Linux Operations
Day-to-day Linux administration — disk, memory, processes, systemd, permissions, and troubleshooting.
17 questions
JuniorTheoryVery commonHow do you find which directory under a path consumes the most disk space?
How do you find which directory under a path consumes the most disk space?
du -sh /home/ubuntu shows the total size of one directory. To rank several, run du -sh * | sort -h — du -s sums each entry, -h prints human units, and sort -h sorts those human-readable sizes so the largest lands last.
Common mistakes
- ✗Confusing
du(space used by files) withdf(free space on a mounted filesystem) - ✗Sorting human-readable sizes with
sort -ninstead ofsort -h, which mis-orders1Gvs900M - ✗Expecting
ls -Sto account for the recursive contents of a directory
Follow-up questions
- →Why does
dureport a different total thandfon the same mount? - →What does
du -sh *miss, and how do you include hidden dotfiles?
MiddleTheoryVery commonWhat does /etc/sudoers control, and what does the sticky bit do on a directory?
What does /etc/sudoers control, and what does the sticky bit do on a directory?
/etc/sudoers defines which users may run which commands as another user (usually root) via sudo — edited safely with visudo. The sticky bit on a directory (chmod 1777, shown as t) restricts deletion: in a world-writable dir like /tmp, only a file's owner or root can remove it.
Common mistakes
- ✗Editing
/etc/sudoersdirectly instead of withvisudo, risking a syntax error that locks out sudo - ✗Thinking the sticky bit makes a directory read-only rather than restricting deletion to owners
- ✗Confusing the sticky bit (
1prefix) with setuid (4) or setgid (2)
Follow-up questions
- →Why is
visudopreferred over editing/etc/sudoerswith a plain editor? - →What do the setuid and setgid bits do, and why are they riskier than the sticky bit?
JuniorTheoryCommonWhat is LVM, and what are its physical volume, volume group and logical volume layers?
What is LVM, and what are its physical volume, volume group and logical volume layers?
LVM (Logical Volume Manager) is a storage abstraction between disks and filesystems. A physical volume (PV) is a raw disk or partition; one or more PVs form a volume group (VG), a storage pool; a logical volume (LV) is carved from a VG and gets a filesystem, and can be resized or span disks online.
Common mistakes
- ✗Confusing the PV/VG/LV layers — a VG is a pool, an LV is what gets a filesystem
- ✗Thinking LVM is itself a filesystem rather than a layer beneath one
- ✗Believing a logical volume cannot span more than one physical disk
Follow-up questions
- →What is the sequence of commands to grow a logical volume and its filesystem online?
- →What does an LVM snapshot capture, and what is its copy-on-write cost?
JuniorTheoryCommonHow do you see total memory usage and which process consumes the most on Linux?
How do you see total memory usage and which process consumes the most on Linux?
free -h shows total, used, available RAM plus swap. For per-process use top (or htop), sorting by the RES column — the resident set actually in RAM. VIRT is the virtual address space (often huge and shared) and SHR is the shared portion, so neither reflects real use.
Common mistakes
- ✗Ranking processes by
VIRTinstead ofRES, overstating memory because virtual space is mostly unbacked - ✗Treating the
availablefigure infreeasfree— cache is reclaimable and counts as available - ✗Forgetting that
SHRis double-counted across processes that map the same library
Follow-up questions
- →Why can the sum of all processes'
RESexceed physical RAM without the host swapping? - →What is the difference between
freememory andavailablememory infree -h?
JuniorTheoryCommonWhat is systemd, under which PID does it run, and how do you restart a service with it?
What is systemd, under which PID does it run, and how do you restart a service with it?
systemd is the init system and service manager on modern Linux. The kernel starts it first, so it runs as PID 1 and becomes the parent of every other process. You manage a unit with systemctl: systemctl restart nginx stops and starts the service, and systemctl status nginx shows its state.
Common mistakes
- ✗Thinking PID 1 is the kernel itself rather than the init process the kernel starts
- ✗Believing
systemctlonly reads config and cannot control a running service - ✗Assuming
serviceandsystemctlare unrelated rather thanserviceshimming to systemd
Follow-up questions
- →What happens to orphaned child processes when their parent dies, and why does PID 1 adopt them?
- →What does
systemctl enablechange compared tosystemctl start?
MiddleTheoryCommonHow do you stop a running process, and how do SIGTERM and SIGKILL differ?
How do you stop a running process, and how do SIGTERM and SIGKILL differ?
You signal a process by PID: kill <pid> sends SIGTERM (15), a request the process can catch to clean up and exit. kill -9 <pid> sends SIGKILL (9), which the kernel enforces at once — it cannot be caught, blocked, or ignored, so no cleanup runs. Prefer SIGTERM first, reserving SIGKILL for stuck processes.
Common mistakes
- ✗Reaching for
kill -9first instead of lettingSIGTERMtrigger a clean shutdown - ✗Believing
SIGKILLcan be caught or ignored by a signal handler - ✗Thinking
SIGTERMandSIGKILLbehave identically
Follow-up questions
- →Why might a process stuck in uninterruptible sleep (state
D) ignore evenSIGKILL? - →What does
SIGHUPtraditionally mean for a long-running daemon?
