Table of Contents Link to heading

• Accessing the Command Line
• How Applications Interact with the Kernel
  • Application Categories
  • Server Applications
  • Desktop Applications
• Console Tools: Shells and Text Editors
• Package Management
  • Debian Package Management (APT)
  • RPM Package Management (DNF/YUM)
• Development Languages on Linux
• Security Fundamentals
  • Password and Account Security
  • Hardening and Threat Mitigation
  • Privacy and Encryption Tools
• Linux in the Cloud
  • Cloud Deployment Models
  • Why Linux Dominates Cloud Infrastructure
  • Virtualisation
  • Containers and Modern Deployment

Accessing the Command Line Link to heading

The command-line interface (CLI) is the primary interface for Linux systems administration. On systems that boot to a GUI, there are two ways to reach a command-line environment:

1. GUI terminal emulator: Open a terminal application from the application menu (GNOME Terminal, Konsole, xterm). This runs a shell inside the graphical environment.
2. Virtual terminal (TTY): Press Ctrl+Alt+F2 through F6 to switch to a text-mode virtual console independent of the GUI. The GUI typically runs on Ctrl+Alt+F1 or F7. Virtual terminals are useful when the GUI is unresponsive or unavailable.

For remote systems — which describes most production Linux infrastructure — access is exclusively via SSH to a shell, with no GUI involved.

How Applications Interact with the Kernel Link to heading

The kernel is the arbitrator of all hardware access on a Linux system. Applications do not communicate with hardware directly; they make requests to the kernel via system calls, and the kernel fulfills (or denies) those requests:

• The kernel decides which process gets CPU time and for how long (scheduling)
• The kernel allocates and protects memory — each process gets its own isolated address space
• The kernel manages process lifecycle — starting (exec), pausing, and terminating (kill) processes
• Applications that require more than one process (web servers, databases) rely on the kernel to manage all spawned processes and their resource allocation

Multitasking on Linux is preemptive — the kernel can suspend any process at any time to give CPU time to another, creating the illusion of parallelism even on single-core systems.

Application Categories Link to heading

Linux software falls into three functional categories:

Server Applications Link to heading

Linux’s reliability, low resource overhead, and rich networking stack make it the dominant platform for server workloads:

• Web servers: nginx and Apache serve HTTP/HTTPS content; nginx’s event-driven architecture makes it particularly efficient for high-concurrency workloads
• Database servers: PostgreSQL (advanced relational), MySQL/MariaDB (widely deployed), Redis (in-memory key-value), MongoDB (document store)
• Mail servers: Postfix (MTA), Dovecot (IMAP/POP3), SpamAssassin (filtering)
• Private cloud: ownCloud and Nextcloud provide self-hosted file sync, sharing, and collaboration platforms — replacing cloud services like Dropbox or Google Drive in privacy-sensitive environments
• DNS: BIND, Unbound, and PowerDNS for name resolution infrastructure
• Monitoring: Prometheus, Zabbix, Nagios, Grafana for infrastructure observability

Desktop Applications Link to heading

Linux provides a complete desktop application ecosystem, though mainstream commercial software availability varies:

• Email: Thunderbird (cross-platform, IMAP/POP3), Evolution (GNOME), KMail (KDE)
• Office: LibreOffice (Writer, Calc, Impress) — the standard open-source alternative to Microsoft Office; compatible with .docx, .xlsx, .pptx formats
• Web browsers: Firefox and Chromium are the primary open-source browsers; Google Chrome is available as a binary package
• Creative tools: GIMP (image editing), Inkscape (vector graphics), Blender (3D modelling and animation), Audacity (audio editing), Kdenlive/DaVinci Resolve (video editing)

Console Tools: Shells and Text Editors Link to heading

Linux systems administration requires fluency in two categories of console tools:

Shells — the command interpreters that accept and execute commands:

Text editors — essential for editing configuration files and scripts:

vim is worth learning even if you prefer another editor — vi is guaranteed to be present on every POSIX system, including minimal containers and recovery environments where no other editor is available.

Package Management Link to heading

Every Linux system needs to install, update, and remove software. Packages are compressed archives that bundle an application with its metadata and dependency information. A package manager resolves dependencies, downloads packages from repositories, verifies their integrity, and manages installation and removal.

Debian Package Management (APT) Link to heading

Used by Debian, Ubuntu, Linux Mint, and derivatives. Packages use the .deb format.

