LFCA cheat sheet

Filesystem Hierarchy Standard (FHS): /etc holds host-specific configuration, /var holds variable data (logs, spools, databases), /usr holds read-only user data and installed programs, /tmp is world-writable and often cleared on boot, /home holds user home directories.

Permissions: each file has owner/group/other bits r=4, w=2, x=1. Directories require x to traverse and r to list; removing a file requires write+execute on the parent directory, not on the file itself.

Special permission bits: setuid (4xxx) runs an executable with the file owner's UID; setgid (2xxx) on a directory makes new files inherit the directory's group; sticky bit (1xxx) on a directory prevents users from deleting files they do not own.

Hard link vs symbolic link: a hard link is another directory entry for the same inode and cannot cross filesystems; a symlink is a separate file containing a path and can point anywhere, including to nonexistent targets.

Process inspection: ps aux shows all processes with user and CPU/memory; top/htop are interactive; kill sends signals by PID (SIGTERM=15 asks for clean exit, SIGKILL=9 cannot be caught); kill -l lists signal names.

Package management: Debian/Ubuntu use dpkg and apt (apt install/remove/update/upgrade); RHEL/Fedora use rpm and dnf/yum; Arch uses pacman. dpkg -l lists installed packages; apt search queries repositories.

Text processing pipeline: grep filters lines, sed performs stream edits (s/old/new/g), awk processes fields ($1, $NF) and can compute aggregates; pipes (|) connect stdout of one command to stdin of the next, and > / >> redirect to files.

Boot sequence: firmware (BIOS/UEFI) → bootloader (GRUB) → kernel + initramfs → init system (systemd or SysV). systemctl status/start/enable/disable manage services; journalctl -u unit reads that unit's logs.

systemd units are described by files in /etc/systemd/system (local overrides), /run/systemd/system (runtime), and /lib/systemd/system (packaged defaults); systemctl daemon-reload is required after editing a unit file.

User management: useradd creates accounts (with -m to create home), usermod -aG group adds supplementary groups, passwd sets passwords, and /etc/passwd, /etc/shadow, and /etc/group store account data; group membership changes apply at next login.

Disk and filesystem tools: lsblk shows block devices, df -h shows mounted filesystem usage, du -sh summarizes directory size, mkfs creates a filesystem, mount/umount attach and detach, and /etc/fstab persists mounts at boot.

Scheduling: cron entries in /etc/crontab and /etc/cron.d use five time fields (minute hour day month weekday) plus a user field; systemd timers use OnCalendar= and are enabled with systemctl enable --now timer.timer.

Logging: journalctl queries the systemd journal (journalctl -b for current boot, -p err for priority error and above, --since/--until for time ranges); rsyslog writes to /var/log/syslog or /var/log/messages depending on distribution.

Networking: ip addr shows interfaces, ip route shows the routing table, ss -tulpn lists listening TCP/UDP sockets with owning processes, and /etc/resolv.conf configures DNS resolvers; hostnamectl shows and sets the hostname.

Resource monitoring: free -h reports memory and swap, uptime reports load averages over 1/5/15 minutes, vmstat and iostat report system and disk I/O, and lsof lists open files and the processes holding them.

Backup and archives: tar -czf archive.tar.gz dir creates a gzip-compressed archive, tar -xzf extracts it, rsync -av --delete source/ dest/ mirrors trees while deleting extraneous files at the destination.

Service models: IaaS provides virtualized compute/storage/network (the customer manages the OS and up); PaaS provides a managed runtime (the customer manages only the application); SaaS provides a finished application (the customer manages only data and access).

Deployment models: public cloud is shared multi-tenant infrastructure, private cloud is dedicated to one organization, hybrid combines both with orchestration between them, and community cloud is shared by organizations with common requirements.

Elasticity vs scalability: vertical scaling adds resources to one instance (resize), horizontal scaling adds instances (scale out); elasticity is automatic horizontal adjustment in response to demand.

Shared responsibility: the provider secures the physical facility, hypervisor, and managed-service infrastructure; the customer is responsible for identity and access configuration, data classification, and patching of self-managed systems.

Cloud storage tiers: object storage (S3-style) is key-value with eventual or strong consistency depending on provider; block storage attaches to one instance; file storage is shared over NFS/SMB; archival tiers trade retrieval latency for lower cost.

Availability: an availability zone is an isolated failure domain within a region; a region contains multiple zones. Multi-zone deployment survives a single-zone failure; multi-region survives a regional failure.

Billing: most providers bill per second or per hour for compute, per GB-month for storage, and per GB for egress (data leaving the provider); ingress is commonly free. Reserved/committed use discounts trade flexibility for lower rates.

