Linux runs more than 90% of cloud servers, most Android devices, and all supercomputers. If you are serious about IT infrastructure, security, or DevOps, Linux fluency is not optional. The Linux+ (XK0-005) exam tests your ability to administer Linux systems — not just run commands, but understand WHY each command works the way it does. This guide walks through the file system, user management, process control, networking, and security from a working administrator's perspective.
Practice this topic
Linux uses a single-root hierarchy — everything starts at / (the root directory). Key directories: /boot (kernel and bootloader files — never delete), /etc (system-wide configuration files — all text, human-readable), /home (user home directories — /home/username), /var (variable data: logs in /var/log, mail spools, databases), /tmp (temporary files — cleared on reboot), /usr (user-space programs and libraries), /bin and /sbin (essential binaries for boot and repair), /dev (device files — block and character devices represented as files), /proc (virtual filesystem exposing kernel data — /proc/cpuinfo, /proc/meminfo), /sys (hardware and kernel parameter interface). Navigation: ls -la (list all files including hidden, with details), cd (change directory), pwd (print working directory), find / -name filename (search from root), locate filename (search indexed database — run updatedb first).
Linux access control is built on users, groups, and permissions. Commands: useradd username (create user), passwd username (set password), usermod -aG groupname username (add user to group — the -a flag appends, without it you remove from all other groups), userdel -r username (delete user and home directory), groupadd / groupdel (manage groups). Key files: /etc/passwd (username, UID, GID, home, shell — no passwords stored here), /etc/shadow (hashed passwords with expiry policies — readable only by root), /etc/group (group memberships). Privilege escalation: sudo (run as root, logged, requires sudoers entry), su - (switch to root — requires root password). The sudoers file (/etc/sudoers) controls who can run what — always edit with visudo to prevent syntax errors that lock you out.
Every file has an owner (user), a group, and three permission sets: owner, group, others. Permissions: r (read=4), w (write=2), x (execute=1). Display: ls -l shows -rwxr-xr-- meaning owner=rwx(7), group=r-x(5), others=r--(4). chmod 755 file (owner full, group and others read+execute), chmod u+x file (add execute for owner), chmod g-w file (remove write from group). chown user:group file changes ownership. Special permissions: SUID (chmod 4755 — file runs as the owner's UID, used for passwd command), SGID (chmod 2755 on directory — new files inherit the group), Sticky bit (chmod 1777 on /tmp — users can only delete their own files). ACLs (Access Control Lists) extend beyond three-party permissions: setfacl -m u:bob:rw file gives bob read/write regardless of standard permissions.
Processes are the running instances of programs. Commands: ps aux (snapshot of all processes — USER, PID, %CPU, %MEM, COMMAND), top / htop (real-time process viewer, sortable by CPU/memory), kill PID (send SIGTERM — graceful stop), kill -9 PID (SIGKILL — immediate termination, no cleanup), killall processname (kill all instances by name), nice -n 10 command (launch with lower priority, -20 to 19, lower = higher priority), renice -n 5 -p PID (change priority of running process). Systemd service management: systemctl start/stop/restart/status service, systemctl enable service (start at boot), systemctl disable service (do not start at boot), journalctl -u service -f (follow logs for a service). Background jobs: command & (run in background), jobs (list background jobs), fg %1 (bring job 1 to foreground), Ctrl+Z (suspend foreground job).
Network commands: ip addr show (show interfaces and IP addresses — replaces ifconfig), ip route show (routing table), ss -tuln (listening ports — replaces netstat), nmcli (NetworkManager CLI for persistent configuration on modern distros), ping, traceroute, nslookup, dig, curl, wget. Firewall tools: firewalld (Red Hat family — uses zones and services, firewall-cmd to manage), ufw (Uncomplicated Firewall — Debian/Ubuntu, simpler syntax: ufw allow 22/tcp), iptables (low-level netfilter rules, still relevant for advanced filtering). SSH: ssh user@host, ssh-keygen generates key pairs, ssh-copy-id copies public key to remote host (enables passwordless login), /etc/ssh/sshd_config controls daemon settings (PermitRootLogin no, PasswordAuthentication no for hardening). File transfer: scp source user@host:dest, rsync -avz source dest (efficient incremental sync).
Storage commands: lsblk (list block devices and partitions), fdisk -l (partition tables), parted (partition management for GPT and large disks), mkfs.ext4 /dev/sdb1 (format partition), mount /dev/sdb1 /mnt (mount partition — temporary), add to /etc/fstab for persistent mounts. LVM (Logical Volume Manager) adds flexibility: Physical Volumes (PVs) > Volume Groups (VGs) > Logical Volumes (LVs) — you can resize LVs online without rebooting. df -h (disk usage by filesystem), du -sh /path (directory size). Package managers: apt update && apt install package (Debian/Ubuntu — update refreshes package index), yum install / dnf install (Red Hat/CentOS/Fedora — dnf is the modern replacement for yum), rpm -ivh package.rpm (install RPM directly), dpkg -i package.deb (install DEB directly). Always update package lists before installing to get the latest versions and security patches.
sudo and su are the same thing
sudo runs a single command with elevated privileges and logs the action. su switches your entire shell session to another user (usually root). sudo is preferred because it is audited and requires the user's own password, not root's.
Deleting a file with rm removes it immediately and permanently
rm removes the directory entry, but the data blocks remain until overwritten. On ext4 with journaling, recovery tools can often restore recently deleted files. Use shred for secure deletion.
chmod 777 is the easiest fix for permission problems
chmod 777 grants everyone full read/write/execute access — a major security risk. Always apply least-privilege: give only the permissions actually needed to the specific user or group that needs them.
Linux does not need a firewall because it is more secure than Windows
Linux needs firewall configuration. The kernel's netfilter subsystem (iptables/nftables) provides the mechanism, but you must configure it. Default configurations vary widely by distribution.
Try free Linux+ Administration practice questions with explanations, topic links and progress tracking.