CS AO key terms

A numbered operating state in traditional SysV init that defines which services are started, such as single-user mode or full multi-user networking. Modern systems often emulate these targets for compatibility.

A named grouping of units that represents a boot state or synchronization point, replacing runlevels. Targets pull in the services and mounts needed for a purpose such as graphical login or rescue mode.

A systemd configuration file describing how to start, stop, and supervise a background daemon. It declares dependencies, restart behavior, and the command used to launch the process.

A long-running background process that provides a service without an attached terminal. Administrators start, stop, and inspect daemons through the service manager or init scripts.

The first process the kernel starts, responsible for adopting orphaned processes and launching the rest of user space. On most modern Linux systems this is systemd or another init replacement.

Loadable code that adds driver or subsystem functionality to a running kernel without rebooting. Administrators load, unload, and blacklist modules to control hardware and feature support.

A command that loads or removes kernel modules while resolving dependencies and configuration files. It is preferred over insmod because it handles module stacking and aliases automatically.

A temporary in-memory filesystem loaded at boot that provides the drivers and tools needed to mount the real root filesystem. It commonly contains storage and encryption modules required before switching root.

Software such as GRUB that loads the kernel and passes boot parameters and the initial ramdisk location. It also offers menu entries for recovery and alternate kernels.

A tool that installs, upgrades, and removes software while tracking dependencies and file ownership. Examples include apt, dnf, and zypper, each with its own metadata and repository model.

A curated collection of packages and metadata that a package manager queries for installs and updates. Administrators configure trusted repositories and may pin or prioritize them.

A cryptographic signature on package metadata or files that proves origin and integrity. Package managers verify signatures against imported public keys before installing software.

The gradual divergence of a system's actual settings from its documented or desired baseline. It causes inconsistent behavior and is countered by automation, version control, and regular audits.

A property of an operation that produces the same result whether run once or many times. Configuration management tools rely on it so repeated runs converge systems without unwanted side effects.

An approved reference configuration of settings, packages, and permissions used to compare and restore systems. Baselines support audits, drift detection, and repeatable builds.

A numeric identifier the kernel uses to determine which user owns a process and its files. Usernames are mapped to UIDs, and special ranges are reserved for system accounts.

A numeric identifier for a group, used alongside UIDs to grant access to shared resources. A user has one primary GID and may belong to several supplementary groups.

The configuration that defines which users or groups may run which commands as other accounts, and under what conditions. It is edited with visudo to prevent syntax errors that could lock out administration.

Pluggable Authentication Modules, a framework that stacks authentication, account, session, and password checks for services. Administrators tune PAM stacks to enforce password quality, lockouts, and MFA.

A policy that temporarily disables authentication after repeated failed login attempts. It slows brute-force attacks but must be tuned to avoid locking out legitimate users.

Granting each account only the access needed for its tasks and no more. It limits the blast radius of compromise and mistakes, and is enforced through roles, groups, and scoped sudo rules.

Role-Based Access Control assigns permissions to roles rather than individuals, and users receive roles. It simplifies auditing and revocation when staff change duties.

An Access Control List stores per-file permissions for specific users or groups beyond the classic owner/group/other bits. Tools such as getfacl and setfacl inspect and modify them.

A mask that removes permission bits from newly created files and directories. Administrators set it to enforce default privacy, such as preventing group or world write access.

A filesystem structure holding metadata for a file, including ownership, permissions, timestamps, and data block pointers, but not the filename. Exhausting inodes prevents new files even when space remains.

A directory entry that points to the same inode as another name for a file. Deleting one name leaves data accessible until the last link is removed.

A special file containing a path to another file or directory. It can cross filesystems and dangle if the target is removed, unlike a hard link.

Flags applied when attaching a filesystem that control behavior such as read-only access, no execution, or no setuid binaries. They are a key hardening and troubleshooting lever.

A consistency scan and repair of filesystem metadata, typically run by fsck on unmounted volumes. It resolves corruption after crashes or hardware faults and may require manual intervention.

Logical Volume Manager pools physical disks into volume groups and carves flexible logical volumes from them. It allows resizing and snapshots without repartitioning.

A point-in-time copy of a volume or dataset used for backups and rollback. Snapshots are typically space-efficient and depend on the underlying storage technology.

A bit pattern that separates the network portion of an IP address from the host portion. It determines which destinations are local and which must be reached through a gateway.

Classless Inter-Domain Routing notation expresses a network prefix as an address followed by a slash and prefix length, such as /24. It sizes networks and summarizes routes compactly.

The router address a host uses when no more specific route matches a destination. Missing or wrong gateways are a common cause of partial connectivity.

The kernel's list of destination networks, next hops, interfaces, and metrics used to forward packets. Administrators inspect and edit it to diagnose reachability problems.

The process of translating hostnames into IP addresses using resolvers and name servers. Failures here often look like application outages, so checking resolver configuration is a standard step.

A time-limited assignment of an IP address and options from a DHCP server to a client. Clients renew before expiry; expired or conflicting leases cause address loss or duplication.

A policy entry that permits, denies, or logs traffic based on addresses, ports, protocols, and state. Rules are ordered, so placement and default policies determine effective behavior.

A mandatory access control system that confines processes by type and labels rather than by user identity alone. Modes include enforcing and permissive, and denials are logged for troubleshooting.

A tamper-evident record of security-relevant events such as logins, privilege changes, and file access. It supports investigations and compliance evidence and must be protected and retained.

The disciplined process of identifying, testing, and applying software updates to close vulnerabilities. It balances risk of unpatched flaws against regression risk from change.

A monitoring rule that fires when a metric crosses a defined value for a duration. Good thresholds avoid noise while catching degradation before users notice.

Probing a service with scripted transactions from outside to verify availability and latency. It detects failures that host metrics miss because it tests the user path end to end.

Automatically archiving, compressing, and deleting old log files to control disk use. Misconfiguration can fill storage or destroy evidence needed for investigation.

The scheduled period during which backups run, chosen to limit impact on production. Window length constrains backup type, throughput, and acceptable recovery points.

Recovery Point Objective is the maximum acceptable amount of data loss measured in time. It drives backup frequency and replication design.

Recovery Time Objective is the target duration to restore a service after disruption. It shapes redundancy, runbooks, and restore testing.

A planned exercise that recovers data or services from backups to prove they work. Untested backups frequently fail, so regular tests validate procedures and timing.

A structured investigation that identifies the underlying reason an incident occurred and the conditions that allowed it. It produces corrective actions rather than blame.

A documented, repeatable procedure for a routine task or known incident. Clear runbooks reduce recovery time and make on-call response consistent.

A controlled process for reviewing, approving, scheduling, and documenting modifications to production systems. It reduces outages by ensuring rollback plans and stakeholder awareness.

The defined sequence of people and teams to contact as an incident worsens or exceeds a time limit. It prevents stalls when the first responder cannot resolve the issue.