CompTIA Linux+ (XK0-006) · glossary

Linux+ glossary

692 terms you need for CompTIA Linux+ (XK0-006), in plain words. Each one links to the lesson that teaches it. The acronym list is further down.

#A B C D E F G H I J K L M N O P Q R S T U V W X Z Acronyms

#
.gitignore: .gitignore names files Git must never track: secrets, .venv/, logs. Lesson: Start, stage, commit
.mount: .mount: a filesystem mount, named after its path (/srv/data = srv-data.mount); fstab lines become mount units Lesson: Four unit types
.service: .service: a daemon or one-shot task (nginx.service) Lesson: Four unit types
.target: .target: a group of units, like an old runlevel: multi-user.target, graphical.target, rescue.target Lesson: Four unit types
.timer: .timer: starts the matching .service on a schedule (OnCalendar=daily) or after a delay Lesson: Four unit types
[[ $var =~ regex ]]: [[ $var =~ regex ]] tests a regular expression; captured groups land in BASH_REMATCH. Lesson: case and regular expressions
/bin/rbash: /bin/rbash (restricted bash) allows a login but blocks cd, changing PATH, commands containing / and output redirection: useful for a kiosk-style account. Lesson: Restricted shells and not being root
/dev/null: Special character devices are kernel helpers: /dev/null discards everything, /dev/zero gives endless zero bytes, /dev/urandom and /dev/random give random bytes. Lesson: Device files in /dev
/dev/random: Special character devices are kernel helpers: /dev/null discards everything, /dev/zero gives endless zero bytes, /dev/urandom and /dev/random give random bytes. Lesson: Device files in /dev
/dev/urandom: Special character devices are kernel helpers: /dev/null discards everything, /dev/zero gives endless zero bytes, /dev/urandom and /dev/random give random bytes. Lesson: Device files in /dev
/dev/zero: Special character devices are kernel helpers: /dev/null discards everything, /dev/zero gives endless zero bytes, /dev/urandom and /dev/random give random bytes. Lesson: Device files in /dev
/etc/apt/sources.list.d/: Debian/Ubuntu list repositories in /etc/apt/sources.list and /etc/apt/sources.list.d/ (Ubuntu 24.04 uses .sources files). Lesson: Repository files
/etc/default/grub: You change /etc/default/grub (and scripts in /etc/grub.d), then regenerate. Lesson: Bootloader configuration files
/etc/fstab: Permanent mounts go in /etc/fstab: device, mount point, type, options, dump, fsck order. Lesson: Mounting and /etc/fstab
/etc/group: /etc/group lists groups and their extra members. Lesson: The three account files
/etc/hosts: The hosts: line usually says files dns: try /etc/hosts (static name-to-address lines) first, then DNS using the servers in /etc/resolv.conf. Lesson: Three files, one lookup
/etc/issue: /etc/issue is shown before a local console login; /etc/issue.net before a remote login (sshd shows it if Banner /etc/issue.net is set); /etc/motd is shown after login. Lesson: Security banners
/etc/issue.net: /etc/issue is shown before a local console login; /etc/issue.net before a remote login (sshd shows it if Banner /etc/issue.net is set); /etc/motd is shown after login. Lesson: Security banners
/etc/login.defs: UID ranges tell you the kind of account (defaults in /etc/login.defs). Lesson: User, system and service accounts
/etc/modprobe.d/: Files in /etc/modprobe.d/ set options and block modules: a line blacklist nouveau stops automatic loading. Lesson: Making module choices stick
/etc/motd: /etc/issue is shown before a local console login; /etc/issue.net before a remote login (sshd shows it if Banner /etc/issue.net is set); /etc/motd is shown after login. Lesson: Security banners
/etc/mtab: /proc/mounts is the kernel's live list of mounts, and /etc/mtab today is just a link to it. Lesson: Mounting and /etc/fstab
/etc/netplan/: Ubuntu servers describe the network in YAML files in /etc/netplan/. Lesson: Netplan on Ubuntu
/etc/nsswitch.conf: When a program asks for db01.kibbleco.example, the C library first reads /etc/nsswitch.conf to learn the order of sources. Lesson: Three files, one lookup
/etc/pam.d/: Each service has a file in /etc/pam.d/. Lesson: PAM: one stack for every login
/etc/passwd: /etc/passwd lists accounts, one per line, and everyone can read it: name, x (the password lives elsewhere), UID, GID, comment, home, shell. Lesson: The three account files
/etc/profile: New homes are copied from /etc/skel; /etc/profile (plus /etc/profile.d/) sets the login environment for everyone. Lesson: Add and delete
/etc/resolv.conf: The hosts: line usually says files dns: try /etc/hosts (static name-to-address lines) first, then DNS using the servers in /etc/resolv.conf. Lesson: Three files, one lookup
/etc/shadow: /etc/shadow holds the password hashes and aging dates, readable only by root. Lesson: The three account files
/etc/skel: New homes are copied from /etc/skel; /etc/profile (plus /etc/profile.d/) sets the login environment for everyone. Lesson: Add and delete
/etc/sudoers: sudo rules live in /etc/sudoers and drop-in files in /etc/sudoers.d/. Lesson: sudoers, safely
/etc/sudoers.d/: sudo rules live in /etc/sudoers and drop-in files in /etc/sudoers.d/. Lesson: sudoers, safely
/proc/<PID>/: Each one also has a directory /proc/<PID>/ with its command line, status, open file descriptors (fd/) and environment. Lesson: PIDs, parents and the tree
/proc/cmdline: See the running set in /proc/cmdline. Lesson: Kernel parameters
/proc/mdstat: /proc/mdstat shows each array's state at a glance: [UU] means both mirror halves are up; [U_] means one is missing and the array is degraded. Lesson: Software RAID with mdadm
/proc/mounts: /proc/mounts is the kernel's live list of mounts, and /etc/mtab today is just a link to it. Lesson: Mounting and /etc/fstab
/sbin/nologin: Service accounts get /sbin/nologin (or /usr/sbin/nologin) as their shell: login is refused with a polite message. Lesson: Restricted shells and not being root
/var/log: rsyslog writes classic text logs under /var/log using facility.priority rules, and can forward to a central server. Lesson: The journal and rsyslog
#!/bin/bash: #!/bin/bash (the interpreter directive, or shebang) tells the kernel which program runs the file; #!/usr/bin/env python3 finds python3 on PATH. Lesson: The first line and variables
~/.bash_profile: A login shell (SSH in, console login) reads /etc/profile, then the first of ~/.bash_profile, ~/.bash_login or ~/.profile. Lesson: Startup files: which one runs?
~/.bashrc: An interactive non-login shell (a new terminal tab, running bash) reads ~/.bashrc. Lesson: Startup files: which one runs?
~/.profile: A login shell (SSH in, console login) reads /etc/profile, then the first of ~/.bash_profile, ~/.bash_login or ~/.profile. Lesson: Startup files: which one runs?
1 SIGHUP: 1 SIGHUP originally meant the terminal hung up; many daemons reload their config on it. Lesson: Signals and kill
7-Zip: 7-Zip (7z, .7z): high ratio, also reads many formats; handy for Windows partners Lesson: Compression tools compared
9 SIGKILL: 9 SIGKILL can't be caught: the kernel ends the process at once, with no cleanup. Lesson: Signals and kill
15 SIGTERM: kill sends a signal, by default 15 SIGTERM: please clean up and exit. Lesson: Signals and kill
203/EXEC: Exit status 203/EXEC means the program couldn't be executed: wrong path, or the file isn't executable. Lesson: When a unit fails
A
AArch64: AArch64 (ARM64) is 64-bit ARM: cloud instances, Raspberry Pi, power-sipping storage boxes. Lesson: Server architectures
absolute: An absolute path starts at / (or ~, which expands to an absolute home path) and works from anywhere. Lesson: Absolute and relative paths
account: Lines have a type (auth proves identity, account checks if login is allowed now, password handles changes, session sets things up), a control flag and a module. Lesson: PAM: one stack for every login
Account access: Account access: is it locked (passwd -S), expired (chage -l), set to nologin, or blocked by faillock? Lesson: Accounts and remote access
ACL: An ACL adds more: setfacl -m u:rosa:rw report.csv gives Rosa read-write without changing the group. Lesson: Access control lists
Ad hoc: An ad hoc command runs one module without a playbook: ansible web -m ping. Lesson: Ansible
adduser: adduser is Debian/Ubuntu's friendly interactive script (on RHEL it's just a link to useradd). Lesson: Add and delete
Adhere to corporate policy: Above all, adhere to corporate policy: use only the tools and data classes the company has approved. Lesson: Data governance
agent: Puppet usually runs an agent on each node that pulls its catalog from a Puppet server every 30 minutes and fixes drift. Lesson: Puppet
Agent-based: Agent-based monitoring installs a small program on each server for deep metrics; agentless polls over SSH, SNMP or APIs, with nothing to install but less detail. Lesson: SNMP, agents and agentless
agentless: Ansible is agentless: it connects over SSH and runs Python modules on the targets. Lesson: Ansible
AIDE: AIDE records a baseline database of file hashes and attributes (aide --init), then reports anything that changed (aide --check). Lesson: File integrity
alert: An alert fires when a threshold is crossed or an important event occurs. Lesson: Thresholds, events, alerts, notifications
alias: alias ll='ls -l' makes shortcuts. Lesson: Building and repeating commands
AllowUsers / AllowGroups: AllowUsers / AllowGroups: only these may log in at all Lesson: sshd_config hardening
AMD64: x86_64, also called AMD64, is 64-bit Intel and AMD. Lesson: Server architectures
anacron: anacron is for machines that aren't always on: it runs daily, weekly and monthly jobs that were missed while the machine was off. Lesson: Three schedulers, three jobs
Ansible: Ansible is agentless: it connects over SSH and runs Python modules on the targets. Lesson: Ansible
Anti-malware: Anti-malware on Linux (ClamAV: freshclam updates signatures, clamscan scans) matters most on servers that store files for Windows users or mail. Lesson: Detection and response
Apache HTTP Server: Apache HTTP Server is the package httpd on RHEL (config /etc/httpd/conf/httpd.conf) and apache2 on Debian/Ubuntu (/etc/apache2/, sites-available plus a2ensite). Lesson: Web servers: Apache httpd and Nginx
apache2: Apache HTTP Server is the package httpd on RHEL (config /etc/httpd/conf/httpd.conf) and apache2 on Debian/Ubuntu (/etc/apache2/, sites-available plus a2ensite). Lesson: Web servers: Apache httpd and Nginx
APIs: OpenTofu (the open-source fork of Terraform) builds infrastructure through APIs: VMs, networks, DNS records, cloud services. Lesson: OpenTofu
