Linux foundations

Learn the filesystem, shell, package manager, and permission model you use on every server.

Linux exposes almost everything as files, processes, sockets, and users. Learn those four ideas and server work becomes much less mysterious.

Inspect an unfamiliar server

Run these before making changes:

Terminal

whoami                         # current identity
hostnamectl                    # OS, kernel, hostname, virtualization
uname -a                       # kernel and architecture
cat /etc/os-release            # distribution details
uptime                         # runtime and load averages
free -h                        # memory and swap
df -hT                         # mounted filesystems and capacity

The three load-average values represent runnable or uninterruptible tasks over 1, 5, and 15 minutes. Compare them with the number of CPU cores from nproc; a sustained load far above the core count deserves investigation.

Know the filesystem

Path	Operational purpose
`/etc`	System and service configuration
`/var/log`	Persistent logs
`/var/lib`	Service-owned persistent state
`/var/www` or `/srv`	Common application locations
`/home`	Human user directories
`/opt`	Self-contained third-party software
`/run`	Runtime state cleared at boot
`/tmp`	Temporary files; do not assume persistence

Terminal

pwd                            # current directory
ls -lah                        # include hidden files and readable sizes
cd /var/www
mkdir -p cubis/releases
find /var/log -type f -name '*.log'
du -sh /var/* 2>/dev/null | sort -h

When the disk is full

Do not delete unfamiliar files at random. Find the full filesystem with df -hT, locate large directories with du or ncdu, then check whether logs, container layers, package caches, or deleted-open files are responsible.

Read and change text safely

Terminal

less /var/log/syslog           # scroll; / searches; q exits
tail -n 100 app.log            # last 100 lines
tail -F app.log                # follow across log rotation
grep -Rin 'connection refused' /var/log
cp nginx.conf nginx.conf.bak   # backup before editing
sudoedit /etc/nginx/nginx.conf # edit with your own editor identity
diff -u nginx.conf.bak nginx.conf

Use rm -rf only after resolving the exact path. It bypasses the trash and recursively removes entries without normal confirmation.

Identify the Linux family

Do not guess the distribution from a cloud provider or image name. Read the operating-system metadata first:

Terminal

cat /etc/os-release
command -v apt dnf yum apk zypper
systemctl --version

ID identifies the distribution and ID_LIKE lists related families. Package tools, package names, service names, firewall defaults, and security systems can differ even when the shell commands look familiar.

Install and update packages

Terminal

sudo apt update                         # refresh package information
apt list --upgradable                   # show available upgrades
sudo apt upgrade                        # install normal upgrades
sudo apt install nginx git curl jq htop # install named packages
apt show nginx                          # package details
dpkg -L nginx                           # files installed by the package
sudo apt autoremove                     # remove unused dependencies

apt update only refreshes package information. It does not install upgrades.

Test major upgrades and kernel changes before production rollout. After installing a new kernel, plan and verify the reboot instead of assuming the running kernel changed.

Common family differences

Task	Ubuntu / Debian	RHEL / Rocky / Amazon Linux
Packages	`apt`, `dpkg`	`dnf`, `rpm`
SSH service	usually `ssh`	usually `sshd`
Host firewall	commonly UFW	commonly firewalld
Security policy	AppArmor on Ubuntu	SELinux on RHEL-family systems
Main system log	journal; sometimes `/var/log/syslog`	journal; sometimes `/var/log/messages`

Use systemctl list-unit-files | grep -E 'ssh|sshd' and systemctl status NAME to confirm the actual service name. Do not disable SELinux or AppArmor just to make an application work; read the denial and fix the policy or file context.

Users, groups, and permissions

An ls -l entry separates permissions for the owner, group, and everyone else:

Terminal

-rwxr-xr-- 1 deploy www-data 2048 app.sh
 │└┬┘└┬┘└┬┘
 │ │  │  └─ others: read
 │ │  └──── group: read + execute
 │ └─────── owner: read + write + execute
 └───────── regular file

Terminal

id                               # UID, primary GID, supplementary groups
getent group www-data
chmod 750 deploy.sh              # owner rwx, group r-x, others none
chmod 600 .env                   # owner read/write only
chown deploy:www-data /srv/app
sudo -l                          # commands this identity may elevate

Avoid chmod 777. If a process cannot write, first identify its user with systemctl show -p User SERVICE or ps, then set deliberate ownership and the narrowest useful permissions.

Shell composition

Terminal

command-a | command-b            # pipe stdout into another command
command > file                   # replace file with stdout
command >> file                  # append stdout
command 2> errors.log            # redirect stderr
command && next                  # run next only after success
command || recovery              # run recovery only after failure

Check your understanding Given any file, you can identify its owner, group, permissions, filesystem, package source, and the process currently using it.

On this page