LCA ICT Specialism cheat sheet

Filesystem hierarchy: /etc holds host-specific configuration, /var holds variable data such as logs and spools, /usr holds read-only user data, /tmp is world-writable and cleared on reboot, /home holds user home directories.

File type is encoded in the first character of ls -l output: '-' regular file, 'd' directory, 'l' symlink, 'c' character device, 'b' block device, 's' socket, 'p' named pipe (FIFO).

Redirection operators: > truncates and writes stdout, >> appends stdout, 2> redirects stderr, 2>&1 merges stderr into stdout, < redirects stdin, << delimits a here-document, <<< supplies a here-string.

Pipelines connect stdout of one command to stdin of the next; $? holds the exit status of the last command (0 = success), and $$ is the PID of the current shell.

grep options: -i case-insensitive, -r recursive, -n line numbers, -v invert match, -E extended regex (egrep), -c count of matching lines, -l list only filenames.

find path test action: -name, -type f|d|l, -mtime n, -size +N, -perm mode, -user name; -exec cmd {} ; runs per file, -exec cmd {} + batches arguments, -delete removes matches.

sed 's/old/new/g' replaces all occurrences per line; awk '{print $1}' prints the first whitespace-separated field; cut -d: -f1 sets the delimiter and selects fields.

tar -czvf archive.tgz dir creates a gzip-compressed archive; tar -xzvf extracts it; options are c create, x extract, t list, z gzip, j bzip2, f file, v verbose.

chmod numeric mode: 4 read, 2 write, 1 execute, summed per owner/group/other, so 750 = rwxr-x---; symbolic form u+x,g-w,o=r modifies individual classes.

Process states in ps output: R running/runnable, S interruptible sleep, D uninterruptible sleep (usually I/O wait), T stopped, Z zombie (exited but not reaped by parent).

Signals: SIGHUP (1) hangup, SIGINT (2) keyboard interrupt, SIGKILL (9) cannot be caught or ignored, SIGTERM (15) default polite termination, SIGSTOP (19) and SIGCONT (18) suspend/resume.

kill sends a signal to a PID; kill -9 forces termination; pkill and killall select by name; kill -l lists signal numbers and names.

nice values range from -20 (highest priority) to 19 (lowest); renice changes a running process, nice starts one; only root may assign negative values.

systemd units: systemctl start|stop|restart|status|enable|disable name.service; enable creates the symlink for boot start; systemctl daemon-reload reloads unit files after edits.

journalctl -u unit filters by unit, -f follows, -b shows the current boot, --since and --until filter by time; persistent logs require Storage=persistent in journald.conf.

Load average (uptime, /proc/loadavg) counts runnable and uninterruptible tasks averaged over 1, 5, and 15 minutes; compare against CPU count, not a fixed threshold.

top and htop sort by CPU or memory interactively; free -h reports memory; vmstat 1 samples processes, memory, paging, and CPU once per second.

IPv4 private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; loopback is 127.0.0.0/8; link-local is 169.254.0.0/16 and indicates a failed DHCP lease.

A /24 mask (255.255.255.0) leaves 8 host bits, so 254 usable hosts; usable hosts = 2^(32-prefix) - 2 for IPv4 subnets.

ip addr show displays interfaces and addresses; ip route show displays the routing table; ip link set eth0 up enables an interface; these replace legacy ifconfig and route.

DNS resolution order is controlled by /etc/nsswitch.conf (hosts: files dns); /etc/hosts is consulted before DNS when files precedes dns; /etc/resolv.conf lists nameservers.

ss -tuln lists listening TCP and UDP sockets with numeric ports; ss -tanp shows established connections with owning processes; netstat -tulnp is the legacy equivalent.

TCP is connection-oriented with a three-way handshake (SYN, SYN-ACK, ACK); UDP is connectionless; common ports: 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 3306 MySQL.

ping uses ICMP echo; traceroute/tracepath maps the path with increasing TTL; dig and nslookup query DNS; tcpdump -i iface port 80 captures traffic for analysis.

DHCP uses UDP ports 67 (server) and 68 (client); DORA sequence is Discover, Offer, Request, Acknowledge; a static address must lie within the subnet and outside the DHCP pool.

Partition tables: MBR supports up to 4 primary partitions and 2 TiB disks; GPT supports 128 partitions by default and disks larger than 2 TiB; tools are fdisk (MBR) and gdisk/parted (GPT).

Mount workflow: create filesystem with mkfs.ext4 or mkfs.xfs on the device, mount it, then add a UUID entry to /etc/fstab; verify with mount -a before rebooting.

fstab fields are device, mountpoint, filesystem type, options, dump, pass; options include defaults, noatime, ro, and nofail to avoid boot failure if the device is absent.

df -h reports filesystem usage; du -sh dir reports directory size; inode exhaustion (df -i at 100%) prevents new files even when free blocks remain.

Permissions: r=4, w=2, x=1; directories require x to traverse and r to list; files require r to read, w to modify, x to execute.

Special bits: setuid (4000) runs as file owner, setgid (2000) on a directory makes new files inherit the group, sticky (1000) on a directory lets only owners delete their files (e.g., /tmp).

umask masks permissions from the default 666 for files and 777 for directories; umask 022 yields 644 files and 755 directories.

LVM layers physical volumes (PV) into a volume group (VG) and carves logical volumes (LV); lvextend plus resize2fs or xfs_growfs grows a filesystem online.

