Understanding User and Group Management
User and group management forms the foundation of Linux access control. Every file and process has an owner and group, which determines permissions and resource allocation.
Key Files and Concepts
The /etc/passwd file stores user account information: username, user ID (UID), group ID (GID), home directory, and login shell. The /etc/group file contains group definitions and membership lists.
Understand UID and GID numbering conventions. System accounts typically have UIDs below 1000, while regular user accounts start at 1000 or higher. This distinction matters for security policies and resource management.
Managing Users and Groups
Use these commands to manage accounts:
- useradd creates new user accounts (requires explicit flags for home directories)
- usermod modifies existing accounts
- userdel removes user accounts
- groupadd creates new groups
- groupmod modifies groups
Privilege Escalation and Security
The sudo command enables privilege escalation for regular users. Configure it through the /etc/sudoers file using the visudo editor. This prevents syntax errors that could lock out root access.
Manage passwords securely using passwd and understand shadow password security. Master user switching with su and sudo, permission inheritance, and default group assignment. This knowledge appears extensively on the Linux+ exam.
File System Management and Disk Administration
Linux file system management encompasses partitioning, formatting, mounting, and maintaining disk storage. Different file systems offer different features for reliability, performance, and capacity.
Understanding File Systems and Devices
Common Linux file systems include ext4, XFS, and Btrfs. Learn device naming conventions: /dev/sda represents the first hard drive, /dev/sdb the second. /dev/sda1 indicates the first partition on the first drive.
Use fdisk and parted to create and modify partitions. Use mkfs to format partitions with specific file systems.
Mounting and Configuration
Mount points determine where partitions appear in the directory structure. Define them in /etc/fstab to automatically mount at boot. Common mount options include:
- ro (read-only)
- rw (read-write)
- noexec (prevent execution)
Advanced Storage and Maintenance
Logical Volume Manager (LVM) provides flexible disk management. You can resize partitions dynamically without downtime.
Disk quotas restrict user and group storage consumption. This prevents individual users from consuming excessive resources. Regular maintenance tasks include:
- Check disk usage with df and du commands
- Monitor inode usage
- Clean unnecessary files
- Plan for future capacity
Understand the file system hierarchy: /root for the root user, /home for regular users, and /var for variable data. Proper disk administration prevents crashes from full partitions.
Network Configuration and Management
Network configuration enables systems to communicate across networks. Modern distributions use NetworkManager or systemd-networkd, though traditional tools remain useful.
Networking Fundamentals
Master IPv4 and IPv6 concepts, CIDR notation (classless inter-domain routing), and subnet masks. These form the foundation of all network configuration.
The /etc/hostname file sets your system hostname. The /etc/hosts file provides local DNS resolution for specific addresses without querying remote servers.
Configuration and Tools
Network interface configuration varies by distribution. Red Hat-based systems use /etc/sysconfig/network-scripts/, while Debian-based systems use /etc/network/interfaces or netplan.
Essential commands include:
- ip or ifconfig to view interface status
- ping for connectivity testing
- ss or netstat for connection monitoring
- iptables for firewall rules
DNS and Services
Configure DNS through /etc/resolv.conf or /etc/systemd/resolved.conf. These files determine which nameservers the system queries.
Ensure proper gateway configuration for routing to external networks. Network services like SSH, HTTP, and FTP rely on proper configuration and listening ports.
Troubleshooting Network Issues
Follow this systematic approach: check interface status, verify IP configuration, test routing, and examine DNS resolution. Secure network interfaces by disabling unnecessary services and configuring firewalls.
System Security and Access Control
Security protects your systems from unauthorized access and malicious activities. Implement multiple layers of security controls.
File Permissions and Ownership
File permissions use the rwx (read, write, execute) model with three scopes: owner, group, and others. Permissions convert numerically: 4 for read, 2 for write, 1 for execute.
Use chmod to modify permissions, chown to change ownership, and chgrp to change group. Special permissions include:
- setuid (runs with file owner's privileges)
- setgid (runs with group privileges)
- sticky bit (prevents deletion by non-owners)
Advanced Access Control
SELinux and AppArmor provide mandatory access control beyond traditional permissions. These add granular security policies that restrict even root in certain contexts.
The sudo configuration through /etc/sudoers enables controlled privilege escalation. Allow specific users or groups to execute specific commands as root without entering the root password. Always edit with visudo to prevent syntax errors.
Remote Access and Network Security
SSH public key authentication provides secure remote access. Replace passwords with cryptographic keys stored in ~/.ssh/authorized_keys.
Firewall configuration through iptables, firewalld, or ufw controls incoming and outgoing traffic. Regular security audits include:
- Check open ports with ss or netstat
- Examine running processes
- Review log files for suspicious activity
- Identify unauthorized accounts
Implement the principle of least privilege by granting only necessary permissions. This reduces attack surface and limits damage from compromised accounts.
System Monitoring, Logging, and Performance Optimization
Continuous system monitoring ensures reliability, identifies problems early, and optimizes performance. Establish baselines for normal performance and set up alerts for anomalies.
Process and Resource Monitoring
Process monitoring through ps, top, and htop displays running processes, CPU usage, and memory consumption. Identify resource hogs that degrade performance.
The load average indicates system busyness relative to CPU count. Values above the CPU count suggest bottlenecks. Memory management involves understanding RAM usage, swap usage, and cache behavior. Use free and vmstat for detailed statistics.
Disk I/O monitoring through iostat reveals read/write patterns and identifies slow storage issues.
Logging and Log Management
Logging through syslog, journald, and application-specific logs provides audit trails for troubleshooting. Log files typically reside in /var/log, with common examples:
- /var/log/syslog for system messages
- /var/log/auth.log for authentication events
- /var/log/apache2 for web server activities
Systemd journal accessed through journalctl offers centralized logging with powerful filtering. Use logrotate to prevent logs from consuming excessive disk space.
Performance Optimization
Analyze performance bottlenecks by tuning kernel parameters, optimizing I/O, and managing background processes. Cron jobs automate regular maintenance tasks like backups and updates.
Monitoring tools like Nagios, Prometheus, and Grafana provide comprehensive visibility into system health. Maintain detailed logs for forensic analysis when issues occur.