AppArmor: Ubuntu's counterpart, AppArmor, confines programs with path-based profiles instead (aa-status, complain or enforce mode). Lesson: Labels and type enforcement
AppImage: Snap (Ubuntu), Flatpak and AppImage ship an app with its own libraries and run it confined from the rest of the system. Lesson: Sandboxed applications
apt: apt install / remove / purge (purge also deletes config files). Lesson: Install, update, remove
Apt update: apt update refreshes the package index, and apt upgrade installs newer versions (full-upgrade may also remove packages to finish). Lesson: Install, update, remove
Apt upgrade: apt update refreshes the package index, and apt upgrade installs newer versions (full-upgrade may also remove packages to finish). Lesson: Install, update, remove
apt-mark: To stop a package from updating: exclude=kernel* in /etc/dnf/dnf.conf or one .repo file (or dnf versionlock), and apt-mark hold pkg on Debian. Lesson: Exclusions, holds and alternatives
Argon2: LUKS2, the current format, keeps several key slots (passphrases or key files that unlock one master key) and uses Argon2 (argon2id) to turn a passphrase into a key. Lesson: Disk encryption: LUKS2 and Argon2
arp: arp (or ip neigh) shows the MAC addresses this host has learned on the local network. Lesson: The ip command
Asymmetric: Asymmetric: gpg -e -r priya@kibbleco.example file encrypts to Priya's public key, so only her private key can decrypt it, with no shared secret to pass around. Lesson: File encryption with GPG
atop: atop also records history to disk, so you can replay what happened at 3 a.m. Lesson: Live monitors
atq: at runs something once: at 22:00, then type the commands; atq lists and atrm removes queued jobs. Lesson: Three schedulers, three jobs
atrm: at runs something once: at 22:00, then type the commands; atq lists and atrm removes queued jobs. Lesson: Three schedulers, three jobs
attributes: File attributes sit below permissions. Lesson: Immutable and append-only
audit.rules: Persistent rules go in /etc/audit/rules.d/*.rules (augenrules merges them into audit.rules). Lesson: auditd
audit2allow: audit2allow builds a custom policy module from denials: a last resort, after labels and Booleans. Lesson: Booleans, ports and denials
auditd: auditd writes them to /var/log/audit/audit.log. Lesson: auditd
auth: Lines have a type (auth proves identity, account checks if login is allowed now, password handles changes, session sets things up), a control flag and a module. Lesson: PAM: one stack for every login
autofs: autofs mounts a share the moment someone opens its path and unmounts it when idle (maps in /etc/auto.master). Lesson: autofs, network mounts and inodes
awk: awk '{print $1}': pick whitespace fields; -F: sets the separator; $NF is the last field Lesson: Slicing lines
B
backporting: Watch out for backporting: RHEL and Ubuntu fix CVEs inside the old version number (openssh 8.7p1-38.el9 can include a fix shipped upstream in 9.8), so version-only scanners report false positives. Lesson: Vulnerability scanning: CVE and CVSS
badblocks: badblocks -w writes test patterns over an entire disk (destructive). Lesson: Secure data destruction
bare-metal: A bare-metal server runs its OS directly on the hardware: all of the performance, none of the flexibility. Lesson: Bare metal vs virtual machines
Baseline image templates: Baseline image templates: a golden image, patched and generalized, that every new VM starts from Lesson: VM operations
blacklist: Files in /etc/modprobe.d/ set options and block modules: a line blacklist nouveau stops automatic loading. Lesson: Making module choices stick
blkid: blkid prints each filesystem's UUID, label and type, which is what /etc/fstab should use because device names can change between boots. Lesson: Seeing the disks
Block devices: Block devices (b) move data in blocks with random access: disks, partitions, LVs (/dev/sda, /dev/nvme0n1). Lesson: Device files in /dev
Blocked processes: Blocked processes (vmstat b column) wait on I/O. Lesson: Load, CPU and context switches
Bonding: Bonding joins NICs for failover or speed. Lesson: MTU, bonding and MAC addresses
Boolean: Is it the context (wrong label), a Boolean that's off, or policy that has no rule for this? Lesson: SELinux, permissions and attributes
Booleans: Booleans are on/off switches built into the policy: getsebool -a | grep httpd lists them; setsebool -P httpd_can_network_connect on lets the web server make outgoing connections (-P makes it permanent). Lesson: Booleans, ports and denials
bootloader: Firmware (BIOS or UEFI) tests the hardware and finds a bootloader. Lesson: The boot chain, link by link
branch: A branch is a movable pointer for separate work: git branch fix-ubuntu, then git checkout fix-ubuntu (git checkout -b does both; git switch is the newer verb). Lesson: Branches, merge and rebase
bridge: bridge: the default; a private network behind the host, reached through -p Lesson: Container networks
Bridged: Bridged: the VM sits on the physical LAN like any server, with its own address there Lesson: Virtual network types
btrfs: btrfs: copy-on-write, snapshots, subvolumes, checksums, built-in RAID (Fedora and openSUSE default) Lesson: Four filesystem formats
Built-in modules: The standard library's built-in modules cover most admin work: os, sys, subprocess (run commands), pathlib and shutil (files), json, re, logging, argparse, datetime, socket. Lesson: Modules: built-in and installed
bzip2: bzip2 (.bz2): smaller files, slower Lesson: Compression tools compared
C
cargo: Language-specific managers install libraries for one language: pip (Python), cargo (Rust), npm (Node.js). Lesson: Source code and language packages
case: case matches one value against patterns, cleaner than a chain of elifs. Lesson: case and regular expressions
cat: cat prints files. Lesson: Sorting, counting and viewing
cd: cd - jumps back to the previous directory (it's stored in $OLDPWD). Lesson: Absolute and relative paths
Certificate issues: Certificate issues: expired, wrong host name, or a chain the client doesn't trust. Lesson: Certificates, protocols and ciphers
certificates: Agents and server trust each other through certificates that the server signs. Lesson: Puppet
cgroups: A container is a group of host processes isolated with kernel namespaces (own view of PIDs, network, mounts, users) and limited with cgroups (CPU, memory). Lesson: Containers share the kernel
chage: To disable the whole account, expire it: chage -E 0 tomas (or usermod -e 1). Lesson: Lock and expire
Character devices: Character devices (c) stream bytes in order: terminals, serial ports (/dev/ttyS0). Lesson: Device files in /dev
Chattr +a: chattr +a makes it append-only: data can be added but never changed or removed, which suits logs. Lesson: Immutable and append-only
Chattr +i file: chattr +i file makes it immutable: nobody, not even root, may change, delete or rename it until chattr -i. Lesson: Immutable and append-only
chcon: chcon -t httpd_sys_content_t file changes a label right now, but a relabel or restorecon will undo it. Lesson: Fixing labels: chcon, semanage, restorecon
chgrp: chown sam:webteam file changes the owner and group; chgrp webteam file only the group. Lesson: Octal and symbolic modes
chmod: chmod 640 file sets them all in octal; chmod u+x,g-w,o= file changes them symbolically. Lesson: Octal and symbolic modes
chown: chown sam:webteam file changes the owner and group; chgrp webteam file only the group. Lesson: Octal and symbolic modes
chrony: chrony (chronyd) is the usual NTP client and server: list sources in /etc/chrony.conf (RHEL) or /etc/chrony/chrony.conf (Ubuntu), then check with chronyc sources. Lesson: Time: NTP and PTP
chroot: A chroot jail (ChrootDirectory with ForceCommand internal-sftp) traps an SFTP-only user in one directory, which must be owned by root. Lesson: Tunnels, SFTP, chroot and fail2ban
chsh: chsh -s /bin/zsh changes a shell; passwd sets a password; groupmod -n renames a group. Lesson: Modify: the -aG trap
CI/CD: CI/CD (continuous integration, continuous delivery/deployment) runs every change through an automated pipeline: build, test, scan, then deploy. Lesson: Pipelines and version control
Cipher negotiation issues: Cipher negotiation issues: client and server share no common TLS version or cipher, so the handshake fails. Lesson: Certificates, protocols and ciphers
CIS Benchmarks: CIS Benchmarks are consensus hardening guides per OS (Level 1 = safe basics, Level 2 = stricter). Lesson: Standards: OpenSCAP and CIS
classes: Code is organized in classes inside modules; facts (from Facter) describe each node. Lesson: Puppet
Cloning: Cloning: copy a VM (virt-clone). Lesson: VM operations
cloud-init: cloud-init configures cloud and VM images on first boot from user-data: users, SSH keys, packages, files, commands. Lesson: Unattended installs
CMD: CMD gives default arguments (or a default command), which podman run ... Lesson: Building with a Dockerfile
Code linting: Security review, code optimization, code linting and recommendations to improve compliance ("check this sshd_config against CIS") Lesson: Where AI helps
Code optimization: Security review, code optimization, code linting and recommendations to improve compliance ("check this sshd_config against CIS") Lesson: Where AI helps
Collections: Collections bundle modules and roles. Lesson: Ansible
Command substitution: Command substitution puts a command's output into the line: $(date +%F), or the older backticks date +%F. Lesson: Expansions and subshells
Commercial: Commercial CAs sell certificates with organization validation, support and warranties, and some extras. Lesson: No-cost vs commercial CAs
Compose file: A compose file (compose.yaml) lists services, their images, ports, volumes and environment in one place. Lesson: Compose
ConfigMap: ConfigMap: plain configuration; Secret: sensitive values (only base64-encoded by default, so restrict access) Lesson: Kubernetes objects
conflict: A conflict is two packages that can't be installed together, such as both claiming the same file. Lesson: Dependencies and conflicts
Connection profiles: Settings live in connection profiles; devices are the actual NICs. Lesson: NetworkManager with nmcli
containerd: containerd is a daemon that manages images and container lifecycles and calls runc; Kubernetes and Docker both use it. Lesson: The runtime stack
context: SELinux gives every process and file a context: user:role:type:level. Lesson: Labels and type enforcement
convert: convert changes formats (raw, qcow2, vmdk), and resize grows an image (then grow the partition and filesystem inside the guest). Lesson: Disk images and VM states