# Update package index (always do this before installing)
sudo apt update

# Install a package
sudo apt install nginx
sudo apt install --no-install-recommends nginx    # minimal dependencies

# Remove a package
sudo apt remove nginx
sudo apt purge nginx            # remove + delete configuration files

# Remove unused dependencies
sudo apt autoremove

# Upgrade all installed packages
sudo apt upgrade
sudo apt full-upgrade           # may remove packages to resolve conflicts

# Search for packages
apt search "web server"
apt show nginx                  # detailed package information

# List installed packages
dpkg -l
dpkg -l | grep nginx

# Show files installed by a package
dpkg -L nginx

# Low-level dpkg commands
sudo dpkg -i package.deb        # install a local .deb file
sudo dpkg -r nginx              # remove package
dpkg --get-selections           # list all installed packages

RPM Package Management (DNF/YUM) Link to heading

Used by Red Hat Enterprise Linux, Fedora, Rocky Linux, AlmaLinux, and CentOS. Packages use the .rpm format.

# Install a package (dnf is the modern replacement for yum)
sudo dnf install nginx
sudo yum install nginx          # legacy (RHEL 7 and older)

# Remove a package
sudo dnf remove nginx

# Update all packages
sudo dnf update
sudo dnf upgrade                # equivalent

# Search for packages
dnf search "web server"
dnf info nginx                  # package details

# List installed packages
rpm -qa
rpm -qa | grep nginx

# Show files installed by a package
rpm -ql nginx

# Install a local .rpm file
sudo dnf install ./package.rpm
sudo rpm -ivh package.rpm       # low-level install with verbose output

# Check which package owns a file
rpm -qf /etc/nginx/nginx.conf
dnf provides /etc/nginx/nginx.conf

Development Languages on Linux Link to heading

Linux is a primary development platform across virtually all programming domains. Languages fall into two execution models:

Compiled languages: Source code is translated to machine code in full before execution. The resulting binary runs directly on the CPU without a runtime intermediary. Faster execution; requires recompilation for different architectures.

Interpreted languages: Source code is translated and executed line-by-line (or compiled to bytecode) at runtime by an interpreter. More portable; generally slower than compiled code for CPU-intensive tasks.

Key languages in the Linux ecosystem:

For sysadmins, Python and Bash are the most immediately relevant — Python for automation tools (Ansible is Python-based, many monitoring and infrastructure tools have Python APIs) and Bash for shell scripting and one-off automation tasks.

Security Fundamentals Link to heading

Password and Account Security Link to heading

The root account (UID 0) is the highest-privilege account on any Linux system. Proper management of privileged access is foundational to system security:

• Use sudo instead of root login: See su and sudo
• Strong password policy: Minimum length, complexity requirements, and rotation intervals configured in /etc/login.defs and enforced via PAM
• Disable unused accounts: Lock accounts for users who no longer require access with passwd --lock or usermod --lock
• SSH key authentication: Prefer public key authentication over password authentication for SSH; disable PasswordAuthentication in /etc/ssh/sshd_config on public-facing systems
• Principle of least privilege: Grant users and service accounts only the permissions required for their specific function

Hardening and Threat Mitigation Link to heading

Web tracking via cookies is one surface of a much broader attack landscape for administered systems. Core hardening practices:

• Keep software current: Apply security updates promptly — most exploited vulnerabilities have patches available before the attack; the gap is time-to-patch

# Debian/Ubuntu — unattended security updates
sudo apt install unattended-upgrades
sudo dpkg-reconfigure unattended-upgrades

# RHEL/CentOS — automatic security updates
sudo dnf install dnf-automatic
sudo systemctl enable --now dnf-automatic.timer

• Firewall: Restrict inbound connections to only the ports your services require

# UFW (Ubuntu/Debian)
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

# firewalld (RHEL/CentOS)
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

• Fail2ban: Automatically block IPs with repeated failed authentication attempts
• Audit logging: Enable auditd for comprehensive system call and file access logging
• SELinux / AppArmor: Mandatory Access Control systems that confine processes to defined policy — enabled by default on RHEL (SELinux) and Ubuntu (AppArmor)

Privacy and Encryption Tools Link to heading

Encryption protects data in transit and at rest from interception and unauthorised access:

• HTTPS / TLS: The standard for encrypting web traffic. Let’s Encrypt provides free, automated TLS certificates. Configure via nginx or Apache with strong cipher suites.

• SSH: The standard for encrypted remote administration. All Linux-to-Linux remote management should use SSH; Telnet and rsh transmit credentials in cleartext and should never be used.

• GPG (GNU Privacy Guard): Asymmetric encryption for files, email, and software package signing. Used to sign git commits, encrypt sensitive configuration files, and verify downloaded software. See GPG Encryption and Key Management.

