CTLA: Linux System Administration

The Linux System Administration domain tests whether you can operate a running host without a GUI: reading and changing filesystem state, managing accounts and permissions, and knowing which file is authoritative for a given setting. CTLA items here are scenario-shaped - a permission surprise, a user who cannot log in - so knowing where state lives matters as much as knowing the command.

Where state lives

• /etc holds host configuration; persistent edits belong here.
• /var holds variable data: /var/log, /var/lib, /var/spool.
• /usr is read-only userland; /run is tmpfs runtime state (sockets, PID files).
• /proc and /sys are kernel interfaces, not editable configuration.
• /tmp is world-writable with the sticky bit set.

Permissions, umask, and special bits

Octal 4/2/1 for r/w/x across user, group, other. Base values are 666 for files and 777 for directories, and the umask is removed from those: umask 022 yields 644/755, umask 027 yields 640/750. A umask can only remove bits, never add them.

Special bits: setuid (4) on an executable runs it with the file owner's UID; setgid (2) on a directory makes new entries inherit that directory's group; sticky (1) on a world-writable directory restricts deletion to the file's owner - the 1777 on /tmp.

Accounts

useradd -m -s /bin/bash; usermod -aG group appends supplementary groups while usermod -G alone replaces the entire set; passwd -l locks an account; chage -l shows aging policy. Supplementary group membership is evaluated at login, so changes need a fresh session.

Worked example

Three engineers need a shared directory /srv/project, group appteam, hidden from others, new files group-writable.

1. chgrp appteam /srv/project - fix the owning group.
2. chmod 2770 - setgid forces group inheritance; the trailing 0 blocks other.
3. Set umask 007 for that group in /etc/profile.d/shared.sh so new files land 660, not 640.

Reasoning: 2770 solves ownership and confidentiality, umask solves the write bit. Files created earlier still need chmod g+w. Verify with ls -ld and stat.

Traps that cost marks

• Confusing setgid on a directory (inheritance) with setgid on a file (effective GID at exec).
• Believing umask can grant permissions.
• Hand-editing /etc/passwd (race-prone) instead of using vipw.
• Expecting /etc/skel to change existing home directories.
• Forgetting that a deleted-but-open file still consumes space until the process closes it.