System Administration Fundamentals
System Administration Fundamentals tests day-two operations: accounts, services, logs, storage, networking, and scheduled work. The exam favors practical diagnosis over memorized definitions.
Accounts, services, and logs
Accounts live in /etc/passwd, hashed passwords in /etc/shadow, and groups in /etc/group. Use useradd, usermod, groupadd, and sudo with least privilege. systemd manages services: systemctl start runs a unit now, while systemctl enable makes it start at boot; systemctl enable --now nginx does both. Inspect with systemctl status and journalctl -u nginx. Logs under /var/log are rotated by logrotate.
Storage, networking, and scheduling
df reports filesystem free space; du summarizes directory usage; lsblk shows block devices; /etc/fstab controls persistent mounts. ip addr shows addresses, ss -tulpn shows listening sockets, and dig queries DNS. Cron entries in /etc/crontab or user crontabs run recurring jobs; systemd timers are an alternative.
Worked example
Remote users cannot reach an app, but curl http://localhost:8080 works on the server. ss -tulpn shows the process listening on 127.0.0.1:8080, not 0.0.0.0:8080. The service is healthy but bound only to loopback. Change the app's bind address to 0.0.0.0 (or the specific interface), restart it, and confirm the firewall permits port 8080. Checking the socket first separates a bind problem from a firewall or routing problem.
Traps
Starting a service is not enabling it. df can show space while deleted-but-open files consume it. Opening a port in the app does not override a host firewall. Avoid kill -9 before graceful signals.