Unit 1: Introduction to Linux & System Administration Fundamentals

1. Operating System Architecture & Linux Characteristics

Linux is an enterprise-grade, open-source Unix-like operating system operating under the GNU General Public License (GPL). At its foundation lies a monolithic kernel designed with modularity, allowing dynamic loading and unloading of device drivers via Loadable Kernel Modules (LKMs) without requiring a full kernel recompilation or system reboot.

1.1 Core Architectural Distinctions

• Monolithic Kernel with LKM: Unlike a microkernel where services (like filesystems and networking) operate in user space, the Linux kernel executes primary operating subsystems—process scheduling, virtual memory management, virtual filesystem (VFS), and network stacks—within privileged kernel space (Ring 0). Loadable kernel modules extend functionality dynamically.
• GNU User Space Environment: Linux refers strictly to the kernel. A complete operating system distribution (such as Ubuntu, Debian, Red Hat Enterprise Linux, or Rocky Linux) integrates the Linux kernel with GNU toolchains, system libraries (glibc), shell interpreters (bash), core utilities (coreutils), and service management managers (systemd).
• Multi-User and Preemptive Multitasking: Linux isolates simultaneous user sessions through distinct User Identifiers (UID) and Group Identifiers (GID). The Completely Fair Scheduler (CFS) provides deterministic CPU timeslices to threads based on nice priorities (-20 to 19).
• Filesystem Hierarchy Standard (FHS): Everything in Linux is represented as an abstraction of a file. The directory hierarchy adheres to FHS:
  • /bin & /sbin: Fundamental user and administrative binary executables.
  • /etc: Host-specific static configuration files.
  • /var: Variable data files including logs (/var/log) and spool queues.
  • /proc & /sys: Virtual pseudo-filesystems exposing kernel runtime metrics and hardware device topologies.
  • /dev: Device nodes representing block and character hardware peripherals.

2. Command Line Shell Interaction & Bash Operations

The Bourne Again Shell (bash) serves as the primary command-language interpreter between the human administrator and the operating system kernel.

2.1 The Standard I/O Descriptor Pipeline

Every native process spawned within the shell automatically inherits three fundamental POSIX file descriptors:

1. stdin (File Descriptor 0): Default stream capturing keyboard input.
2. stdout (File Descriptor 1): Standard output capturing normal execution results.
3. stderr (File Descriptor 2): Dedicated diagnostics stream capturing error reports.

Stream Redirection Operators:

• command > file: Overwrites file with standard output (FD 1).
• command >> file: Appends standard output to the designated file.
• command 2> file: Captures and redirects only standard error (FD 2).
• command &> file or command > file 2>&1: Merges both stdout and stderr into a single destination.
• command1 | command2: Pipes stdout of command1 into stdin of command2 via an in-memory kernel buffer.

2.2 Shell Environment & Variables

• Local vs Environment Variables: Local variables (VAR=val) exist solely within the current shell instance. Exported variables (export VAR=val) persist across child process invocations.
• Critical System Variables:
  • PATH: Colon-delimited list of directories searched sequentially for executable binaries.
  • HOME: Absolute path to the active user's home directory.
  • SHELL: Path to the currently configured login shell interpreter.
  • PS1: String definition dictating the interactive shell prompt appearance.

3. System Documentation and Help Systems

Efficient Linux systems management relies on built-in offline manual references.

Manual Page Numerical Sections:

• Section 1: General User Commands (ls, grep, tar).
• Section 2: Kernel System Calls (fork, open, read).
• Section 3: C Library Functions (printf, malloc).
• Section 4: Special Devices and Drivers (/dev/null, /dev/sda).
• Section 5: Configuration File Formats and Conventions (/etc/passwd, /etc/fstab).
• Section 8: System Administration and Privileged Commands (fdisk, useradd, systemctl).

4. The Linux Boot Process Architecture

The transformation from an unpowered motherboard to an operational multi-user environment follows a strict sequence:

CODECopy Code
+-------------------------------------------------------------------------+
| Phase 1: Firmware Initialization (UEFI / Legacy BIOS)                   |
| - Executes Power-On Self-Test (POST).                                   |
| - Inspects NVRAM boot order; loads EFI System Partition (ESP) binary.   |
+-------------------------------------------------------------------------+
                                    |
                                    v
+-------------------------------------------------------------------------+
| Phase 2: GRUB2 Bootloader Stage                                         |
| - Reads /boot/grub2/grub.cfg.                                           |
| - Loads compressed kernel binary (vmlinuz) and Initial RAM Disk (initrd)|
+-------------------------------------------------------------------------+
                                    |
                                    v
+-------------------------------------------------------------------------+
| Phase 3: Kernel Execution & initramfs Unpacking                          |
| - Initializes hardware registers, memory paging, and CPU structures.    |
| - Unpacks initramfs into temporary rootfs; loads root storage drivers.  |
| - Mounts real storage root (/) read-only, pivots root, and spawns PID 1.|
+-------------------------------------------------------------------------+
                                    |
                                    v
+-------------------------------------------------------------------------+
| Phase 4: System Initialization (systemd PID 1)                          |
| - Resolves dependency graph of target units (multi-user.target).        |
| - Spawns background daemons, mounts filesystems (/etc/fstab).           |
| - Launches display managers or virtual console login prompts (getty).   |
+-------------------------------------------------------------------------+

