Linux System Administration learning path: everything to study, topic by topic

Linux architecture, distribution families, the Filesystem Hierarchy Standard, the boot sequence (firmware, bootloader, kernel, init), kernel modules, hardware discovery, and the shell environment

Navigating and managing files and directories, hard and symbolic links, find, archiving and compression, redirection and pipes, grep, sed, awk, and editing with vi/vim and nano

Installing, updating and removing software with rpm/dnf/yum and dpkg/apt, repositories and GPG signature verification, shared libraries, and compiling from source with configure/make

Managing configuration under /etc, kernel parameters with sysctl, time synchronization with chrony, locale and timezone, logging with rsyslog and journald, log rotation, and environment and alternatives configuration

RHCSA essentials at the shell: command syntax, redirection and pipes, grep with regular expressions, tar with gzip and bzip2, hard and symbolic links, ugo/rwx permissions, su and sudo login shells, and finding answers offline with man, info and /usr/share/doc

Registering RHEL, BaseOS and AppStream repositories, writing .repo files, dnf install/remove/provides/history, GPG key import, rpm queries and verification, and Flatpak remotes and applications

systemd targets (default, isolate, rescue, emergency), interrupting GRUB2 to edit the kernel line, rd.break root password reset with SELinux relabeling, persistent kernel arguments with grubby and grub2-mkconfig, and controlled shutdown and reboot

File inspection and transfer details: stat output with access (atime), modify (mtime) and change (ctime) times and which operation updates each, following growing logs with tail -f versus tail -F across rotation, rsync archive mode with --delete to mirror a directory (trailing slash semantics, --dry-run, -z, -e ssh), and verifying integrity with sha256sum, md5sum and sha256sum -c against a published checksum file

Command-line text recipes for logs and config files: in-place bulk replacement across files with sed -i.bak and find or xargs, summing a delimited column with awk -F, '{s+=$3} END{print s}', counting distinct values with cut -d' ' -f1 | sort -u | wc -l or sort | uniq -c | sort -rn, and why uniq needs sorted input

Partitioning with fdisk/parted, GPT vs MBR, ext4 and XFS, LVM (PV, VG, LV) with resize and snapshots, software RAID with mdadm, swap, fstab and mounts, quotas, and network storage with NFS and iSCSI

Process states and signals, priorities with nice/renice, ps/top, systemd units, targets and dependencies, writing unit files, drop-in overrides, cron, at and systemd timers, and journalctl

Configuring interfaces and addresses with NetworkManager (nmcli), netplan or ifcfg, the ip command, routing, DNS resolution and resolv.conf, hostname, bonding and VLANs, and tools such as ss, dig, curl and tcpdump

Finding and ending CPU or memory heavy processes, signals, nice and renice, tuned profiles and tuned-adm, reading journalctl and /var/log, making the journal persistent, and bounding journal size

systemctl enable --now, mask and dependencies, cron and crontab, at jobs, systemd timers with OnCalendar and Persistent, chrony time clients, and scp, sftp and rsync transfers

Creating GPT partitions with parted or fdisk, physical volumes, volume groups and logical volumes, mkfs for XFS, ext4 and VFAT, mounting by UUID or label in /etc/fstab, extending logical volumes online, adding swap, and Stratis and LVM-VDO volumes

Mounting NFS exports manually and in /etc/fstab, _netdev and nofail, autofs master and map files with direct, indirect and wildcard maps, idle timeouts, and the firewall, SELinux and export-side checks for NFS

Filesystem tuning and recovery: user and group disk quotas (usrquota,grpquota mount options, quotacheck, quotaon, edquota soft and hard limits with grace period, repquota, and xfs_quota for XFS), reducing the ext4 reserved block percentage with tune2fs -m on data volumes, and mounting a cloned or snapshotted XFS volume whose UUID duplicates a mounted one with -o nouuid or regenerating it with xfs_admin -U generate

Routine administration tools: preventing overlapping cron jobs with flock -n on a lock file, rotating logs with logrotate (weekly or size rules, rotate count, compress, copytruncate versus postrotate reload, /etc/logrotate.d), managing multiple versions of a command with the alternatives system (update-alternatives or alternatives --config, symlinks under /etc/alternatives), and resuming long-running work over a dropped SSH connection with tmux (new, detach, attach, list sessions)

Linux virtualization administration: confirming hardware virtualization extensions (vmx/svm flags in /proc/cpuinfo, lscpu, kvm-ok), installing and using KVM with libvirt (virsh list, start, shutdown, autostart, define, dumpxml), creating guests with virt-install, paravirtualized virtio disk and network drivers instead of emulated IDE and e1000 devices for I/O performance, and point-in-time guest snapshots with virsh snapshot-create-as and snapshot-revert

