Unit 1: Linux Command Line and User Management

1. Introduction to Linux System Administration and the Shell

1.1 The Role of the Linux System Administrator

In enterprise IT infrastructure, Red Hat Enterprise Linux (RHEL) and derivative Unix-like operating systems power mission-critical workloads, cloud infrastructure, containerized platforms (OpenShift/Kubernetes), and database clusters. A system administrator is responsible for:

Guaranteeing high system availability, security, and performance.
Managing user identities, authentication boundaries, and fine-grained permissions.
Navigating and maintaining the file system hierarchy in compliance with standard conventions.
Automating administrative workflows via shell scripting, pipelines, and standard text manipulation tools.

The primary interface for enterprise system administration is the Command-Line Interface (CLI) operating through the GNU Bourne-Again Shell (Bash). Unlike graphical user interfaces (GUIs), the CLI provides programmatic reproducibility, remote headless administration over secure channels, and granular diagnostic control.

CODE
+---------------------------------------------------------------------------------------------------+
|                                  LINUX SYSTEM ARCHITECTURE TOPOLOGY                               |
+---------------------------------------------------------------------------------------------------+
|  USER SPACE                                                                                       |
|   +-----------------------+     +------------------------+     +------------------------------+   |
|   |  Interactive Users    |     |  System Daemons        |     |  Administrative Scripts      |   |
|   |  (Virtual Consoles,   |     |  (sshd, systemd,       |     |  (Bash, Python, Ansible)     |   |
|   |   SSH Sessions)       |     |   crond, rsyslogd)     |     |                              |   |
|   +-----------+-----------+     +-----------+------------+     +--------------+---------------+   |
|               |                             |                                 |                   |
|               v                             v                                 v                   |
|   +-------------------------------------------------------------------------------------------+   |
|   |                    GNU C LIBRARY (glibc) / SYSTEM CALL INTERFACE (POSIX)                  |   |
|   +---------------------------------------------+---------------------------------------------+   |
|                                                 |                                                 |
|  KERNEL SPACE                                   v                                                 |
|   +-------------------------------------------------------------------------------------------+   |
|   |                                     LINUX KERNEL                                          |   |
|   | - Process Management & Scheduler             - Memory Management & Virtual Memory Subsystem|   |
|   | - Virtual File System (VFS) Layer           - Network Stack (TCP/IP, Netfilter)           |   |
|   | - Device Drivers                            - Security Modules (SELinux, LSM)             |   |
|   +---------------------------------------------+---------------------------------------------+   |
|                                                 |                                                 |
|  HARDWARE LAYER                                 v                                                 |
|   +-------------------------------------------------------------------------------------------+   |
|   |         CPU (x86_64/ARM64)  |  RAM  |  Storage Devices (NVMe, SSD, HDD)  |  NICs          |   |
+---------------------------------------------------------------------------------------------------+

2. Command-Line Access and Terminal Control

2.1 Physical Terminals, Virtual Consoles, and Pseudo-Terminals

Linux distinguishes between physical hardware terminals, virtual consoles, and software-emulated pseudo-terminals:

Virtual Consoles (tty1 through tty6):
- Linux provisions multiple independent character-cell terminal interfaces directly managed by the kernel and systemd-getty-generator.
- On RHEL, switching between virtual consoles is achieved using key combinations:
  - Ctrl + Alt + F1: In modern RHEL systems, tty1 hosts the display manager (GNOME Display Manager - GDM) or graphical desktop session.
  - Ctrl + Alt + F2 through Ctrl + Alt + F6: Provide full-screen text-mode virtual console login prompts (agetty).
Pseudo-Terminal Slaves (pts):
- Graphical terminal emulators (e.g., gnome-terminal) and remote network sessions (e.g., ssh) allocate pseudo-terminal devices located under /dev/pts/N (e.g., /dev/pts/0, /dev/pts/1).
- The command tty prints the file name of the terminal connected to standard input.
- The command who or w displays currently logged-in users alongside their active terminal type, IP address, and idle time.

