebtables), nftables provides one framework and one command, `nft`, spanning multiple address families (`ip`, `ip6`, `inet`, `arp`, `bridge`), so a ruleset no longer has to be duplicated per protocol family the way it historically did.
Why does sending SIGKILL to a stuck process work when SIGTERM doesn't, and what does that cost you?
SIGTERM asks a process to terminate but can be caught by a signal handler, letting the process run its own cleanup logic (closing files, flushing buffers, releasing locks) before actually exiting, or in a broken process, being caught and never acted on at all. SIGKILL cannot be caught, blocked, or ignored under any circumstances, the kernel terminates the process directly, which is why it works on a process SIGTERM couldn't reach. The cost is that none of that cleanup logic runs, a database connection isn't closed cleanly, a temp file isn't removed, a lock isn't released, so SIGKILL is a last resort after SIGTERM has been given a real chance to work, not a default first move.