Infrastructure as Code and APIs: cloud resources are managed through REST APIs and IaC tools; the principle of least privilege applies to API credentials, and API keys should be scoped, rotated, and never committed to source control.

CIA triad: Confidentiality protects data from unauthorized disclosure, Integrity protects against unauthorized modification, Availability ensures timely access; controls are classified as preventive, detective, or corrective.

Authentication factors: something you know (password), something you have (token, key), something you are (biometrics). MFA requires two or more factors from different categories; two passwords are not MFA.

Symmetric vs asymmetric cryptography: AES is symmetric (one shared key, fast, used for bulk data); RSA/ECC are asymmetric (public/private key pair, used for key exchange and signatures). TLS combines both.

Hashing vs encryption: a hash (SHA-256) is one-way and used for integrity and password storage with a salt; encryption is reversible with a key. Passwords must be stored as salted hashes, never encrypted or plaintext.

TLS handshake establishes a session key using the server's certificate; the certificate binds a public key to a hostname and is validated against a trusted CA chain. Expired or mismatched certificates cause client errors.

Access control models: DAC (owner decides), MAC (system-enforced labels, e.g., SELinux/AppArmor), and RBAC (permissions assigned to roles). The principle of least privilege grants only the permissions required for a task.

Common attack classes: phishing (social engineering), SQL injection (unsanitized input), XSS (injected client-side script), MITM (intercepted traffic), and brute force (repeated credential guessing, mitigated by rate limiting and lockout).

Firewalls and hardening: default-deny inbound rules, allow only required ports; SSH key authentication with PasswordAuthentication no; keep systems patched; audit with tools such as fail2ban, auditd, and file integrity monitoring.

CI/CD: continuous integration merges and tests changes frequently; continuous delivery keeps every build releasable; continuous deployment automatically releases every passing build. A pipeline typically runs build → test → package → deploy.

Version control: git commits form a DAG; git branch/checkout create and switch branches, git merge combines histories, git rebase replays commits onto a new base, and git push/pull synchronize with a remote; commits are identified by SHA hashes.

Infrastructure as Code: declarative tools (Terraform, CloudFormation) describe desired state and compute a plan/diff; imperative scripts describe steps. State files must be stored remotely and locked to prevent concurrent modification.

Containers vs VMs: containers share the host kernel and isolate processes via namespaces and cgroups, giving fast startup and low overhead; VMs run a full guest OS on a hypervisor. Docker images are built from Dockerfiles and stored in registries.

Orchestration: Kubernetes schedules pods onto nodes, Services provide stable virtual IPs and load balancing, Deployments manage replica sets and rolling updates, and ConfigMaps/Secrets inject configuration.

Observability: metrics (counters/gauges, e.g., Prometheus), logs (structured event records), and traces (request paths across services). SLI is a measured indicator, SLO is the target, and the error budget is 1 minus the SLO.

Deployment strategies: rolling update replaces instances gradually, blue-green runs two environments and switches traffic, and canary routes a small percentage of traffic to the new version before full rollout.

Configuration management: Ansible uses agentless SSH and idempotent playbooks; Puppet and Chef use agents and manifests/recipes. Idempotence means re-running a task converges to the same state without side effects.

Web stack layers: reverse proxy (nginx/HAProxy) terminates TLS and forwards to an application server; the app server runs application code; the database stores state. Each layer should be health-checked independently.

Application logs: read with journalctl -u service or tail -f /var/log/app.log; structured JSON logs are parsed with jq. Log levels (DEBUG, INFO, WARN, ERROR) determine verbosity; excessive DEBUG logging degrades performance.

Environment configuration: applications read environment variables (export VAR=value) and config files; secrets belong in a secret manager or environment injection, never in the repository. The 12-factor app stores config in the environment.

Ports and connectivity: check the service is listening with ss -tulpn, test reachability with curl -v http://host:port/ and nc -zv host port, and confirm DNS with dig or getent hosts. A connection refused means nothing is listening; a timeout suggests a firewall or routing issue.

HTTP debugging: curl -I fetches headers only, -X sets the method, -d sends a body, and -k skips certificate verification (diagnostic only). Status codes 2xx success, 3xx redirect, 4xx client error, 5xx server error.

Language runtimes: Python uses venv and pip (requirements.txt), Node.js uses npm and package.json, Java uses Maven/Gradle and JARs, and Go compiles to static binaries. Missing runtime versions are a common deployment failure.

Databases: connection failures are diagnosed with the client (psql, mysql) and by checking the service status, listening port, credentials, and max_connections. Slow queries are found with EXPLAIN and the slow query log.

Support workflow: reproduce the issue, identify the failing layer (client, network, proxy, app, database), inspect logs and metrics at that layer, apply the smallest change, and verify with the same reproduction steps before closing.