Swap is created with mkswap on a partition or file and enabled with swapon; swapon --show lists active swap; /proc/swaps reports usage.

User account files: /etc/passwd stores user, UID, GID, home, and shell; /etc/shadow stores password hashes readable only by root; /etc/group stores group membership.

UID 0 is root; system accounts typically use UIDs below 1000; useradd creates an account, usermod modifies it, userdel -r removes it with the home directory.

sudo grants command-level privilege escalation per /etc/sudoers; visudo edits the file safely; entries follow user host=(runas) command format.

SSH hardening: disable root login (PermitRootLogin no), prefer key authentication (PasswordAuthentication no), restrict users with AllowUsers, and keep the host key private.

File permission auditing: find / -perm -4000 -type f locates setuid binaries; find / -perm -0002 lists world-writable files; both are common privilege-escalation vectors.

SELinux modes are enforcing, permissive, and disabled (getenforce, setenforce); contexts are viewed with ls -Z and restored with restorecon; AppArmor profiles are managed with aa-status.

Firewalls: firewalld uses zones and firewall-cmd --add-service=ssh --permanent followed by --reload; nftables/iptables rules are ordered and the first match wins.

Password policy lives in /etc/login.defs (PASS_MAX_DAYS, PASS_MIN_LEN) and PAM modules such as pam_pwquality; chage -l user shows aging information.

Least privilege: grant only required permissions, avoid chmod 777, separate service accounts from login accounts, and rotate credentials and keys on a schedule.

A script begins with a shebang such as #!/bin/bash; the interpreter path must be absolute; scripts need execute permission (chmod +x) or must be invoked via bash script.sh.

Exit codes: 0 means success and any nonzero value means failure; scripts should end with exit N and callers should test $? or use set -e to abort on error.

set -euo pipefail makes scripts fail on errors, undefined variables, and pipeline failures; quoting variables as "$var" prevents word splitting and globbing.

Positional parameters: $0 script name, $1-$9 arguments, $# count, $@ all arguments as separate words, $* all arguments as one word; shift moves the argument list left.

Test operators: -f file exists, -d directory, -e path exists, -z string empty, -n string nonempty, -eq/-ne/-lt/-gt numeric, = and != string; use [[ ]] in bash for safer tests.

Loops: for item in list; do ...; done; while read -r line; do ...; done < file; case "$var" in pattern) ...;; esac for branching.

Cron format has five time fields (minute hour day-of-month month day-of-week) followed by the command; crontab -e edits, crontab -l lists; @reboot runs at startup.

systemd timers pair a .timer unit with a .service unit; OnCalendar defines the schedule and systemctl list-timers shows the next run.

Command substitution $(cmd) captures output; arithmetic uses $((expr)); functions are defined as name() { ...; } and called by name.

Hypervisor types: Type 1 (bare-metal) runs directly on hardware, e.g., KVM, Xen, ESXi; Type 2 runs on a host OS, e.g., VirtualBox, VMware Workstation.

KVM is a Linux kernel module; libvirt and virsh manage guests; qemu-img creates and inspects disk images; virt-install provisions new VMs.

Containers share the host kernel and isolate with namespaces and cgroups; VMs include a full guest OS; containers start faster and have lower overhead.

Cloud service models: IaaS supplies virtual machines and storage, PaaS supplies a managed runtime, SaaS supplies finished applications; responsibility for the guest OS shifts to the provider above IaaS.

The shared responsibility model: the provider secures physical facilities and the hypervisor; the customer secures operating systems, identities, and data in IaaS.

Cloud storage classes: object storage (S3-compatible) for unstructured data, block storage for VM disks, file storage for shared network filesystems; object storage is accessed via HTTP APIs, not mounted by default.

Snapshots capture point-in-time disk state and are usually incremental; they are not backups by themselves because they depend on the same storage layer.

Auto-scaling adjusts instance count from metrics such as CPU utilization; horizontal scaling adds instances, vertical scaling resizes an instance.

Infrastructure as Code tools (Terraform, Ansible) declare desired state; Terraform plan previews changes and apply executes them; Ansible is agentless over SSH.

Troubleshooting order: identify the problem, establish a theory, test the theory, establish a plan of action, implement or escalate, verify functionality, and document findings.

Change one variable at a time and record the result; reverting an untested change is cheaper than stacking changes that obscure the original cause.

Layered diagnosis: physical (cable, power, link LED), then network (IP, route, DNS), then service (port listening, process state), then application (logs, configuration).

Essential log locations: /var/log/messages or /var/log/syslog for general events, /var/log/auth.log or /var/log/secure for authentication, journalctl for systemd, and application logs under /var/log.

Ticket priority is derived from impact times urgency; severity describes the technical effect while priority describes the response order; document each action with a timestamp.

Escalation criteria are defined by SLA and by the boundary of the technician's authority; communicate status to the user before escalating and record the escalation in the ticket.

Documentation for a fix should include symptom, environment, commands run, output, root cause, resolution, and verification steps so another technician can reproduce it.

Backup rule 3-2-1: three copies, two different media, one offsite; test restores regularly because an untested backup is an assumption, not a control.

Useful diagnostics: dmesg for kernel messages, uptime for load, df and du for disk, ss for ports, ping and dig for network, and last for login history.