Backup design and tooling: full, incremental and differential schemes and which sets a restore needs, GNU tar incremental archives with --listed-incremental, preserving ACLs, extended attributes and SELinux contexts with --acls --xattrs --selinux, bit-for-bit disk imaging with dd (if, of, bs, status=progress, conv=fsync) and the risk of swapping if and of

Account templates and long-running sessions: files placed in /etc/skel copied into new home directories by useradd -m (.bashrc, README.txt) without affecting existing users, and keeping a foreground job such as rsync alive after SSH logout by suspending with Ctrl+Z, bg and disown -h, or starting it with nohup, setsid or inside tmux or screen

Defense in depth on Linux: patching cadence, minimizing services and packages, disk encryption with LUKS, GPG, TLS certificates and PKI, auditing with auditd, benchmark-based hardening (CIS), and secure defaults

Local accounts and groups (/etc/passwd, /etc/shadow), useradd and usermod, password aging, sudoers, PAM modules, centralized identity with LDAP, SSSD and Kerberos, and multi-factor authentication

Host firewall concepts (stateful filtering, zones, chains), firewalld zones/services/rich rules, nftables and iptables rule evaluation, ufw, NAT and port forwarding, and persistence of rules

OpenSSH client and server configuration, key-based authentication, ssh-agent, sshd_config hardening, port forwarding and jump hosts, scp/sftp/rsync, tmux, and remote desktop alternatives

Discretionary permissions (rwx, umask), special bits (setuid, setgid, sticky), file attributes, POSIX ACLs, mandatory access control with SELinux (contexts, booleans, modes) and AppArmor profiles

useradd and usermod options, groups and shared directories with setgid, chage and login.defs password aging, locking accounts, sudoers.d and visudo, POSIX ACLs with masks and defaults, umask, and diagnosing file permission problems with namei and getfacl

Persistent IPv4 and IPv6 addressing with nmcli, hostnamectl, /etc/hosts and nsswitch.conf, autoconnect at boot, firewall-cmd zones, services, ports and sources with runtime versus permanent rules, and key-based SSH with ssh-copy-id

getenforce, setenforce and /etc/selinux/config, reading file and process contexts with ls -Z and ps -Z, semanage fcontext with restorecon, semanage port, setsebool -P, and diagnosing AVC denials with ausearch and sealert

Hardening in practice: Linux file capabilities set with setcap and read with getcap (cap_net_bind_service+ep to bind privileged ports without root, rather than setuid), compliance scanning with OpenSCAP (oscap xccdf eval with a profile, HTML report, remediation), banning brute-force SSH sources with fail2ban (jails, maxretry, findtime, bantime, fail2ban-client status), and restoring SELinux labels after a root password reset in rd.break (touch /.autorelabel and restorecon) so logins work again

Detecting and limiting tampering: file integrity monitoring with AIDE or Tripwire (initialize a baseline database with aide --init, store it read-only off-host, compare with aide --check, update after authorized changes), protecting logs from an attacker who compromises a server by forwarding them to a remote collector with rsyslog or journal remote and append-only chattr +a, and reviewing failed authentication with lastb, faillog, journalctl and /var/log/secure or auth.log

Writing reliable Bash scripts: shebang, variables and quoting, conditionals, loops, functions, arguments, exit codes, error handling with set -euo pipefail, traps, here-documents, and cron-driven automation

Containers as Linux processes (namespaces, cgroups, capabilities), image and container lifecycle with Podman or Docker, volumes and port publishing, rootless containers, systemd-managed containers, and basic orchestration and cloud concepts

Infrastructure as code for Linux fleets: Ansible inventories, ad hoc commands, playbooks, modules and idempotency, cloud-init user data, templating, Git-based workflow for configuration, and drift detection

Pulling UBI and registry images, running detached rootless containers with published ports, bind mounts with :Z labeling, Containerfile builds, Quadlet .container units run under systemd, loginctl enable-linger, and container troubleshooting

Everyday Git recovery operations used by administrators managing configuration repositories: git reset --soft, --mixed and --hard and what each does to HEAD, the index and the working tree, git stash push, list, pop and apply to park uncommitted changes, and removing a committed file from tracking with git rm --cached together with .gitignore while keeping the file on disk (with history rewrite needed to purge secrets)

Releasing changes safely and handling credentials in orchestrated environments: rolling updates, blue-green deployments with instant switchback, canary releases that route a small percentage of traffic to the new version and promote on healthy metrics, and Kubernetes Secrets (created with kubectl create secret generic, base64 encoding is not encryption, mounted as volumes or environment variables, encryption at rest, RBAC limits, external secret stores)