copyleft: Licenses: open source means the code is open under an approved license; free software stresses the user's freedoms; proprietary keeps code closed; copyleft (GNU GPL) says changed versions you share must stay under… Lesson: GUI pieces, and licenses
COUNT=0: Assign with no spaces: COUNT=0. Lesson: The first line and variables
cp: cp -a copies keeping owners, permissions and times (an archive copy); -r for directories Lesson: Everyday utilities, precisely
cpio: cpio reads the list of files to pack from standard input, which pairs nicely with find. Lesson: cpio: archives from a file list
CPU bottleneck: High CPU usage and a CPU bottleneck show in top's us/sy columns and mpstat. Lesson: Load, CPU and context switches
crashed: VM states in virsh: running, paused (frozen in RAM), shut off, crashed, pmsuspended (guest went to sleep). Lesson: Disk images and VM states
crontab: crontab -e edits your recurring jobs (five time fields, then the command); crontab -l lists them. Lesson: Three schedulers, three jobs
Cryptographic destruction: Cryptographic destruction destroys the encryption key (cryptsetup luksErase, or a drive's crypto erase), which makes the data unreadable at once: the best fit for SSDs. Lesson: Secure data destruction
Ctrl+C: Ctrl+C sends SIGINT to stop it. Lesson: Jobs in your shell
Ctrl+D: Ctrl+D isn't a signal: it's end-of-input, which also logs you out of a shell. Lesson: Jobs in your shell
Ctrl+Z: Ctrl+Z suspends the foreground job (state T); bg resumes it in the background, fg brings it back, jobs lists them. Lesson: Jobs in your shell
curl: curl talks HTTP(S): curl -I shows headers, -v shows the TLS and HTTP conversation. Lesson: Names, ports and services
Current versions: Current versions are Python 3 (a new 3.x arrives every October; distros may ship an older one); Python 2 reached end of life in 2020, so #!/usr/bin/python with no 3 is a red flag. Lesson: Indentation and versions
cut: cut -d: -f1: pick fields by a fixed delimiter Lesson: Slicing lines
CVE: A CVE is the public ID for one known vulnerability (CVE-year-number). Lesson: Vulnerability scanning: CVE and CVSS
CVSS: CVSS scores its severity from 0 to 10. Lesson: Vulnerability scanning: CVE and CVSS
D
Data corruption: Data corruption: checksum errors, garbled files, fsck complaints. Lesson: Corruption and dying devices
date: Command substitution puts a command's output into the line: $(date +%F), or the older backticks date +%F. Lesson: Expansions and subshells
dd: dd if=/dev/urandom of=/dev/sdX overwrites a whole device with random data. Lesson: Secure data destruction
ddrescue: ddrescue is dd for failing disks. Lesson: ddrescue: when the disk is dying
Default ACL: A default ACL on a directory (-m d:g:webteam:rwx) is copied to new files inside it. Lesson: Access control lists
degraded: /proc/mdstat shows each array's state at a glance: [UU] means both mirror halves are up; [U_] means one is missing and the array is degraded. Lesson: Software RAID with mdadm
deluser: To remove: userdel -r (home and mail too), Debian's deluser --remove-home, and groupdel. Lesson: Add and delete
Deployment: Deployment: keeps N identical pods running and rolls out new versions gradually Lesson: Kubernetes objects
depmod: depmod rebuilds modules.dep, the dependency map modprobe reads. Lesson: Kernel modules
DES/3DES: Retire MD5 and SHA-1 for signatures and integrity, DES/3DES and RC4 for encryption, and old SSH key exchange and MAC choices. Lesson: Removing weak algorithms
Device failure: Device failure: dmesg shows I/O errors or resets, smartctl -a reports reallocated sectors, mdstat shows (F). Lesson: Corruption and dying devices
DevSecOps: DevSecOps builds security into each stage: dependency and image scanning, secret detection, signed artifacts. Lesson: Shift left, GitOps, DevSecOps
df: df -h shows free space per mounted filesystem. Lesson: Space and speed utilities
DHCP: A DHCP server (ISC Kea, or the older dhcpd) hands out addresses from a range, plus the gateway and DNS servers, and can reserve fixed addresses by MAC. Lesson: DNS and DHCP servers
DHCP issues: DHCP issues: no address, or a leftover address, after boot. Lesson: DHCP, DNS and IP conflicts
dictionary: dictionary: key-value pairs: {"host": "db01", "cpu": 32} Lesson: Data types and structures
diff: diff -u shows changes line by line (the patch format). Lesson: Finding and comparing
dig: dig and nslookup query DNS directly (dig +short db01.kibbleco.example; dig @10.10.0.53 to ask one server). Lesson: Names, ports and services
directory: setgid (2000) on a program runs it with the file's group; on a directory it makes new files inherit the directory's group, which is perfect for team folders. Lesson: setuid, setgid and sticky
Disabled: Disabled: off entirely. Lesson: Modes
DISPLAY: DISPLAY: which X display GUI programs draw on (:0, or forwarded over SSH) Lesson: Six variables the exam names
Display manager: The display manager is the graphical login screen (GDM, SDDM, LightDM). Lesson: GUI pieces, and licenses
dmesg: dmesg: kernel ring buffer messages (dmesg -T for clock times; journalctl -k also works) Lesson: Asking the hardware what it is
dmidecode: dmidecode: firmware tables: serial number, BIOS version, RAM slots Lesson: Asking the hardware what it is
DNAT: DNAT changes the destination: port forwarding to an inside server. Lesson: Address translation and forwarding
dnf: On RHEL: dnf install / remove / upgrade, dnf info, dnf provides /usr/bin/dig (which package ships a file) and dnf history undo to roll back a transaction. Lesson: Install, update, remove
Dnf info: On RHEL: dnf install / remove / upgrade, dnf info, dnf provides /usr/bin/dig (which package ships a file) and dnf history undo to roll back a transaction. Lesson: Install, update, remove
DNS: A DNS server (BIND's named, or unbound for caching) answers name queries from zone files. Lesson: DNS and DHCP servers
DNS issues: DNS issues: the IP works but the name fails: check resolv.conf, then dig @server name. Lesson: DHCP, DNS and IP conflicts
Docker: Docker adds the dockerd daemon and the docker CLI on top. Lesson: The runtime stack
Document code: Document code and create documentation: explain an old script, write a README or runbook Lesson: Where AI helps
Dovecot: IMAP4 lets clients read mail that stays on the server (143, or 993 with TLS); Dovecot is the usual IMAP server. Lesson: Mail: SMTP and IMAP4
down: docker compose up -d (or podman compose / podman-compose) starts the whole set, down stops and removes it, logs shows output from all of them. Lesson: Compose
dpkg: dpkg -i and rpm -i don't fetch dependencies; they just fail. Lesson: Dependencies and conflicts
dpkg-based: dpkg-based distros (Debian, Ubuntu) use .deb packages, dpkg and apt. Lesson: Two big families of distributions
dracut: RHEL family: dracut -f (current kernel). Lesson: initrd tools and special hardware
du: du -sh dir totals what a directory uses, so df tells you which filesystem is full and du tells you why. Lesson: Space and speed utilities
Dual stack issues: Dual stack issues: a name returns both an AAAA and an A record, the client tries IPv6 first, and the IPv6 path is broken, so connections stall. Lesson: Firewalls, dual stack and "unreachable"
E
echo: echo prints text; printf prints formatted text (printf '%-10s %5d\n' web01 42). Lesson: Building and repeating commands
edquota: Check with quota -u rosa or the report repquota -a; raise limits with edquota (ext4) or xfs_quota (XFS). Lesson: Quota issues
EGID: Each process also has an EUID and EGID (effective IDs): who it acts as right now. Lesson: UIDs, GIDs and the effective IDs
Embedded systems: Special hardware: embedded systems (kiosks, scanners, routers) run small Linux images on ARM boards. Lesson: initrd tools and special hardware
enable / disable: enable / disable decide whether it starts at boot (enable --now does both). Lesson: Changing unit states
Enabled or disabled: A repo can be enabled or disabled: enabled=0 in the .repo file, dnf config-manager --set-disabled, or dnf --enablerepo=name for a single command. Lesson: Repository files
Enforcing: Enforcing: denies and logs. Lesson: Modes
ENTRYPOINT: ENTRYPOINT fixes the program that always runs. Lesson: Building with a Dockerfile
Esc: i enters insert mode to type; Esc goes back. Lesson: vi/vim and nano
Ethtool ens3: ethtool ens3 shows link speed, duplex, auto-negotiation and whether a link is detected. Lesson: Looking at the wire and the link
EUID: Each process also has an EUID and EGID (effective IDs): who it acts as right now. Lesson: UIDs, GIDs and the effective IDs
event: An event is something that happened: a service restarted, a backup finished. Lesson: Thresholds, events, alerts, notifications
Exceeding baselines: Exceeding baselines only means something if you recorded normal (sar keeps history). Lesson: Network, logins, startup and hardware
exec: exec cmd replaces the shell itself with cmd. Lesson: Jobs in your shell
Expiration: Expiration: chage -M sets a maximum age. Lesson: Password policy that helps
export: export VAR passes a variable to child programs (an environmental variable). Lesson: Assignments and scope
ext4: ext4: Debian/Ubuntu default; can grow online and shrink offline with resize2fs; checked with fsck Lesson: Four filesystem formats
Extensible using modules and packages: Python is extensible using modules and packages. Lesson: Modules: built-in and installed
F
Facts: Facts are details Ansible gathers first (ansible_distribution, memory). Lesson: Ansible
fail2ban: fail2ban watches logs and bans IPs in the firewall after repeated failures. Lesson: Tunnels, SFTP, chroot and fail2ban
faillock: faillock --user rosa shows the failures; faillock --user rosa --reset unlocks her. Lesson: Lockouts: pam_tally2 and pam_faillock
fdisk: fdisk edits MBR and GPT partition tables interactively. Lesson: Partitioning tools
file: file names a file's type from its content, not its extension Lesson: Everyday utilities, precisely
Filesystem Hierarchy Standard (FHS): The Filesystem Hierarchy Standard (FHS) says where things go, so every distro feels familiar. Lesson: The FHS in one table
find: find searches the live tree by any property: find /var -type f -size +100M -mtime -7 -exec ls -lh {} \;. Lesson: Finding and comparing
fio: fio benchmarks storage: IOPS, throughput and latency with patterns you choose. Lesson: Space and speed utilities
firewalld: firewalld and ufw are friendlier front ends that write the rules for you. Lesson: One engine, many dashboards
