<p><big><strong>Linux Quick Study</strong></big></p>

Linux Kernel — Quick Summary
Kernel: Core component of the OS that acts as a bridge between applications and hardware and manages CPU, memory, filesystems, devices, networking, etc.
Types: Monolithic – major OS functions in kernel space; Microkernel – only essential functions; Hybrid – combination of both; Exokernel – minimal kernel with more direct hardware control.
Kernel Modules: Pieces of kernel code, commonly drivers, that can be dynamically loaded/unloaded without rebooting.
Commands: lsmod → view modules, modprobe module → load, modprobe -r module → remove.
Linux: A monolithic kernel with support for loadable kernel modules.

=========================================================================================================================================
RPO vs RTO — Quick Summary
Term Full Form   Simple Meaning   Example
RPO   Recovery Point Objective   How much data can we afford to lose?   RPO = 15 min → maximum 15 min of data loss
RTO   Recovery Time Objective   How quickly must the service be restored? RTO = 2 hours → service must recover within 2 hours

RPO defines the maximum acceptable data loss, while RTO defines the maximum acceptable downtime required to restore the service.

==============================================================================================================

RHEL Boot Process — Quick Summary
BIOS / UEFI
↓
MBR / EFI System Partition
↓
GRUB2
↓
Kernel + initramfs
↓
Kernel initialization
↓
Real root filesystem
↓
systemd (PID 1)
↓
Targets
↓
Services
↓
Login
BIOS/UEFI → Initializes hardware and finds the bootloader.
GRUB2 → Loads the Linux kernel + initramfs.
Kernel → Initializes CPU, memory, devices and other kernel components.
initramfs → Provides drivers/tools to find and mount the real root filesystem.
systemd (PID 1) → Starts userspace services and reaches the configured target.
Target → Brings the system to the required state (multi-user.target / graphical.target).
Finally, services start and the login prompt appears.

===============================================================================

Linux File Types — Quick Summary
- → Regular file → Normal data/config/log files
d → Directory → Contains files/directories
l → Symbolic link → Shortcut/reference to another file
c → Character device → Character/stream-based device
b → Block device → Storage devices like HDD/SSD
s → Socket → Communication between processes
p → Named pipe → Communication between processes using FIFO

================================================================================================

Cron / Crontab — Quick Summary
Cron → Time-based job scheduler used to run commands/scripts automatically.
crond → Background daemon/service that executes cron jobs.
crontab → File containing scheduled jobs.
Basic commands

crontab -l # List jobs
crontab -e # Edit jobs
crontab -r # Remove crontab
crontab -u user -l # View another user's crontab

* * * * * command
│ │ │ │ │
│ │ │ │ └─ Day of week (0-7)
│ │ │ └─── Month (1-12)
│ │ └───── Day of month (1-31)
│ └─────── Hour (0-23)
└───────── Minute (0-59)

0 2 * * * /backup.sh

* → every
, → multiple values
- → range
/ → interval

→ Every 10 minutes.
*/10 * * * * command

Important locations

/var/spool/cron/ → User crontabs
/etc/crontab → System-wide cron
/etc/cron.d/ → System cron jobs
/etc/cron.daily/ → Daily jobs
/etc/cron.weekly/ → Weekly jobs
/etc/cron.monthly/ → Monthly jobs

User crontab:
* * * * * command
/etc/crontab:
* * * * * user command

systemctl status crond
journalctl -u crond

===========================================================================================================================

RHEL UsrMerge — Quick Summary

Modern RHEL uses UsrMerge, where many traditional directories are symlinks to locations under /usr.

/bin → /usr/bin
/sbin → /usr/sbin
/lib → /usr/lib
/lib64 → /usr/lib64
l at the beginning of ls -l → symbolic link
The actual target directories are under /usr.
Old paths are kept as symlinks for backward compatibility.

Example:
/bin/ls

→ follows the symlink → /usr/bin/ls.

Remember: /usr is the main location; /bin, /sbin, /lib, and /lib64 are compatibility links on modern RHEL.

