System Administrator interview questions

/ is the root of the filesystem hierarchy and contains or provides access to every other filesystem path.

• /etc stores host-specific system configuration files.
• /var stores variable data such as logs, caches, queues, and state files.
• /home contains the home directories and personal files of regular users.
• /tmp holds temporary files and may be cleared automatically, including at reboot.

An absolute path starts at the root directory, while a relative path is interpreted from the current working directory.

• An absolute path begins with /, such as /etc/hosts.
• A relative path does not begin with /, such as documents/report.txt.
• . refers to the current directory.
• .. refers to the parent directory.

The first character in an ls -l entry indicates the type of the filesystem object.

• - means a regular file, and d means a directory.
• l means a symbolic link.
• b and c mean block and character device files.
• p means a named pipe, and s means a socket.

A hard link is another directory entry for the same inode, while a symbolic link is a separate file that stores a path to a target.

• Hard links share the target's inode and file contents.
• Symbolic links have their own inode and can point to directories.
• A hard link normally cannot cross filesystem boundaries, while a symbolic link can.
• Removing the original name does not break a hard link, but it can leave a symbolic link dangling.

Every Linux file has one owning user and one owning group used when permission checks are made.

• The owner permission bits apply when the accessing user is the file's owner.
• The group permission bits apply to eligible members of the file's group when owner bits do not apply.
• The other permission bits apply when neither the owner nor group class applies.

The rwx bits have different effects depending on whether the object is a regular file or a directory.

• For a regular file, r reads its contents, w changes its contents, and x permits executing it as a program.
• For a directory, r lists its entries, w permits creating, deleting, or renaming entries, and x permits traversal and access to entries by name.
• Directory operations often require combinations, such as r with x for a useful listing or w with x to change entries.

Symbolic chmod notation specifies whose permissions change, the operation, and the permission bits.

• u, g, o, and a select the owner, group, others, or all classes.
• + adds permissions, - removes permissions, and = sets the selected permissions exactly.
• r, w, and x select read, write, and execute permission.
• chmod u+x,g-w file adds owner execute permission and removes group write permission.

Numeric chmod notation represents each permission class with an octal digit formed by adding permission values.

• Read has value 4, write has value 2, and execute has value 1.
• The three digits normally represent owner, group, and others in that order.
• Each digit ranges from 0 for no permissions to 7 for read, write, and execute.
• chmod 640 file gives the owner rw, the group r, and others no permissions.

chown changes file ownership, while chgrp changes a file's owning group.

• chown user file sets a new owning user.
• chown user:group file sets both the owning user and group.
• chgrp group file changes only the owning group.

umask is a process setting that removes permission bits from the base mode requested when a new file or directory is created.

• Regular files commonly start from base mode 666, without execute bits.
• Directories commonly start from base mode 777.
• Each bit set in the umask is cleared from the corresponding base mode.
• With umask 022, the common results are 644 for files and 755 for directories.

/etc/passwd stores public account data, while /etc/shadow stores protected password and aging data.

• Each /etc/passwd entry includes the login name, UID, primary GID, descriptive field, home directory, and login shell.
• The password field in /etc/passwd is usually x, indicating that the password data is kept in /etc/shadow.
• /etc/shadow contains a password hash or a marker that locks or disables password login, not the plaintext password.
• /etc/shadow also records password aging values and is normally readable only by privileged processes.

Linux groups assign shared identities and permissions to sets of users.

• /etc/group normally records a group name, password placeholder, numeric GID, and a comma-separated list of supplementary members.
• A user's primary group is referenced by the GID in that user's /etc/passwd entry, so the user may not appear in the member list in /etc/group.
• id shows a user's UID, primary GID, and supplementary group memberships, usually with both numbers and names.
• groups prints the group names associated with the current user or a specified user.

sudo runs an authorized command with another user's privileges, while su starts a shell or command as another user.

• sudo normally authenticates the invoking user and applies rules configured for that user.
• su commonly requires the target user's password and, without a command, opens a shell under the target identity.
• sudo can permit a narrow set of administrative commands and creates a clearer audit trail than sharing a root password.
• Least privilege means granting only the commands and access needed for a role, for no longer than necessary.

A PID identifies a running process, and a PPID identifies the process that created or adopted it as its parent.

• The kernel assigns each process a numeric process ID called a PID.
• The parent process ID, or PPID, represents the process relationship used in the process hierarchy.
• ps displays a snapshot of processes and can show fields such as PID, PPID, user, state, CPU time, and command.
• Options such as ps -ef, ps aux, or ps -o pid,ppid,user,stat,command select different process sets and output formats.

A foreground job owns the terminal, while a background job runs without occupying the shell prompt.

• Adding & to a command starts it as a background job and returns the prompt immediately.
• jobs lists jobs tracked by the current shell, including their job numbers and states.
• bg resumes a stopped job in the background, commonly by referring to a job number such as %1.
• fg brings a background or stopped job into the foreground and reconnects it to the terminal.

Signals are asynchronous notifications sent to processes, and kill is a command for sending them.

• SIGTERM, signal 15, requests an orderly termination and can be handled so the process can clean up.
• SIGKILL, signal 9, ends a process immediately and cannot be caught, blocked, or ignored.
• SIGHUP, signal 1, historically reports a disconnected terminal and is also commonly used to request a configuration reload.
• kill uses SIGTERM by default, while a signal name or number can explicitly select another signal.

An exit status is an integer through which a command reports success or a type of failure to the shell.

• By convention, status 0 means success and a nonzero status means the command did not complete successfully.
• The special parameter $? expands to the exit status of the most recently completed command or pipeline.
• Running another command replaces the value represented by $?, so it should be read or saved promptly.
• Shell constructs such as &&, ||, and if use exit statuses to decide which command or branch runs next.

Commands normally use three standard streams that the shell can connect to files or other commands.

• Standard input is file descriptor 0 and normally supplies data from the terminal.
• Standard output is file descriptor 1 for regular results, while standard error is file descriptor 2 for errors and diagnostics.
• Operators such as <, >, >>, and 2> redirect input, replace output, append output, or redirect errors.
• A pipe, |, connects the standard output of the command on the left to the standard input of the command on the right.

A shell variable belongs to the current shell, while an environment variable is exported for inheritance by child processes.

• An assignment such as NAME=value creates or updates a variable in the current shell.
• export NAME or export NAME=value marks the variable for inclusion in the environment of subsequently started commands.
• Child processes inherit copies of exported values but do not receive unexported shell variables.
• A child process cannot directly change the variable or environment value stored in its parent shell.

Shell quoting and escaping control which characters are interpreted before arguments are passed to a command.

• Single quotes preserve every character inside them literally until the closing single quote.
• Double quotes preserve spaces and wildcard characters but still allow expansions such as variables and command substitution.
• A backslash removes the special meaning of the following character where the shell's quoting rules permit it.
• Unquoted glob patterns such as *.log are expanded by the shell to matching pathnames before the command runs.