Firmware: Firmware (BIOS or UEFI) tests the hardware and finds a bootloader. Lesson: The boot chain, link by link
Flatpak: Snap (Ubuntu), Flatpak and AppImage ship an app with its own libraries and run it confined from the rest of the system. Lesson: Sandboxed applications
Floating point: integer (42) and floating point (0.75) Lesson: Data types and structures
Free software: Licenses: open source means the code is open under an approved license; free software stresses the user's freedoms; proprietary keeps code closed; copyleft (GNU GPL) says changed versions you share must stay under… Lesson: GUI pieces, and licenses
FROM: FROM picks the base image. Lesson: Building with a Dockerfile
fsck: fsck checks and repairs ext filesystems, and must run on an unmounted filesystem. Lesson: Space and speed utilities
FTP: FTP (21) does the same: use SFTP (or FTPS). Lesson: Retire the cleartext protocols
function: A function groups commands: check_disk() { local mount=$1; ...; return 0; }. Lesson: Functions, IFS and OFS
G
gdisk: gdisk is the GPT-focused version. Lesson: Partitioning tools
Generate code: Generate code and regular expressions ("match an IPv4 address at the end of a line") Lesson: Where AI helps
getenforce: getenforce shows the mode; setenforce 0/1 switches between permissive and enforcing until reboot. Lesson: Modes
getent: getent passwd sam reads accounts through nsswitch.conf, so it also finds LDAP or SSSD users that aren't in the local files. Lesson: The three account files
getfacl: getfacl shows them all; ls -l marks such files with a +. Lesson: Access control lists
GID: UID identifies the user and GID the primary group. Lesson: UIDs, GIDs and the effective IDs
git: git config --global user.name / user.email labels your commits. Lesson: Start, stage, commit
Git add: Changes move through three places: the working tree, the staging area (git add), then history (git commit -m). Lesson: Start, stage, commit
Git diff: git status says where everything is; git diff shows unstaged changes (--staged for staged ones); git log --oneline lists history. Lesson: Start, stage, commit
Git fetch: git fetch downloads new commits from the remote without touching your files. Lesson: Remotes: fetch, pull, push
Git init: git init makes a new repository; git clone URL copies an existing one. Lesson: Start, stage, commit
Git pull: git pull is fetch plus merge (or rebase) into your branch. Lesson: Remotes: fetch, pull, push
Git push: git push uploads your commits. Lesson: Remotes: fetch, pull, push
Git reset: git reset moves the branch pointer back: --soft keeps the changes staged, the default (--mixed) keeps them unstaged, and --hard throws them away completely. Lesson: Undo tools: stash and reset
Git stash: git stash shelves uncommitted changes so you can switch branches; git stash pop brings them back. Lesson: Undo tools: stash and reset
Git status: git status says where everything is; git diff shows unstaged changes (--staged for staged ones); git log --oneline lists history. Lesson: Start, stage, commit
GitOps: GitOps makes Git the single source of truth: an agent compares the running system with the repo and syncs it, so you change production by merging a pull request. Lesson: Shift left, GitOps, DevSecOps
GNU Privacy Guard (GPG): Repositories sign their packages with a GNU Privacy Guard (GPG) key. Lesson: GPG signatures
Goal and constraints: Give context ("RHEL 9, firewalld, SELinux enforcing"), the goal and constraints ("idempotent, no shell module"), the output format ("one playbook, YAML, with comments"), and an example if you have one. Lesson: Prompt engineering
GPG: GPG (GNU Privacy Guard) encrypts single files. Lesson: File encryption with GPG
GPUs: GPUs do AI training and inference, video transcoding and other parallel compute. Lesson: initrd tools and special hardware
grep: grep pattern: keep matching lines (-i ignore case, -v invert, -c count, -r recurse) Lesson: Slicing lines
groupadd: groupadd creates groups. Lesson: Add and delete
groupdel: To remove: userdel -r (home and mail too), Debian's deluser --remove-home, and groupdel. Lesson: Add and delete
groupmod: chsh -s /bin/zsh changes a shell; passwd sets a password; groupmod -n renames a group. Lesson: Modify: the -aG trap
groups: whoami prints your user name; id your IDs and groups; groups just the groups. Lesson: Who is here, and who was
growpart: growpart (from cloud-utils) grows a partition to fill the disk, which is exactly what you need after enlarging a VM's virtual disk: growpart /dev/vda 3 (note the space before the partition number). Lesson: Partitioning tools
GRUB 2: The bootloader (usually GRUB 2) loads the kernel and the initial RAM disk. Lesson: The boot chain, link by link
Grub rescue>: A typo in the boot config, a deleted kernel, or a wrong disk ID leaves you at a grub> or grub rescue> prompt, or with an entry that fails. Lesson: GRUB misconfiguration
grub>: A typo in the boot config, a deleted kernel, or a wrong disk ID leaves you at a grub> or grub rescue> prompt, or with an entry that fails. Lesson: GRUB misconfiguration
grub2-mkconfig: RHEL family: grub2-mkconfig -o /boot/grub2/grub.cfg. Lesson: Bootloader configuration files
gzip: gzip (.gz): fast, everywhere; gunzip or gzip -d to undo Lesson: Compression tools compared
H
Hard link: A hard link is a second name for the same inode: same data, same permissions. Lesson: Hard links and symbolic links
Hardware errors: Hardware errors: dmesg (MCE, EDAC), SMART. Lesson: Network, logins, startup and hardware
hash: A hash like SHA-256 turns any input into a fixed 256-bit fingerprint. Lesson: Hashes and HMAC
head: head/tail show the start/end (tail -f follows a growing log). Lesson: Sorting, counting and viewing
Health check: A health check probes an endpoint (GET /health) or a port on a schedule; load balancers use them to stop sending traffic to a sick server. Lesson: Webhooks, health checks, log aggregation
Here document: A here document (<<) feeds several lines into a command until a marker word. Lesson: Here documents and here strings
Here string: A here string (<<<) feeds one string. Lesson: Here documents and here strings
High context switching: High context switching (vmstat cs, pidstat -w) means the CPU keeps juggling too many threads. Lesson: Load, CPU and context switches
High CPU usage: High CPU usage and a CPU bottleneck show in top's us/sy columns and mpstat. Lesson: Load, CPU and context switches
High disk latency: iostat -x shows per-device detail: high disk latency in r_await/w_await (milliseconds per request) and %util near 100. Lesson: Disk: I/O wait and latency
High I/O wait time: High I/O wait time (top wa, iostat) means CPUs sit idle waiting for storage. Lesson: Disk: I/O wait and latency
High latency: Random disconnects, random timeouts and high latency suggest a flapping link, an MTU problem or a full conntrack table. Lesson: Network, logins, startup and hardware
High load average: High load average (uptime: 1, 5 and 15 minutes) counts tasks running or waiting for CPU, plus tasks blocked in D state. Lesson: Load, CPU and context switches
history: history lists past commands; !! repeats the last one (sudo !!), !42 runs number 42, !ssh the last one starting with ssh. Lesson: Building and repeating commands
HMAC: An HMAC mixes a secret key into the hash, so it proves integrity AND that the sender knew the key: API request signatures and webhooks use it. Lesson: Hashes and HMAC
HOME: HOME: your home directory (what ~ means). Lesson: Six variables the exam names
host: host: shares the host's network stack: no isolation, no -p needed Lesson: Container networks
Host-only / isolated: Host-only / isolated: VMs talk to each other and the host, nothing else Lesson: Virtual network types
hostname: hostname prints or sets the name (hostnamectl makes it permanent). Lesson: The ip command
hostnamectl: hostnamectl set-hostname db01: the permanent host name Lesson: The systemd toolbox
htop: htop is a friendlier, colored top with scrolling and tree view. Lesson: Live monitors
httpd: Apache HTTP Server is the package httpd on RHEL (config /etc/httpd/conf/httpd.conf) and apache2 on Debian/Ubuntu (/etc/apache2/, sites-available plus a2ensite). Lesson: Web servers: Apache httpd and Nginx
Human review: Avoid copy/paste without review: read it, check flags against man pages, run it in a lab or with --check, and have a human approve it like any other code (human review, quality assurance). Lesson: Verify, never just paste
I
IFS: IFS (internal field separator) is how the shell splits words and how read splits a line: IFS=: read splits /etc/passwd fields. Lesson: Functions, IFS and OFS
image: An image is a read-only template. Lesson: Images, tags and layers
IMAP4: IMAP4 lets clients read mail that stays on the server (143, or 993 with TLS); Dovecot is the usual IMAP server. Lesson: Mail: SMTP and IMAP4
indentation: Python marks blocks by indentation, not braces: everything indented under if belongs to it. Lesson: Indentation and versions
Indicators of compromise (IOCs): Indicators of compromise (IOCs) are clues an attacker was here: unknown processes or cron jobs, new accounts, new SUID files, changed system binaries, outbound connections to strange addresses, file hashes or IPs… Lesson: Detection and response
info: info shows the image properties: format, virtual size, real size on disk, backing file. Lesson: Disk images and VM states
Initial RAM disk: The bootloader (usually GRUB 2) loads the kernel and the initial RAM disk. Lesson: The boot chain, link by link
initramfs: The initial RAM disk (initrd; today an initramfs) is a small temporary root filesystem loaded with the kernel. Lesson: initrd, and booting over the network
inode: An inode stores a file's metadata (owner, permissions, times, where its blocks are) but not its name; the directory maps names to inode numbers. Lesson: autofs, network mounts and inodes
Inode exhaustion: Inode exhaustion: "No space left on device" while df -h shows free space. Lesson: Full filesystems, and full inode tables
insmod: insmod loads a single .ko file by path, with no dependency handling, and rmmod removes one. Lesson: Kernel modules
Installed file verification: Installed file verification compares files on disk with the package database: rpm -V pkg (or rpm -Va for all), debsums or dpkg --verify on Debian. Lesson: File integrity
integer: integer (42) and floating point (0.75) Lesson: Data types and structures
Interactive non-login shell: An interactive non-login shell (a new terminal tab, running bash) reads ~/.bashrc. Lesson: Startup files: which one runs?
