CELE cheat sheet

Linux kernel responsibilities: process scheduling, memory management, device drivers, VFS, and network stack; user space reaches these only through system calls.

Boot sequence order: firmware (BIOS/UEFI) → bootloader (GRUB) → kernel + initramfs → init/systemd (PID 1) → target/runlevel units.

Filesystem Hierarchy Standard: /etc holds host-specific configuration, /var holds variable data (logs, spools), /usr holds read-only user data, /tmp is world-writable and cleared on boot.

Everything is a file abstraction: regular files, directories, block/character devices under /dev, sockets, pipes, and /proc and /sys pseudo-filesystems exposing kernel state.

Kernel vs user space separation is enforced by CPU privilege rings; a process crossing into the kernel via syscall runs in kernel mode, otherwise in user mode.

systemd as PID 1 manages units (.service, .socket, .target, .timer); targets replace SysV runlevels, and multi-user.target is the standard non-graphical boot state.

Exit status convention: 0 means success, non-zero means failure; the shell stores the last status in $? and scripts often use it for branching.

Standard streams are numbered 0 (stdin), 1 (stdout), 2 (stderr); redirection uses > (overwrite), >> (append), 2> (stderr), and 2>&1 to merge.

Major distributions differ by package manager and init lineage: Debian/Ubuntu use apt/dpkg, RHEL/Fedora use dnf/rpm, SUSE uses zypper/rpm; most modern ones use systemd.

Installation media options: full ISO (offline install), netboot/minimal ISO (downloads packages during install), and cloud images (prebuilt for KVM/VMware/cloud).

Disk partitioning schemes: MBR supports four primary partitions and disks up to 2 TiB; GPT supports 128 partitions by default and disks beyond 2 TiB, and pairs with UEFI.

UEFI systems require an EFI System Partition (ESP) formatted FAT32, typically 100–512 MiB, mounted at /boot/efi; BIOS systems use a small biosboot or none.

Swap sizing rule of thumb: equal to RAM for small systems, reduced for large RAM; swap can be a partition or a swapfile created with fallocate/dd then mkswap and swapon.

LVM layering: physical volume (pvcreate) → volume group (vgcreate) → logical volume (lvcreate); resizing a filesystem usually requires lvextend plus resize2fs or xfs_growfs.

GRUB 2 configuration is generated from /etc/default/grub and /etc/grub.d/*; after editing, regenerate with grub2-mkconfig -o /boot/grub2/grub.cfg (RHEL) or update-grub (Debian).

Kernel modules: lsmod lists loaded modules, modprobe loads with dependencies, modinfo shows parameters, and /etc/modprobe.d/*.conf sets persistent options or blacklists.

Network configuration on modern systems is handled by NetworkManager (nmcli, nmtui) or systemd-networkd; persistent config lives in /etc/NetworkManager/system-connections or /etc/systemd/network.

Navigation shortcuts: cd with no argument returns to $HOME, cd - returns to the previous directory, cd .. moves up one level, and pwd prints the absolute path.

Listing options: ls -l shows long format, -a includes dotfiles, -h makes sizes human-readable, -t sorts by modification time, and -R recurses.

Copying and moving: cp -r copies directories, cp -a preserves permissions/timestamps, mv renames or moves across filesystems by copy-and-delete, and rm -r removes directories recursively.

Finding files: find /path -name '*.conf' -type f matches by name and type; -mtime -7 finds files modified in the last 7 days; -exec executes a command per result.

Text viewing: cat prints whole files, less pages interactively, head/tail show the first/last 10 lines by default, and tail -f follows a growing log.

Searching content: grep -r recurses, -i ignores case, -n prints line numbers, -v inverts the match, and -E enables extended regular expressions.

Permissions notation: rwx maps to 4/2/1; chmod 755 gives owner rwx and group/other r-x; chmod u+x adds execute for the owner.

Ownership and special bits: chown user:group changes both, and the setuid (4), setgid (2), and sticky (1) bits modify execution or deletion behavior (sticky on /tmp).

Key account files: /etc/passwd stores username, UID, GID, home, and shell; /etc/shadow stores password hashes and aging; /etc/group stores group membership.

UID 0 is root; system accounts typically use UIDs below 1000 (or 500 on older RHEL); regular users start at 1000 (or 500).

useradd creates an account, usermod modifies it (usermod -aG group user appends without removing other groups), and userdel -r removes the home directory.

passwd sets a password; chage -l lists aging and chage -M sets maximum days; /etc/login.defs sets system-wide defaults for aging and UID ranges.

Permissions are evaluated as owner first, then group, then other; the most specific matching class wins, so owner permissions override group permissions.

Special permissions: setuid runs a binary as the file owner (e.g., /usr/bin/passwd), setgid on a directory makes new files inherit the directory's group, sticky prevents non-owners from deleting files.

ACLs extend standard permissions: getfacl displays them, setfacl -m u:alice:rw file grants access, and setfacl -x removes an entry.

sudo grants delegated privilege via /etc/sudoers (edit with visudo); entries follow user host=(runas) command, and NOPASSWD removes the password prompt.

Process listing: ps aux shows all processes with user and CPU/memory; ps -ef shows full command lines; pgrep -f matches on the full command line.

Signals: SIGTERM (15) requests graceful termination, SIGKILL (9) forces termination and cannot be caught, SIGHUP (1) often triggers reload, SIGSTOP/SIGCONT pause and resume.