• VPN: Creates an encrypted tunnel between two systems across an untrusted network. Common implementations: OpenVPN, WireGuard (modern, performant, in-kernel since Linux 5.6), IPsec.

• Tor: Routes traffic through a volunteer relay network to obscure the origin IP address. Used for anonymised browsing and bypassing censorship; the Tor Browser bundles Firefox with appropriate privacy settings.

• Full-disk encryption (LUKS): Encrypts the entire block device; data is inaccessible without the encryption key. Essential for laptops and portable storage devices.

# Check if a disk is LUKS-encrypted
sudo cryptsetup isLuks /dev/sda && echo "LUKS encrypted"

Linux in the Cloud Link to heading

Cloud Deployment Models Link to heading

Cloud computing moves IT resources from on-premises hardware to remotely accessed infrastructure. Four deployment models:

Why Linux Dominates Cloud Infrastructure Link to heading

Linux runs the overwhelming majority of cloud infrastructure — over 90% of cloud workloads on AWS, GCP, and Azure run on Linux. The reasons are structural:

• Licensing cost: No per-instance OS licence fee; critical at cloud scale where thousands of VMs may run simultaneously
• Automation-first design: Linux systems are designed to be configured programmatically via files and APIs, not through GUI wizards — essential for infrastructure-as-code and cloud automation
• Container compatibility: Docker, Kubernetes, and all container runtimes are built on Linux kernel features (cgroups, namespaces); Linux is the native platform
• Security and auditability: Open source codebase allows independent security review; kernel security features (SELinux, seccomp, namespaces, capabilities) provide fine-grained control
• Efficiency: Minimal Linux distributions (Alpine, distroless containers) run in megabytes; Windows Server base images run in gigabytes — the difference matters at scale

Virtualisation Link to heading

Virtualisation runs multiple independent operating system instances on a single physical host. The physical machine (host) runs a hypervisor — software that manages virtual machines (guests) and mediates their access to physical hardware:

• Each guest gets its own virtualised CPU, memory, storage, and network — completely isolated from other guests
• The hypervisor schedules physical CPU time among all running guests

Type 1 hypervisors (bare-metal) run directly on hardware with no host OS: VMware ESXi, Microsoft Hyper-V, KVM (Kernel-based Virtual Machine — built into the Linux kernel).

Type 2 hypervisors (hosted) run as applications on a host OS: VMware Workstation, VirtualBox, QEMU.

KVM is the Linux native hypervisor — it is part of the kernel itself, making Linux both the host and the hypervisor for most cloud virtualisation infrastructure.

# Check if KVM is available
kvm-ok                              # Ubuntu kvm-ok package
egrep -c '(vmx|svm)' /proc/cpuinfo # > 0 means VT-x/AMD-V is available

# List running VMs (libvirt/KVM)
virsh list --all

Containers and Modern Deployment Link to heading

Containers are a lighter-weight alternative to full virtualisation. Instead of emulating an entire machine, containers share the host kernel and isolate processes using Linux kernel features:

• Namespaces: Provide process, network, filesystem, and IPC isolation — each container sees its own isolated view of these resources
• cgroups (control groups): Limit and account for CPU, memory, disk I/O, and network bandwidth per container
• Overlay filesystems: Layer container images efficiently — multiple containers share the same base image layers, using copy-on-write for divergent changes

This architecture makes containers start in milliseconds (versus seconds or minutes for VMs), consume far less memory (no guest OS overhead), and pack far more workloads onto the same host.

Docker is the dominant container runtime and image format. Kubernetes (K8s) is the standard orchestration platform for running containers at scale — scheduling, load balancing, scaling, and service discovery across clusters of nodes.

The shift to containerisation fundamentally changed the sysadmin role: traditional server management (configuring individual machines) has evolved into infrastructure engineering (defining declarative state for clusters of containers via Kubernetes manifests, Helm charts, and GitOps workflows). Linux kernel knowledge remains foundational — Kubernetes runs on Linux, containers are Linux processes, and debugging containerised workloads requires understanding the underlying kernel mechanisms.

# Docker fundamentals
docker run --rm ubuntu:22.04 bash      # run a container
docker ps                              # list running containers
docker images                          # list local images
docker logs container_name             # view container logs
docker exec -it container_name bash    # shell into running container

# Kubernetes (kubectl)
kubectl get pods -A                    # list all pods
kubectl logs pod_name                  # pod logs
kubectl exec -it pod_name -- bash      # shell into pod
kubectl describe node node_name        # node resource usage and events