Interpreter directive: #!/bin/bash (the interpreter directive, or shebang) tells the kernel which program runs the file; #!/usr/bin/env python3 finds python3 on PATH. Lesson: The first line and variables
inventory: The inventory lists hosts and groups. Lesson: Ansible
Ip address: ip address (ip a) shows addresses, ip link shows interfaces and whether they are UP, and ip route shows the routing table, including the default gateway. Lesson: The ip command
IP conflicts: IP conflicts: two hosts claim one address, so connections flap. Lesson: DHCP, DNS and IP conflicts
Ip link: ip address (ip a) shows addresses, ip link shows interfaces and whether they are UP, and ip route shows the routing table, including the default gateway. Lesson: The ip command
Ip route: ip address (ip a) shows addresses, ip link shows interfaces and whether they are UP, and ip route shows the routing table, including the default gateway. Lesson: The ip command
iperf3: iperf3 measures throughput between two hosts: run iperf3 -s on one and iperf3 -c <server> on the other. Lesson: Looking at the wire and the link
ipmitool: ipmitool: talk to the BMC: power, sensors, event log, even when the OS is down Lesson: Asking the hardware what it is
ipset: ipset stores big lists of addresses that iptables rules can match in one step. Lesson: One engine, many dashboards
iptables: iptables is the classic tool (chains INPUT, OUTPUT, FORWARD in tables like filter and nat). Lesson: One engine, many dashboards
ipvlan: macvlan: the container gets its own MAC address on the physical LAN; ipvlan gets its own IP but shares the parent's MAC Lesson: Container networks
J
Jitter: Jitter is uneven delay, deadly for voice and video. Lesson: Network, logins, startup and hardware
jobs: Ctrl+Z suspends the foreground job (state T); bg resumes it in the background, fg brings it back, jobs lists them. Lesson: Jobs in your shell
journalctl: systemctl status shows the result and exit code; journalctl -u name -b shows its log from this boot; systemctl --failed lists every failed unit. Lesson: When a unit fails
K
KDC: Kerberos handles authentication with tickets: you prove your password once to the KDC, get a ticket-granting ticket (kinit, klist), and then log in to other services without sending the password again. Lesson: LDAP and Kerberos
Kerberos: Kerberos handles authentication with tickets: you prove your password once to the KDC, get a ticket-granting ticket (kinit, klist), and then log in to other services without sending the password again. Lesson: LDAP and Kerberos
kernel: The bootloader (usually GRUB 2) loads the kernel and the initial RAM disk. Lesson: The boot chain, link by link
Kernel corruption: Kernel corruption (a damaged kernel or initramfs file, a failed update) looks similar. Lesson: Kernel panic and kernel corruption
Kernel modules: Drivers usually load as kernel modules (.ko files under /lib/modules/$(uname -r)) instead of being built into the kernel. Lesson: Kernel modules
Kernel panic: A kernel panic is the kernel stopping because it can't safely continue. Lesson: Kernel panic and kernel corruption
Kernel parameters: Kernel parameters are words on the kernel command line that change how it boots: root= (where the real root filesystem is), quiet, nomodeset, or a target such as systemd.unit=rescue.target. Lesson: Kernel parameters
Key authentication: Key authentication uses a key pair: the private key stays on your machine (protected by a passphrase), and the public key goes into ~/.ssh/authorized_keys on the server. Lesson: Keys instead of passwords
Kickstart: Kickstart is the RHEL-family answer file: a ks.cfg with disk layout, packages and post-install scripts, often served over PXE so a new server installs itself. Lesson: Unattended installs
kill: kill sends a signal, by default 15 SIGTERM: please clean up and exit. Lesson: Signals and kill
killall: killall nginx signals by exact name; pkill -u tomas by pattern or user. Lesson: Signals and kill
Killed processes: Killed processes: the OOM killer ended them when RAM ran out. Lesson: Killed, unresponsive, leaking, crashing
KVM: KVM (Kernel-based Virtual Machine) is a kernel module that turns Linux into a hypervisor, using the CPU's virtualization features (Intel VT-x, AMD-V: look for vmx or svm in /proc/cpuinfo). Lesson: KVM and QEMU
L
Language-specific: Language-specific managers install libraries for one language: pip (Python), cargo (Rust), npm (Node.js). Lesson: Source code and language packages
lastlog: last shows the login history (from /var/log/wtmp) including reboots; lastlog shows each account's most recent login, handy for spotting unused accounts. Lesson: Who is here, and who was
latest: latest is just a default tag name, not a promise of newest. Lesson: Images, tags and layers
layer: Each Dockerfile instruction adds a layer; layers are cached and shared between images, so a second image built on the same base downloads almost nothing. Lesson: Images, tags and layers
LDAP: LDAP is the protocol for directories: a tree of entries such as uid=sam,ou=people,dc=kibbleco,dc=example, holding users, groups and attributes (port 389, or 636 for LDAPS). Lesson: LDAP and Kerberos
Length: Length beats complexity: a long passphrase is stronger and easier to remember than P@ssw0rd!. Lesson: Password policy that helps
less: less pages forward and back with search; more is the older forward-only pager. Lesson: Sorting, counting and viewing
LibreSSL: LibreSSL is OpenBSD's fork of OpenSSL with a cleaned-up code base and a compatible API. Lesson: TLS, OpenSSL and LibreSSL
libvirt: libvirt is the management layer (the libvirtd or modular virtqemud daemons, plus an API) that tools talk to. Lesson: libvirt, virsh and virt-manager
Link down: Link down: ip link says NO-CARRIER or state DOWN: cable, switch port, NIC. Lesson: Link, address, route, name
Link negotiation issues: Link negotiation issues: ethtool shows 100Mb/s or Half duplex on a gigabit link: auto-negotiation mismatch, fix both ends. Lesson: Link, address, route, name
LLM training: LLM training: public services may use prompts to train future models. Lesson: Data governance
LLMs: Large language models (LLMs) are useful drafting tools for admins: Lesson: Where AI helps
lm_sensors: lm_sensors: run sensors-detect once, then sensors for temperatures and fans Lesson: Asking the hardware what it is
local: local keeps a variable inside a function. Lesson: Assignments and scope
Local model: Private vs public: an enterprise tenant with no-training terms, or a local model running in-house, keeps data inside. Lesson: Data governance
locate: locate is much faster but searches a database built by updatedb, so brand-new files are missing until it runs again. Lesson: Finding and comparing
Log aggregation: Log aggregation collects logs from every server in one searchable place (rsyslog forwarding, journald remote, a log platform), so one search covers the whole fleet. Lesson: Webhooks, health checks, log aggregation
Logging: Logging records what happened for later analysis, at a level that's useful without flooding the disk. Lesson: Thresholds, events, alerts, notifications
Logical Volume Manager (LVM): The Logical Volume Manager (LVM) puts a flexible layer between disks and filesystems. Lesson: PV, VG, LV
Logical volumes (LVs): You carve logical volumes (LVs) out of the VG and put filesystems on them. Lesson: PV, VG, LV
Login shell: A login shell (SSH in, console login) reads /etc/profile, then the first of ~/.bash_profile, ~/.bash_login or ~/.profile. Lesson: Startup files: which one runs?
logrotate: logrotate keeps logs from filling the disk: it renames the current log, starts a fresh one, compresses old ones and deletes the oldest. Lesson: logrotate
logs: docker compose up -d (or podman compose / podman-compose) starts the whole set, down stops and removes it, logs shows output from all of them. Lesson: Compose
Low throughput: Low throughput with high latency points to a struggling or failing disk, or one process hammering it (iotop). Lesson: Disk: I/O wait and latency
ls: ls -l / -a / -i / -h: long, hidden, inode numbers, human sizes. Lesson: Everyday utilities, precisely
lsattr: lsattr shows the flags. Lesson: Immutable and append-only
lsblk: lsblk draws the tree of disks, partitions, LVM volumes and mount points. Lesson: Seeing the disks
lscpu: Check with uname -m or lscpu. Lesson: Server architectures
lshw: lshw: the whole hardware tree (lshw -short) Lesson: Asking the hardware what it is
lsmem: lscpu, lsmem: CPU details; memory blocks and online state Lesson: Asking the hardware what it is
lsmod: lsmod lists loaded modules. Lesson: Kernel modules
lsof: lsof lists open files: lsof /var/log/app.log shows who holds it, and lsof -i :80 shows who uses a port. Lesson: Finding and comparing
lspci: lspci (-k shows the driver in use), lsusb: PCI and USB devices Lesson: Asking the hardware what it is
lsusb: lspci (-k shows the driver in use), lsusb: PCI and USB devices Lesson: Asking the hardware what it is
LUKS: LUKS encrypts a whole block device, so a stolen laptop or a failed disk sent for repair gives away nothing. Lesson: Disk encryption: LUKS2 and Argon2
LUKS2: LUKS2, the current format, keeps several key slots (passphrases or key files that unlock one master key) and uses Argon2 (argon2id) to turn a passphrase into a key. Lesson: Disk encryption: LUKS2 and Argon2
lvextend: -an to deactivate), lvextend / lvresize (grow or change size) Lesson: The command families
lvresize: -an to deactivate), lvextend / lvresize (grow or change size) Lesson: The command families
M
MAC spoofing: MAC spoofing: a changed or cloned MAC can trip switch port security, or break DHCP reservations tied to the old MAC. Lesson: MTU, bonding and MAC addresses
macvlan: macvlan: the container gets its own MAC address on the physical LAN; ipvlan gets its own IP but shares the parent's MAC Lesson: Container networks
Map file: It copies the healthy areas first, skips bad spots, then goes back to retry them, and it keeps a map file so you can stop and resume. Lesson: ddrescue: when the disk is dying
mask: mask links the unit to /dev/null so nothing can start it, not even a dependency; unmask undoes that. Lesson: Changing unit states
masquerade: SNAT changes the source: inside hosts reach out using the gateway's address (masquerade is SNAT for a changing address). Lesson: Address translation and forwarding
MD5: Retire MD5 and SHA-1 for signatures and integrity, DES/3DES and RC4 for encryption, and old SSH key exchange and MAC choices. Lesson: Removing weak algorithms
mdadm: mdadm builds Linux software RAID devices (/dev/md0). Lesson: Software RAID with mdadm
Memory leaks: Memory leaks: memory use (RSS) climbs for days and never drops. Lesson: Killed, unresponsive, leaking, crashing
MIBs: Each value has an OID, described in MIBs (management information bases). Lesson: SNMP, agents and agentless
Migrations: Migrations: move a VM to another host; live migration keeps it running, with shared storage Lesson: VM operations
Misconfigured firewalls: Misconfigured firewalls: ss shows the service listening, but clients time out. Lesson: Firewalls, dual stack and "unreachable"
Misconfigured package repository: Misconfigured package repository: a GPG key error, a wrong release in the URL, or a dead mirror stops patches silently. Lesson: Exposed services and unpatched systems
mkdir: mkdir -p makes parents as needed; touch creates an empty file or updates its time Lesson: Everyday utilities, precisely
mkinitrd: mkinitrd is the older tool; on RHEL it now just calls dracut. Lesson: initrd tools and special hardware
modinfo: modinfo shows a module's file, parameters and dependencies. Lesson: Kernel modules
modprobe: modprobe loads a module plus everything it depends on; modprobe -r removes one. Lesson: Kernel modules
module: A playbook (YAML) holds plays and tasks, and each task calls a module (dnf, apt, copy, service, user). Lesson: Ansible
modules: Code is organized in classes inside modules; facts (from Facter) describe each node. Lesson: Puppet
more: less pages forward and back with search; more is the older forward-only pager. Lesson: Sorting, counting and viewing
mount: mount attaches a filesystem to a directory; umount detaches it (it fails with "target is busy" while something uses it). Lesson: Mounting and /etc/fstab
mpstat: mpstat -P ALL shows each CPU core and pidstat shows per-process CPU, memory (-r) or disk (-d) over time; both come from the sysstat package. Lesson: Live monitors
mtr: mtr combines ping and traceroute live, showing loss and delay at every hop, which is great for intermittent problems. Lesson: Is it reachable, and where does it stop?
