Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

https://github.com/trimstray/test-your-sysadmin-skills

A collection of Linux Sysadmin Test Questions and Answers. Test your knowledge and skills in different fields with these Q/A.
https://github.com/trimstray/test-your-sysadmin-skills

answers bsd cheatsheets cybersecurity databases devops exam interview interview-questions knowledge linux network resources security skills sysadmin sysops systems unix webops

Last synced: about 1 year ago
JSON representation

A collection of Linux Sysadmin Test Questions and Answers. Test your knowledge and skills in different fields with these Q/A.

Awesome Lists containing this project

README 

          


  

    Master

  








:star:



"A great Admin doesn't need to know everything, but they should be able to come up with amazing solutions to impossible projects." - cwheeler33 (ServerFault)



:star:



"My skills are making things work, not knowing a billion facts. [...] If I need to fix a system I’ll identify the problem, check the logs and look up the errors. If I need to implement a solution I’ll research the right solution, implement and document it, the later on only really have a general idea of how it works unless I interact with it frequently... it’s why it’s documented." - Sparcrypt (Reddit)









  

    Pull Requests

  

  

    MIT License

  








****







:information_source:  This project contains **284** test questions and answers that can be used as a test your knowledge or during an interview/exam for position such as **Linux (\*nix) System Administrator**.



:heavy_check_mark:  The answers are only **examples** and do not exhaust the whole topic. Most of them contains **useful resources** for a deeper understanding.



:warning:  Questions marked **`***`** don't have answer yet or answer is incomplete - **make a pull request to add them**!



:traffic_light:  If you find something which doesn't make sense, or something doesn't seem right, **please make a pull request** and please add valid and well-reasoned explanations about your changes or comments.



:books:  In order to improve your knowledge/skills please see [devops-interview-questions](https://github.com/bregman-arie/devops-interview-questions). It looks really interesting.









  » All suggestions are welcome «








## Table of Contents



| The type of chapter | Number of questions | Short description |

| :---         | :---         | :---         |

| [Introduction](#introduction) |||

| :small_orange_diamond: [Simple Questions](#simple-questions) | 14 questions | Relaxed, fun and simple - are great for starting everything. |

| [General Knowledge](#general-knowledge) |||

| :small_orange_diamond: [Junior Sysadmin](#junior-sysadmin) | 65 questions | Reasonably simple and straight based on basic knowledge. |

| :small_orange_diamond: [Regular Sysadmin](#regular-sysadmin) | 94 questions | The mid level of questions if that you have sound knowledge. |

| :small_orange_diamond: [Senior Sysadmin](#senior-sysadmin) | 99 questions | Hard questions and riddles. Check it if you want to be good. |

| [Secret Knowledge](#secret-knowledge) ||

| :small_orange_diamond: [Guru Sysadmin](#guru-sysadmin) | 12 questions | Really deep questions are to get to know Guru Sysadmin. |







## Introduction



### :diamond_shape_with_a_dot_inside: Simple Questions



- What did you learn this week?

- What excites or interests you about the sysadmin world?

- What is a recent technical challenge you experienced and how did you solve it?

- Tell me about the last major project you finished.

- Do you contribute to any open source projects?

- Describe the setup of your homelab.

- What personal achievement are you most proud of?

- Tell me about the biggest mistake you've made. How would you do it differently today?

- What software tools are you going to install on the first day at a new job?

- Tell me about how you manage your knowledge database (e.g. wikis, files, portals).

- What news sources do you check daily? (sysadmin, security-related or other)

- Your NOC team has a new budget for sysadmin certifications. What certificate would you like and why?

- How do you interact with developers: *us vs. them* or *all pulling together with a different approach*?

- Which sysadmin question would you ask, if you were interviewing me, to know, how good I'm with non-standard situations?



## General Knowledge



### :diamond_shape_with_a_dot_inside: Junior Sysadmin



###### System Questions (37)



Give some examples of Linux distribution. What is your favorite distro and why?


- Red Hat Enterprise Linux

- Fedora

- CentOS

- Debian

- Ubuntu

- Mint

- SUSE Linux Enterprise Server (SLES)

- SUSE Linux Enterprise Desktop (SLED)

- Slackware

- Arch

- Kali

- Backbox



My favorite Linux distribution:



- **Arch Linux**, which offers a nice minimalist base system on which one can build a custom operating system. The beauty of it too is that it has the Arch User Repository (AUR), which when combined with its official binary repositories allows it to probably have the largest repositories of any distribution. Its packaging process is also very simple, which means if one wants a package not in its official repositories or the AUR, it should be easy to make it for oneself.

- **Linux Mint**, which is also built from Ubuntu LTS releases, but features editions featuring a few different desktop environments, including Cinnamon, MATE and Xfce. Mint is quite polished and its aesthetics are rather appealing, I especially like its new icon theme, although I do quite dislike its GTK+ theme (too bland to my taste). I’ve also found a bug in its latest release Mint 19, that is getting quite irritating as I asked for with it over a fortnight ago on their forums and I have received no replies so far and it is a bug that makes my life on it more difficult.

- **Kali Linux**, is a Debian-based Linux distribution aimed at advanced Penetration Testing and Security Auditing. Kali contains several hundred tools which are geared towards various information security tasks, such as Penetration Testing, Security research, Computer Forensics and Reverse Engineering.



Useful resources:



- [List of Linux distributions](https://en.wikipedia.org/wiki/List_of_Linux_distributions)

- [What is your favorite Linux distro and why?](https://www.quora.com/What-is-your-favorite-Linux-distro-and-why)



What are the differences between Unix, Linux, BSD, and GNU?



**GNU** isn't really an OS. It's more of a set of rules or philosophies that govern free software, that at the same time gave birth to a bunch of tools while trying to create an OS. So **GNU** tools are basically open versions of tools that already existed, but were reimplemented to conform to principals of open software. **GNU/Linux** is a mesh of those tools and the **Linux kernel** to form a complete OS, but there are other GNUs, e.g. **GNU/Hurd**.



**Unix** and **BSD** are "older" implementations of POSIX that are various levels of "closed source". **Unix** is usually totally closed source, but there are as many flavors of **Unix** as there are **Linux** (if not more). **BSD** is not usually considered "open", but it was considered to be very open when it was released. Its licensing also allowed for commercial use with far fewer restrictions than the more "open" licenses of the time allowed.



**Linux** is the newest of the four. Strictly speaking, it's "just a kernel"; however, in general, it's thought of as a full OS when combined with GNU Tools and several other core components.



The main governing differences between these are their ideals. **Unix**, **Linux**, and **BSD** have different ideals that they implement. They are all POSIX, and are all basically interchangeable. They do solve some of the same problems in different ways. So other then ideals and how they choose to implement POSIX standards, there is little difference.



For more info I suggest your read a brief article on the creation of **GNU**, **OSS**, **Linux**, **BSD**, and **UNIX**. They will be slanted towards their individual ideas, but those articles should give you a better idea of the differences.



Useful resources:



- [What is the difference between Unix, Linux, BSD and GNU? (original)](https://unix.stackexchange.com/questions/104714/what-is-the-difference-between-unix-linux-bsd-and-gnu)

- [The Great Debate: Is it Linux or GNU/Linux?](https://www.howtogeek.com/139287/the-great-debate-is-it-linux-or-gnulinux/)



What is a CLI? Tell me about your favorite CLI tools, tips, and hacks.



**CLI** is an acronym for Command Line Interface or Command Language Interpreter. The command line is one of the most powerful ways to control your system/computer.



In Unix like systems, **CLI** is the interface by which a user can type commands for the system to execute. The **CLI** is very powerful, but is not very error-tolerant.



The **CLI** allows you to do manipulations with your system’s internals and with code in a much more fine-tuned way. It offers greater flexibility and control than a GUI regardless of what OS is used. Many programs that you might want to use in your software that are hosted on say Github also require running some commands on the **CLI** in order to get them running.



**My favorite tools**



- `screen` - free terminal multiplexer, I can start a session and My terminals will be saved even when you connection is lost, so you can resume later or from home

- `ssh` - the most valuable over-all command to learn, I can use it to do some amazing things:

  * mount a file system over the internet with `sshfs`

  * forward commands: runs against a `rsync` server with no `rsync` deamon by starting one itself via ssh

  * run in batch files: I can redirect the output from the remote command and use it within local batch file

- `vi/vim` - is the most popular and powerful text editor, it's universal, it's work very fast, even on large files

- `bash-completion` - contains a number of predefined completion rules for shell



**Tips & Hacks**



- searches the command history with `CTRL + R`

- `popd/pushd` and other shell builtins which allow you manipulate the directory stack

- editing keyboard shortcuts like a `CTRL + U`, `CTRL + E`

- combinations will be auto-expanded:

  * `!*` - all arguments of last command

  * `!!` - the whole of last command

  * `!ssh` - last command starting with ssh



Useful resources:



- [Command Line Interface Definition](http://www.linfo.org/command_line_interface.html)

- [What is your single most favorite command-line trick using Bash?](https://stackoverflow.com/questions/68372/what-is-your-single-most-favorite-command-line-trick-using-bash/69716)

- [What are your favorite command line features or tricks?](https://unix.stackexchange.com/questions/6/what-are-your-favorite-command-line-features-or-tricks)



What is your favorite shell and why?



**BASH** is my favorite. It’s really a preferential kind of thing, where I love the syntax and it just "clicks" for me. The input/output redirection syntax (`>>`, `<< 2>&1`, `2>`, `1>`, etc) is similar to C++ which makes it easier for me to recognize.



I also like the **ZSH** shell, because is much more customizable than **BASH**. It has the Oh-My-Zsh framework, powerful context based tab completion, pattern matching/globbing on steroids, loadable modules and more.



Useful resources:



- [Comparison of command shells](https://en.wikipedia.org/wiki/Comparison_of_command_shells)



How do you get help on the command line? ***



- `man` [commandname] can be used to see a description of a command (ex.: `man less`, `man cat`)



- `-h` or `--help` some programs will implement printing instructions when passed this parameter (ex.: `python -h` and `python --help`)



Your first 5 commands on a *nix server after login.



