LFA cheat sheet

Filesystem Hierarchy Standard: /etc holds host-specific configuration, /var holds variable data such as logs and spools, /usr holds shareable read-only programs and libraries, /home holds user data, /tmp is world-writable scratch cleared at reboot, and /proc plus /sys are virtual kernel and device interfaces.

Permission bits per owner, group, and other: read=4, write=2, execute=1, so chmod 640 yields rw-r----- and chmod 755 yields rwxr-xr-x; a directory needs execute (x) to be traversed or to reach entries inside it.

umask arithmetic: file mode = 666 minus umask, directory mode = 777 minus umask, so umask 027 gives 640 for files and 750 for directories; the value is set in /etc/profile, /etc/bashrc, or a user shell rc file.

Special bits: setuid (4000) makes an executable run with the file owner's effective UID, setgid (2000) makes a directory give new files its group or makes a binary run with the file group, sticky (1000) restricts deletion in a shared directory to file owners, as on /tmp.

Redirection operators: > truncates and writes stdout, >> appends, 2> redirects stderr, 2>&1 merges stderr into stdout, &> captures both streams, | sends stdout to the next command's stdin, and tee writes output to a file and to stdout simultaneously.

Hard link versus symbolic link: a hard link is an additional directory entry for the same inode and cannot cross filesystems or target a directory; a symlink is a separate inode holding a path string, may cross filesystems, and can dangle if the target is removed.

Boot order: firmware/UEFI, then GRUB2 reading /boot/grub2/grub.cfg, then kernel plus initramfs, then systemd as PID 1, then the default target (multi-user.target for text, graphical.target with a display manager).

systemctl enable creates symlinks under /etc/systemd/system/*.wants/ so a unit starts with its target; disable removes them; mask points the unit name at /dev/null, blocking both manual start and dependency-based start.

Package management families: Debian/Ubuntu use dpkg with apt (dpkg -l lists installed packages, /etc/apt/sources.list defines repositories); RHEL/Fedora use rpm with dnf (rpm -qa lists packages, repositories live in /etc/yum.repos.d/).

Signals: SIGTERM (15, the kill default) can be caught for graceful shutdown, SIGHUP (1) commonly triggers a configuration reload, and SIGKILL (9) cannot be caught or ignored, so the process dies without cleanup.

Priority: nice values run from -20 (most favorable) to 19 (least favorable); nice -n 10 cmd starts a lowered-priority process, renice -n -5 -p PID raises priority, and negative values require root.

Disk inspection: df -hT reports usage and filesystem type per mount, du -sh /path totals a directory tree, lsblk -f lists devices with filesystems and UUIDs; /etc/fstab entries need a device or UUID, mount point, type, and options, with nofail for non-critical mounts.

LVM layers: pvcreate /dev/sdb, then vgcreate vg0 /dev/sdb, then lvcreate -L 10G -n lv0 vg0, then mkfs on /dev/vg0/lv0; extend with lvextend -L +5G -r, which also grows ext4 via resize2fs or XFS via xfs_growfs.

Networking: ip addr show lists interfaces, ip route show reveals the default gateway, ss -tulpn lists listening TCP/UDP sockets with owning processes, nmcli connection writes persistent configuration, and dig or nslookup resolves against the servers in /etc/resolv.conf.

Log locations: journalctl -u sshd --since '1 hour ago' -f follows a systemd unit; text logs such as /var/log/messages, /var/log/syslog, and /var/log/auth.log are distribution-specific; logrotate rules in /etc/logrotate.d/ set rotation frequency and retention.

Cron syntax: five fields, minute hour day-of-month month day-of-week, precede the command; files in /etc/cron.d/ add a user field before the command; systemd timers express the same schedules with OnCalendar=.

Accounts: useradd -m -s /bin/bash creates a home and shell, passwd -l locks an account, usermod -aG group adds a supplementary group; /etc/passwd holds UID, GID, home, and shell, /etc/shadow holds the hash, /etc/group holds memberships, and visudo validates /etc/sudoers before saving.

Time and targets: timedatectl set-timezone changes the zone and timedatectl status shows NTP synchronization, chronyd is configured in /etc/chrony.conf, and systemctl get-default or set-default switches between multi-user.target and graphical.target.

NIST essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service; a model missing measured service or pooling is not full cloud.

Service model boundary: in IaaS the provider manages virtualization, storage, and network while the customer patches the OS and above; in PaaS the provider also manages OS and runtime while the customer ships code and configuration; in SaaS the provider manages the entire application.

Deployment models: public (multi-tenant, provider-owned), private (single organization), hybrid (workloads split with orchestration between them), community (shared by organizations with common compliance or mission requirements).

Storage decision rule: block volumes attach to one instance and are formatted with a filesystem, object storage is reached through HTTP or S3-style APIs using buckets and keys and is not mounted like a disk, and file storage (NFS/SMB) is shared concurrently by many clients.

Regions and zones: a region contains multiple isolated availability zones; a multi-AZ deployment survives a zone failure and addresses high availability, while multi-region addresses disaster recovery and user latency.

Scaling: vertical scaling resizes a single instance and usually needs downtime; horizontal scaling adds instances behind a load balancer, and an auto-scaling group adjusts instance count from metrics such as CPU or queue depth.

Identity and access: IAM users are long-lived identities, roles issue temporary credentials through STS and are assumed by services, and policies are evaluated with explicit deny overriding explicit allow, which overrides implicit deny.

Cost and control plane: tags drive cost allocation and budget alerts, and the cloud API is the control plane - declarative infrastructure-as-code templates such as Terraform or CloudFormation converge the account to the declared state rather than issuing one-off commands.

CIA triad: confidentiality is enforced with encryption and access control, integrity with hashes, checksums, and signatures, and availability with redundancy, backups, and DDoS protection.