MTU mismatch: MTU mismatch: small packets pass, big transfers hang. Lesson: MTU, bonding and MAC addresses
Multifactor authentication (MFA): Multifactor authentication (MFA) combines factors: something you know (password), have (phone app, hardware key) or are (fingerprint). Lesson: MFA and breach lists
N
namespaces: A container is a group of host processes isolated with kernel namespaces (own view of PIDs, network, mounts, users) and limited with cgroups (CPU, memory). Lesson: Containers share the kernel
nano: nano shows its keys on screen: Ctrl+O saves, Ctrl+X exits, Ctrl+W searches. Lesson: vi/vim and nano
NAT: NAT: libvirt's default network (virbr0, 192.168.122.0/24). Lesson: Virtual network types
Nested virtualization: Nested virtualization runs a hypervisor inside a VM: handy for labs and CI, slower in production. Lesson: Disk images and VM states
net.ipv4.ip_forward = 1: A Linux box only routes or NATs between interfaces if net.ipv4.ip_forward = 1 (sysctl -w now, /etc/sysctl.d/ for good). Lesson: Address translation and forwarding
Netfilter: Netfilter is the packet-filtering framework inside the kernel: hooks where packets are inspected, changed or dropped. Lesson: One engine, many dashboards
Netplan apply: netplan apply applies it for real, with no safety net. Lesson: try, apply, status
Netplan status: netplan status shows the current state of interfaces, addresses, routes and DNS. Lesson: try, apply, status
Netplan try: netplan try applies the new config and rolls it back automatically after 120 seconds unless you press Enter to confirm. Lesson: try, apply, status
NetworkManager: NetworkManager runs the network on RHEL, Fedora and most desktops. Lesson: NetworkManager with nmcli
Networks: Networks of type overlay connect tasks across nodes. Lesson: Docker Swarm
NFS: NFS shares Linux exports (server:/path, type nfs). Lesson: autofs, network mounts and inodes
nftables: nftables (the nft command) is its modern replacement, with one syntax for IPv4 and IPv6 and built-in sets. Lesson: One engine, many dashboards
Nginx: Nginx keeps config in /etc/nginx/nginx.conf, with server blocks in conf.d/ or sites-enabled/. Lesson: Web servers: Apache httpd and Nginx
nice: The nice value runs from -20 (greediest, highest priority) to 19 (most polite); the default is 0. Lesson: nice and renice
nmap: nmap scans another host to see which ports answer from the outside. Lesson: Names, ports and services
nmcli: nmcli changes profiles from the shell, and nmtui is a text menu for the same thing. Lesson: NetworkManager with nmcli
nmtui: nmcli changes profiles from the shell, and nmtui is a text menu for the same thing. Lesson: NetworkManager with nmcli
No-cost: No-cost CAs such as Let's Encrypt issue domain-validated certificates automatically over the ACME protocol (certbot and similar clients). Lesson: No-cost vs commercial CAs
noatime / nodiratime: noatime / nodiratime: don't write an access time on every read (of files / of directories): less disk I/O Lesson: Mount options that matter
Nodes: Nodes are managers (keep the desired state) or workers. Lesson: Docker Swarm
nodev: noexec: no programs run from here (good for /tmp); nosuid: setuid bits are ignored; nodev: device files are ignored Lesson: Mount options that matter
noexec: noexec: no programs run from here (good for /tmp); nosuid: setuid bits are ignored; nodev: device files are ignored Lesson: Mount options that matter
nofail: nofail: if the device is missing, boot carries on instead of stopping Lesson: Mount options that matter
nohup: nohup cmd & ignores the HUP sent at logout, so a long job survives. Lesson: Jobs in your shell
NOPASSWD: NOPASSWD: skips the password: fine for one narrow automation command, risky on broad rules, because malware or anyone at an unlocked session gets root silently. Lesson: wheel, sudo, NOPASSWD and NOEXEC
nosuid: noexec: no programs run from here (good for /tmp); nosuid: setuid bits are ignored; nodev: device files are ignored Lesson: Mount options that matter
notification: A notification delivers it to the right people (chat, email, pager), with severity and escalation. Lesson: Thresholds, events, alerts, notifications
npm: Language-specific managers install libraries for one language: pip (Python), cargo (Rust), npm (Node.js). Lesson: Source code and language packages
nslookup: dig and nslookup query DNS directly (dig +short db01.kibbleco.example; dig @10.10.0.53 to ask one server). Lesson: Names, ports and services
NTP: chrony (chronyd) is the usual NTP client and server: list sources in /etc/chrony.conf (RHEL) or /etc/chrony/chrony.conf (Ubuntu), then check with chronyc sources. Lesson: Time: NTP and PTP
nvtop: nvtop is a top-style monitor for GPU load and memory. Lesson: initrd tools and special hardware
O
OFS: OFS is awk's output field separator: awk 'BEGIN{FS=":"; OFS=","} {print $1,$3}' turns passwd into CSV. Lesson: Functions, IFS and OFS
Open source: Licenses: open source means the code is open under an approved license; free software stresses the user's freedoms; proprietary keeps code closed; copyleft (GNU GPL) says changed versions you share must stay under… Lesson: GUI pieces, and licenses
OpenSCAP: OpenSCAP (the oscap tool with SCAP Security Guide content) checks a system against a profile automatically and writes an HTML report; it can also generate remediation scripts. Lesson: Standards: OpenSCAP and CIS
OpenSSL: OpenSSL is the library most Linux software uses for TLS, plus a Swiss-army command: s_client tests a server, req makes certificate requests, x509 reads certificates, dgst hashes. Lesson: TLS, OpenSSL and LibreSSL
OpenTofu: OpenTofu (the open-source fork of Terraform) builds infrastructure through APIs: VMs, networks, DNS records, cloud services. Lesson: OpenTofu
optional: optional: only matters if it's the only module. Lesson: Control flags
OS filesystem full: OS filesystem full: df -h finds which one, du -xh --max-depth=1 finds where. Lesson: Full filesystems, and full inode tables
Out of memory: When even swap isn't enough, you get out of memory: the OOM killer ends a process (dmesg). Lesson: Memory: swapping and OOM
Output format: Give context ("RHEL 9, firewalld, SELinux enforcing"), the goal and constraints ("idempotent, no shell module"), the output format ("one playbook, YAML, with comments"), and an example if you have one. Lesson: Prompt engineering
overlay: Running a container adds a thin writable layer on top, stacked with an overlay filesystem. Lesson: Images, tags and layers
P
Packet drops: Packet drops show in ip -s link (dropped, errors) and ethtool -S. Lesson: Network, logins, startup and hardware
pam_faillock: It's been removed; today's module is pam_faillock (settings in /etc/security/faillock.conf: deny=, unlock_time=). Lesson: Lockouts: pam_tally2 and pam_faillock
pam_tally2: pam_tally2 counted failed logins and locked accounts on older distros. Lesson: Lockouts: pam_tally2 and pam_faillock
Parameter expansion: Parameter expansion: ${var}, ${var:-default} (use a default if empty), ${#var} (length), ${file%.log} (strip a suffix). Lesson: Expansions and subshells
Paravirtualized: Paravirtualized drivers know they're in a VM and talk to the hypervisor directly. Lesson: Paravirtualized drivers: VirtIO
parted: parted works with both, can be scripted and can resize partitions. Lesson: Partitioning tools
Partition not writable: Partition not writable: the kernel may have remounted it read-only after I/O errors (dmesg: "Remounting filesystem read-only"), it's mounted ro, or permissions/attributes block you. Lesson: Won't mount, won't write
passwd: chsh -s /bin/zsh changes a shell; passwd sets a password; groupmod -n renames a group. Lesson: Modify: the -aG trap
password: Lines have a type (auth proves identity, account checks if login is allowed now, password handles changes, session sets things up), a control flag and a module. Lesson: PAM: one stack for every login
PasswordAuthentication no: Once keys work, set PasswordAuthentication no. Lesson: Keys instead of passwords
PAT: PAT (port address translation) lets many hosts share one address by tracking ports. Lesson: Address translation and forwarding
PATH: PATH: colon-separated directories searched for commands, in order. Lesson: Six variables the exam names
PEP 8: PEP 8 is Python's style guide: 4-space indents, snake_case names for functions and variables, CapWords for classes, UPPER_CASE constants, short lines, imports at the top. Lesson: Virtual environments and PEP 8
Permission issues: Permission issues: the owner, group and mode, then an ACL mask, then attributes (lsattr) such as immutable. Lesson: SELinux, permissions and attributes
Permissive: Permissive: allows but logs what it would deny, good for diagnosis. Lesson: Modes
PermitRootLogin no: PermitRootLogin no: log in as yourself, then sudo Lesson: sshd_config hardening
Persistent=true: OnCalendar=Mon..Fri 02:30 works like a calendar; Persistent=true runs a missed job at the next boot, like anacron. Lesson: Timers instead of cron
Physical volume (PV): A physical volume (PV) is a disk or partition prepared for LVM. Lesson: PV, VG, LV
PID: Every process has a PID and a parent, its PPID: the process that started it. Lesson: PIDs, parents and the tree
pidstat: mpstat -P ALL shows each CPU core and pidstat shows per-process CPU, memory (-r) or disk (-d) over time; both come from the sysstat package. Lesson: Live monitors
ping: ping / ping6 test basic reachability over ICMP (IPv4 / IPv6). Lesson: Is it reachable, and where does it stop?