- `w` - a lot of great information in there with the server uptime

- `top` - you can see all running processes, then order them by CPU, memory utilization and more

- `netstat` - to know on what port and IP your server is listening on and what processes are using those

- `df` - reports the amount of available disk space being used by file systems

- `history` - tell you what was previously run by the user you are currently connected to



Useful resources:



- [First 5 Commands When I Connect on a Linux Server (original)](https://www.linux.com/blog/first-5-commands-when-i-connect-linux-server)



What do the fields in ls -al output mean?



In the order of output:



```bash

-rwxrw-r--    1    root   root 2048    Jan 13 07:11 db.dump

```



- file permissions,

- number of links,

- owner name,

- owner group,

- file size,

- time of last modification,

- file/directory name



File permissions is displayed as following:



- first character is `-` or `l` or `d`, `d` indicates a directory, a `-` represents a file, `l` is a symlink (or soft link) - special type of file

- three sets of characters, three times, indicating permissions for owner, group and other:

  - `r` = readable

  - `w` = writable

  - `x` = executable



In your example `-rwxrw-r--`, this means the line displayed is:



- a regular file (displayed as `-`)

- readable, writable and executable by owner (`rwx`)

- readable, writable, but not executable by group (`rw-`)

- readable but not writable or executable by other (`r--`)



Useful resources:



- [What do the fields in ls -al output mean? (original)](https://unix.stackexchange.com/questions/103114/what-do-the-fields-in-ls-al-output-mean)



How do you get a list of logged-in users?



For a summary of logged-in users, including each login of a username, the terminal users are attached to, the date/time they logged in, and possibly the computer from which they are making the connection, enter:



```bash

# It uses /var/run/utmp and /var/log/wtmp files to get the details.

who

```



For extensive information, including username, terminal, IP number of the source computer, the time the login began, any idle time, process CPU cycles, job CPU cycles, and the currently running command, enter:



```bash

# It uses /var/run/utmp, and their processes /proc.

w

```



Also important for displays a list of last logged in users, enter:



```bash

# It uses /var/log/wtmp.

last

```



Useful resources:



- [4 Ways to Identify Who is Logged-In on Your Linux System](https://www.thegeekstuff.com/2009/03/4-ways-to-identify-who-is-logged-in-on-your-linux-system/)



What is the advantage of executing the running processes in the background? How can you do that?



The most significant advantage of executing the running process in the background is that you can do any other task simultaneously while other processes are running in the background. So, more processes can be completed in the background while you are working on different processes. It can be achieved by adding a special character `&` at the end of the command.



Generally applications that take too long to execute and doesn't require user interaction are sent to background so that we can continue our work in terminal.



For example if you want to download something in background, you can:



```bash

wget https://url-to-download.com/download.tar.gz &

```



When you run the above command you get the following output:



```bash

[1] 2203

```



Here 1 is the serial number of job and 2203 is PID of the job.



You can see the jobs running in background using the following command:



```bash

jobs

```



When you execute job in background it give you a PID of job, you can kill the job running in background using the following command:



```bash

kill PID

```



Replace the PID with the PID of the job. If you have only one job running you can bring it to foreground using:



```bash

fg

```



If you have multiple jobs running in background you can bring any job in foreground using:



```bash

fg %#

```



Replace the `#` with serial number of the job.



Useful resources:



- [How do I run a Unix process in the background?](https://kb.iu.edu/d/afnz)

- [Job Control Commands](http://tldp.org/LDP/abs/html/x9644.html)

- [What is/are the advantage(s) of running applications in background?](https://unix.stackexchange.com/questions/162186/what-is-are-the-advantages-of-running-applications-in-backgound)



Before you can manage processes, you must be able to identify them. Which tools will you use? ***



To be completed.



Running the command as root user. It is a good or bad practices?



Running (everything) as root is bad because:



- **Stupidity**: nothing prevents you from making a careless mistake. If you try to change the system in any potentially harmful way, you need to use sudo, which ensures a pause (while you're entering the password) to ensure that you aren't about to make a mistake.



- **Security**: harder to hack if you don't know the admin user's login account. root means you already have one half of the working set of admin credentials.



- **You don't really need it**: if you need to run several commands as root, and you're annoyed by having to enter your password several times when `sudo` has expired, all you need to do is `sudo -i` and you are now root. Want to run some commands using pipes? Then use `sudo sh -c "command1 | command2"`.



- **You can always use it in the recovery console**: the recovery console allows you to recover from a major mistake, or fix a problem caused by an app (which you still had to run as `sudo`). Ubuntu doesn't have a password for the root account in this case, but you can search online for changing that - this will make it harder for anyone that has physical access to your box to be able to do harm.



Useful resources:



- [Why is it bad to log in as root? (original)](https://askubuntu.com/questions/16178/why-is-it-bad-to-log-in-as-root)

- [What's wrong with always being root?](https://serverfault.com/questions/57962/whats-wrong-with-always-being-root)

- [Why you should avoid running applications as root](https://bencane.com/2012/02/20/why-you-should-avoid-running-applications-as-root/)



How to check memory stats and CPU stats?



You'd use `top/htop` for both. Using `free` and `vmstat` command we can display the physical and virtual memory statistics respectively. With the help of `sar` command we see the CPU utilization & other stats (but `sar` isn't even installed in most systems).



Useful resources:



- [How do I Find Out Linux CPU Utilization?](https://www.cyberciti.biz/tips/how-do-i-find-out-linux-cpu-utilization.html)

- [16 Linux server monitoring commands you really need to know](https://www.hpe.com/us/en/insights/articles/16-linux-server-monitoring-commands-you-really-need-to-know-1703.html)



What is load average?



Linux **load averages** are "system load averages" that show the running thread (task) demand on the system as an average number of running plus waiting threads. This measures demand, which can be greater than what the system is currently processing. Most tools show three averages, for 1, 5, and 15 minutes.



These 3 numbers are not the numbers for the different CPUs. These numbers are mean values of the load number for a given period of time (of the last 1, 5 and 15 minutes).



**Load average** is usually described as "average length of run queue". So few CPU-consuming processes or threads can raise **load average** above 1. There is no problem if **load average** is less than total number of CPU cores. But if it gets higher than number of CPUs, this means some threads/processes will stay in queue, ready to run, but waiting for free CPU.



It is meant to give you an idea of the state of the system, averaged over several periods of time. Since it is averaged, it takes time for it to go back to 0 after a heavy load was placed on the system.



Some interpretations:



- if the averages are 0.0, then your system is idle

- if the 1 minute average is higher than the 5 or 15 minute averages, then load is increasing

- if the 1 minute average is lower than the 5 or 15 minute averages, then load is decreasing

- if they are higher than your CPU count, then you might have a performance problem (it depends)



Useful resources:



- [Linux Load Averages: Solving the Mystery (original)](http://www.brendangregg.com/blog/2017-08-08/linux-load-averages.html)

- [Linux load average - the definitive summary](http://blog.angulosolido.pt/2015/04/linux-load-average-definitive-summary.html)

- [How CPU load averages work (and using them to triage webserver performance!)](https://jvns.ca/blog/2016/02/07/cpu-load-averages/)



Where is my password stored on Linux/Unix?



The passwords are not stored anywhere on the system at all. What is stored in `/etc/shadow` are so called hashes of the passwords.



A hash of some text is created by performing a so called one way function on the text (password), thus creating a string to check against. By design it is "impossible" (computationally infeasible) to reverse that process.



Older Unix variants stored the encrypted passwords in `/etc/passwd` along with other information about each account.



Newer ones simply have a `*` in the relevant field in `/etc/passwd` and use `/etc/shadow` to store the password, in part to ensure nobody gets read access to the passwords when they only need the other stuff (`shadow` is usually protected more strongly than `passwd`).



For more info consult `man crypt`, `man shadow`, `man passwd`.



Useful resources:



- [Where is my password stored on Linux?](https://security.stackexchange.com/questions/37050/where-is-my-password-stored-on-linux)

- [Where are the passwords of the users located in Linux?](https://www.cyberciti.biz/faq/where-are-the-passwords-of-the-users-located-in-linux/)

- [Linux Password & Shadow File Formats](https://www.tldp.org/LDP/lame/LAME/linux-admin-made-easy/shadow-file-formats.html)



How to recursively change permissions for all directories except files and for all files except directories?



To change all the directories e.g. to **755** (`drwxr-xr-x`):



```bash

find /opt/data -type d -exec chmod 755 {} \;

```



To change all the files e.g. to **644** (`-rw-r--r--`):



```bash

find /opt/data -type f -exec chmod 644 {} \;

```



Useful resources:



- [How do I set chmod for a folder and all of its subfolders and files? (original)](https://stackoverflow.com/questions/3740152/how-do-i-set-chmod-for-a-folder-and-all-of-its-subfolders-and-files?rq=1)



Every command fails with command not found. How to trace the source of the error and resolve it?



It looks that at one point or another are overwriting the default `PATH` environment variable. The type of errors you have, indicates that `PATH` does not contain e.g. `/bin`, where the commands (including bash) reside.



One way to begin debugging your bash script or command would be to start a subshell with the `-x` option:



```bash

bash --login -x

```



This will show you every command, and its arguments, which is executed when starting that shell.



Also very helpful is show `PATH` variable values:



```bash

echo $PATH

```



If you run this:



```bash

PATH=/bin:/sbin:/usr/bin:/usr/sbin

```



most commands should start working - and then you can edit `~/.bash_profile` instead of `~/.bashrc` and fix whatever is resetting `PATH` there. Default `PATH` variable values for **root** and other users is in `/etc/profile` file.



Useful resource:



- [How to correctly add a path to PATH?](https://unix.stackexchange.com/questions/26047/how-to-correctly-add-a-path-to-path)



You typing CTRL + C but your script still running. How do you stop it? 



In most cases, you can stop a running script by using the `CTRL + C` keyboard combination. This sends an interrupt signal (SIGINT) to the script, which terminates its execution. If this does not work and the script is still running, you can try using the `CTRL + \` combination, which sends a quit signal (SIGQUIT) to the script, which may terminate it immediately.