Linux Directory Structure — Quick Summary

/ → Root of entire filesystem
/boot → Kernel, initramfs, GRUB boot files
/etc → System configuration files
/home → Normal users' home directories
/root → Root user's home directory
/bin → Symlink → /usr/bin
/sbin → Symlink → /usr/sbin
/usr → Programs, libraries, shared data
/var → Logs, cache, variable/application data
/tmp → Temporary files
/dev → Device files
/proc → Process & kernel information (virtual)
/sys → Hardware/device & kernel information (virtual)
/run → Runtime data since boot
/opt → Optional/third-party applications
/mnt → Temporary filesystem mount point
/media → Removable media
/srv → Data provided by services

=====================================================================================

Linux Links + Inode — Quick Summary
🔹 Inode

Inode is a filesystem data structure that stores file metadata and references to the file's data blocks.

Filename → Inode → File Data

Inode contains:

Permissions
Owner/group
Size
Timestamps
Link count
Data block references

Filename is mapped to the inode by the directory.

🔹 Hard Link

Another filename pointing to the same inode.

file1 ──→ inode 123
file2 ──→ inode 123

Same inode
Same data
Cannot normally cross filesystem
Normally cannot link directories
Original filename deleted → hard link still works

ln file1 file2

Inode → File metadata + data references
Hard link → SAME inode
Soft link → DIFFERENT inode → PATH

======================================================================================================================

/etc/fstab (filesystem table) contains persistent filesystem mount configuration, so filesystems can be mounted automatically during boot.

UUID/device → Identifies the filesystem.
Mount point → Where it will be mounted, e.g. /data.
FS type → xfs, ext4, etc.
Options → How to mount, e.g. defaults, ro, rw, nofail.
Dump → Legacy backup setting; commonly 0.
Pass → Filesystem check order; commonly 0 for XFS.

fstab = What to mount + Where to mount + Filesystem type + How to mount + Boot/check settings.

============================================================================================================================

NFS — Quick Summary
NFS (Network File System) → Allows a client to access a directory/filesystem from a remote Linux server over the network.
NFS Server → Shares/exports a directory using /etc/exports.
NFS Client → Mounts the exported directory.

dnf install nfs-utils
Server → nfs-utils + nfs-server
Client → nfs-utils

Firewall
firewall-cmd --permanent --add-service=nfs
firewall-cmd --reload

Server
/etc/exports
/data 192.168.1.20(rw,sync)
exportfs -rav
exportfs -v
mount -t nfs server:/data /mnt/data

/etc/fstab
server:/data /mnt/data nfs defaults,_netdev 0 0
_netdev → tells systemd that the filesystem requires the network.

rw → Read/write
ro → Read-only
sync → Synchronous writes
async → Asynchronous writes
root_squash → Client root mapped to unprivileged user
no_root_squash → Client root not squashed
all_squash → All users mapped to anonymous user

NFSv4 → TCP 2049
NFSv3 → 2049 + RPC services such as rpcbind (111)

Important commands
systemctl status nfs-server
exportfs -v
exportfs -rav
showmount -e server
mount
umount
findmnt
rpcinfo -p server
journalctl -u nfs-server

NFS = Server exports → Client mounts → /etc/exports controls sharing → /etc/fstab makes it persistent → nfs-utils provides NFS tools.
===============================================================================================================================

RHEL PACKAGE MANAGEMENT — INTERVIEW QUICK NOTES

“yum update updates installed packages while generally preserving obsolete packages. yum upgrade also updates packages but can remove obsolete packages when required. For normal maintenance, yum update is commonly used. yum upgrade is useful when you want the installed package set to reflect the current repository state.”

1. RPM vs YUM vs DNF
--------------------
RPM = Low-level package management tool
YUM = Older high-level package manager
DNF = Modern high-level package manager / successor to YUM

RHEL 7 → YUM commonly used
RHEL 8+ → DNF primarily used

RPM works directly with .rpm files.
DNF/YUM work with repositories and resolve dependencies.

IMPORTANT:
Don't say "yum is simply a symlink to dnf".
In modern RHEL, yum is a compatibility interface using DNF
functionality.