2.2 Bash Command Execution Syntax and Parsing Cycle

When an administrator enters a command line, Bash executes an explicit multi-step parsing cycle before dispatching the binary to the kernel:

CODE
[User Input String] 
        |
        v
1. Tokenization & Quoting Analysis (Splits words on IFS: space, tab, newline)
        |
        v
2. History Expansion (e.g., !!, !$, !string)
        |
        v
3. Alias Substitution (e.g., ll -> ls -l --color=auto)
        |
        v
4. Brace Expansion (e.g., {a,b,c}, {1..5})
        |
        v
5. Tilde Expansion (e.g., ~ -> /home/username, ~+ -> $PWD)
        |
        v
6. Parameter & Variable Expansion (e.g., $VAR, ${PATH})
        |
        v
7. Command Substitution (e.g., $(date +%F) or `uname -r`)
        |
        v
8. Arithmetic Expansion (e.g., $(( 5 + 3 * 2 )))
        |
        v
9. Word Splitting (Re-evaluates fields using IFS)
        |
        v
10. Pathname / Glob Expansion (Wildcards *, ?, [a-z])
        |
        v
11. Command Lookup & Execution (Built-ins -> Hashes -> PATH directories)
        |
        v
12. Exit Status Code Return ($?)

Standard command structure conforms to:
$\texttt{command} \quad [-\text{short\_options}] \quad [--\text{long\_options}] \quad [\text{arguments}]$

Exit Status Code ($?): Every executed process returns an 8-bit unsigned integer ( $0 \le \text{code} \le 255$ $0 \leq code \leq 255$ ) to the parent shell.
- Value 0: Successful execution with zero errors.
- Values 1 to 255: Failure or specific error condition (e.g., 127 = Command not found, 126 = Command invoked cannot execute/permission denied, 130 = Script terminated by Ctrl+C / SIGINT).

2.3 Shell Quoting Mechanisms

To control shell parameter and wildcard evaluation, Bash provides three quoting mechanisms:

Quoting Style	Syntax	Behavior
Escape Character	`\character`	Preserves the literal value of the following character. Suppresses special meanings of spaces, wildcards, and symbols (`\$`, `\` ).
Single Quotes (Strong Quoting)	`'string'`	Preserves the literal value of all enclosed characters. Inhibits variable interpolation, command substitution, and globbing entirely.
Double Quotes (Weak Quoting)	`"string"`	Preserves literal value of most characters, but permits variable expansion (`$`), command substitution (`$()`), and backslash escaping (`\`).

3. The Linux File System Hierarchy Standard (FHS)

3.1 Principles of the File System Hierarchy

Linux organizes all storage partitions, peripheral devices, network shares, and virtual kernel interfaces into a single unified hierarchical tree rooted at / (the root directory), defined by the Filesystem Hierarchy Standard (FHS 3.0).

CODE
+---------------------------------------------------------------------------------------------------+
|                                 LINUX FHS DIRECTORY TOPOLOGY                                      |
+---------------------------------------------------------------------------------------------------+
|  / (Root Directory - The anchor of the entire filesystem tree)                                    |
|  |                                                                                                |
|  +-- /bin   --> Symlink to /usr/bin (Essential administrative and user binary executables)        |
|  +-- /sbin  --> Symlink to /usr/sbin (Essential system administrative binaries, e.g., fdisk, ip)  |
|  +-- /lib   --> Symlink to /usr/lib (Shared library objects (.so) needed to boot the system)      |
|  +-- /lib64 --> Symlink to /usr/lib64 (64-bit architecture shared libraries)                      |
|  +-- /boot  (Static bootloader files, GRUB2 configuration, kernel vmlinuz, initramfs images)     |
|  +-- /dev   (Special device files created by udev daemon, e.g., /dev/sda, /dev/nvme0n1, /dev/null)|
|  +-- /etc   (Host-specific machine configuration files, e.g., /etc/passwd, /etc/hosts)           |
|  +-- /home  (User home directories, e.g., /home/student)                                         |
|  +-- /root  (Home directory for the root superuser account)                                       |
|  +-- /media (Mount point for removable media, e.g., CD-ROMs, USB flash drives)                   |
|  +-- /mnt   (Temporary mount point for manually mounted filesystems by administrator)             |
|  +-- /opt   (Add-on third-party software packages and commercial application suites)              |
|  +-- /proc  (Virtual pseudo-filesystem representing kernel state, memory, and process table)     |
|  +-- /sys   (Virtual pseudo-filesystem exposing kernel device tree and hardware subsystem drivers)|
|  +-- /tmp   (Temporary scratch space; cleared automatically on boot or via systemd-tmpfiles)      |
|  +-- /usr   (Secondary hierarchy containing shareable, read-only user utilities and libraries)    |
|  +-- /var   (Variable data files: system logs, mail spools, database storage, web server roots)   |
+---------------------------------------------------------------------------------------------------+