Alternatively, if you are using a terminal or command line interface, you can try using the `kill` command to send a signal to the script process. You can find the process ID (PID) of the script by using the `ps` or `top` command, and then use `kill` with the PID to stop the script.



In some cases, you may need to use the `kill -9` command to force the script to stop, as the regular kill command may not work if the script is stuck or not responding. The `-9` option sends a SIGKILL signal, which forces the process to stop immediately.



What is grep command? How to match multiple strings in the same line?



The `grep` utilities are a family of Unix tools, including `egrep` and `fgrep`.



`grep` searches file patterns. If you are looking for a specific pattern in the output of another command, `grep` highlights the relevant lines. Use this grep command for searching log files, specific processes, and more.



For match multiple strings:



```bash

grep -E "string1|string2" filename

```



or



```bash

grep -e "string1" -e "string2" filename

```



Useful resources:



- [What is grep, and how do I use it? (original)](https://kb.iu.edu/d/afiy)



Explain the file content commands along with the description.



- `head`: to check the starting of a file.

- `tail`: to check the ending of the file. It is the reverse of head command.

- `cat`: used to view, create, concatenate the files.

- `more`: used to display the text in the terminal window in pager form.

- `less`: used to view the text in the backward direction and also provides single line movement.



Useful resources:



- [Viewing text files from the shell prompt](https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/4/html/Step_by_Step_Guide/s1-viewingtext-terminal.html)



SIGHUP, SIGINT, SIGKILL, and SIGTERM POSIX signals. Explain.



- **SIGHUP** - is sent to a process when its controlling terminal is closed. It was originally designed to notify the process of a serial line drop (a hangup). Many daemons will reload their configuration files and reopen their logfiles instead of exiting when receiving this signal.

- **SIGINT** - is sent to a process by its controlling terminal when a user wishes to interrupt the process. This is typically initiated by pressing `Ctrl+C`, but on some systems, the "delete" character or "break" key can be used.

- **SIGKILL** - is sent to a process to cause it to terminate immediately (kill). In contrast to **SIGTERM** and **SIGINT**, this signal cannot be caught or ignored, and the receiving process cannot perform any clean-up upon receiving this signal.

- **SIGTERM** - is sent to a process to request its termination. Unlike the **SIGKILL** signal, it can be caught and interpreted or ignored by the process. This allows the process to perform nice termination releasing resources and saving state if appropriate. **SIGINT** is nearly identical to **SIGTERM**.



Useful resources:



- [POSIX signals](https://dsa.cs.tsinghua.edu.cn/oj/static/unix_signal.html)

- [Introduction To Unix Signals Programming](http://titania.ctie.monash.edu.au/signals/)



What does kill command do?



In Unix and Unix-like operating systems, `kill` is a command used to send a signal to a process. By default, the message sent is the termination signal, which requests that the process exit. But `kill` is something of a misnomer; the signal sent may have nothing to do with process killing.



Useful resources:



- [Mastering the "Kill" Command in Linux](https://www.maketecheasier.com/kill-command-in-linux/)



What is the difference between rm and rm -rf?



`rm` only deletes the named files (and not directories). With `-rf` as you say:



- `-r`, `-R`, `--recursive` recursively deletes content of a directory, including hidden files and sub directories

- `-f`, `--force` ignore nonexistent files, never prompt



Useful resources:



- [What is the difference between `rm -r` and `rm -f`?](https://superuser.com/questions/1126206/what-is-the-difference-between-rm-r-and-rm-f)



How do I grep recursively? Explain on several examples. ***



To be completed.



archive.tgz has ~30 GB. How do you list content of it and extract only one file?



```bash

# list of content

tar tf archive.tgz



# extract file

tar xf archive.tgz filename

```



Useful resources:



- [List the contents of a tar or tar.gz file](https://www.cyberciti.biz/faq/list-the-contents-of-a-tar-or-targz-file/)

- [How to extract specific file(s) from tar.gz](https://unix.stackexchange.com/questions/61461/how-to-extract-specific-files-from-tar-gz)



Execute combine multiple shell commands in one line.



If you want to execute each command only if the previous one succeeded, then combine them using the `&&` operator:



```bash

cd /my_folder && rm *.jar && svn co path to repo && mvn compile package install

```



If one of the commands fails, then all other commands following it won't be executed.



If you want to execute all commands regardless of whether the previous ones failed or not, separate them with semicolons:



```bash

cd /my_folder; rm *.jar; svn co path to repo; mvn compile package install

```



In your case, I think you want the first case where execution of the next command depends on the success of the previous one.



You can also put all commands in a script and execute that instead:



```bash

#! /bin/sh

cd /my_folder \

&& rm *.jar \

&& svn co path to repo \

&& mvn compile package install

```



Useful resources:



- [Execute combine multiple linux commands in one line (original)](https://stackoverflow.com/questions/13077241/execute-combine-multiple-linux-commands-in-one-line)



What symbolic representation can you pass to chmod to give all users execute access to a file without affecting other permissions?



```bash

chmod a+x /path/to/file

```



- `a` - for all users

- `x` - for execution permission

- `r` - for read permission

- `w` - for write permission



Useful resources:

- [How to Set File Permissions Using chmod](https://www.washington.edu/computing/unix/permissions.html)

- [What does "chmod +x your_file_name" do and how do I use it?](https://askubuntu.com/questions/443789/what-does-chmod-x-filename-do-and-how-do-i-use-it)



How can I sync two local directories?



To sync the contents of **dir1** to **dir2** on the same system, type:



```bash

rsync -av --progress --delete dir1/ dir2

```



- `-a`, `--archive` - archive mode

- `--delete` - delete extraneous files from dest dirs

- `-v`, `--verbose` - verbose mode (increase verbosity)

- `--progress` - show progress during transfer



Useful resources:



- [How can I sync two local directories? (original](https://unix.stackexchange.com/questions/392536/how-can-i-sync-two-local-directories)

- [Synchronizing folders with rsync](https://www.jveweb.net/en/archives/2010/11/synchronizing-folders-with-rsync.html)



Many basic maintenance tasks require you to edit config files. Explain ways to undo the changes you make.



- manually backup of a file before editing (with brace expansion like this: `cp filename{,.orig}`)

- manual copy of the directory structure where file is stored (e.g. `cp`, `rsync` or `tar`)

- make a backup of original file in your editor (e.g. set rules in your editor configuration file)

- the best solution is to use `git` (or any other version control) to keep track of configuration files (e.g. `etckeeper` for `/etc` directory)



Useful resources:



- [Backup file with .bak before filename extension](https://unix.stackexchange.com/questions/66376/backup-file-with-bak-before-filename-extension)

- [Is it a good idea to use git for configuration file version controlling?](https://superuser.com/questions/1037211/is-it-a-good-idea-to-use-git-for-configuration-file-version-controlling)



You have to find all files larger than 20MB. How you do it?



```bash

find / -type f -size +20M

```



Useful resources:



- [How can I find files that are bigger/smaller than x bytes?](https://superuser.com/questions/204564/how-can-i-find-files-that-are-bigger-smaller-than-x-bytes)



Why do we use sudo su - and not just sudo su?



`sudo` is in most modern Linux distributions where (but not always) the root user is disabled and has no password set. Therefore you cannot switch to the root user with `su` (you can try). You have to call `sudo` with root privileges: `sudo su`.



`su` just switches the user, providing a normal shell with an environment nearly the same as with the old user.



`su -` invokes a login shell after switching the user. A login shell resets most environment variables, providing a clean base.



Useful resources:



- [su vs sudo -s vs sudo -i vs sudo bash](https://unix.stackexchange.com/questions/35338/su-vs-sudo-s-vs-sudo-i-vs-sudo-bash)

- [Why do we use su - and not just su? (original)](https://unix.stackexchange.com/questions/7013/why-do-we-use-su-and-not-just-su)



How to find files that have been modified on your system in the past 60 minutes?



```bash

find / -mmin -60 -type f

```



Useful resources:



- [Get all files modified in last 30 days in a directory (orignal)](https://stackoverflow.com/questions/23070245/get-all-files-modified-in-last-30-days-in-a-directory)



What are the main reasons for keeping old log files?



They are essential to investigate issues on the system. **Log management** is absolutely critical for IT security.



Servers, firewalls, and other IT equipment keep log files that record important events and transactions. This information can provide important clues about hostile activity affecting your network from within and without. Log data can also provide information for identifying and troubleshooting equipment problems including configuration problems and hardware failure.



It’s your server’s record of who’s come to your site, when, and exactly what they looked at. It’s incredibly detailed, showing:



- where folks came from

- what browser they were using

- exactly which files they looked at

- how long it took to load each file

- and a whole bunch of other nerdy stuff



Factors to consider:



- legal requirements for retention or destruction

- company policies for retention and destruction

- how long the logs are useful

- what questions you're hoping to answer from the logs

- how much space they take up



By collecting and analyzing logs, you can understand what transpires within your network. Each log file contains many pieces of information that can be invaluable, especially if you know how to read them and analyze them.



Useful resources:



- [How long do you keep log files?](https://serverfault.com/questions/135365/how-long-do-you-keep-log-files)



What is an incremental backup?



An incremental backup is a type of backup that only copies files that have changed since the previous backup.



Useful resources:



- [What Is Incremental Backup?](https://www.nakivo.com/blog/what-is-incremental-backup/)



What is RAID? What is RAID0, RAID1, RAID5, RAID6, RAID10? 



A **RAID** (Redundant Array of Inexpensive Disks) is a technology that is used to increase the performance and/or reliability of data storage.



