LFCE cheat sheet

systemd unit states: enabled = symlink in /etc/systemd/system/*.wants/; active = running now. systemctl is-enabled and is-active answer different questions.

systemctl daemon-reload is required after editing any unit file; without it systemd keeps the old in-memory definition.

Targets replace runlevels: multi-user.target ≈ runlevel 3, graphical.target ≈ runlevel 5. systemctl get-default shows the default.

journald persistence: /var/log/journal/ exists → logs persist across reboot; absent → logs live in /run/log/journal and are lost.

nice values range -20 (highest priority) to 19 (lowest); only root can set negative values. renice -n changes a running process.

Scheduling precedence on cron: /etc/cron.d and /etc/crontab include a user field; files in /etc/cron.{hourly,daily,weekly,monthly} run as root without one.

ulimit -n is per-process soft limit; hard limits (-H) can only be raised by root. Persistent values go in /etc/security/limits.conf or limits.d.

Package manager decision: dpkg/rpm operate on local files and do not resolve dependencies; apt/dnf/yum resolve dependencies from repositories.

ip addr add 10.0.0.5/24 dev eth0 does not persist; persistence is via NetworkManager (nmcli), systemd-networkd (.network files), or /etc/network/interfaces on Debian.

ip route add default via 10.0.0.1 sets the default gateway; ip route get 8.8.8.8 shows which route and source address the kernel would use.

ss -tulpn lists listening TCP/UDP sockets with process name and PID; -l listening, -t TCP, -u UDP, -p process, -n numeric.

nftables replaced iptables: nft list ruleset dumps all tables/chains. Base chain hook types are input, output, forward, prerouting, postrouting.

sysctl net.ipv4.ip_forward=1 enables routing between interfaces; persist in /etc/sysctl.d/*.conf. Without it, forwarded packets are dropped.

DNS resolution order is governed by /etc/nsswitch.conf (hosts line); /etc/resolv.conf lists nameservers, search domains, and options ndots.

dig +trace example.com walks from the root servers down; dig @8.8.8.8 example.com queries a specific resolver directly.

Bonding modes: mode=1 active-backup needs no switch config; mode=4 (802.3ad/LACP) requires a LACP-configured switch port channel.

LVM stack order: physical volume (pvcreate) → volume group (vgcreate) → logical volume (lvcreate). lvextend -r resizes the filesystem in the same step.

XFS grows online with xfs_growfs but cannot shrink. ext4 grows online with resize2fs and shrinks only offline after e2fsck.

/etc/fstab fields: device, mountpoint, fstype, options, dump, fsck-pass. Use UUID= or LABEL= because device names like /dev/sdb are not stable.

mount -a tests fstab without rebooting; a bad fstab entry can drop the system into emergency mode. The nofail option prevents boot failure.

NFS export in /etc/exports: ro/rw, sync, root_squash (maps remote root to nobody), no_subtree_check. Apply with exportfs -ra.

Software RAID: mdadm --create --level=1 --raid-devices=2; /proc/mdstat shows rebuild progress. RAID is not a backup and does not replace snapshots.

df reports filesystem-level free space; du sums file usage. A large gap usually means deleted-but-open files held by a process.

blkid prints UUIDs and filesystem types; lsblk -f shows the device tree with mountpoints and filesystem labels.

SSH hardening: PermitRootLogin no, PasswordAuthentication no, AllowUsers/AllowGroups lists. Validate with sshd -t before restarting.

Key auth requires ~/.ssh permissions 700 on the directory and 600 on authorized_keys, owned by the target user; otherwise sshd silently rejects the key.

SELinux modes: enforcing, permissive, disabled. getenforce/sestatus show state; restorecon -Rv fixes mislabeled files; semanage fcontext -a adds persistent contexts.

Firewalld zones bind interfaces/sources to rule sets; firewall-cmd --permanent changes are not active until --reload. Runtime and permanent configs are separate.

TLS certificates: openssl x509 -in cert.pem -noout -dates -subject inspects validity and subject; openssl s_client -connect host:443 tests the served chain.

sudo policy lives in /etc/sudoers and /etc/sudoers.d/; always edit with visudo to catch syntax errors that would otherwise lock out sudo.

PAM controls authentication stacking; /etc/pam.d/sshd and /etc/pam.d/system-auth define modules. pam_tally2/faillock implement lockout after failed logins.

Boot diagnosis order: GRUB → initramfs → root mount → systemd targets. journalctl -b -1 reads the previous boot; -p err filters to errors.

systemd-analyze blame ranks units by boot time; systemd-analyze critical-chain shows the dependency path that actually delayed boot.

strace -f -p PID traces syscalls of a running process; -e trace=open,connect narrows output. Useful when a service fails without a clear log line.

tcpdump -i eth0 -nn port 443 captures traffic without name resolution; -w file.pcap writes for later analysis.

Ansible idempotence: modules like copy, service, package report changed only when state differs; command/shell always report changed unless changed_when is set.

Ansible inventory groups plus hosts: targeting; --check runs a dry run and --diff shows file content changes.

Shell strict mode: set -euo pipefail exits on error, undefined variable, or failed pipeline stage. trap 'cleanup' EXIT runs cleanup on any exit.

lsof +L1 finds deleted files still held open - the usual cause when df shows full but du does not.