ping6: ping / ping6 test basic reachability over ICMP (IPv4 / IPv6). Lesson: Is it reachable, and where does it stop?
pip: Language-specific managers install libraries for one language: pip (Python), cargo (Rust), npm (Node.js). Lesson: Source code and language packages
pipeline: CI/CD (continuous integration, continuous delivery/deployment) runs every change through an automated pipeline: build, test, scan, then deploy. Lesson: Pipelines and version control
pkill: killall nginx signals by exact name; pkill -u tomas by pattern or user. Lesson: Signals and kill
playbook: A playbook (YAML) holds plays and tasks, and each task calls a module (dnf, apt, copy, service, user). Lesson: Ansible
Pluggable Authentication Modules (PAM): Pluggable Authentication Modules (PAM) let login programs (sshd, sudo, login, su) share one configurable stack instead of each coding its own password checks. Lesson: PAM: one stack for every login
pmsuspended: VM states in virsh: running, paused (frozen in RAM), shut off, crashed, pmsuspended (guest went to sleep). Lesson: Disk images and VM states
Pod: Pod: the smallest unit; one or more containers sharing an IP and volumes Lesson: Kubernetes objects
Podman: Podman is daemonless: each container is a child of your command (or of systemd), it runs rootless by default and accepts Docker's command syntax. Lesson: The runtime stack
policy: Is it the context (wrong label), a Boolean that's off, or policy that has no rule for this? Lesson: SELinux, permissions and attributes
Polkit: Polkit decides whether an unprivileged process may ask a privileged system service to do something over D-Bus: reboot, mount a disk, manage a unit, change the network. Lesson: Polkit: permission for privileged actions
port: You can allow a service (a named definition like http, which knows its ports) or a raw port (8080/tcp). Lesson: firewalld: zones and services
Port scanners: Tools: port scanners (nmap) and protocol analyzers (tcpdump, Wireshark). Lesson: Vulnerability scanning: CVE and CVSS
ports: Like firewalld, it accepts service names (from /etc/services or app profiles) or ports. Lesson: ufw: Ubuntu's simple firewall
Postfix: Postfix is the common Linux mail transfer agent: main.cf sets myhostname and a relayhost if mail goes out through another server. Lesson: Mail: SMTP and IMAP4
PPID: Every process has a PID and a parent, its PPID: the process that started it. Lesson: PIDs, parents and the tree
printf: echo prints text; printf prints formatted text (printf '%-10s %5d\n' web01 42). Lesson: Building and repeating commands
Private vs public: Private vs public: an enterprise tenant with no-training terms, or a local model running in-house, keeps data inside. Lesson: Data governance
Process limits: Process limits cap what one user or service can use: ulimit -a shows them, /etc/security/limits.conf sets them per user, and LimitNOFILE= does it in a systemd unit. Lesson: nice and renice
proprietary: Licenses: open source means the code is open under an approved license; free software stresses the user's freedoms; proprietary keeps code closed; copyleft (GNU GPL) says changed versions you share must stay under… Lesson: GUI pieces, and licenses
Protocol analyzers: Tools: port scanners (nmap) and protocol analyzers (tcpdump, Wireshark). Lesson: Vulnerability scanning: CVE and CVSS
provider: A provider is a plugin for one platform; a resource is one thing to create; the state file records what exists so the next run knows what to change. Lesson: OpenTofu
ps: pstree -p draws the family tree; ps -ef or ps aux lists every process (ps -eo pid,ppid,stat,cmd picks columns). Lesson: PIDs, parents and the tree
PS1: PS1: the prompt's format (\u@\h:\w\$ gives ranger@web01:~$) Lesson: Six variables the exam names
pstree: pstree -p draws the family tree; ps -ef or ps aux lists every process (ps -eo pid,ppid,stat,cmd picks columns). Lesson: PIDs, parents and the tree
PTP: PTP (Precision Time Protocol, ptp4l) reaches sub-microsecond accuracy with hardware timestamps, for trading floors, telecom and factories. Lesson: Time: NTP and PTP
Puppet: Puppet usually runs an agent on each node that pulls its catalog from a Puppet server every 30 minutes and fixes drift. Lesson: Puppet
pvmove: PV: pvcreate, pvs, pvdisplay, pvscan, pvremove, pvresize (after the disk itself grows), pvmove (move data off a PV before removing it) Lesson: The command families
pvremove: To pull an old disk out of a VG: pvmove /dev/sdc moves its extents onto other PVs in the VG (there must be enough free space), vgreduce vg_web /dev/sdc takes it out of the group, and pvremove /dev/sdc wipes the LVM… Lesson: Retiring a disk with no downtime
pvresize: PV: pvcreate, pvs, pvdisplay, pvscan, pvremove, pvresize (after the disk itself grows), pvmove (move data off a PV before removing it) Lesson: The command families
pwd: pwd shows where you are Lesson: Everyday utilities, precisely
PXE: PXE (Preboot Execution Environment) boots with no disk at all: the network card gets an address from DHCP, learns a boot server, and downloads the bootloader over TFTP. Lesson: initrd, and booting over the network
Q
QEMU: QEMU emulates the rest of the machine (disks, NICs, firmware) and runs each VM as a process. Lesson: KVM and QEMU
qemu-img: qemu-img handles disk images. Lesson: Disk images and VM states
Quality assurance: Avoid copy/paste without review: read it, check flags against man pages, run it in a lab or with --check, and have a human approve it like any other code (human review, quality assurance). Lesson: Verify, never just paste
quota: Check with quota -u rosa or the report repquota -a; raise limits with edquota (ext4) or xfs_quota (XFS). Lesson: Quota issues
quotas: Disk quotas cap how much space or how many files a user or group may use. Lesson: Quota issues
R
Random disconnects: Random disconnects, random timeouts and high latency suggest a flapping link, an MTU problem or a full conntrack table. Lesson: Network, logins, startup and hardware
Random timeouts: Random disconnects, random timeouts and high latency suggest a flapping link, an MTU problem or a full conntrack table. Lesson: Network, logins, startup and hardware
RC4: Retire MD5 and SHA-1 for signatures and integrity, DES/3DES and RC4 for encryption, and old SSH key exchange and MAC choices. Lesson: Removing weak algorithms
realm: realm join kibbleco.example (realmd) discovers the domain and sets up SSSD in one step. Lesson: SSSD, Winbind and realm
Recommendations to improve compliance: Security review, code optimization, code linting and recommendations to improve compliance ("check this sshd_config against CIS") Lesson: Where AI helps
Regular expressions: Generate code and regular expressions ("match an IPv4 address at the end of a line") Lesson: Where AI helps
relative: A relative path starts where you are: . is this directory, .. the parent. Lesson: Absolute and relative paths
reload: reload asks the service to re-read its config without stopping (if it supports that). Lesson: Changing unit states
Remote access issues: Remote access issues: AllowUsers/AllowGroups, PasswordAuthentication off with no key, home or ~/.ssh too open (sshd's StrictModes refuses keys if the permissions are loose), or a changed host key warning. Lesson: Accounts and remote access
remount: ro / rw: read-only or read-write; remount changes options live (mount -o remount,rw /) Lesson: Mount options that matter
renice: Change a running one with renice -n 15 -p 3991. Lesson: nice and renice
repquota: Check with quota -u rosa or the report repquota -a; raise limits with edquota (ext4) or xfs_quota (XFS). Lesson: Quota issues
required: required: must pass, but the stack keeps going (so attackers can't tell which module failed). Lesson: Control flags
requirements.txt: List them in requirements.txt (pip freeze > requirements.txt) so the next person installs the same versions with pip install -r. Lesson: Modules: built-in and installed
requisite: requisite: must pass, and failure stops right away. Lesson: Control flags
resize: convert changes formats (raw, qcow2, vmdk), and resize grows an image (then grow the partition and filesystem inside the guest). Lesson: Disk images and VM states
resize2fs: ext4: Debian/Ubuntu default; can grow online and shrink offline with resize2fs; checked with fsck Lesson: Four filesystem formats
resolvectl: resolvectl status / query: DNS as seen by systemd-resolved, the local resolver behind 127.0.0.53 Lesson: The systemd toolbox
resource: A provider is a plugin for one platform; a resource is one thing to create; the state file records what exists so the next run knows what to change. Lesson: OpenTofu
Resources: Resources: give a VM more vCPUs, RAM, disks or NICs (virsh setvcpus, setmem, attach-disk) Lesson: VM operations
restorecon: The lasting way: tell the policy with semanage fcontext, then apply with restorecon. Lesson: Fixing labels: chcon, semanage, restorecon
Return code: $? holds the last command's return code: 0 means success. Lesson: The first line and variables
Rich rule: For anything finer than 'open this port to everyone', use a rich rule: source addresses, ports or services, an action, plus optional logging and rate limits. Lesson: Rich rules
RISC-V: RISC-V is an open, royalty-free instruction set, newer to servers. Lesson: Server architectures
rkhunter: rkhunter scans for rootkits and suspicious changes to key binaries. Lesson: File integrity
rm: mv moves or renames; rm -r deletes a tree; rmdir removes only EMPTY directories Lesson: Everyday utilities, precisely
rmdir: mv moves or renames; rm -r deletes a tree; rmdir removes only EMPTY directories Lesson: Everyday utilities, precisely
rmmod: insmod loads a single .ko file by path, with no dependency handling, and rmmod removes one. Lesson: Kernel modules
ro / rw: ro / rw: read-only or read-write; remount changes options live (mount -o remount,rw /) Lesson: Mount options that matter
root: root: UID 0, always Lesson: User, system and service accounts