3.2 Inodes and Hard Links vs. Symbolic (Soft) Links

In the Linux Virtual File System (VFS), a file consists of two decoupled components:

Directory Entry (Dentry): A human-readable name mapped to a numerical Index Node (inode).
Inode: A data structure on disk storing metadata: file size, disk block pointers, ownership (UID/GID), permissions, timestamps (atime, mtime, ctime), and link count. The inode does not store the file name.

CODE
HARD LINK ARCHITECTURE:
[Dentry: file1.txt] ----\
                         +---> [ Inode #104821 ] ---> [ Data Blocks on Disk ]
[Dentry: file2.txt] ----/     (Link Count = 2)

SYMBOLIC (SOFT) LINK ARCHITECTURE:
[Dentry: symlink.txt] ---> [ Inode #992410 ] ---> [ Data Block containing: "/var/log/file1.txt" ]
                                                                 |
                                                                 v
                               [ Target File: Inode #104821 ] ---> [ Actual Data Blocks ]

Dimension	Hard Link (`ln target linkname`)	Symbolic / Soft Link (`ln -s target linkname`)
Inode Number	Identical inode number as the original file.	Distinct, newly allocated inode number.
Cross-Filesystem	Cannot span across separate disk partitions/filesystems.	Can span across different mount points and file systems.
Directory Linking	Prohibited for regular users to prevent circular loops.	Permitted; can link to directories.
Target Deletion	Target file data remains intact as long as link count $\ge 1$ .	Becomes a dangling/broken link pointing to a non-existent path.
Storage Overhead	Zero additional disk blocks consumed.	Consumes a small data block storing the target path string.

4. Path Expansion, File Manipulation, and Search Utilities

4.1 Shell Wildcards (Globbing) vs Regular Expressions

Pathname expansion operates at the shell level to match directory entries:

*: Matches zero or more arbitrary characters (e.g., *.log matches app.log, error.log, .log).
?: Matches exactly one single character (e.g., test?.txt matches test1.txt but not test12.txt).
[characters]: Matches any one character contained within the set (e.g., file[0-9].txt).
[!characters] or [^characters]: Matches any one character not in the enclosed set.
Predefined Character Classes: [[:alpha:]], [[:digit:]], [[:alnum:]], [[:space:]].

4.2 Locating Files: `find` vs `locate`

Linux provides two fundamentally different file search paradigms:

CODE
LOCATE (Database Search):
[locate query] ---> Queries [/var/lib/mlocate/mlocate.db] ---> Instantaneous Results
                     (Updated nightly via cron or manually via 'updatedb')

FIND (Real-Time Live Tree Crawl):
[find /path]   ---> Traverses live disk directory tree ---> Evaluates Inode Predicates
                     (Always 100% current, supports deep actions: -exec, -delete)

Common find expressions in enterprise administration:

bash
# Find files larger than 100MB modified in the last 7 days under /var/log
find /var/log -type f -size +100M -mtime -7

# Find world-writable files and securely revoke write permissions
find /data -type f -perm -0002 -exec chmod o-w {} +

# Find files owned by deleted users (orphaned files)
find /home -nouser -o -nogroup

5. Documentation and Technical Support

5.1 The Manual Pages (`man`) Architecture

The primary offline documentation repository in Linux is the Manual Pages system, partitioned into standardized numbered sections:

