LFCE key terms

A configuration file that describes how systemd manages a resource such as a service, mount, timer, or socket. Units declare dependencies, start commands, and restart behavior, replacing much of the older SysV init script logic.

A systemd unit that groups other units to represent a system state, such as multi-user or graphical login. Targets replace traditional runlevels and are reached by starting all units they require.

A systemd unit with a .service suffix that controls a daemon or one-shot process. Its [Service] section defines ExecStart, Type, Restart, and User settings that determine how the process runs and recovers.

The command-line client for reading the systemd journal. It filters entries by unit, priority, time range, or boot, and supports persistent versus volatile storage plus output formats such as JSON for automation.

A syslog daemon that receives, filters, and forwards log messages according to rule files. It can write to local files, send to remote collectors over TCP or TLS, and complement or replace the systemd journal.

A utility run by a timer that rotates, compresses, and deletes log files according to configuration stanzas. It supports size or time triggers, postrotate scripts, and copytruncate for processes that keep files open.

A time-based job scheduler that runs commands from user and system crontabs using five time fields. Related directories such as cron.d and cron.hourly let packages install jobs without editing per-user crontabs.

A systemd unit pair that schedules activation of another unit. Timers support monotonic and calendar expressions, persistence across downtime, and randomized delays, and they integrate with journal logging.

Pluggable Authentication Modules, a framework where stacked shared libraries handle authentication, account checks, password changes, and sessions. Configuration files under /etc/pam.d define the stack order and control flags for each service.

The configuration file defining which users or groups may run which commands as which accounts. It is edited with visudo to catch syntax errors and supports aliases, defaults, and passwordless rules.

A numeric label assigned to a network interface for addressing and routing. IPv4 uses 32 bits and IPv6 uses 128 bits, and each address is paired with a prefix length that defines the local subnet.

A compact way to express an address plus its network prefix, such as 192.0.2.0/24. The suffix counts network bits, so it determines the subnet mask, the host range, and how many addresses the subnet contains.

The kernel's list of rules that decide which interface and next hop carry a packet. Longest-prefix match wins, and each entry records destination, gateway, device, and metric.

A Linux feature that selects routing tables by rules beyond destination address, such as source address, firewall mark, or incoming interface. Rules are managed with ip rule and tables with ip route.

An isolated copy of the kernel networking stack with its own interfaces, addresses, routes, and firewall rules. Namespaces underpin containers and are linked to the host with veth pairs and bridges.

A virtual Ethernet cable made of two linked interfaces. A packet sent into one end emerges from the other, which makes veth pairs the standard way to connect a network namespace to a host bridge.

A software switch that forwards frames between attached interfaces at layer two. Linux bridges connect virtual machines and namespaces to each other and to a physical uplink, often with an IP address on the bridge itself.

A method of splitting one physical link into logically separate layer-two networks using 802.1Q tags. Linux creates VLAN subinterfaces on a parent device and tags or strips frames as they pass.

A dynamic firewall manager that organizes rules into zones tied to interfaces or sources. It applies nftables or iptables rules at runtime and can reload persistent configuration without dropping existing connections.

The modern Linux packet-filtering framework that replaces iptables. It uses tables, chains, and rules in a single language, supports sets and maps, and applies changes atomically.

The kernel connection-tracking subsystem that records the state of flows so firewalls can match on established, related, or new traffic. Tools such as conntrack inspect and clear entries, and table sizes are tunable.

Logical Volume Manager, a layer that pools physical disks into volume groups and carves flexible logical volumes from them. It supports resizing, snapshots, and moving data between physical volumes while mounted.

A block device or partition initialized for use by LVM, holding a metadata header and extents. Physical volumes are added to a volume group, which then allocates their extents to logical volumes.

The LVM storage pool formed by one or more physical volumes. It divides its space into fixed-size extents and allocates them to logical volumes, which can be grown or shrunk within available space.

An allocation model where storage is reported as larger than the space physically committed. Blocks are assigned on first write, so overcommit requires monitoring of the pool and careful sizing to avoid running out.

The file /etc/fstab lists filesystems to mount at boot, with device, mount point, type, options, and dump and fsck order. Errors here can block boot, so UUIDs and the nofail option are common safeguards.

A systemd unit generated from or written for a mount point, named after the escaped path. It expresses mount dependencies and options so systemd can order mounts against other units during boot.

Network File System, a protocol for sharing directories over a network so clients mount them as local filesystems. Exports are defined on the server and access is controlled by host, subnet, or Kerberos.

An on-demand automounter that mounts filesystems when a path is accessed and unmounts them after idle time. Map files define mount points, and it is often used for home directories and NFS shares.

A protocol that carries SCSI commands over TCP, letting a host attach remote block storage as a local disk. An initiator logs in to a target, and multipath tools provide redundancy across sessions.

A kernel framework that presents virtual block devices built from mappings over other devices. It underlies LVM, dm-crypt, multipath, and snapshots, with each mapping configured through the dmsetup tool or higher-level tools.

The standard Linux disk-encryption format layered on dm-crypt. It stores keyslots and metadata in a header, supports multiple passphrases, and is managed with cryptsetup for opening, closing, and rekeying volumes.

A mandatory access control system that labels processes and files and enforces policy between them. Modes include enforcing, permissive, and disabled, and denials are diagnosed from audit logs with tools such as ausearch.

A mandatory access control system that confines programs using per-path profiles rather than inode labels. Profiles can run in complain or enforce mode, and changes are loaded with apparmor_parser.

A fine-grained privilege split from the all-powerful root account, such as binding low ports or changing ownership. Capabilities can be set on executables or dropped from services to limit damage from compromise.

A signed public-key document that binds an identity to a key and is validated by a client against trusted authorities. Servers present certificates during handshakes, and expiry or name mismatch causes verification failures.

A toolkit and library implementing TLS and cryptography. Its command line creates keys and certificate signing requests, inspects chains and expiry, verifies handshakes, and converts between PEM and DER formats.

An asymmetric key pair used for passwordless SSH authentication, where the public half is placed in authorized_keys. Permissions on private keys and directories are strict, and passphrases protect keys at rest.

A diagnostic tool that traces system calls and signals made by a process. It reveals which files, sockets, and devices a program touches, making it useful for permission errors and hangs.

A tool that lists open files, sockets, and devices with the owning process. It answers which process holds a port, a deleted file, or a mount busy, and supports filtering by user, PID, or path.

A packet capture utility that filters traffic with BPF expressions and writes pcap files for later analysis. It is used to confirm whether packets reach an interface and to inspect protocol exchanges.

A socket statistics tool that shows listening and established connections with addresses, ports, and process owners. Options filter by TCP state or protocol, replacing the older netstat command.

A YAML file describing desired state as ordered tasks run against inventory hosts. Tasks call modules, support handlers and variables, and are designed to be idempotent so repeated runs converge without side effects.

A reusable bundle of tasks, handlers, defaults, templates, and files with a fixed directory layout. Roles let playbooks share configuration logic across projects and are pulled in by name.

The property that running an operation repeatedly yields the same end state without duplicating changes. Configuration management modules aim for it, and it is verified by rerunning a playbook and expecting no changes.