Job control: Ctrl-Z suspends the foreground job, bg resumes it in the background, fg brings it back, jobs lists them, and nohup command & survives logout.

Priority is controlled by nice values from -20 (highest priority) to 19 (lowest); renice changes a running process, and nice starts a new one.

systemctl verbs: start, stop, restart, reload, enable (persist across boot), disable, status, and mask (prevent starting).

Logs and inspection: journalctl -u service shows unit logs, -f follows, --since filters by time; systemctl list-units --failed shows failed units.

Process trees: top and htop show live resource use, pstree shows parent-child relationships, and kill -9 PID terminates by PID while pkill -f name matches by name.

Service unit files live in /etc/systemd/system (local overrides) and /usr/lib/systemd/system (packaged); after editing run systemctl daemon-reload.

IPv4 addresses are 32-bit dotted decimal; CIDR /24 means 255.255.255.0 and 254 usable hosts; private ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.

Key diagnostic tools: ip addr shows interfaces, ip route shows the routing table, ping tests reachability, ss -tuln lists listening TCP/UDP ports, and dig/nslookup query DNS.

Port numbers: SSH 22, HTTP 80, HTTPS 443, DNS 53, SMTP 25, and NTP 123; /etc/services maps names to ports.

Name resolution order is controlled by /etc/nsswitch.conf; /etc/resolv.conf lists DNS servers, and /etc/hosts provides static local mappings.

SSH key auth: ssh-keygen creates a keypair, ssh-copy-id installs the public key into ~/.ssh/authorized_keys, and ssh-agent/ssh-add cache passphrases.

SSH config in /etc/ssh/sshd_config: PermitRootLogin no, PasswordAuthentication no, and Port 22 changes take effect after restarting sshd.

File transfer: scp copies over SSH, rsync -avz is efficient for incremental sync, and sftp provides interactive transfer.

Firewall tools: firewalld (firewall-cmd --add-service=ssh --permanent then --reload) and nftables/iptables for packet filtering.

Debian family: apt update refreshes indexes, apt install/remove manages packages, apt upgrade upgrades, and dpkg -i installs a local .deb; dpkg -l lists installed packages.

RHEL family: dnf install/remove/upgrade manages packages, rpm -qa lists installed packages, and rpm -ivh installs a local .rpm; dnf provides finds the package owning a file.

Repository configuration: Debian uses /etc/apt/sources.list and /etc/apt/sources.list.d; RHEL uses /etc/yum.repos.d/*.repo with baseurl or mirrorlist.

Package verification: rpm -V and debsums check installed files against package metadata; rpm -qf /path identifies the owning package.

Dependency resolution is automatic in apt and dnf; dpkg and rpm alone do not resolve dependencies and will report missing requirements.

Source builds follow ./configure && make && make install; prerequisites are compiler toolchains and -devel/-dev headers.

Distribution upgrade safety: snapshot or back up first, read release notes, and upgrade in place with do-release-upgrade (Ubuntu) or dnf system-upgrade (Fedora).

Container and language-specific package managers (snap, flatpak, pip, npm) install outside the system package database; they do not satisfy rpm/dpkg dependencies.

Shebang line #!/bin/bash selects the interpreter; scripts must be executable (chmod +x) or invoked as bash script.sh.

Variables: NAME=value assigns with no spaces around =, $NAME or ${NAME} expands, and export makes it visible to child processes.

Special variables: $0 script name, $1–$9 positional args, $# arg count, $@ all args, $? last exit status, and $$ current PID.

Quoting rules: single quotes preserve literal text, double quotes allow expansion, and backticks or $(...) command substitution.

Test constructs: [ -f file ] tests a regular file, [ -d dir ] a directory, [ -z "$var" ] an empty string, and [ "$a" -eq "$b" ] numeric equality.

Control flow: if/then/elif/else/fi, for var in list; do ...; done, while condition; do ...; done, and case $var in pattern) ...;; esac.

Pipelines and redirection: cmd1 | cmd2 passes stdout, tee duplicates output to a file, and xargs builds command lines from stdin (use -0 with find -print0).

Text utilities: awk '{print $1}' prints fields, sed 's/old/new/g' substitutes globally, cut -d: -f1 splits on a delimiter, and sort | uniq -c counts occurrences.

set -e exits on error, set -u errors on unset variables, and set -o pipefail makes a pipeline fail if any stage fails.

File permissions are the first line of defense: avoid world-writable files (find / -perm -0002), keep /etc/shadow mode 0000 or 0640, and never put secrets in world-readable files.

SSH hardening: disable root login, require key-based auth, restrict AllowUsers/AllowGroups, and consider changing the default port or using fail2ban.

Least privilege: run services as dedicated non-root users, use sudo instead of su, and grant only the commands needed in /etc/sudoers.

Patch management: apply security updates regularly (apt upgrade / dnf update --security), and monitor advisories; unattended-upgrades automates Debian-family patching.

Audit trails: /var/log/auth.log or /var/log/secure record authentication events, journalctl -u sshd shows SSH activity, and last/lastb show login history.

Firewall baseline: allow only required ports, default-deny inbound, and use firewall-cmd --permanent --add-service=... followed by --reload to persist rules.

Backup strategy: the 3-2-1 rule (three copies, two media, one offsite), verify restores regularly, and use rsync, tar, or snapshot tools with tested recovery.

Integrity and encryption: sha256sum verifies downloads, gpg signs and encrypts, and LUKS provides full-disk encryption with cryptsetup.