Section Number	Domain Topic	Enterprise Examples
1	User Commands (Executable binaries and shell utilities)	`ls(1)`, `tar(1)`, `grep(1)`
2	System Calls (Kernel function entry points in C)	`open(2)`, `fork(2)`, `read(2)`
3	C Library Functions (glibc subroutines)	`printf(3)`, `malloc(3)`
4	Special Files (Device interfaces in `/dev`)	`null(4)`, `zero(4)`, `random(4)`
5	File Formats and Configuration File Conventions	`passwd(5)`, `shadow(5)`, `sudoers(5)`
6	Games and Amusements	Historical text games
7	Miscellaneous Conventions, Protocols, and Overviews	`man(7)`, `hier(7)`, `ip(7)`
8	System Administration Commands (Superuser/root binaries)	`useradd(8)`, `systemctl(8)`, `fdisk(8)`

Navigating man:

Search keywords: man -k keyword or apropos keyword (queries the pre-compiled whatis index generated by mandb).
Viewing specific sections: man 5 passwd opens configuration format documentation rather than the passwd(1) command utility.
Internal navigation: /pattern to search forward, n for next match, N for previous match, q to exit.

6. Text Processing, Data Streams, and I/O Redirection

6.1 Standard Streams and File Descriptors

Every process launched in a POSIX environment initializes with three standard I/O integer file descriptors:

0 (Standard Input - stdin): Keyboards, piped data, default read stream.
1 (Standard Output - stdout): Terminal screen, default output stream for successful execution.
2 (Standard Error - stderr): Terminal screen, unbuffered output stream dedicated to error diagnostics.

CODE
                +---------------------------------------+
  stdin (FD 0)  |                                       |  stdout (FD 1)
 -------------> |           RUNNING PROCESS             | -------------> Terminal Screen
 Keyboard / Redir|                                       | Data Stream
                |  (Computes Logic / Memory Buffers)    |
                |                                       |  stderr (FD 2)
                +---------------------------------------+ -------------> Terminal Screen
                                                          Diagnostic Log Stream

6.2 Redirection Syntax Matrix

Operator	File Descriptor	Operation Performed
`>`	`1>` (stdout)	Overwrites destination file with process standard output. Creates file if missing.
`>>`	`1>>` (stdout)	Appends process standard output to the end of the destination file.
`2>`	`2>` (stderr)	Overwrites destination file with process error diagnostics.
`2>>`	`2>>` (stderr)	Appends error diagnostics to destination file.
`&>` or `>&`	`1 & 2`	Redirects both stdout and stderr simultaneously to a single file.
`2>&1`	Merging	Redirects descriptor 2 (stderr) to point to wherever descriptor 1 is currently routed.
`<`	`0<` (stdin)	Feeds file content into the process as standard input.
`<<delimiter`	Here-Document	Feeds multi-line text block into stdin until reaching the designated delimiter string.
`\|`	Pipe	Binds `stdout` of the upstream process directly to `stdin` of the downstream process.
`tee [-a]`	T-Splitter	Copies standard input simultaneously to `stdout` and one or more target files on disk.

7. Command-Line Text Editing with Vim

The vim (Vi IMproved) editor is the ubiquitous modal text editor in enterprise Linux environments. Its operation relies on discrete modes:

CODE
                  +---------------------------+
                  |        NORMAL MODE        | <----+
                  |  (Navigation & Commands)  |      |
                  +-------------+-------------+      |
                                |                    |
                  +-------------+-------------+      | Esc
                  |                           |      |
             i, a, o |                 : / ?  |      |
                  v                           v      |
    +-----------------------+   +--------------------+-----+
    |      INSERT MODE      |   |    COMMAND-LINE / EX     |
    |  (Typing raw text)    |   | (:w, :q!, :%s/old/new/g) |
    +-----------------------+   +--------------------------+

Navigation (Normal Mode):
- h, j, k, l: Left, Down, Up, Right.
- 0 / $: Move cursor to beginning / end of current line.
- gg / G: Jump to the first line / last line of file.
- 42G or :42: Jump directly to line number 42.
Editing and Cut/Paste:
- x: Delete single character under cursor.
- dd / 5dd: Delete (cut) current line / next 5 lines.
- yy / 3yy: Yank (copy) current line / next 3 lines.
- p / P: Paste clipboard buffer after / before cursor.
- u / Ctrl + r: Undo last action / Redo undone action.
Ex Commands (Colon Mode):
- :w [file]: Write (save) buffer to disk.
- :q!: Force quit without saving modifications.
- :wq or ZZ: Save and exit.
- :%s/old_text/new_text/g: Search and replace all instances throughout the file.
- :set number: Enable line numbering.

