Operating System and Server Operations
Domain 2 covers installing and hardening a server, managing accounts and permissions, and reading performance data. Exam items mix command-level knowledge (which command shows what) with judgement questions (is this account handled correctly, is that resource actually exhausted).
Installation and boot
Plan partitions so that log and data growth cannot fill the root filesystem: separate /, /var, /home and swap. Boot sequence: firmware POST, bootloader, kernel plus initramfs, then init/systemd targets. After install, set hostname, time zone and NTP, apply updates, remove unused services, disable direct root login over SSH, and record the baseline configuration.
Users and permissions
Accounts are identified by UID and group by GID; /etc/passwd holds account data, /etc/shadow the password hashes. Permission bits rwx read as 4/2/1 for owner, group, other. On a directory, r lists names, w creates or deletes entries, and x is required to traverse into it. umask clears bits from the default: new directories start at 777, new files at 666, then the umask is removed bitwise. Use sudo for delegated privilege rather than sharing root. On departure, disable and lock an account, then archive its files - do not delete the UID, because file ownership and logs refer to it.
Monitoring
Use top or vmstat for CPU and load, free for memory and swap, iostat for disk utilisation and await, df for capacity, df -i for inode exhaustion, sar for history, and log rotation checks. Compare load average with the number of CPU cores: load 8 on a 4-core host means heavy queueing, not 800% CPU.
Worked example
Set umask 027. Directories: 777 AND NOT 027 = 750. Files: 666 AND NOT 027 = 640. Reasoning: 027 is 000 010 111 in binary, so the complement clears group-write and all other bits; the file result loses the execute bits it never had, giving 640, not 650.
Traps
- Believing file ownership controls deletion: deleting a file requires write permission on its directory.
- Applying chmod 777 as a fix - it removes the diagnosis and creates a security finding.
- Treating swap as extra memory; heavy swapping shows as high iowait and latency.
- Forgetting that root bypasses permission checks, so a test as root proves nothing.