Python 3 in administration scripts: reading command-line arguments with sys.argv and argparse (int conversion of sys.argv[1]), running commands safely with subprocess.run using a list of arguments, capture_output=True, text=True and check=True without shell=True to avoid injection, loading JSON with json.load, isolating dependencies with python3 -m venv and source venv/bin/activate plus pip install, try/except FileNotFoundError to fail with a clear message, and dict.get(key, default) for optional settings

Undoing and inspecting history in configuration repositories: git revert abc1234 creating a new commit that undoes a pushed commit without rewriting history (versus reset and force push), git revert -m for merge commits, git blame -L to show the author and commit of each line in a file such as sshd_config, git log -p and git log --follow for a file, and git bisect to locate a breaking commit

Operating configuration management at scale: encrypting variable files with ansible-vault encrypt, edit, view and --vault-id so playbook secrets can be committed to Git, supplying the password with --ask-vault-pass or a vault password file, and choosing push (Ansible over SSH from a controller) versus pull (ansible-pull, Puppet agent, Chef client) models when hundreds of hosts sit behind NAT and cannot accept inbound connections

Using generative AI safely for Linux administration: giving the assistant the distribution and version (Ubuntu 24.04 versus Rocky Linux 8) so commands match the package manager and paths, treating output as unverified (hallucinated packages, flags or modules), checking package names in official repositories, reviewing and testing generated scripts with dry runs, shellcheck and a non-production host before production, never pasting passwords, API keys or customer data into public AI services, and handling licensing and provenance of generated code that resembles GPL projects

Diagnosing full filesystems and inode exhaustion, df/du/lsof, mount and fstab failures, filesystem repair with fsck and xfs_repair, LVM and RAID degradation, I/O bottlenecks with iostat/iotop, and failing disks with SMART

Layered diagnosis of connectivity: link, IP, route, DNS and port; ping, traceroute, mtr, ss, dig, curl, tcpdump; firewall and routing misconfiguration, MTU and duplicate IP problems, and bandwidth and latency analysis

Interpreting load average, top/htop, vmstat, free, sar and pidstat; CPU saturation vs I/O wait, memory pressure, swapping, OOM killer behavior, memory leaks, runaway processes, and cgroup limits

Resolving login failures, locked accounts, sudo denials, 'Permission denied' on files and directories, ownership and group membership issues, ACL and SELinux denials, quota and ulimit limits

Diagnosing failed units with systemctl status and journalctl, dependency and ordering cycles, systemd-analyze blame, rescue and emergency targets, GRUB and initramfs repair, and recovering from bad fstab or lost root passwords

Diagnosing storage faults: a 'target is busy' unmount resolved by finding processes with fuser -vm or lsof +f, then stopping them or using a lazy unmount carefully, drive health from smartctl -H and -a (reallocated, pending and uncorrectable sectors, temperature) and smartd alerts, and 'permission denied' executing a script from a filesystem mounted noexec, found with findmnt or mount and fixed with a remount or running through an interpreter

Deep-dive diagnosis tools: the kernel OOM killer (dmesg and journalctl evidence 'Out of memory: Killed process', oom_score and oom_score_adj from -1000 to 1000 to protect or sacrifice processes, vm.overcommit_memory, cgroup memory limits), tracing system calls with strace (-p, -f, -e trace=file or network, -c summary, -tt timestamps) to see why a process hangs or cannot open a file, and historical performance data with sysstat (sar -u CPU, -r memory, -d disk, -n DEV network, -q load, sadc collection and the sa files)

Two network faults: intermittent connectivity from duplicate IP addresses on a segment, detected with arping -D (duplicate address detection exit status) or arping -I and by inspecting ARP cache MAC changes (ip neigh), and outbound connection failures caused by ephemeral port exhaustion with many sockets in TIME-WAIT, seen with ss -s, tuned with net.ipv4.ip_local_port_range, connection reuse and keep-alive, and net.ipv4.tcp_tw_reuse

Diagnosing remote-access failures step by step: ssh -v/-vv/-vvv to see the keys and authentication methods the client tries, testing whether a TCP port such as 5432 is reachable without sending application data using nc -zv host port (or bash /dev/tcp), Kerberos 'Clock skew too great' caused by time drift and fixed by synchronizing time with chrony or NTP, and viewing per-interface DNS servers and search domains on systemd-resolved hosts with resolvectl status

Recovering a system that drops to an emergency shell because the initramfs lacks the storage driver: booting rescue media, mounting the root filesystem and bind-mounting /dev, /proc and /sys, entering it with chroot, regenerating the image with dracut -f --kver on RHEL-family, update-initramfs -u -k on Debian-family or mkinitcpio -P on Arch, and verifying contents with lsinitrd or lsinitramfs