2. RPM IMPORTANT COMMANDS
-------------------------
Install:
rpm -ivh package.rpm

Upgrade:
rpm -Uvh package.rpm

Remove:
rpm -e package

List installed:
rpm -qa

Package information:
rpm -qi package

Files installed by package:
rpm -ql package

Find which package owns a file:
rpm -qf /path/file

Show dependencies:
rpm -qR package

Verify package:
rpm -V package

3. DNF IMPORTANT COMMANDS
-------------------------
Install:
dnf install package

Remove:
dnf remove package

Update:
dnf update

Search:
dnf search package

Package information:
dnf info package

Find package providing command/file:
dnf provides '*/command'

Reinstall:
dnf reinstall package

List repositories:
dnf repolist

Clean cache:
dnf clean all

Refresh metadata:
dnf makecache

Transaction history:
dnf history

Undo transaction:
dnf history undo <ID>

4. REPOSITORIES
-------------------------------------------------------------------------------------------
Repository = location containing RPM packages + metadata.

Repository configuration:
/etc/yum.repos.d/*.repo

DNF main configuration:
/etc/dnf/dnf.conf

Important .repo options:
baseurl = repository location
enabled=1 = repository enabled
gpgcheck=1 = verify package signature

5. DEPENDENCY
-------------------------------------------------------------------------------------------
Dependency = another package/library required by software.

RPM:
- Directly installs RPM
- Does not provide DNF-style automatic repository
dependency resolution

DNF:
- Finds package from repository
- Resolves dependencies automatically

6. GPG
-------------------------------------------------------------------------------------------
GPG verifies package signatures.

gpgcheck=1
= Enable package signature verification.

7. RPM DATABASE
-------------------------------------------------------------------------------------------
Location:
/var/lib/rpm/

Contains information about installed RPM packages.

8. RHEL REPOSITORY/SUBSCRIPTION
-------------------------------------------------------------------------------------------
Check subscription:
subscription-manager status

List repositories:
subscription-manager repos --list

Enable repository:
subscription-manager repos --enable=<repo-id>

9. COMMON INTERVIEW SCENARIOS
-------------------------------------------------------------------------------------------

Which package installed a file?
rpm -qf /path/file

Which package provides a command?
dnf provides '*/command'

What files did a package install?
rpm -ql package

Why does DNF say "No match"?
→ Check repository, subscription, metadata and package availability.

Refresh DNF metadata:
dnf clean all
dnf makecache

See recent package changes:
dnf history

⭐ MOST IMPORTANT MEMORY

RPM → Direct .rpm package management
DNF → Repository + dependency management
YUM → Older DNF-style package manager
Repo → Source of RPM packages
GPG → Package signature verification
/var/lib/rpm/ → RPM database
/etc/yum.repos.d/ → Repository files
/etc/dnf/dnf.conf → DNF configuration

RPM → rpm -qa / -qi / -ql / -qf
DNF → install / remove / update / search / provides / history

=============================================================================================

SSHD + PUBLIC KEY AUTHENTICATION
================================

SSH = client
SSHD = SSH server/daemon
Default port = TCP 22

Main config:
/etc/ssh/sshd_config

Important settings:
Port 22
PermitRootLogin no
PasswordAuthentication yes/no
PubkeyAuthentication yes
AllowUsers / AllowGroups

Service:
systemctl status sshd
systemctl restart/reload sshd

Test config:
sshd -t

PUBLIC KEY AUTHENTICATION
=========================
Key pair:
Private key → Client (KEEP SECRET)
Public key → Server

Create:
ssh-keygen -t ed25519

Copy public key:
ssh-copy-id user@server

Server stores public key in:
~/.ssh/authorized_keys

Permissions:
~/.ssh = 700
authorized_keys = 600
private key = 600

Authentication:
Client proves it has private key
↓
Server checks public key in authorized_keys
↓
Login successful

known_hosts = Client stores server host keys
authorized_keys = Server stores user public keys

Troubleshooting:
ssh -vvv user@server
journalctl -u sshd
ss -lntp | grep :22
============================================================================================================================

RSYNC — SHORT INTERVIEW NOTES
============================================================================================================================

Rsync = File/directory synchronization tool.
Used for backup, migration and repeated data transfer.

Basic:
rsync -av /data/ /backup/

Remote:
rsync -av /data/ user@server:/backup/

Important options:
-a = archive/preserve attributes
-v = verbose
-z = compression
-P = progress + partial
-n = dry run
--delete = delete destination files not in source
--exclude = exclude files

Rsync over SSH → TCP 22
Rsync daemon → TCP 873
Daemon config → /etc/rsyncd.conf

IMPORTANT:
/data → copy directory
/data/ → copy contents

RSYNC vs SCP
==============================================================================================================================
SCP = Secure file copy
Rsync = File synchronization

SCP → simple/one-time copy
Rsync → repeated sync, transfers only required changes,
supports --delete, --exclude, --dry-run, etc.