8. Managing Local Linux Users and Groups

8.1 Linux Security Model: Users, Groups, and UIDs

Linux enforces discretionary access control (DAC) rooted in numerical identifiers:

User Identification (UID):
- UID 0: Reserved exclusively for the root superuser account, possessing unrestricted system authority.
- System Users (UID 1 to 999 in RHEL 8/9): Non-interactive service accounts used to run system daemons (e.g., bin, daemon, sshd, chrony, nginx). They have /sbin/nologin or /bin/false as their login shell.
- Regular Users (UID 1000 to 60000+): Human users assigned interactive login shells (e.g., /bin/bash).
Group Identification (GID):
- Primary (Default) Group: Assigned to a user at account creation; files created by the user inherit this GID by default. In RHEL, User Private Group (UPG) policy creates a unique group with the same name and GID as the user's UID.
- Supplementary (Secondary) Groups: Additional groups to which a user belongs, granting shared access to departmental assets or administrative privileges.

8.2 User and Group Account Configuration Files

Local identity and authentication state is maintained across four critical system files:

CODE
+---------------------------------------------------------------------------------------------------+
|                            LOCAL IDENTITY FILE SPECIFICATION MATRIX                               |
+---------------------------------------------------------------------------------------------------+
| 1. /etc/passwd (World-readable 0644 - Stores user account definitions)                            |
|    Format: username:password_flag:UID:GID:GECOS_comment:home_directory:login_shell                |
|    Example: student:x:1001:1001:Student User:/home/student:/bin/bash                              |
|                                                                                                   |
| 2. /etc/shadow (Restricted 0000 / 0600 - Stores salted cryptographic password hashes & aging)     |
|    Format: username:hashed_pw:last_change:min_days:max_days:warn_days:inactive_days:expire:flag  |
|    Example: student:$6$salt$hash...:19740:0:90:7:14:19900:                                        |
|                                                                                                   |
| 3. /etc/group (World-readable 0644 - Stores group definitions)                                    |
|    Format: group_name:password_flag:GID:user_member_list                                          |
|    Example: wheel:x:10:root,student                                                               |
|                                                                                                   |
| 4. /etc/gshadow (Restricted 0000 / 0600 - Stores group passwords and administrators)              |
|    Format: group_name:group_password:group_admins:group_members                                   |
+---------------------------------------------------------------------------------------------------+

8.3 Detailed Field Breakdown of `/etc/shadow`

The /etc/shadow file contains nine colon-separated fields vital for security compliance:

Username: Login identifier matching /etc/passwd.
Encrypted Password Hash:
- Begins with a prefix identifying the cryptographic hash algorithm:
  - $1$ : MD5 (Legacy, insecure).
  - $5$ : SHA-256.
  - $6$ : SHA-512 (Standard enterprise default).
  - $y$ : yescrypt (Modern RHEL 9 default).
- If field contains ! or *, the account is locked and cannot authenticate via password.
Last Password Change: Number of days between January 1, 1970 (Unix epoch) and the date the password was last modified.
Minimum Password Age (min_days): Days that must elapse before the user is permitted to change the password again.
Maximum Password Age (max_days): Days before the password expires and must be changed.
Warning Period (warn_days): Days prior to expiration during which the user receives warning notices upon login.
Inactive Period (inactive_days): Days after password expiration before the account is permanently disabled.
Expiration Date (expire): Epoch days when the account itself expires and is disabled.
Reserved: Unused flag reserved for future extensions.

9. Superuser Privileges: `su`, `sudo`, and `/etc/sudoers`

9.1 `su` vs. `su -` Login Dynamics

When escalating privileges to root or switching user accounts using su (Switch User):

su [username]: Non-login shell. Preserves the environment variables, working directory, and path of the original user. Can cause script errors due to unaligned $PATH settings.
su - [username] (or su -l): Login shell. Completely reinitializes the environment, resetting $HOME, $PATH, $USER, and sourcing the target user’s shell initialization files (/etc/profile, ~/.bash_profile, ~/.bashrc). This is the required best practice.