MiddleTheoryCommonWhat is swap, can you add or remove it on the fly, and how do you see per-process swap use?
What is swap, can you add or remove it on the fly, and how do you see per-process swap use?
Swap is disk space (partition or file) the kernel uses to offload inactive pages when RAM is tight. You add it live with swapon and remove it with swapoff, but swapoff must move swapped pages back to RAM first — so it fails if that exceeds free RAM. Per-process swap is in /proc/<pid>/status (VmSwap) or smem.
Common mistakes
- ✗Believing
swapoffalways succeeds — it fails when swapped data exceeds free RAM - ✗Confusing swap with a RAM cache instead of disk-backed overflow
- ✗Looking for per-process swap in
top'sREScolumn rather thanVmSwap
Follow-up questions
- →How does the
vm.swappinesstunable change when the kernel decides to swap? - →Why can heavy swap activity raise load average even when CPU is idle?
JuniorTheoryOccasionalWhere do logs and config files normally live on Linux, and what is an inode?
Where do logs and config files normally live on Linux, and what is an inode?
By convention logs go under /var/log and config under /etc, though services may use other paths. An inode is the on-disk structure holding a file's metadata — size, owner, permissions, timestamps, block pointers — but not its name, which lives in the directory entry pointing to the inode.
Common mistakes
- ✗Thinking the inode stores the filename — the name is in the directory entry, not the inode
- ✗Assuming log/config paths are hard rules rather than conventions services can override
- ✗Believing each hard link has its own inode rather than sharing one
Follow-up questions
- →How can a filesystem run out of inodes while still showing free space in
df -h? - →What does deleting one of several hard links to a file do to the inode's link count?
JuniorTheoryOccasionalHow do you add an IP to a Linux interface, and how do you make it survive a reboot?
How do you add an IP to a Linux interface, and how do you make it survive a reboot?
ip addr add 10.0.0.5/24 dev eth0 adds an address immediately, but it is lost on reboot because it is not persisted. To make it permanent you write it into the distro's config: Netplan YAML under /etc/netplan on modern Ubuntu, NetworkManager profiles, or /etc/network/interfaces on older Debian — then apply it.
Common mistakes
- ✗Thinking
ip addr addpersists across reboots on its own - ✗Not knowing which config file the distro uses (Netplan vs interfaces)
- ✗Forgetting to apply the config after editing it
Follow-up questions
- →How does Netplan relate to the backend renderer it drives (networkd or NetworkManager)?
- →Why might
ip addr addsucceed but the host still be unreachable on that IP?
JuniorTheoryOccasionalWhich services keep a Linux host's clock accurate, and how do you check the status?
Which services keep a Linux host's clock accurate, and how do you check the status?
Time is synchronised over NTP by a daemon: chrony (chronyd) on modern distros, or the older ntpd. On systemd hosts timedatectl shows whether the clock is synchronised and which service handles it, while chronyc tracking reports the offset and the upstream source. Accurate time matters for logs and TLS.
Common mistakes
- ✗Confusing the hardware RTC clock with the NTP-synced system clock
- ✗Not knowing
chronyhas largely replacedntpdon modern distros - ✗Forgetting
timedatectlreports synchronisation state, not just timezone
Follow-up questions
- →Why does an unsynchronised clock break TLS certificate validation?
- →How does
chronycope with intermittent network connectivity better thanntpd?
SeniorTheoryOccasionalWhat is the OOM killer, and how does it choose which process to terminate?
What is the OOM killer, and how does it choose which process to terminate?
The out-of-memory (OOM) killer is a kernel mechanism that kills a process to free memory when RAM and swap are exhausted and an allocation cannot be met. It scores each process with oom_score — mostly memory footprint, tunable via oom_score_adj — and kills the highest scorer to recover the most memory.
Common mistakes
- ✗Thinking the OOM killer targets the oldest or lowest-PID process rather than the highest
oom_score - ✗Believing it fires on a per-process
ulimitrather than system-wide memory exhaustion - ✗Forgetting
oom_score_adjcan bias the kernel to spare or prefer a specific process
Follow-up questions
- →How does setting
oom_score_adjto-1000affect a process during OOM? - →Why can
vm.overcommit_memorysettings change how often the OOM killer fires?
JuniorTheoryRareWhat are the built-in Linux security tools iptables, firewalld, SELinux and AppArmor for?
What are the built-in Linux security tools iptables, firewalld, SELinux and AppArmor for?
iptables (and its successor nftables) is the kernel packet filter — host firewall rules; firewalld is a higher-level front-end managing those rules with zones. SELinux and AppArmor are Mandatory Access Control layers that confine processes beyond file permissions: SELinux uses labels and policy, AppArmor uses path-based profiles. Firewalls filter traffic; MAC limits a compromised process.
Common mistakes
- ✗Treating SELinux/AppArmor as firewalls rather than Mandatory Access Control
- ✗Not knowing
firewalldis a front-end overiptables/nftables - ✗Assuming file permissions alone provide the confinement MAC adds
Follow-up questions
- →How does SELinux's label-based model differ from AppArmor's path-based profiles?