- **RAID0**: Also known as disk **striping**, is a technique that breaks up a file and spreads the data across all the disk drives in a RAID group. There are no safeguards against failure

- **RAID1**: A popular disk subsystem that increases safety by writing the same data on two drives. Called "**mirroring**," RAID 1 does not increase write performance, but read performance may equal up to the sum of each disks' performance. However, if one drive fails, the second drive is used, and the failed drive is manually replaced. After replacement, the RAID controller duplicates the contents of the working drive onto the new one

- **RAID5**: It is disk subsystem that increases safety by computing parity data and increasing speed by interleaving data across three or more drives (**striping**). Upon failure of a single drive, subsequent reads can be calculated from the distributed parity such that no data is lost

- **RAID6**: RAID 6 extends RAID 5 by adding another parity block. It requires a minimum of four disks and can continue to execute read and write of any two concurrent disk failures. RAID 6 does not have a performance penalty for read operations, but it does have a performance penalty on write operations because of the overhead associated with parity calculations

- **RAID10**: Also known as **RAID 1+0**, is a RAID configuration that combines disk mirroring and disk striping to protect data. It requires a minimum of four disks, and stripes data across mirrored pairs. As long as one disk in each mirrored pair is functional, data can be retrieved. If two disks in the same mirrored pair fail, all data will be lost because there is no parity in the striped sets



Useful resources:



- [RAID](https://www.prepressure.com/library/technology/raid)



How is a user’s default group determined? How would you change it? 



```bash

useradd -m -g initial_group username

```



`-g/--gid`: defines the group name or number of the user's initial login group. If specified, the group name must exist; if a group number is provided, it must refer to an already existing group.



If not specified, the behaviour of useradd will depend on the `USERGROUPS_ENAB` variable contained in `/etc/login.defs`. The default behaviour (`USERGROUPS_ENAB yes`) is to create a group with the same name as the username, with **GID** equal to **UID**.



Useful resources:



- [How can I change a user's default group in Linux?](https://unix.stackexchange.com/questions/26675/how-can-i-change-a-users-default-group-in-linux)



What is your best command line text editor for daily working and scripting? ***



To be completed.



Why would you want to mount servers in a rack?



- Protecting Hardware

- Proper Cooling

- Organized Workspace

- Better Power Management

- Cleaner Environment



Useful resources:



- [5 Reasons to Rackmount Your PC](https://www.racksolutions.com/news/custom-projects/5-reasons-to-rackmount-pc/)



###### Network Questions (23)



Draw me a simple network diagram: you have 20 systems, 1 router, 4 switches, 5 servers, and a small IP block. ***



To be completed.



What are the most important things to understand about the OSI (or any other) model?



The most important things to understand about the **OSI** (or any other) model are:



- we can divide up the protocols into layers

- layers provide encapsulation

- layers provide abstraction

- layers decouple functions from others



Useful resources:



- [OSI Model and Networking Protocols Relationship](https://networkengineering.stackexchange.com/questions/6380/osi-model-and-networking-protocols-relationship)



What is the difference between a VLAN and a subnet? Do you need a VLAN to setup a subnet?



**VLANs** and **subnets** solve different problems. **VLANs** work at Layer 2, thereby altering broadcast domains (for instance). Whereas **subnets** are Layer 3 in the current context.



**Subnet** - is a range of IP addresses determined by part of an address (often called the network address) and a subnet mask (netmask). For example, if the netmask is `255.255.255.0` (or `/24` for short), and the network address is `192.168.10.0`, then that defines a range of IP addresses `192.168.10.0` through `192.168.10.255`. Shorthand for writing that is `192.168.10.0/24`.



**VLAN** - a good way to think of this is "switch partitioning." Let's say you have an 8 port switch that is VLAN-able. You can assign 4 ports to one **VLAN** (say `VLAN 1`) and 4 ports to another **VLAN** (say `VLAN 2`). `VLAN 1` won't see any of `VLAN 2's` traffic and vice versa, logically, you now have two separate switches. Normally on a switch, if the switch hasn't seen a MAC address it will "flood" the traffic to all other ports. **VLANs** prevent this.



Subnet is nothing more than an IP address range of IP addresses that help hosts communicate over layer 2 and 3. Each subnet does not require its own **VLAN**. **VLANs** are implemented for isolation (are sandbox for layer two communication, no 2 systems of 2 different **VLANs** may communicate but it can be done through **Inter VLAN routing**), ease of management and security.



Useful resources:



- [What is the difference between a VLAN and a subnet? (original)](https://superuser.com/questions/353664/what-is-the-difference-between-a-vlan-and-a-subnet)

- [VLANS vs. subnets for network security and segmentation](https://networkengineering.stackexchange.com/questions/46899/vlans-vs-subnets-for-network-security-and-segmentation)



List 5 common network ports you should know.



  

    SERVICE

    PORT

  

  

    SMTP

    25

  

  

    FTP

    20 for data transfer and 21 for connection established

  

  

    DNS

    53

  

  

    DHCP

    67/UDP for DHCP server, 68/UDP for DHCP client

  

  

    SSH

    22

  



Useful resources:



- [Red Hat Enterprise Linux 4: Security Guide - Common Ports](https://web.mit.edu/rhel-doc/4/RH-DOCS/rhel-sg-en-4/ch-ports.html)



What POP and IMAP are, and how to choose which of them you should implement?



POP and IMAP are both protocols for retrieving messages from a mail server to a mail client.



**POP** (_Post Office Protocol_) uses a one way push from mail server to client. By default this will send messages to the POP mail client and remove them from the mail server, though it is possible to configure the mail server to retain all messages. Any actions you take on the message in your mail client (labeling, deleting, moving to a folder) will not be reflected on the mail server, and thus inaccessible to other mail clients pulling from the mail server. POP uses little storage space on the mail server and can be seen as more secure since messages only exist on one mail client instead of the mail server and multiple clients.



**IMAP** (_Internet Message Access Protocol_) uses two way communication between mail server and client. Deleting or labeling a message in your mail client configured with IMAP will also delete or label the message on the mail server. IMAP allows for a similar experience when accessing mail across different clients or devices since messages can existing in the same state across multiple devices. IMAP can also save disk space on the mail client by selectively syncing messages, deleting older messages from the mail client since it can sync them from the mail server later as needed.



Choose IMAP if you need to access messages across multiple devices and you want to save disk space on your client device. Choose POP if you want to save disk space on your mail server, only access messages from one client device, and ensure that messages do not exist on multiple systems.



How to check default route and routing table?



Using the commands `netstat -nr`, `route -n` or `ip route show` we can see the default route and routing tables.



Useful resources:



- [How to check routes (routing table) in linux](https://howto.lintel.in/how-to-check-routes-routing-table-in-linux/)

- [FreeBSD Set a Default Route/Gateway](https://www.cyberciti.biz/faq/freebsd-setup-default-routing-with-route-command/)



What is the difference between 127.0.0.1 and localhost?



Well, the most likely difference is that you still have to do an actual lookup of localhost somewhere.



If you use `127.0.0.1`, then (intelligent) software will just turn that directly into an IP address and use it. Some implementations of `gethostbyname` will detect the dotted format (and presumably the equivalent IPv6 format) and not do a lookup at all.



Otherwise, the name has to be resolved. And there's no guarantee that your hosts file will actually be used for that resolution (first, or at all) so `localhost` may become a totally different IP address.



By that I mean that, on some systems, a local hosts file can be bypassed. The `host.conf` file controls this on Linux (and many other Unices).



If you use a Unix domain socket it'll be slightly faster than using TCP/IP (because of the less overhead you have). Windows is using TCP/IP as a default, whereas Linux tries to use a Unix Domain Socket if you choose localhost and TCP/IP if you take `127.0.0.1`.



Useful resources:



- [What is the difference between 127.0.0.1 and localhost?](https://stackoverflow.com/questions/7382602/what-is-the-difference-between-127-0-0-1-and-localhost)

- [localhost vs. 127.0.0.1](https://stackoverflow.com/questions/3715925/localhost-vs-127-0-0-1)



Which port is used for ping command?



`ping` uses **ICMP**, specifically **ICMP echo request** and **ICMP echo reply** packets. There is no 'port' associated with **ICMP**. Ports are associated with the two IP transport layer protocols, TCP and UDP. **ICMP**, TCP, and UDP are "siblings"; they are not based on each other, but are three separate protocols that run on top of IP.



**ICMP** packets are identified by the 'protocol' field in the IP datagram header. **ICMP** does not use either UDP or TCP communications services, it uses raw IP communications services. This means that the **ICMP** message is carried directly in an IP datagram data field. `raw` comes from how this is implemented in software, to create and send an **ICMP** message, one opens a `raw` socket, builds a buffer containing the **ICMP** message, and then writes the buffer containing the message to the raw socket.



The IP protocol value for **ICMP** is 1. The protocol field is part of the IP header and identifies what is in the data portion of the IP datagram.



However, you could use `nmap` to see whether ports are open or not:



```bash

nmap -p 80 example.com

```



Useful resources:



- [Ping Port Number](https://networkengineering.stackexchange.com/questions/42463/ping-port-number)

- [Is it possible to ping an address:port?](https://superuser.com/questions/769541/is-it-possible-to-ping-an-addressport)



Server A can't talk to Server B. Describe possible reasons in a few steps.



To troubleshoot communication problems between servers, it is better to ideally follow the TCP/IP stack:



1. **Application Layer**: are the services up and running on both servers? Are they correctly configured (eg. bind the correct IP and correct port)? Do application and system logs show meaningful errors?



2. **Transport Layer**: are the ports used by the application open (try telnet!)? Is it possible to ping the server?



3. **Network Layer**: is there a firewall on the network or on the OS correctly configured? Is the IP stack correctly configured (IP, routes, dns, etc.)? Are switches and routers working (check the ARP table!)?



4. **Physical Layer**: are the servers connected to a network? Are packets being lost?



Why won’t the hostnames resolve on your server? Fix this issue. ***



To be completed.



How to resolve the domain name (using external dns) with CLI? Can IPs be resolved to domain names?



Examples for resolve IP address to domain name:



```bash

# with host command:

host domain.com 8.8.8.8



# with dig command:

dig @9.9.9.9 google.com



# with nslookup command:

nslookup domain.com 8.8.8.8

```



You can (sometimes) resolve an IP Address back to a hostname. IP Address can be stored against a **PTR** record. You can then do:



```bash

dig A 

```



To lookup the IPv4 address for a host, or:



```bash

dig AAAA 

```



To lookup the IPv6 address for a host, or:



```bash

dig PTR ZZZ.YYY.XXX.WWW.in-addr.arpa.