9.2 The `sudo` Subsystem and `visudo`

The sudo (Superuser Do) utility allows authorized users to execute specific commands with superuser privileges while preserving their individual identity for auditable traceability.

Advantages over su:
- Eliminates the need to share the root password among multiple engineers.
- Grants granular, command-specific privileges (e.g., allow an operator to restart Apache without granting root shell access).
- Logs all executed administrative commands to /var/log/secure.

Configuration is maintained in /etc/sudoers and modular files under /etc/sudoers.d/. It must always be edited using the visudo command, which locks the file against concurrent writes and validates syntax before saving, preventing administrative lockouts.

CODE
/etc/sudoers Syntax:
user_or_group    HOSTS = (RUN_AS_USERS : RUN_AS_GROUPS)    TAGS: COMMANDS

Example 1: Granting wheel group full administrative access
%wheel           ALL=(ALL)                                 ALL

Example 2: Granting webadmin permission to restart web server without password
webadmin         ALL=(root)                                NOPASSWD: /usr/bin/systemctl restart httpd

10. User Account Management Commands

10.1 Command Reference Matrix

Command	Primary Function	Key Enterprise Options
`useradd`	Creates a new user account and sets up defaults.	`-u <uid>`: Assigns specific UID. `-g <gid>`: Assigns primary group. `-G <groups>`: Assigns supplementary groups (comma-separated). `-d <dir>`: Specifies custom home directory path. `-s <shell>`: Assigns default login shell. `-c <comment>`: Sets GECOS description. `-m`: Forces creation of home directory (default in RHEL).
`usermod`	Modifies an existing user account's properties.	`-aG <groups>`: Appends supplementary groups without removing existing ones. `-s <shell>`: Changes default login shell. `-L`: Locks account (prepends `!` to password hash in `/etc/shadow`). `-U`: Unlocks account. `-e YYYY-MM-DD`: Sets account expiration date.
`userdel`	Deletes a user account.	`-r`: Recursive removal; removes user's home directory and mail spool along with account entry.
`groupadd`	Creates a new group.	`-g <gid>`: Assigns specific GID. `-r`: Creates a system group (GID < 1000).
`passwd`	Manages user passwords and lock status.	`-l <user>`: Locks password. `-u <user>`: Unlocks password. `-e <user>`: Expires password immediately, forcing change on next login. `-S <user>`: Displays password status report.
`chage`	Manages password aging policies.	`-l <user>`: Lists current password aging parameters. `-M <days>`: Sets maximum password age. `-m <days>`: Sets minimum password age. `-W <days>`: Sets expiration warning days. `-I <days>`: Sets inactivity period days.

10.2 User Account Creation Workflow

When an administrator runs useradd -m -s /bin/bash developer:

The kernel allocates the next available UID $\ge 1000$ (defined by UID_MIN in /etc/login.defs).
A new primary group developer is created in /etc/group with matching GID.
The user entry is appended to /etc/passwd and locked password record added to /etc/shadow.
The home directory /home/developer is created.
Template configuration files located in /etc/skel/ (e.g., .bash_profile, .bashrc, .bash_logout) are copied into /home/developer.
Ownership of the home directory and its contents is recursively updated to developer:developer (chown -R), and permissions set to 0700 or 0750.

11. Summary of Engineering Best Practices

Never Share Root Credentials: Enforce sudo access via the %wheel group; revoke direct remote SSH root logins by configuring PermitRootLogin no in /etc/ssh/sshd_config.
Always Use su - Rather Than su: Guarantee complete environment reinitialization and correct $PATH inheritance when switching identities.
Always Use visudo to Modify Sudo Privileges: Prevent syntax errors that could lock administrators out of superuser access.
Always Append Groups with usermod -aG: Omitting the -a (append) flag removes the user from all existing supplementary groups, inadvertently stripping administrative access.
Enforce Password Aging Compliance: Use chage -M 90 -W 7 to enforce 90-day password rotation and 7-day advance warnings in compliance with corporate security baselines.

Linux System Administration