INTERVIEW:
"SCP is for secure copying; rsync is for efficient
synchronization and repeated transfers."

===============================================================================================================================

LVM = Logical Volume Manager
Purpose = Flexible storage management

Architecture:
Disk/Partition → PV → VG → LV → Filesystem → Mount Point

PV = Physical Volume
Physical disk/partition prepared for LVM
Command: pvcreate

VG = Volume Group
Storage pool made from one or more PVs
Command: vgcreate

LV = Logical Volume
Virtual disk created from VG
Command: lvcreate

PE = Physical Extent
LE = Logical Extent

PV → PE
LV → LE
LE maps to PE

Extent size is defined at VG creation:
vgcreate -s 8M vgdata /dev/sdb

Create LV using 100 extents:
lvcreate -l 100 -n lvdata vgdata

Create LV using size:
lvcreate -L 10G -n lvdata vgdata

Common commands:
pvs / pvdisplay
vgs / vgdisplay
lvs / lvdisplay

Add disk:
pvcreate /dev/sdc
vgextend vgdata /dev/sdc

Extend LV:
lvextend -L +10G /dev/vgdata/lvdata

Extend LV + filesystem:
lvextend -r -L +10G /dev/vgdata/lvdata

XFS:
xfs_growfs /data

ext4:
resize2fs /dev/vgdata/lvdata

Snapshot:
lvcreate -L 10G -s -n lvdata_snap /dev/vgdata/lvdata

Important:
LV size ≠ filesystem size
After extending LV, filesystem may also need to be extended.

XFS → can grow, cannot shrink
ext4 → can grow and shrink

LVM Snapshot ≠ Backup
Snapshot = point-in-time view using copy-on-write

Main Advantages of LVM:
1. Online expansion
→ Increase LV/filesystem size while mounted
→ No need to stop the application in many cases

2. Easy storage expansion
→ Add a new disk/PV to an existing VG
→ Then extend the LV

3. Flexible storage allocation
→ Allocate space to LVs as required
→ Don't need fixed partitions for everything

4. Combine multiple disks
→ Multiple PVs can be combined into one VG

5. Snapshots
→ Create point-in-time snapshots of LVs
→ Useful for backups/testing

======================================================================================================================================

Linux permissions control who can access files/directories.

Check:
ls -l
ls -ld /directory

Basic permissions:
r = read = 4
w = write = 2
x = execute = 1

Permission order:
Owner | Group | Others

Example:
-rwxr-xr--
Owner → rwx
Group → r-x
Others → r--

Numeric:
755 = rwxr-xr-x
644 = rw-r--r--
700 = rwx------
600 = rw-------

Commands:
chmod 755 file → change permissions
chown user:group file → change owner + group
chgrp group file → change group

Directory permissions:
r → list contents
w → create/delete/rename files
x → enter/traverse directory

SUID:
4xxx
Executable runs with file owner's effective UID.
Example:
chmod 4755 file

SGID:
2xxx
Executable → runs with file's group
Directory → new files inherit directory's group
Example:
chmod 2775 /shared

Sticky Bit:
1xxx
Users cannot normally delete/rename files belonging to other users
Example:
chmod 1777 /shared
Common example: /tmp

umask:
Controls default permissions for NEW files/directories.

Base:
File → 666
Directory → 777

umask 022:
File → 644
Directory → 755

umask 077:
File → 600
Directory → 700

ACL = Access Control List
Used when owner/group/others are not enough.
Allows specific users/groups to have specific permissions.