```



To lookup the hostname for IPv4 address `WWW.XXX.YYY.ZZZ` (note the octets are reversed), or:



```bash

dig PTR b.a.9.8.7.6.5.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.

```



Useful resources:



- [How can I resolve a hostname to an IP address in a Bash script?](https://unix.stackexchange.com/questions/20784/how-can-i-resolve-a-hostname-to-an-ip-address-in-a-bash-script)

- [How To Resolve IP Addresses To Domain Names?](https://superuser.com/questions/315687/how-to-resolve-ip-addresses-to-domain-names)



How to test port connectivity with telnet or nc?



```bash

# with telnet command:

telnet code42.example.com 5432



# with nc (netcat) command:

nc -vz code42.example.com 5432

```



Why should you avoid telnet to administer a system remotely?



Modern operating systems have turned off all potentially insecure services by default. On the other hand, some vendors of network devices still allow to establish communication using the telnet protocol.



**Telnet** uses most insecure method for communication. It sends data across the network in plain text format and anybody can easily find out the password using the network tool.



In the case of **Telnet**, these include the passing of login credentials in plain text, which means anyone running a sniffer on your network can find the information he needs to take control of a device in a few seconds by eavesdropping on a **Telnet** login session.



Useful resources:



- [Telnet and SSH as a secure alternative](https://www.ssh.com/ssh/telnet)

- [How to telnet to an IP address on a specific port?](https://superuser.com/questions/339107/how-to-telnet-to-an-ip-address-on-a-specific-port)



What is the difference between wget and curl?



The main differences are: `wget's` major strong side compared to `curl` is its ability to download recursively. `wget` is command line only. `curl` supports FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, POP3, IMAP, SMTP, RTMP and RTSP.



Useful resources:



- [What is the difference between curl and wget? (original)](https://unix.stackexchange.com/questions/47434/what-is-the-difference-between-curl-and-wget)



What is SSH and how does it work?



**SSH** stands for **Secure Shell**. It is a protocol that lets you drop from a server "A" into a shell session to a server "B". It allows you interact with your server "B".



An **SSH** connection to be established, the remote machine (server A) must be running a piece of software called an **SSH** daemon and the user's computer (server B) must have an **SSH** client.



The **SSH** daemon and **SSH** client listen for connections on a specific network port (default 22), authenticates connection requests, and spawns the appropriate environment if the user provides the correct credentials.



Useful resources:



- [Understanding the SSH Encryption and Connection Process](https://www.digitalocean.com/community/tutorials/understanding-the-ssh-encryption-and-connection-process)



Most tutorials suggest using SSH key authentication rather than password authentication. Why it is considered more secure?



An **SSH key** is an access credential in the SSH protocol. Its function is similar to that of user names and passwords, but the keys are primarily used for automated processes and for implementing single sign-on by system administrators and power users.



Instead of requiring a user's password, it is possible to confirm the client's identity by using asymmetric cryptography algorithms, with public and private keys.



If your SSH service only allows public-key authentication, an attacker needs a copy of a private key corresponding to a public key stored on the server.



If your SSH service allows password based authentication, then your Internet connected SSH server will be hammered day and night by bot-nets trying to guess user-names and passwords. The bot net needs no information, it can just try popular names and popular passwords. Apart from anything else this clogs your logs.



Useful resources:



- [Key-Based Authentication (Public Key Authentication)](http://www.crypto-it.net/eng/tools/key-based-authentication.html)

- [SSH password vs. key authentication](https://security.stackexchange.com/questions/33381/ssh-password-vs-key-authentication)



What is a packet filter and how does it work?



**Packet filtering** is a firewall technique used to control network access by monitoring outgoing and incoming packets and allowing them to pass or halt based on the source and destination Internet Protocol (IP) addresses, protocols and ports.



Packet filtering is appropriate where there are modest security requirements. The internal (private) networks of many organizations are not highly segmented. Highly sophisticated firewalls are not necessary for isolating one part of the organization from another.



However it is prudent to provide some sort of protection of the production network from a lab or experimental network. A packet filtering device is a very appropriate measure for providing isolation of one subnet from another.



Operating at the network layer and transport layer of the TCP/IP protocol stack, every packet is examined as it enters the protocol stack. The network and transport headers are examined closely for the following information:



- **protocol (IP header, network layer)** - in the IP header, byte 9 (remember the byte count begins with zero) identifies the protocol of the packet. Most filter devices have the capability to differentiate between TCP, UPD, and ICMP.

- **source address (IP header, network layer)** - the source address is the 32-bit IP address of the host which created the packet.

- **destination address (IP header, network layer)** - the destination address is the 32-bit IP address of the host the packet is destined for.

- **source port (TCP or UDP header, transport layer)** - each end of a TCP or UDP network connection is bound to a port. TCP ports are separate and distinct from UDP ports. Ports numbered below 1024 are reserved – they have a specifically defined use. Ports numbered above 1024 (inclusive) are known as ephemeral ports. They can be used however a vendor chooses. For a list of "well known" ports, refer to RFP1700. The source port is a pseudo-randomly assigned ephemeral port number. Thus it is often not very useful to filter on the source port.

- **destination port (TCP or UDP header, transport layer)** - the destination port number indicates a port that the packet is sent to. Each service on the destination host listens to a port. Some well-known ports that might be filtered are 20/TCP and 21/TCP - ftp connection/data, 23/TCP - telnet, 80/TCP - http, and 53/TCP - DNS zone transfers.

- **connection status (TCP header, transport layer)** - the connection status tells whether the packet is the first packet of the network session. The ACK bit in the TCP header is set to “false” or 0 if this is the first packet in the session. It is simple to disallow a host from establishing a connection by rejecting or discarding any packets which have the ACK bit set to "false" or 0.



Useful resources:



- [Building Internet Firewalls - Packet Filtering](http://web.deu.edu.tr/static/oreily/networking/firewall/ch06_01.htm)



What are the advantages of using a reverse proxy server?



**Hide the topology and characteristics of your back-end servers**



The **reverse proxy server** can hide the presence and characteristics of the origin server. It acts as an intermediate between internet cloud and web server. It is good for security reason especially when you are using web hosting services.



**Allows transparent maintenance of backend servers**



Changes you make to servers running behind a reverse proxy are going to be completely transparent to your end users.



**Load Balancing**



The reverse proxy will then enforce a load balancing algorithm like round robin, weighted round robin, least connections, weighted least connections, or random, to distribute the load among the servers in the cluster.



When a server goes down, the system will automatically failover to the next server up and users can continue with their secure file transfer activities.



**SSL offloading/termination**



Handles incoming HTTPS connections, decrypting the requests and passing unencrypted requests on to the web servers.



**IP masking**



Using a single ip but different URLs to route to different back end servers.



Useful resources:



- [The Benefits of a Reverse Proxy](https://dzone.com/articles/benefits-reverse-proxy)



What is the difference between a router and a gateway? What is the default gateway?



**Router** describes the general technical function (layer-3 forwarding) or a hardware device intended for that purpose, while gateway describes the function for the local segment (providing connectivity to elsewhere). You could also state that "_you set up a router as gateway_". Another term is hop which describes the forwarding in between subnets.



The term **default gateway** is used to mean the router on your LAN which has the responsibility of being the first point of contact for traffic to computers outside the LAN.



It's just a matter of perspective, the device is the same.



Useful resources:



- [Difference between router and gateway (orignal)](https://networkengineering.stackexchange.com/questions/51426/difference-between-router-and-gateway)



Explain the function of each of the following DNS records: SOA, PTR, A, MX, and CNAME.



**DNS records** are basically mapping files that tell the DNS server which IP address each domain is associated with, and how to handle requests sent to each domain. Some **DNS records** syntax that are commonly used in nearly all DNS record configurations are `A`, `AAAA`, `CNAME`, `MX`, `PTR`, `NS`, `SOA`, `SRV`, `TXT`, and `NAPTR`.



- **SOA** - A Start Of Authority

- **A** - Address Mapping records

- **AAAA** - IP Version 6 Address records

- **CNAME** - Canonical Name records

- **MX** - Mail exchanger record

- **NS** - Name Server records

- **PTR** - Reverse-lookup Pointer records



Useful resources:



- [List of DNS record types](https://en.wikipedia.org/wiki/List_of_DNS_record_types)



Why couldn't MAC addresses be used instead of IPv4/6 for networking?



The **OSI** model explains why it doesn't make sense to make routing, a **layer 3** concept, decisions based on a physical, **layer 2**, mechanism.



Modern networking is broken into many different layers to accomplish your end to end communication. Your network card (what is addressed by the mac address - physical address) needs to only be responsible for communicating with peers on it's physical network.



The communication that you are allowed to accomplish with your **MAC** address is going to be limited to other devices that reside within physical contact to your machine. On the internet, for example, you are not physically connected to each machine. That's why we make use of **TCP/IP** (a **layer 3**, logical address) mechanism when we need to communicate with a machine that we are not physically connected to.



**IP** is an arbitrary numbering scheme imposed in a hierarchical fashion on a group of computers to logically distinguish them as a group (that's what a subnet is). Sending messages between those groups is done by routing tables, themselves divided into multiple levels so that we don't have to keep track of every single subnet.



It's also pretty easy to relate this to another pair of systems. You have a State Issued ID Number, why would you need a mailing address if that ID number is already unique to just you? You need the mailing address because it's an arbitrary system that describes where the unique destination for communications to you should go.



On the other hand, the distribution of **MAC** addresses across the network is random and completely unrelated to topology. Routes grouping would be impossible, every router would need to keep track of routes for every single device that relays traffic trough it. That is what **layer 2** switches do, and that does not scale well beyond a certain number of hosts.



