CTLA cheat sheet

Filesystem Hierarchy Standard: /etc holds host-specific configuration, /var holds variable data (logs, spools, databases), /usr holds the read-only user hierarchy, /tmp is world-writable and often cleared on boot.

systemd is PID 1 on most distributions; it reads unit files from /etc/systemd/system (highest priority), /run/systemd/system, and /usr/lib/systemd/system, in that override order.

User account facts live in /etc/passwd (world-readable, 7 colon fields), hashed passwords in /etc/shadow (root-only), groups in /etc/group, and password aging policy in /etc/login.defs and /etc/shadow field 3-8.

UID 0 is root; UIDs 1-999 are reserved for system/service accounts on most modern distros; regular users start at 1000 (RHEL and Debian families).

File permission bits: owner/group/other each get r=4, w=2, x=1. The leading digit encodes setuid (4), setgid (2), and sticky (1); a lowercase s in the execute position means the bit is set and execute is also granted.

umask is subtracted from the base mode: files start at 0666 and directories at 0777. A umask of 022 yields files 0644 and directories 0755.

journalctl -u filters by unit, -b shows the current boot, --since/--until filter by time, and -p err limits to priority error and above; persistent storage requires /var/log/journal to exist.

cron: /etc/crontab and files in /etc/cron.d carry a user field; per-user crontabs (crontab -e) do not. Fields are minute, hour, day-of-month, month, day-of-week.

Package managers are family-specific: apt/dpkg with .deb on Debian/Ubuntu, dnf/rpm with .rpm on RHEL/Fedora, zypper on SUSE, pacman on Arch. Query installed files with dpkg -L or rpm -ql.

Exit status 0 means success; any nonzero value means failure. $? holds the last command's status, and a script returns the status of its final command unless exit is called.

set -e exits on any unhandled nonzero command, set -u errors on unset variables, set -o pipefail makes a pipeline fail if any stage fails, and set -x traces commands to stderr.

Quoting rules: double quotes allow variable and command substitution but suppress word splitting and globbing; single quotes suppress everything; $'...' interprets backslash escapes.

Redirection: > truncates, >> appends, 2> sends stderr, &> sends both, 2>&1 duplicates stderr onto stdout's current target, and < reads from a file; order of redirections matters.

Parameter expansion: ${var:-default} substitutes when unset or empty, ${var:=default} assigns, ${var:?msg} errors out, ${var#pattern} strips the shortest prefix, ${var%pattern} strips the shortest suffix.

Pipelines connect stdout of one process to stdin of the next; each stage runs in a subshell, so variable changes inside a pipeline do not persist in the parent shell unless the lastpipe option is set.

find /path -name '*.log' -mtime +7 -exec rm {} ; deletes logs older than 7 days; -delete is faster but only works when no other expression depends on traversal order.

grep -r recurses, -i ignores case, -v inverts, -E enables extended regex, -o prints only matches, and -c counts matching lines; awk '{print $2}' prints the second whitespace-delimited field.

Command substitution uses $(command) or backticks; arithmetic uses $(( expression )) for integers only. Test with [ ] (POSIX) or [[ ]] (bash, supports pattern matching and no word splitting).

IPv4 addresses are 32 bits in dotted-quad notation; a /24 prefix means 24 network bits and 8 host bits, giving 254 usable hosts after reserving network and broadcast addresses.

Private ranges (RFC 1918) are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16; 169.254.0.0/16 is link-local (APIPA) and appears when DHCP fails.

TCP is connection-oriented with a three-way handshake (SYN, SYN-ACK, ACK) and guarantees ordered delivery; UDP is connectionless with no retransmission, used by DNS, DHCP, and streaming.

Well-known ports: SSH 22, DNS 53, HTTP 80, HTTPS 443, SMTP 25, NTP 123/udp, DHCP server 67 and client 68, and SNMP 161.

ip addr shows interfaces and addresses, ip route shows the routing table, ip link manages link state; ss -tulpn lists listening TCP/UDP sockets with owning processes (replaces netstat).

Name resolution order is governed by /etc/nsswitch.conf; /etc/resolv.conf lists nameservers and search domains; /etc/hosts is checked before DNS by default on most systems.

DHCP assigns addresses via DISCOVER, OFFER, REQUEST, ACK; the lease and renewal times are controlled by the server, and the client requests renewal at 50 percent of lease time.

ping uses ICMP echo, traceroute maps hops by incrementing TTL (Linux uses UDP by default, -I forces ICMP), and dig +short or host resolve names and show record types A, AAAA, MX, CNAME, and PTR.

Least privilege: run services under dedicated non-root accounts, grant sudo per command in /etc/sudoers via visudo, and never grant blanket ALL=(ALL) NOPASSWD to interactive users.

SSH hardening: disable root login (PermitRootLogin no), disable password auth (PasswordAuthentication no) once keys work, restrict users with AllowUsers, and set a nondefault port only as defense in depth, not as a control.

SELinux modes are enforcing, permissive, and disabled; contexts are viewed with ls -Z and changed persistently with semanage fcontext -a -t, followed by restorecon. Never disable SELinux to fix a denial; read audit.log instead.

AppArmor profiles live in /etc/apparmor.d and are enforced per program path; aa-status reports loaded and complaining profiles.

Firewalls: firewalld uses zones and services (firewall-cmd --add-service=ssh --permanent then --reload); nftables/iptables rules are ordered and the first match wins; default policy should be DROP on input.

File integrity and audit: AIDE or Tripwire hash critical files; auditd rules (auditctl -w /etc/passwd -p wa) log writes and attribute changes to /var/log/audit/audit.log.

Password hashing should use SHA-512 or yescrypt in /etc/shadow; chage -l shows aging, and pam_faillock or pam_tally2 lock accounts after repeated failures.