AAA and factors: authentication proves identity, authorization decides permitted actions, accounting records them; MFA requires factors from different categories (something you know, have, or are) rather than two instances of the same category.

Encryption choice: symmetric AES handles bulk data quickly with a shared key, asymmetric RSA or ECC handles key exchange and signatures, and hashes such as SHA-256 are one-way for integrity checks and password storage rather than reversible encryption.

Password storage: each password gets a unique random salt and a deliberately slow KDF (bcrypt, scrypt, argon2); /etc/shadow is readable only by root, and hash prefixes identify the algorithm, for example $6$ for SHA-512 crypt.

TLS validation: the server presents an X.509 certificate signed by a CA in the client trust store, and the handshake checks chain of trust, hostname, and validity dates; an expired or mismatched certificate breaks API clients until the chain is corrected.

SSH keys: the private key stays in ~/.ssh with mode 600 and the public key is appended to ~/.ssh/authorized_keys on the server by ssh-copy-id; sshd_config hardening uses PasswordAuthentication no and PermitRootLogin prohibit-password.

Host firewalls: firewalld applies zone and service rules (firewall-cmd --add-service=https --permanent followed by --reload), ufw allow 443/tcp is the simple front end, and nftables or iptables evaluate rules in order against a default policy - deny inbound and permit established, related traffic.

SELinux versus AppArmor: SELinux labels objects with user:role:type:level contexts, has enforcing, permissive, and disabled modes set in /etc/selinux/config, logs denials as avc: denied, and is repaired with restorecon -Rv after files are moved; AppArmor instead applies per-program path-based profiles from /etc/apparmor.d/.

Detection and scoring: authentication failures appear in /var/log/auth.log or /var/log/secure, auditd records syscall rules, AIDE detects file changes, fail2ban bans repeated failed logins, and CVSS scores range 0.0 to 10.0 with 9.0 and above rated critical.

Pipeline shape: commit triggers build (compile, test, package image), artifact publication, deploy to staging, then promotion to production; a failing gate stops promotion, so the artifact that reaches production is the one that passed tests.

Delivery versus deployment: continuous delivery keeps every change releasable and leaves the production release to a human decision; continuous deployment releases every change that passes the pipeline with no manual approval step.

Git mechanics: commits are immutable snapshots addressed by SHA, branches are movable pointers, merge preserves history with a merge commit, rebase replays commits onto a new base and must not be used on shared branches, revert adds an inverse commit while reset --hard discards local work.

Infrastructure as code: Terraform is declarative HCL with a state file and plan/apply cycle, Ansible is agentless over SSH with YAML playbooks, and both are idempotent, meaning a second run with unchanged inputs makes no further changes.

Containers versus VMs: an image is a stack of immutable layers produced by Dockerfile instructions (FROM, RUN, COPY, CMD versus ENTRYPOINT); containers share the host kernel and are isolated by namespaces and cgroups, while a VM runs its own guest kernel under a hypervisor.

Kubernetes objects: a Pod is the smallest unit and shares a network namespace and volumes among its containers, a Deployment manages replicas and rolling updates, a Service provides a stable address and load balancing to Pods, and ConfigMaps and Secrets inject configuration; kubectl apply -f, describe, logs, and rollout status are the core operations.

Observability: metrics such as Prometheus counters and gauges are scraped at intervals, logs are structured for querying, traces follow a request across services; an SLI is the measured ratio, an SLO is the internal target, an SLA is the contractual commitment, and the error budget is 1 minus the SLO.

Release strategies: a rolling update replaces instances gradually, blue-green switches traffic between two identical environments with instant rollback, and a canary sends a small traffic percentage to the new version first; all three depend on versioned, immutable artifacts.

HTTP semantics: GET, PUT, and DELETE are idempotent while POST is not; status families are 2xx success (200, 201 created, 204 no content), 3xx redirect, 4xx client error (400, 401 unauthenticated, 403 forbidden, 404, 409 conflict, 429 rate limited), and 5xx server error (500, 502, 503, 504).

Gateway errors: 502 Bad Gateway means the upstream returned an invalid response or refused the connection (crashed app, wrong port, protocol mismatch), while 504 Gateway Timeout means the upstream did not answer before the proxy deadline (slow query, hung worker); check the proxy error log and the upstream health endpoint.

curl and jq: curl -i shows response headers, -s silences progress, -o writes to a file, -X sets the method, -H sets a header such as Content-Type: application/json, -d supplies the request body, -u supplies basic auth credentials; jq -r '.items[].id' extracts fields from a JSON response.

Log reading: severity runs DEBUG, INFO, WARN, ERROR, FATAL; production normally records INFO and above and enables DEBUG temporarily; a stack trace lists the exception and frames from the throw site outward, and correlation or request IDs tie one request across services.

Environments and secrets: dev, staging (production-like), and production are separated; configuration arrives through environment variables and secrets through a secret manager or mounted file, never committed to Git.

Database support: connection pooling caps per-request connections, migrations are versioned forward-only scripts applied before new code runs, and a missing index shows up as a slow query in the slow query log rather than an application error.

Diagnosis order: reproduce with the user's exact input, check recent deployments, read logs and metrics for the incident window, and isolate scope (one user versus all, one region versus global) before escalating with timestamps, request IDs, and evidence.

Versioning: semantic versions are MAJOR.MINOR.PATCH, where MAJOR signals incompatible API changes, MINOR adds backward-compatible features, and PATCH fixes bugs; pinning dependency versions prevents surprise breaking upgrades.

Supporting documentation: a README covers setup and run, an API reference covers endpoints, auth, and error codes, a runbook lists alerts and remediation steps, a changelog records releases, and a blameless postmortem records timeline, root cause, and action items with owners.