Check ACL:
getfacl file

Set ACL:
setfacl -m u:alice:rw file

Remove ACL:
setfacl -x u:alice file

If ls shows '+':
-rw-r-----+
↑
Extended ACL exists

Important difference:
chmod → basic permissions
ACL → granular permissions
umask → default permissions for new objects

SUID → owner privilege
SGID → group privilege / group inheritance
Sticky → restrict deletion in shared directories

======================================================================================================================

IP Address
→ Identifies a host/network interface.
Example: 192.168.1.10

Subnet
→ Defines network + host portion.
Example: 192.168.1.0/24

Gateway
→ Router used to reach other networks.
Check:
ip route

DNS
→ Converts hostname ↔ IP.
Check:
cat /etc/resolv.conf
dig google.com
nslookup google.com

Routing
→ Determines where packets should go.
Check:
ip route

PORTS
→ Identify services on a host.

22 → SSH
53 → DNS
80 → HTTP
443 → HTTPS
123 → NTP
389 → LDAP
636 → LDAPS
445 → SMB
2049 → NFS
3306 → MySQL
5432 → PostgreSQL
8080 → HTTP alternate

TCP
→ Connection-oriented + reliable.
→ SYN → SYN-ACK → ACK

UDP
→ Connectionless + no delivery guarantee.

ss
→ Check listening ports/connections.

ss -lntp
→ Listening TCP + process

ss -lunp
→ Listening UDP + process

ss -tunap
→ All TCP/UDP connections

ss -lntp | grep :22
→ Check SSH port

IP COMMANDS

ip addr
→ Show IP addresses/interfaces

ip link
→ Show interface status

ip route
→ Show routing table

PING

ping 192.168.1.1
→ Test IP connectivity using ICMP

Important:
Ping success does NOT mean application/port is working.

TRACEPATH / TRACEROUTE

tracepath 8.8.8.8
traceroute 8.8.8.8

→ Show network path/hops

DNS

dig google.com
nslookup google.com

→ Test DNS resolution

CURL

curl -v http://server:8080
curl -I https://server

→ Test application/HTTP/HTTPS connectivity

FIREWALL

Check:
firewall-cmd --state
firewall-cmd --get-active-zones
firewall-cmd --list-all
firewall-cmd --list-services
firewall-cmd --list-ports

Allow service:
firewall-cmd --permanent --add-service=http
firewall-cmd --reload

Allow single port:
firewall-cmd --permanent --add-port=8080/tcp
firewall-cmd --reload

Allow UDP:
firewall-cmd --permanent --add-port=53/udp
firewall-cmd --reload

Allow port range:
firewall-cmd --permanent --add-port=8000-8080/tcp
firewall-cmd --reload

Allow UDP range:
firewall-cmd --permanent --add-port=5000-6000/udp
firewall-cmd --reload

Remove port:
firewall-cmd --permanent --remove-port=8080/tcp
firewall-cmd --reload

TCPDUMP
→ Captures actual network packets.

Basic:
tcpdump -i any -n

Specific port:
tcpdump -i any -n port 8080

TCP port:
tcpdump -i any -n tcp port 443

UDP port:
tcpdump -i any -n udp port 53

Specific host:
tcpdump -i any -n host 192.168.1.10

Host + port:
tcpdump -i any -n host 192.168.1.10 and port 443

Source:
tcpdump -i any -n src host 192.168.1.10

Destination:
tcpdump -i any -n dst host 192.168.1.10

Save capture:
tcpdump -i any -n -w capture.pcap

Read capture:
tcpdump -r capture.pcap

Capture 100 packets:
tcpdump -i any -n -c 100

TCP FLAGS

[S] → SYN
[S.] → SYN-ACK
[.] → ACK
[R] → RST
[F.] → FIN-ACK

TCP TROUBLESHOOTING

SYN
→ Client is trying to connect.

SYN → SYN-ACK → ACK
→ TCP connection established.

SYN reaches server but no SYN-ACK
→ Check service, firewall, routing.

SYN → RST
→ Connection refused; often no service listening.

SYN repeatedly, no response
→ Timeout; investigate firewall/network/remote host.

Handshake succeeds but application fails
→ Check application/TLS/HTTP.

NETWORK TROUBLESHOOTING FLOW

ip addr
↓
ip route
↓
ping
↓
ss
↓
firewall-cmd
↓
curl
↓
tcpdump
↓
application logs

tcpdump:
tcpdump -i any -nn
tcpdump -i any -nn port 8080
tcpdump -i any -nn host 10.10.10.20
tcpdump -i any -nn host 10.10.10.20 and port 8080
tcpdump -i any -nn -w capture.pcap

============================================================================================================================