IT FundamentalsXK0-005

Linux+ System Administration: Commands, File Systems, and Process Management

Linux runs more than 90% of cloud servers, most Android devices, and all supercomputers. If you are serious about IT infrastructure, security, or DevOps, Linux fluency is not optional. The Linux+ (XK0-005) exam tests your ability to administer Linux systems — not just run commands, but understand WHY each command works the way it does. This guide walks through the file system, user management, process control, networking, and security from a working administrator's perspective.

13 min
6 sections · 10 exam key points

The Linux File System Hierarchy and Navigation

Linux uses a single-root hierarchy — everything starts at / (the root directory). Key directories: /boot (kernel and bootloader files — never delete), /etc (system-wide configuration files — all text, human-readable), /home (user home directories — /home/username), /var (variable data: logs in /var/log, mail spools, databases), /tmp (temporary files — cleared on reboot), /usr (user-space programs and libraries), /bin and /sbin (essential binaries for boot and repair), /dev (device files — block and character devices represented as files), /proc (virtual filesystem exposing kernel data — /proc/cpuinfo, /proc/meminfo), /sys (hardware and kernel parameter interface). Navigation: ls -la (list all files including hidden, with details), cd (change directory), pwd (print working directory), find / -name filename (search from root), locate filename (search indexed database — run updatedb first).

User and Group Management

Linux access control is built on users, groups, and permissions. Commands: useradd username (create user), passwd username (set password), usermod -aG groupname username (add user to group — the -a flag appends, without it you remove from all other groups), userdel -r username (delete user and home directory), groupadd / groupdel (manage groups). Key files: /etc/passwd (username, UID, GID, home, shell — no passwords stored here), /etc/shadow (hashed passwords with expiry policies — readable only by root), /etc/group (group memberships). Privilege escalation: sudo (run as root, logged, requires sudoers entry), su - (switch to root — requires root password). The sudoers file (/etc/sudoers) controls who can run what — always edit with visudo to prevent syntax errors that lock you out.

File Permissions and Ownership

Every file has an owner (user), a group, and three permission sets: owner, group, others. Permissions: r (read=4), w (write=2), x (execute=1). Display: ls -l shows -rwxr-xr-- meaning owner=rwx(7), group=r-x(5), others=r--(4). chmod 755 file (owner full, group and others read+execute), chmod u+x file (add execute for owner), chmod g-w file (remove write from group). chown user:group file changes ownership. Special permissions: SUID (chmod 4755 — file runs as the owner's UID, used for passwd command), SGID (chmod 2755 on directory — new files inherit the group), Sticky bit (chmod 1777 on /tmp — users can only delete their own files). ACLs (Access Control Lists) extend beyond three-party permissions: setfacl -m u:bob:rw file gives bob read/write regardless of standard permissions.

Process Management and System Resources

Processes are the running instances of programs. Commands: ps aux (snapshot of all processes — USER, PID, %CPU, %MEM, COMMAND), top / htop (real-time process viewer, sortable by CPU/memory), kill PID (send SIGTERM — graceful stop), kill -9 PID (SIGKILL — immediate termination, no cleanup), killall processname (kill all instances by name), nice -n 10 command (launch with lower priority, -20 to 19, lower = higher priority), renice -n 5 -p PID (change priority of running process). Systemd service management: systemctl start/stop/restart/status service, systemctl enable service (start at boot), systemctl disable service (do not start at boot), journalctl -u service -f (follow logs for a service). Background jobs: command & (run in background), jobs (list background jobs), fg %1 (bring job 1 to foreground), Ctrl+Z (suspend foreground job).

Networking and Firewall Configuration

Network commands: ip addr show (show interfaces and IP addresses — replaces ifconfig), ip route show (routing table), ss -tuln (listening ports — replaces netstat), nmcli (NetworkManager CLI for persistent configuration on modern distros), ping, traceroute, nslookup, dig, curl, wget. Firewall tools: firewalld (Red Hat family — uses zones and services, firewall-cmd to manage), ufw (Uncomplicated Firewall — Debian/Ubuntu, simpler syntax: ufw allow 22/tcp), iptables (low-level netfilter rules, still relevant for advanced filtering). SSH: ssh user@host, ssh-keygen generates key pairs, ssh-copy-id copies public key to remote host (enables passwordless login), /etc/ssh/sshd_config controls daemon settings (PermitRootLogin no, PasswordAuthentication no for hardening). File transfer: scp source user@host:dest, rsync -avz source dest (efficient incremental sync).

Storage, Filesystems, and Package Management

Storage commands: lsblk (list block devices and partitions), fdisk -l (partition tables), parted (partition management for GPT and large disks), mkfs.ext4 /dev/sdb1 (format partition), mount /dev/sdb1 /mnt (mount partition — temporary), add to /etc/fstab for persistent mounts. LVM (Logical Volume Manager) adds flexibility: Physical Volumes (PVs) > Volume Groups (VGs) > Logical Volumes (LVs) — you can resize LVs online without rebooting. df -h (disk usage by filesystem), du -sh /path (directory size). Package managers: apt update && apt install package (Debian/Ubuntu — update refreshes package index), yum install / dnf install (Red Hat/CentOS/Fedora — dnf is the modern replacement for yum), rpm -ivh package.rpm (install RPM directly), dpkg -i package.deb (install DEB directly). Always update package lists before installing to get the latest versions and security patches.

Key exam facts — XK0-005

  • usermod -aG group user adds a user to a group without removing from others (-a is append)
  • visudo is the safe way to edit /etc/sudoers — prevents syntax errors
  • chmod 4755 sets SUID — file runs as the file owner's UID
  • kill -9 sends SIGKILL (forced termination); kill sends SIGTERM (graceful)
  • systemctl enable starts a service at boot; systemctl start runs it now
  • ip addr show and ss -tuln replace deprecated ifconfig and netstat
  • LVM allows online resizing: PV > VG > LV hierarchy
  • /etc/fstab controls automatic mount on boot
  • PermitRootLogin no and PasswordAuthentication no are SSH hardening best practices
  • find searches live file system; locate searches pre-built index (updatedb required)

Common exam traps

sudo and su are the same thing

sudo runs a single command with elevated privileges and logs the action. su switches your entire shell session to another user (usually root). sudo is preferred because it is audited and requires the user's own password, not root's.

Deleting a file with rm removes it immediately and permanently

rm removes the directory entry, but the data blocks remain until overwritten. On ext4 with journaling, recovery tools can often restore recently deleted files. Use shred for secure deletion.

chmod 777 is the easiest fix for permission problems

chmod 777 grants everyone full read/write/execute access — a major security risk. Always apply least-privilege: give only the permissions actually needed to the specific user or group that needs them.

Linux does not need a firewall because it is more secure than Windows

Linux needs firewall configuration. The kernel's netfilter subsystem (iptables/nftables) provides the mechanism, but you must configure it. Default configurations vary widely by distribution.

Practice this topic

Test yourself on Linux+ Administration

JT Exams routes you to questions in your exact weak areas — automatically, after every session.

No credit card · Cancel anytime

Related certification topics