CVE severity uses CVSS base scores 0.1-3.9 low, 4.0-6.9 medium, 7.0-8.9 high, 9.0-10.0 critical; patch management should prioritize internet-facing criticals first.

Partition tables: MBR supports 4 primary partitions and disks up to 2 TiB; GPT supports 128 partitions by default, uses a backup header, and is required above 2 TiB.

LVM layers physical volumes (pvcreate) into a volume group (vgcreate) that is carved into logical volumes (lvcreate); lvextend grows an LV, then the filesystem must be grown separately (resize2fs or xfs_growfs).

XFS cannot shrink; ext4 can grow and shrink offline (resize2fs after e2fsck). XFS growth is online only.

Mount configuration lives in /etc/fstab with fields device, mountpoint, type, options, dump, pass; use UUID= rather than /dev/sdX because device names are not stable. systemd mounts are generated from fstab.

df reports filesystem-level usage, du reports directory consumption; a full filesystem with df showing space but no free inodes is diagnosed with df -i.

RAID levels: 0 stripes with no redundancy, 1 mirrors, 5 stripes with single parity (survives one disk), 6 dual parity, 10 mirrors plus stripes. mdadm --detail /dev/md0 shows state and rebuild progress.

Backup types: full copies everything, incremental copies changes since the last backup of any type, differential copies changes since the last full. Restoring an incremental chain requires the full plus every incremental in order.

rsync -a preserves permissions, timestamps, and symlinks; --delete removes files absent from the source, and trailing slashes matter: src/ copies contents, src copies the directory itself.

Swap is created with mkswap and enabled with swapon; swappiness (/proc/sys/vm/swappiness) tunes how aggressively the kernel pages out anonymous memory.

systemctl start/stop/restart/reload/enable/disable controls units; enable creates the symlink that starts the unit at boot, start only affects the current runtime. systemctl status shows state and recent logs.

Unit types include .service, .socket, .timer, .mount, .target, and .path. Timers replace cron for system tasks and are inspected with systemctl list-timers.

A unit file's [Unit] section holds Description, After, and Requires; [Service] holds ExecStart, Restart, User, and Type; [Install] holds WantedBy, which determines enablement.

Process states in ps: R running, S interruptible sleep, D uninterruptible sleep (usually I/O wait), Z zombie, T stopped. A zombie has exited but its parent has not reaped it.

Signals: SIGTERM (15) requests graceful shutdown, SIGKILL (9) cannot be caught and should be a last resort, SIGHUP (1) often triggers config reload, SIGSTOP/SIGCONT pause and resume.

nice values range -20 (highest priority) to 19 (lowest); only root can set negative values. renice changes a running process, and ionice tunes I/O priority.

Foreground/background control: Ctrl-Z suspends, bg resumes in background, fg brings to foreground, jobs lists them, and nohup or a systemd unit keeps work alive after logout.

cgroups (v2 unified hierarchy under /sys/fs/cgroup) limit CPU, memory, and I/O per unit; systemd exposes them via MemoryMax, CPUQuota, and TasksMax in the [Service] section.

Type 1 hypervisors run on bare metal (KVM, Xen, ESXi); Type 2 run on a host OS (VirtualBox, VMware Workstation). KVM is a Linux kernel module using hardware virtualization extensions (VT-x/AMD-V).

Full virtualization emulates hardware and needs no guest changes; paravirtualization exposes a hypervisor-aware interface (virtio drivers) for higher performance; containers share the host kernel and are not VMs.

Cloud service models: IaaS provides virtual machines and storage, PaaS provides a managed runtime, SaaS provides the application. Responsibility for patching the guest OS shifts to the customer in IaaS.

Instance lifecycle states include pending, running, stopped, and terminated; stopping usually preserves attached storage while terminating releases ephemeral storage. Elastic IPs and static addresses persist independently of instances.

Security groups are stateful instance-level firewalls that allow rules only; network ACLs are stateless subnet-level with allow and deny rules and are evaluated in numbered order.

Snapshots capture a point-in-time block device state; they are incremental and should be taken after quiescing or flushing the filesystem. Images are templates used to launch new instances.

Cloud identity uses roles and temporary credentials rather than long-lived access keys; least-privilege policies attach to users, groups, or roles, and MFA should guard privileged accounts.

virt-manager, virsh list --all, and virsh dominfo manage libvirt guests; qemu-img info and qemu-img convert inspect and convert disk images between qcow2 and raw formats.

Work a defined order: identify the symptom, establish a timeline, check recent changes, form one hypothesis at a time, test it, then document. Change one variable per test so the cause is attributable.

Layer-based network diagnosis: ip link (physical), ip addr (L3 address), ip route (gateway), ping loopback then gateway then external IP, then DNS resolution, then application port with ss or nc -zv.

Log locations: /var/log/messages or /var/log/syslog for general system messages, /var/log/secure or /var/log/auth.log for authentication, dmesg for kernel and hardware events, journalctl for systemd-managed services.

Boot failures: a system that drops to emergency mode usually has an fstab entry that cannot mount. Boot with rd.break or emergency, fix /etc/fstab, and regenerate the initramfs if needed.

Disk full or inode exhaustion causes service failures; check df -h and df -i, find large files with find / -xdev -size +1G, and check for deleted-but-open files with lsof +L1.

A service failing to start should be diagnosed with systemctl status, then journalctl -u -b, then running ExecStart manually as the service user to surface permission and path errors.

Operational hygiene: take a configuration backup before changes, use change windows and rollback plans, verify with a test after each change, and record the outcome in the ticket.

Capacity and health checks: uptime for load average (compare to CPU count), free -m for memory and cache, vmstat 1 for run queue and swap, and iostat or sar for disk latency trends.