4.1 Modifying Boot Parameters & GRUB2

Kernel boot parameters dictate fundamental hardware and runtime parameters passed on the linux16 / linux line:

• quiet: Suppresses informational kernel dmesg scrolling during boot.
• rhgb: Red Hat Graphical Boot (presents Plymouth splash screen).
• systemd.unit=rescue.target: Directs systemd to boot into single-user administrative rescue mode.
• init=/bin/bash or rd.break: Breaks execution before pivot-root to allow Emergency root password recovery.
• Permanent Configuration: Edited inside /etc/default/grub and compiled via grub2-mkconfig -o /boot/grub2/grub.cfg.

5. User and Group Account Administration

Linux safeguards multi-tenant security by defining granular user identities and privilege boundaries.

5.1 Account Database Structures

1. /etc/passwd (World-readable metadata, permissions 0644):
   • Format: username:password_indicator:UID:GID:GECOS:home_dir:shell
   • Example: sarah:x:1001:1001:Database Admin:/home/sarah:/bin/bash
   • Note: The x indicates password hash is secured within /etc/shadow.
2. /etc/shadow (Restricted read access 0640 or 0000, root-owned):
   • Contains salted crypt-hash (e.g., SHA-512 indicated by $6$), last password change epoch, minimum/maximum password age, and warning periods.
3. /etc/group (Group mappings, permissions 0644):
   • Format: group_name:password:GID:user_list_comma_separated
   • Example: wheel:x:10:root,sarah

5.2 User & Group Management Utilities

• useradd -m -s /bin/bash -g developers -G wheel devuser: Creates a user with home directory, primary group, and supplementary wheel group.
• usermod -aG docker devuser: Appends user to supplementary group without stripping existing memberships.
• userdel -r devuser: Removes user account along with their home directory and mail spool.
• chage -M 90 -W 7 devuser: Enforces 90-day password expiration with 7-day advance warning.
• passwd -l devuser: Locks account by prepending an exclamation point (!) to the encrypted hash in /etc/shadow.

6. Privilege Escalation & Administrative Delegation

Direct root logins are heavily discouraged in production environments to maintain auditability and non-repudiation.

6.1 su versus sudo

• su devuser: Switches real/effective UID to target user but retains the invoking user's existing environment variables.
• su - devuser: Spawns a full login shell, initializing target user's clean environment (PATH, HOME, shell rc files).
• sudo command: Executes single privileged binary with elevated credentials while logging command invocation to /var/log/secure or /var/log/auth.log.

6.2 Sudoers Configuration Syntax

The /etc/sudoers file must always be modified using visudo to prevent locking the system through syntax errors.

• Rule Syntax: User Host=(RunAs_User:RunAs_Group) [TAGS] Commands
• Wheel Group Privilege: %wheel ALL=(ALL) ALL allows members of group wheel to execute any command as root.
• Passwordless Delegation: %devops ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx permits restarting the web service without prompting for the operator's password.

7. Common Pitfalls & Exam Tips

• Forgetting -a when using usermod -G: Running usermod -G group user replaces all existing secondary groups. Always append with usermod -aG group user.
• Directly editing /etc/sudoers with nano or vi: Always use visudo. It performs syntax validation before writing changes to disk, preventing syntax corruption that locks out all administrative access.
• Misinterpreting Manual Sections: Running man passwd opens the user command manual (Section 1). To view the configuration file layout of /etc/passwd, you must explicitly specify man 5 passwd.
• Locked vs Disabled Shell: An account set to /sbin/nologin or /bin/false in /etc/passwd prevents interactive shell logins, but scheduled batch jobs or SSH key authentications might still occur unless the account itself is locked in /etc/shadow.

8. Quick Revision Summary

• The Linux kernel is a modular monolithic engine utilizing LKMs for runtime hardware driver integration.
• Standard I/O uses file descriptors 0 (stdin), 1 (stdout), and 2 (stderr). Pipes (|) link process streams in memory.
• Bootloader flow transitions from Firmware -> GRUB2 -> Kernel (with initramfs) -> systemd (PID 1).
• System manual pages are cataloged into 8 sections; Section 1 covers commands, 5 covers file formats, and 8 covers sysadmin tools.
• User authentication data is split between public metadata in /etc/passwd and secured hashes in /etc/shadow.
• Privilege escalation is controlled via /etc/sudoers audited by visudo and logged through system security facilities.