- →Why is Mandatory Access Control useful even when file permissions are correct?
MiddleTheoryRareWhat is an APT/yum package repository, where is it configured, and how do you host your own?
What is an APT/yum package repository, where is it configured, and how do you host your own?
A repository is a server holding signed packages plus a signed index the package manager fetches and verifies against a trusted key before installing. On Debian/Ubuntu sources live in /etc/apt/sources.list and /etc/apt/sources.list.d/; on RHEL in /etc/yum.repos.d/. To self-host you mirror or build a repo and serve it over HTTP — tools like Aptly, Pulp, or Nexus manage the packages, keys, and index.
Common mistakes
- ✗Not knowing where sources are configured (
/etc/aptvs/etc/yum.repos.d) - ✗Forgetting a repo needs signed index metadata, not just package files
- ✗Assuming self-hosting requires mirroring the entire upstream archive
Follow-up questions
- →Why does APT refuse a repository whose
Releasefile signature does not verify? - →When would you pin a package version to a specific repo over the default?
MiddleTheoryRareHow do you stop a specific Linux user from scheduling cron jobs?
How do you stop a specific Linux user from scheduling cron jobs?
There is no per-user on/off switch, but cron has an allow/deny gate: /etc/cron.allow and /etc/cron.deny. If cron.allow exists, only users listed in it may use crontab; otherwise anyone not in cron.deny may. So you add the user to cron.deny (or omit them from cron.allow), and remove any existing /var/spool/cron entry, since a deny does not stop already-scheduled jobs.
Common mistakes
- ✗Expecting a single per-user disable flag that does not exist
- ✗Not knowing
cron.allowtakes precedence and changes default behaviour - ✗Forgetting an existing spool entry keeps running even after a deny
Follow-up questions
- →How does the presence of
cron.allowchange the default for unlisted users? - →Why does adding a user to
cron.denynot stop their already-installed jobs?
MiddleTheoryRareWhat is PAM (Pluggable Authentication Modules) and how does it shape Linux authentication?
What is PAM (Pluggable Authentication Modules) and how does it shape Linux authentication?
PAM is a framework that lets programs delegate authentication to a stack of pluggable modules instead of hard-coding it. Services like login, sshd, and sudo are PAM-aware; their config in /etc/pam.d/ lists modules across the auth, account, password, session groups. A control flag (required, sufficient) decides the outcome, so you add 2FA or LDAP without recompiling a service.
Common mistakes
- ✗Thinking each service implements its own login instead of delegating to PAM
- ✗Confusing PAM control flags (
requiredvssufficient) when ordering modules - ✗Not knowing PAM splits into auth/account/password/session groups
Follow-up questions
- →How does the
sufficientcontrol flag short-circuit the rest of an auth stack? - →Why can a misordered
/etc/pam.d/sshdlock you out of a server entirely?
SeniorDebuggingRaredu reports 1 GB but df reports 10 GB used on the same mount — diagnose
du reports 1 GB but df reports 10 GB used on the same mount — diagnose
A process holds an open descriptor to a file deleted from the directory tree. du walks names and no longer sees it, but the inode's blocks survive until the last descriptor closes, so df still counts the space. Find it with lsof | grep deleted; reclaim by restarting or signalling the holding process, or truncating its fd via /proc/<pid>/fd.
Common mistakes
- ✗Running
fsckon a live mount instead of finding the process holding the deleted file - ✗Assuming the space is gone permanently rather than pinned by an open descriptor
- ✗Deleting more files when the real fix is to release or restart the holding process
Follow-up questions
- →Why does truncating
/proc/<pid>/fd/<n>free the space without killing the process? - →Which common service typically causes this with a deleted-but-still-written log file?
SeniorDesignRareYou are asked to harden a fleet of Linux user workstations against theft and malware. The machines are laptops carried off-site, run a standard desktop, and are managed centrally. Describe a layered hardening plan: what you would enforce at the boot/firmware level, at the disk level, at the OS/runtime level, and operationally — and explain the threat each layer addresses.
You are asked to harden a fleet of Linux user workstations against theft and malware. The machines are laptops carried off-site, run a standard desktop, and are managed centrally. Describe a layered hardening plan: what you would enforce at the boot/firmware level, at the disk level, at the OS/runtime level, and operationally — and explain the threat each layer addresses.
Layer by threat. Boot/firmware: Secure Boot plus a GRUB/BIOS password so an attacker can't boot alien media or edit kernel args. Disk: full-disk encryption (LUKS) so a stolen laptop leaks no data at rest. OS/runtime: a MAC layer (SELinux/AppArmor), host firewall, USB-storage blocking, updates, and endpoint protection (AV/EDR). Operationally: central config management, least privilege, and off-host audit logging.
Common mistakes
- ✗Treating antivirus as the whole solution instead of one layer
- ✗Skipping disk encryption, leaving data readable on a stolen device
- ✗Ignoring boot/firmware controls so an attacker boots alien media
Follow-up questions
- →How does LUKS protect data at rest but not against a running, unlocked machine?
- →Why does central config management matter more as the fleet size grows?