Useful resources:



- [Why couldn't MAC addresses be used instead of IPv4|6 for networking? (original)](https://serverfault.com/questions/410626/why-couldnt-mac-addresses-be-used-instead-of-ipv46-for-networking)



What is the smallest IPv4 subnet mask that can be applied to a network containing up to 30 devices?



Whether you have a standard `/24` VLAN for end users, a `/30` for point-to-point links, or something in between and subnet that must contain up to 30 devices works out to be a `/27` - or a subnet mask of `255.255.255.224`.



Useful resources:



- [How do you calculate the prefix, network, subnet, and host numbers?](https://networkengineering.stackexchange.com/questions/7106/how-do-you-calculate-the-prefix-network-subnet-and-host-numbers)

- [The slash after an IP Address - CIDR Notation](https://networkengineering.stackexchange.com/questions/3697/the-slash-after-an-ip-address-cidr-notation)

- [Why are there 3 ranges of private IPv4 addresses?](https://networkengineering.stackexchange.com/questions/32119/why-are-there-3-ranges-of-private-ipv4-addresses)

- [IP Calculator](http://jodies.de/ipcalc)



What are some common HTTP status codes?



- **1xx** - Informational responses - communicates transfer protocol-level information

- **2xx** - Success - indicates that the client’s request was accepted successfully

- **3xx** - Redirection - indicates that the client must take some additional action in order to complete their request

- **4xx** - Client side error - this category of error status codes points the finger at clients

- **5xx** - Server side error - the server takes responsibility for these error status codes



Useful resources:



- [HTTP Status Codes](https://httpstatuses.com/)



###### Devops Questions (5)



What is DevOps? Which is more important to the success of any DevOps community: how people communicate or the tools that you choose to deploy? ***



**DevOps** is a cohesive team that engages in both Development and Operations tasks, or it's individual Operations and Development teams that work very closely together. It's more of a "way" of working collaboratively with other departments to achieve common goals.



What is a version control? Are your commit messages good looking?



It is a system that records changes to a file or set of files over time so that you can recall specific versions later. Version control systems consist of a central shared repository where teammates can commit changes to a file or set of file. Then you can mention the uses of version control.



Version control allows you to:



- revert files back to a previous state

- revert the entire project back to a previous state

- compare changes over time

- see who last modified something that might be causing a problem

- who introduced an issue and when



The seven rules of a great commit message:



- separate subject from body with a blank line

- limit the subject line to 50 characters

- capitalize the subject line

- do not end the subject line with a period

- use the imperative mood in the subject line

- wrap the body at 72 characters

- use the body to explain what and why vs. how



Useful resources:



- [Getting Started - About Version Control (original)](https://git-scm.com/book/en/v2/Getting-Started-About-Version-Control)



Explain some basic git commands.



- `git init` - create a new local repository

- `git commit -m "message"` - commit changes to head

- `git status` - list the files you've added with `git add` and also commit any files you've changed since then

- `git push origin master` - send changes to the master branch of your remote repository



Explain a simple Continuous Integration pipeline.



- clone repository

- deploy stage (QA)

- testing environment (QA)

- deploy stage (PROD)



Explain some basic docker commands.



- `docker ps` - show running containers

- `docker ps -a` - show all containers

- `docker images` - show docker images

- `docker logs ` - get logs from container

- `docker network ls` - show all docker networks

- `docker volumes ls` - show all docker volumes

- `docker exec -it  bash` - execute bash in container with interactive shell



###### Cyber Security Questions (1)



What is a Security Misconfiguration?



**Security misconfiguration** is a vulnerability when a device/application/network is configured in a way which can be exploited by an attacker to take advantage of it. This can be as simple as leaving the default username/password unchanged or too simple for device accounts etc.



### :diamond_shape_with_a_dot_inside: Regular Sysadmin



###### System Questions (60)



Tell me about your experience with the production environments? ***



To be completed.



Which distribution would you select for running a major web server? ***



To be completed.



Explain in a few points the boot process of the Linux system.



**BIOS**: Full form of BIOS is Basic Input or Output System that performs integrity checks and it will search and load and then it will execute the bootloader.



**Bootloader**: Since the earlier phases are not specific to the operating system, the BIOS-based boot process for x86 and x86-64 architectures is considered to start when the master boot record (MBR) code is executed in real mode and the first-stage boot loader is loaded. In UEFI systems, a payload, such as the Linux kernel, can be executed directly. Thus no boot loader is necessary. Some popular bootloaders: **GRUB**, **Syslinux/Isolinux** or **Lilo**.



**Kernel**: The kernel in Linux handles all operating system processes, such as memory management, task scheduling, I/O, interprocess communication, and overall system control. This is loaded in two stages - in the first stage, the kernel (as a compressed image file) is loaded into memory and decompressed, and a few fundamental functions such as basic memory management are set up.



**Init**: Is the parent of all processes on the system, it is executed by the kernel and is responsible for starting all other processes.



- `SysV init` - init's job is "to get everything running the way it should be once the kernel is fully running. Essentially it establishes and operates the entire user space. This includes checking and mounting file systems, starting up necessary user services, and ultimately switching to a user-environment when system startup is completed.

- `systemd` - the developers of systemd aimed to replace the Linux init system inherited from Unix System V. Like init, systemd is a daemon that manages other daemons. All daemons, including systemd, are background processes. Systemd is the first daemon to start (during booting) and the last daemon to terminate (during shutdown).

- `runinit` - runinit is an init scheme for Unix-like operating systems that initializes, supervises, and ends processes throughout the operating system. It is a reimplementation of the daemontools process supervision toolkit that runs on the Linux, Mac OS X, \*BSD, and Solaris operating systems.



Useful resources:



- [Analyzing the Linux boot process](https://opensource.com/article/18/1/analyzing-linux-boot-process)

- [Systemd Boot Process a Close Look in Linux](https://linoxide.com/linux-how-to/systemd-boot-process/)



How and why Linux daemons drop privileges? Why some daemons need root permissions to start? Explain. ***



To be completed.



Why is a load of 1.00 not ideal on a single-core machine?



The problem with a load of 1.00 is that you have no headroom. In practice, many sysadmins will draw a line at 0.70.



The "Need to Look into it" Rule of Thumb: 0.70 If your load average is staying above > 0.70, it's time to investigate before things get worse.



The "Fix this now" Rule of Thumb: 1.00. If your load average stays above 1.00, find the problem and fix it now. Otherwise, you're going to get woken up in the middle of the night, and it's not going to be fun.



Rule of Thumb: 5.0. If your load average is above 5.00, you could be in serious trouble, your box is either hanging or slowing way down, and this will (inexplicably) happen in the worst possible time like in the middle of the night or when you're presenting at a conference. Don't let it get there.



Useful resources:



- [Proper way of interpreting system load on a 4 core 8 thread processor](https://serverfault.com/questions/618130/proper-way-of-interpreting-system-load-on-a-4-core-8-thread-processor)

- [Understanding Linux CPU Load - when should you be worried?](http://blog.scoutapp.com/articles/2009/07/31/understanding-load-averages)



What does it mean when the effective user is root, but the real user ID is still your name?



The **real user ID** is who you really are (the user who owns the process), and the **effective user ID** is what the operating system looks at to make a decision whether or not you are allowed to do something (most of the time, there are some exceptions).



When you log in, the login shell sets both the **real and effective user ID** to the same value (your **real user ID**) as supplied by the password file.



If, for instance, you execute setuid, and besides running as another user (e.g. **root**) the setuid program is also supposed to do something on your behalf.



After executing setuid, it will have your **real ID** (since you're the process owner) and the effective user id of the file owner (for example **root**) since it is setuid.



Let's use the case of `passwd`:



```bash

-rwsr-xr-x 1 root root 45396 may 25  2012 /usr/bin/passwd

```



When user2 wants to change their password, they execute `/usr/bin/passwd`.



The **RUID** will be user2 but the **EUID** of that process will be root.



user2 can use only passwd to change their own password, because internally passwd checks the **RUID** and, if it is not root, its actions will be limited to real user's password.



It's necessary that the **EUID** becomes root in the case of passwd because the process needs to write to `/etc/passwd` and/or `/etc/shadow`.



Useful resources:



- [Difference between Real User ID, Effective User ID and Saved User ID? (original)](https://stackoverflow.com/questions/30493424/what-is-the-difference-between-a-process-pid-ppid-uid-euid-gid-and-egid)

- [What is the difference between a pid, ppid, uid, euid, gid and egid?](https://stackoverflow.com/questions/30493424/what-is-the-difference-between-a-process-pid-ppid-uid-euid-gid-and-egid)



Developer added cron job which generate massive log files. How do you prevent them from getting so big?



Using `logrotate` is the usual way of dealing with logfiles. But instead of adding content to `/etc/logrotate.conf` you should add your own job to `/etc/logrotate.d/`, otherwise you would have to look at more diffs of configuration files during release upgrades.



If it's actively being written to you don't really have much you can do by way of truncate. Your only options are to truncate the file:



```bash

: >/var/log/massive-logfile

```



It's very helpful, because it's truncate the file without disrupting the processes.



Useful resources:



- [How to Use logrotate to Manage Log Files](https://www.linode.com/docs/uptime/logs/use-logrotate-to-manage-log-files/)

- [System logging](https://www.ibm.com/developerworks/library/l-lpic1-108-2/index.html)



How the Linux kernel creates, manages and deletes the processes in the system? ***



To be completed.



Useful resources:



- [Linux Processes](https://www.tldp.org/LDP/tlk/kernel/processes.html)



Explain the selected information you can see in top and htop. How to diagnose load, high user time and out-of-memory problems with these tools? ***



To be completed.



Useful resources:



- [top explained visually](https://www.svennd.be/top-explained-visually/)

- [htop Explained Visually](https://codeahoy.com/2017/01/20/hhtop-explained-visually/)

- [Explanation of everything you can see in htop/top on Linux](https://peteris.rocks/blog/htop/)



How would you recognize a process that is hogging resources? 



`top` works reasonably well, as long as you look at the right numbers.

