LFCE flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

systemctl daemon-reload

Command that makes systemd re-read unit files from disk after an edit. Without it, systemd keeps the old in-memory definition and start/restart uses stale settings.

multi-user.target

Systemd target equivalent to the old runlevel 3: full multiuser text mode with networking but no graphical login. Set as default with systemctl set-default.

journald persistent storage

Logs persist across reboots only when the directory /var/log/journal exists. Otherwise journald writes to /run/log/journal, a tmpfs cleared at shutdown.

nice and renice

Nice values run from -20, highest CPU priority, to 19, lowest. Only root may set negative values. renice changes the value of an already running process.

ulimit hard vs soft

Soft limits are the effective per-process values a user can lower or raise up to the hard limit. Only root can raise a hard limit.

cron.d user field

Files in /etc/cron.d and /etc/crontab carry a user column before the command. Scripts in /etc/cron.daily and similar directories run as root with no user field.

ip route get

Queries the kernel routing table for the path to a specific destination, showing the chosen route, outgoing interface, and preferred source address.

ss -tulpn

Lists listening sockets: -t TCP, -u UDP, -l listening only, -p owning process, -n numeric ports. Replaces netstat for checking which service holds a port.

ip_forward sysctl

Kernel switch, net.ipv4.ip_forward, that permits forwarding packets between interfaces. Required for routing, NAT, and container networking; persist under /etc/sysctl.d.

nsswitch hosts line

Entry in /etc/nsswitch.conf deciding resolution order for hostnames, for example files dns, meaning /etc/hosts is consulted before DNS servers.

Bonding mode 4

802.3ad link aggregation mode requiring a switch port channel configured with LACP. Mode 1 active-backup needs no switch-side configuration.

dig +trace

Iterative DNS lookup starting at the root servers and following referrals down to the authoritative server, revealing where delegation or resolution breaks.

LVM creation order

pvcreate marks a block device as a physical volume, vgcreate pools volumes into a volume group, lvcreate carves logical volumes from that group.

lvextend -r

Extends a logical volume and resizes the filesystem in one operation. Without -r the filesystem stays at its old size until resized separately.

XFS resize limits

XFS filesystems can be grown online with xfs_growfs but cannot be shrunk at all. ext4 can grow online and shrink only offline after a filesystem check.

fstab nofail option

Mount option that lets boot continue when the device is missing or fails to mount, preventing the system from dropping into emergency mode.

NFS root_squash

Export option mapping the remote root user to the anonymous nobody account, so clients cannot act as root on exported files.

df versus du gap

df reports filesystem free space while du sums visible files. A large gap usually means deleted files still held open by a running process.

lsblk -f

Shows the block device tree with filesystem type, label, UUID, and mountpoint for each device, useful before writing fstab entries.

sshd -t

Tests the SSH daemon configuration for syntax errors without restarting. Run it before reloading sshd, since a bad config can lock out remote access.

authorized_keys permissions

Key authentication requires the .ssh directory at mode 700 and authorized_keys at 600, both owned by the target user. Wrong modes cause silent key rejection.

restorecon -Rv

Restores SELinux contexts from policy on files under a path, recursively and verbosely. Fixes mislabeled files that cause denials after copying or moving.

firewall-cmd --reload

Applies permanent firewalld configuration to the running runtime configuration. Changes made with --permanent alone do not take effect until reload.

openssl s_client

Connects to a TLS service and prints the certificate chain, protocol, and cipher negotiated. Used to verify what a server actually presents on a port.

visudo

Editor wrapper that validates /etc/sudoers syntax before saving. Editing the file directly risks a syntax error that disables sudo entirely.

journalctl -b -1

Reads the journal from the previous boot. Essential for diagnosing a crash or failed boot when the current boot's logs show nothing useful.

systemd-analyze blame

Lists units sorted by initialization time, identifying which services delayed boot. critical-chain instead shows the dependency path that set total time.

strace -f -p PID

Attaches to a running process, following child processes, and prints system calls. Shows which file, socket, or permission a failing service is blocked on.

tcpdump -nn port 443

Captures packets on an interface with numeric addresses and ports, avoiding DNS lookups. Add -w file.pcap to save traffic for later analysis.

Ansible changed_when

Condition that overrides change reporting for a task. Needed for command and shell tasks, which otherwise always report changed and break idempotence checks.

set -euo pipefail

Shell strict mode: -e exits on error, -u errors on undefined variables, -o pipefail makes a pipeline fail if any stage fails, not only the last.

lsof +L1

Lists open files with a link count below one, meaning deleted but still held open. Explains disk-full reports from df when du shows little usage.