- **M** Sorts by current resident memory usage

- **T** Sorts by total ( or cummulative) CPU usage

- **P** Sorts by current CPU usage (this is the default refresh)

- **?** Displays a usage summary for all top commands



This is very important information to obtain when problem solving why a computer process is running slowly and making decisions on what processes to kill/software to uninstall.



Useful resources:



- [How to find the process(es) which are hogging the machine](https://superuser.com/questions/326300/how-to-find-the-processes-which-are-hogging-the-machine)



You need to upgrade ntpd service at 200 servers. What is the best way to go about upgrading all of these to the latest?



By using **Infrastructure as a Code** approach, there are multiple good ways:



1. **Configuration Synchronization Change Management Model**:



There are Configuration Management Tools (Ansible, Chef, Puppet, Saltstack, ...), that can be used to automatically update `ntpd` service on all servers. To keep systems stable, system packages on servers are usually auto-updated with only security updates. Major or minor versions of packages are usually version locked in configuration definitions to prevent misconfiguration of the service. Change is then deployed by changing `ntpd` version in configuration definition.



With this approach, it is important to be careful when deploying changes into infrastructure massively. The pipeline of deployment should include Unit, Integration and System tests, and eventually be first deployed into Staging environment to prove configuration. If tests prove configuration correctness, deployment should be done by incremental rollout with ability to rollback in case of errors or failure.



2. **Immutable Servers Model**:



In Immutable Server model, whole unit (server, container) is replaced by new updated image rather than making changes to running server (this eliminates configuration drift). With this approach you usually build server image with tools like Packer or Docker with Dockerfile. This image is then tested and deployed similarly as in option above (1.), but now using techniques such as Canary Release, which also has ability to incremental rollout and rollback.



Useful resources:



- [Infrastructure as a Code - Chapter 8: Patterns for Updating and Changing Servers](http://shop.oreilly.com/product/0636920039297.do)



How to permanently set $PATH on Linux/Unix? Why is this variable so important? ***



To be completed.



When your server is booting up some errors appears on the console. How to examine boot messages and where are they stored?



Your console has two types of messages:



- **generated by the kernel** (via printk)

- **generated by userspace** (usually your init system)



Kernel messages are always stored in the **kmsg** buffer, visible via `dmesg` command. They're also often copied to your **syslog**. This also applies to userspace messages written to `/dev/kmsg`, but those are fairly rare.



Meanwhile, when userspace writes its fancy boot status text to `/dev/console` or `/dev/tty1`, it's not stored anywhere at all. It just goes to the screen and that's it.



`dmesg` is used to review boot messages contained in the kernel ring buffer. A ring buffer is a buffer of fixed size for which any new data added to it overwrites the oldest data in it.



It shows operations once the boot process has completed, such as command line options passed to the kernel; hardware components detected, events when a new USB device is added, or errors like NIC (Network Interface Card) failure and the drivers report no link activity detected on the network and so much more.



If system logging is done via the journal component you should use `journalctl`. It shows messages include kernel and boot messages; messages from syslog or various services.



Boot issues/errors calls for a system administrator to look into certain important files in conjunction with particular commands (handled differently by different versions of Linux):



- `/var/log/boot.log` - system boot log, it contains all that unfolded during the system boot

- `/var/log/messages` - stores global system messages, including the messages that are logged during system boot

- `/var/log/dmesg` - contains kernel ring buffer information



Useful resources:



- [How to view all boot messages in Linux after booting? (original)](https://superuser.com/questions/1188407/how-to-view-all-boot-messages-in-linux-after-booting)

- [Differences in /var/log/{syslog,dmesg,messages} log files](https://superuser.com/questions/565927/differences-in-var-log-syslog-dmesg-messages-log-files)

- [How can the messages that scroll by when booting a Debian system be reviewed later?](https://serverfault.com/questions/516411/all-debian-boot-messages)



Swap usage too high. What are the reasons for this and how to resolve swapping problems?



**Swap** space is a restricted amount of physical memory that is allocated for use by the operating system when available memory has been fully utilized. It is memory management that involves swapping sections of memory to and from physical storage.



If the system needs more memory resources and the RAM is full, inactive pages in memory are moved to the swap space. While swap space can help machines with a small amount of RAM, it should not be considered a replacement for more RAM. **Swap** space is located on hard drives, which have a slower access time than physical memory.



Workload increases your RAM demand. You are running a workload that requires more memory. Usage of the entire swap indicates that. Also, changing `swappiness` to **1** might not be a wise decision. Setting `swappiness` to **1** does not indicate that swapping will not be done. It just indicates how aggressive kernel will be in respect of swapping, it does not eliminate swapping. Swapping will happen if needs to be done.



- **Increasing the size of the swap space** - firstly, you'd have increased disk use. If your disks aren't fast enough to keep up, then your system might end up thrashing, and you'd experience slowdowns as data is swapped in and out of memory. This would result in a bottleneck.



- **Adding more RAM** - the real solution is to add more memory. There's no substitute for RAM, and if you have enough memory, you'll swap less.



For monitoring swap space usage:



- `cat /proc/swaps` - to see total and used swap size

- `grep SwapTotal /proc/meminfo` - to show total swap space

- `free` - to display the amount of free and used system memory (also swap)

- `vmstat` - to check swapping statistics

- `top`, `htop`- to check swap space usage

- `atop` - to show is that your system is overcommitting memory

- or use one-liner shell command to list all applications with how much swap space search is using in kilobytes:

```bash

for _fd in /proc/*/status ; do

  awk '/VmSwap|Name/{printf $2 " " $3}END{ print ""}' $_fd

done | sort -k 2 -n -r | less

```



Useful resources:



- [Linux ate my ram!](https://www.linuxatemyram.com/)

- [How to find out which processes are using swap space in Linux?](https://stackoverflow.com/questions/479953/how-to-find-out-which-processes-are-using-swap-space-in-linux)

- [8 Useful Commands to Monitor Swap Space Usage in Linux](https://www.tecmint.com/commands-to-monitor-swap-space-usage-in-linux/)

- [What is the danger in having a fully used SWAP in an Ubuntu server?](https://serverfault.com/questions/499301/what-is-the-danger-in-having-a-fully-used-swap-in-an-ubuntu-server)

- [How to empty swap if there is free RAM?](https://askubuntu.com/questions/1357/how-to-empty-swap-if-there-is-free-ram)



What is umask? How to set it permanently for a user?



On Linux and other Unix-like operating systems, new files are created with a default set of permissions. Specifically, a new file's permissions may be restricted in a specific way by applying a permissions "mask" called the `umask`. The `umask` command is used to set this mask, or to show you its current value.



Permanently change (set e.g. `umask 02`):



- `~/.profile`

- `~/.bashrc`

- `~/.zshrc`

- `~/.cshrc`



Useful resources:



- [What is Umask and How To Setup Default umask Under Linux?](https://www.cyberciti.biz/tips/understanding-linux-unix-umask-value-usage.html)



Explain the differences among the following umask values: 000, 002, 022, 027, 077, and 277.



  

    Umask

    File result

    Directory result

  

  

    000

    666 rw- rw- rw-

    777 rwx rwx rwx

  

 

    002

    664 rw- rw- r--

    775 rwx rwx r-x

  

  

    022

    644 rw- r-- r--

    755 rwx r-x r-x

  



    027

    640 rw- r-- ---

    750 rwx r-x ---

  



    077

    600 rw---- ---

    700 rwx --- ---

  



    277

    400 r-- --- ---

    500 r-x --- ---

  



Useful resources:



- [What is Umask and How To Setup Default umask Under Linux?](https://www.cyberciti.biz/tips/understanding-linux-unix-umask-value-usage.html)



What is the difference between a symbolic link and a hard link?



Underneath the file system files are represented by inodes (or is it multiple inodes not sure)



- a file in the file system is basically a link to an inode

- a hard link then just creates another file with a link to the same underlying inode



When you delete a file it removes one link to the underlying inode. The inode is only deleted (or deletable/over-writable) when all links to the inode have been deleted.



- a symbolic link is a link to another name in the file system



Once a hard link has been made the link is to the inode. deleting renaming or moving the original file will not affect the hard link as it links to the underlying inode. Any changes to the data on the inode is reflected in all files that refer to that inode.



Note: Hard links are only valid within the same file system. Symbolic links can span file systems as they are simply the name of another file.



Differences:



- **Hardlink** cannot be created for directories. Hard link can only be created for a file

- **Softlink** also termed a symbolic links or symlinks can link to a directory



Useful resources:



- [What is the difference between a hard link and a symbolic link?](https://medium.com/@wendymayorgasegura/what-is-the-difference-between-a-hard-link-and-a-symbolic-link-8c0493041b62)



How does the sticky bit work? The SUID/GUID is the same?



This is probably one of my most irksome things that people mess up all the time. The **SUID/GUID** bit and the **sticky-bit** are 2 completely different things.



If you do a `man chmod` you can read about the **SUID** and **sticky-bits**.



**SUID/GUID**



What the above man page is trying to say is that the position that the x bit takes in the rwxrwxrwx for the user octal (1st group of rwx) and the group octal (2nd group of rwx) can take an additional state where the x becomes an s. When this occurs this file when executed (if it's a program and not just a shell script) will run with the permissions of the owner or the group of the file.



So if the file is owned by root and the **SUID** bit is turned on, the program will run as root. Even if you execute it as a regular user. The same thing applies to the **GUID** bit.



Examples:



**no suid/guid** - just the bits `rwxr-xr-x` are set.



```bash

ls -lt b.pl

-rwxr-xr-x 1 root root 179 Jan  9 01:01 b.pl

```



**suid & user's executable bit enabled (lowercase s)** - the bits `rwsr-x-r-x` are set.



```bash

chmod u+s b.pl

ls -lt b.pl

-rwsr-xr-x 1 root root 179 Jan  9 01:01 b.pl

```



**suid enabled & executable bit disabled (uppercase S)** - the bits `rwSr-xr-x` are set.



```bash

chmod u-x b.pl

ls -lt b.pl

-rwSr-xr-x 1 root root 179 Jan  9 01:01 b.pl

```



**guid & group's executable bit enabled (lowercase s)** - the bits `rwxr-sr-x` are set.



```bash

chmod g+s b.pl

ls -lt b.pl

-rwxr-sr-x 1 root root 179 Jan  9 01:01 b.pl

```



**guid enabled & executable bit disabled (uppercase S)** - the bits `rwxr-Sr-x` are set.



```bash

chmod g-x b.pl

ls -lt b.pl

-rwxr-Sr-x 1 root root 179 Jan  9 01:01 b.pl

```



**sticky bit**



The sticky bit on the other hand is denoted as `t`, such as with the `/tmp` directory:



```bash

ls -l /|grep tmp

drwxrwxrwt. 168 root root 28672 Jun 14 08:36 tmp

```



This bit should have always been called the _restricted deletion bit_ given that's what it really connotes. When this mode bit is enabled, it makes a directory such that users can only delete files & directories within it that they are the owners of.



Useful resources:



- [How does the sticky bit work? (original)](https://unix.stackexchange.com/questions/79395/how-does-the-sticky-bit-work)



What does LC_ALL=C before command do? In what cases it will be useful?



`LC_ALL` is the environment variable that overrides all the other localisation settings. This sets all `LC_` type variables at once to a specified locale.



The main reason to set `LC_ALL=C` before command is that fine to simply get English output (general change the locale used by the command).



On the other hand, also important is to increase the speed of command execution with `LC_ALL=C` e.g. `grep` or `fgrep`. Using the `LC_ALL=C` locale increased our performance and brought command execution time down.



For example, if you set `LC_ALL=en_US.utf8` your system opened multiple files from the `/usr/lib/locale` directory. For `LC_ALL=C` a minimum amount of open and read operations is performed.



If you want to restore all your normal (original) locale settings for the session:



```bash

LC_ALL=

```



If `LC_ALL` does not work, try using `LANG` (if that still does not work, try `LANGUAGE`):



```bash

LANG=C date +%A

Monday

```



Useful resources:



- [What does LC_ALL=C do? (original)](https://unix.stackexchange.com/questions/87745/what-does-lc-all-c-do)

- [Speed up grep searches with LC_ALL=C](https://www.inmotionhosting.com/support/website/ssh/speed-up-grep-searches-with-lc-all)



How to make high availability of web application? ***



To be completed.



You are configuring a new server. One of the steps is setting the permissions to the app directories. What steps will you take and what mistakes to avoid?



**1) Main requirements - remember about this**



- which users have access to the app filesystem

- permissions for web servers, e.g. Apache and app servers e.g. uwsgi

- permissions for specific directories like a **uploads**, **cache** and main app directory like a `/var/www/app01/html`

- correct `umask` value for users and **suid**/**sgid** (only for specific situations)

- permissions for all future files and directories

- permissions for cron jobs and scripts



**2) Application directories**



`/var/www` contains a directory for each website (isolation of the apps), e.g. `/var/www/app01`, `/var/www/app02`



```bash

mkdir /var/www/{app01,app02}

```



**3) Application owner and group**



Each application has a designated **owner** (e.g. **u01-prod**, **u02-prod**) and **group** (e.g. **g01-prod**, **g02-prod**) which are set as the owner of all files and directories in the website's directory:



```bash

chown -R u01-prod:g01-prod /var/www/app01

chown -R u02-prod:g02-prod /var/www/app02

```



**4) Developers owner and group**



All of the users that maintain the website have own groups and they're attach to application group:



```bash

id alice

uid=2000(alice) gid=4000(alice) groups=8000(g01-prod)

id bob

uid=2001(bob) gid=4001(bob) groups=8000(g01-prod),8001(g02-prod)

```



So **alice** user has standard privileges for `/var/www/app01` and **bob** user has standard privileges for `/var/www/app01` and `/var/www/app02`.



**5) Web server owner and group**



Any files or directories that need to be written by the webserver have their owner. If the web servers is Apache, default owner/group are **apache:apache** or **www-data:www-data** and for Nginx it will be **nginx:nginx**. Don't change these settings.



If applications works with app servers like a **uwsgi** or **php-fpm** should set the appropriate user and group (e.g. for **app01** it will be **u01-prod:g01-prod**) in specific config files.



**6) Permissions**



Set properly permissions with **Access Control Lists**:



```bash

# For web server

setfacl -Rdm "g:apache:rwx" /var/www/app01

setfacl -Rm "g:apache:rwx" /var/www/app01



# For developers

setfacl -Rdm "g:g01-prod:rwx" /var/www/app01

setfacl -Rm "g:g01-prod:rwx" /var/www/app01

```



If you use **SELinux** remember about security context:



```bash

chcon -R system_u:object_r:httpd_sys_content_t /var/www/app01

```



**7) Security mistakes**



- **root** owner for files and directories

- **root** never executes any files in website directory, and shouldn't be creating files in there

- to wide permissions like a **777** so some critical files may be world-writable and world-readable

- avoid creating maintenance scripts or other critical files with suid root



If you allow your site to modify the files which form the code running your site, you make it much easier for someone to take over your server.



A file upload tool allows users to upload a file with any name and any contents. This allows a user to upload a mail relay PHP script to your site, which they can place wherever they want to turn your server into a machine to forward unsolicited commercial email. This script could also be used to read every email address out of your database, or other personal information.



If the malicious user can upload a file with any name but not control the contents, then they could easily upload a file which overwrites your `index.php` (or another critical file) and breaks your site.



Useful resources:



- [How to setup linux permissions for the WWW folder?](https://serverfault.com/questions/124800/how-to-setup-linux-permissions-for-the-www-folder)

- [What permissions should my website files/folders have on a Linux webserver?](https://serverfault.com/questions/357108/what-permissions-should-my-website-files-folders-have-on-a-linux-webserver)

- [Security Pitfalls of setgid Programs](https://www.agwa.name/blog/post/security_pitfalls_of_setgid_programs)



What steps will be taken by init when you run telinit 1 from run level 3? What will be the final result of this? If you use telinit 6 instead of reboot command your server will be restarted? ***



To be completed.



Useful resources:



- [What differences it will make, if i use “telinit 6” instead of “reboot” command to restart my computer?](https://unix.stackexchange.com/questions/434560/what-differences-it-will-make-if-i-use-telinit-6-instead-of-reboot-command)



I have forgotten the root password! What do I do in BSD? What is the purpose of booting into single user mode?



Restart the system, type `boot -s` at the `Boot:` prompt to enter **single-user mode**.



At the question about the shell to use, hit `Enter` which will display a `#` prompt.



Enter `mount -urw /` to remount the root file system read/write, then run `mount -a` to remount all the file systems.



Run `passwd root` to change the root password then run `exit` to continue booting.



**Single user mode** should basically let you log in with root access & change just about anything. For example, you might use single-user mode when you are restoring a damaged master database or a system database, or when you are changing server configuration options (e.g. password recovery).



Useful resources:



- [FreeBSD Reset or Recover Root Password](https://www.cyberciti.biz/tips/howto-freebsd-reset-recover-root-password.html)

- [Single User Mode Definition](http://www.linfo.org/single_user_mode.html)



How could you modify a text file without invoking a text editor?



For example:



```bash

# cat  >filename ... - overwrite file

# cat >>filename ... - append to file

cat > filename << __EOF__

data

__EOF__

```



How to change the kernel parameters? What kernel options might you need to tune? ***



To set the kernel parameters in Unix-like, first edit the file `/etc/sysctl.conf` after making the changes save the file and run the command `sysctl -p`, this command will make the changes permanently without rebooting the machine.



Useful resources:



- [How to Change Kernel Runtime Parameters in a Persistent and Non-Persistent Way](https://www.tecmint.com/change-modify-linux-kernel-runtime-parameters/)



Explain the /proc filesystem.



`/proc` is a virtual file system that provides detailed information about kernel, hardware and running processes.



Since `/proc` contains virtual files, it is called virtual file system. These virtual files have unique qualities. Most of them are listed as zero bytes in size.



Virtual files such as `/proc/interrupts`, `/proc/meminfo`, `/proc/mounts` and `/proc/partitions` provide an up-to-the-moment glimpse of the system’s hardware. Others: `/proc/filesystems` file and the `/proc/sys/` directory provide system configuration information and interfaces.



Useful resources:



- [Linux Filesystem Hierarchy - /proc](https://www.tldp.org/LDP/Linux-Filesystem-Hierarchy/html/proc.html)



Describe your data backup process. How often should you test your backups? ***



To be completed.



Explain three types of journaling in ext3/ext4.



There are three types of journaling available in **ext3/ext4** file systems:



- **Journal** - metadata and content are saved in the journal

- **Ordered** - only metadata is saved in the journal. Metadata are  journaled only after writing the content to disk. This is the default

- **Writeback** - only metadata is saved in the journal. Metadata might be  journaled either before or after the content is written to the disk



What is an inode? How to find file's inode number and how can you use it?



An **inode** is a data structure on a filesystem on Linux and other Unix-like operating systems that stores all the information about a file except its name and its actual data. A data structure is a way of storing data so that it can be used efficiently.



A Unix file is stored in two different parts of the disk - the data blocks and the inodes. I won't get into superblocks and other esoteric information. The data blocks contain the "contents" of the file. The information about the file is stored elsewhere - in the inode.



A file's inode number can easily be found by using the `ls` command, which by default lists the objects (i.e. files, links and directories) in the current directory (i.e. the directory in which the user is currently working), with its `-i` option. Thus, for example, the following will show the name of each object in the current directory together with its inode number:



```bash

ls -i

```



`df's` `-i` option instructs it to supply information about inodes on each filesystem rather than about available space. Specifically, it tells df to return for each mounted filesystem the total number of inodes, the number of free inodes, the number of used inodes and the percentage of inodes used. This option can be used together with the `-h` option as follows to make the output easier to read:



```bash

df -hi

```



**Finding files by inodes**



If you know the inode, you can find it using the find command:



```bash

find . -inum 435304 -print

```



**Deleting files with strange names**



Sometimes files are created with strange characters in the filename. The Unix file system will allow any charact