Rootless: Rootless containers run as an ordinary user; user namespaces map root inside the container to an unprivileged UID outside. Lesson: Privileged vs unprivileged
Routed: Routed: the host routes the VM subnet without NAT; other routers need a route to it Lesson: Virtual network types
Routing issues: Routing issues: no default route, or a wrong gateway, means the local net works and everything else says Network is unreachable. Lesson: Link, address, route, name
rpm: dpkg -i and rpm -i don't fetch dependencies; they just fail. Lesson: Dependencies and conflicts
RPM-based: RPM-based distros (RHEL, Fedora, Rocky Linux, AlmaLinux, openSUSE) use .rpm packages, the rpm tool and dnf (zypper on SUSE). Lesson: Two big families of distributions
rsync: rsync compares source and destination and sends only the differences, locally or over SSH. Lesson: rsync: copy only what changed
rsyslog: rsyslog writes classic text logs under /var/log using facility.priority rules, and can forward to a central server. Lesson: The journal and rsyslog
runC: runC is the low-level OCI runtime: it actually creates the namespaces and cgroups and starts the process (crun is a faster alternative). Lesson: The runtime stack
Runtime: Runtime changes (no --permanent) take effect at once but vanish at the next reload or reboot. Lesson: Runtime vs permanent
S
Samba: Samba speaks SMB, Windows' file and print sharing protocol. Lesson: Samba
sdiff: sdiff shows two files side by side. Lesson: Finding and comparing
sealert: Denials are logged as AVC lines in /var/log/audit/audit.log; sealert -a explains them in plain words. Lesson: Booleans, ports and denials
Secret: ConfigMap: plain configuration; Secret: sensitive values (only base64-encoded by default, so restrict access) Lesson: Kubernetes objects
Security of data: Security of data: never paste passwords, keys, customer data or full configs with secrets. Lesson: Data governance
Security review: Security review, code optimization, code linting and recommendations to improve compliance ("check this sshd_config against CIS") Lesson: Where AI helps
sed: sed 's/old/new/g': stream edit; -i edits a file in place Lesson: Slicing lines
Segmentation fault: Segmentation fault: the program touched memory it doesn't own: a bug, a bad library or failing RAM. Lesson: Killed, unresponsive, leaking, crashing
self-signed: A self-signed certificate vouches for itself, so clients have no chain of trust. Lesson: Avoid self-signed certificates
SELinux issues: SELinux issues: AVC denials in the audit log (ausearch -m avc -ts recent). Lesson: SELinux, permissions and attributes
semanage: A service on a non-standard port needs semanage port -a -t http_port_t -p tcp 3131. Lesson: Booleans, ports and denials
Semanage fcontext: The lasting way: tell the policy with semanage fcontext, then apply with restorecon. Lesson: Fixing labels: chcon, semanage, restorecon
Server inaccessible: Server inaccessible: if it's on but you can't SSH in, use the out-of-band console (BMC, hypervisor console) to see whether it's stuck at boot or just off the network. Lesson: Server not turning on, or not reachable
service: A service says what to run and how many copies; each copy is a task placed on some node. Lesson: Docker Swarm
Service accounts: Service accounts: system accounts a daemon runs as (nginx, postgres), with a nologin shell so nobody logs in as them Lesson: User, system and service accounts
Service misconfigurations: Scans also find service misconfigurations. Lesson: Vulnerability scanning: CVE and CVSS
session: Lines have a type (auth proves identity, account checks if login is allowed now, password handles changes, session sets things up), a control flag and a module. Lesson: PAM: one stack for every login
setenforce: getenforce shows the mode; setenforce 0/1 switches between permissive and enforcing until reboot. Lesson: Modes
setfacl: An ACL adds more: setfacl -m u:rosa:rw report.csv gives Rosa read-write without changing the group. Lesson: Access control lists
setgid: setgid (2000) on a program runs it with the file's group; on a directory it makes new files inherit the directory's group, which is perfect for team folders. Lesson: setuid, setgid and sticky
setsebool: Booleans are on/off switches built into the policy: getsebool -a | grep httpd lists them; setsebool -P httpd_can_network_connect on lets the web server make outgoing connections (-P makes it permanent). Lesson: Booleans, ports and denials
setuid: setuid (4000, s in the user x spot) runs a program as its owner: /usr/bin/passwd runs as root to write /etc/shadow. Lesson: setuid, setgid and sticky
SFTP: SFTP moves files over SSH. Lesson: Tunnels, SFTP, chroot and fail2ban
SHA-1: Retire MD5 and SHA-1 for signatures and integrity, DES/3DES and RC4 for encryption, and old SSH key exchange and MAC choices. Lesson: Removing weak algorithms
SHA-256: A hash like SHA-256 turns any input into a fixed 256-bit fingerprint. Lesson: Hashes and HMAC
SHELL: SHELL: your login shell, e.g. Lesson: Six variables the exam names
Shift-left testing: Shift-left testing moves tests earlier: lint, unit tests and security checks run on every commit, when fixes are cheap. Lesson: Shift left, GitOps, DevSecOps
shred: shred -n 3 -z overwrites a file or disk several times, but on SSDs and copy-on-write filesystems the old blocks may survive elsewhere. Lesson: Secure data destruction
Shut off: VM states in virsh: running, paused (frozen in RAM), shut off, crashed, pmsuspended (guest went to sleep). Lesson: Disk images and VM states
Signed package verification: Signed package verification checks a package's signature before install (rpm -K file.rpm; apt checks repo signatures). Lesson: File integrity
SLA: An SLA (service-level agreement) is the promise to a customer, with consequences if missed, and is set looser than the SLO so you have a safety margin. Lesson: SLA, SLO and SLI
SLI: An SLI (service-level indicator) is a measurement: the share of checkout requests answered in under 300 ms, or uptime per month. Lesson: SLA, SLO and SLI
SLO: An SLO (service-level objective) is the internal target for it: 99.9% of checkouts under 300 ms. Lesson: SLA, SLO and SLI
Slow application response: Slow application response and slow response times are what users report. Lesson: Slow application response
Slow response times: Slow application response and slow response times are what users report. Lesson: Slow application response
Slow startup: Slow startup: systemd-analyze blame. Lesson: Network, logins, startup and hardware
Sluggish terminal behavior: Everything slows down, often to system unresponsiveness and sluggish terminal behavior. Lesson: Memory: swapping and OOM
SMB/Samba: SMB/Samba shares Windows-style shares (//server/share, type cifs, a credentials file for the password). Lesson: autofs, network mounts and inodes
SMTP: SMTP moves mail between servers (port 25) and from clients that submit it (587). Lesson: Mail: SMTP and IMAP4
Snap: Snap (Ubuntu), Flatpak and AppImage ship an app with its own libraries and run it confined from the rest of the system. Lesson: Sandboxed applications
Snapshots: Snapshots: a point-in-time state to roll back to (virsh snapshot-create-as). Lesson: VM operations
SNAT: SNAT changes the source: inside hosts reach out using the gateway's address (masquerade is SNAT for a changing address). Lesson: Address translation and forwarding
SNMP: SNMP lets a manager poll devices for values (UDP 161). Lesson: SNMP, agents and agentless
Software configuration: Software configuration lives in /etc. Lesson: Exclusions, holds and alternatives
Software supply chain: Protect the software supply chain: install from signed repositories, limit third-party repos, pin versions and verify hashes, scan container images, keep an SBOM (software bill of materials), and watch for… Lesson: Software supply chain
sort: sort orders lines (-n numeric, -h human sizes like 2G, -r reverse). Lesson: Sorting, counting and viewing
source: source file (or . Lesson: Startup files: which one runs?
Special character devices: Special character devices are kernel helpers: /dev/null discards everything, /dev/zero gives endless zero bytes, /dev/urandom and /dev/random give random bytes. Lesson: Device files in /dev
Squash: Squash combines several commits into one: git merge --squash, or squash in an interactive rebase. Lesson: Branches, merge and rebase
ss: ss -tulpn lists listening sockets and the process behind each. Lesson: Names, ports and services
SSH agent: An SSH agent (ssh-agent, ssh-add) holds your unlocked key in memory so you type the passphrase once per session. Lesson: Keys instead of passwords
SSH tunneling: SSH tunneling carries other traffic inside SSH: ssh -L 5432:localhost:5432 db01 makes the remote database reachable on your local port 5432 (-R is the reverse, -D a SOCKS proxy). Lesson: Tunnels, SFTP, chroot and fail2ban
SSSD: SSSD (System Security Services Daemon) connects Linux to central identity: Active Directory, FreeIPA or plain LDAP plus Kerberos. Lesson: SSSD, Winbind and realm
Standard error: Every program gets standard input (0), standard output (1) and standard error (2). Lesson: Three streams
Standard input: Every program gets standard input (0), standard output (1) and standard error (2). Lesson: Three streams
Standard output: Every program gets standard input (0), standard output (1) and standard error (2). Lesson: Three streams
start / stop / restart: start / stop / restart act now. Lesson: Changing unit states
stat: stat shows inode, links, owner, and atime/mtime/ctime Lesson: Everyday utilities, precisely
state: A provider is a plugin for one platform; a resource is one thing to create; the state file records what exists so the next run knows what to change. Lesson: OpenTofu
stateful: A stateful firewall tracks connections (conntrack). Lesson: Stateful vs stateless
stateless: A stateless filter judges each packet on its own, so you need rules for both directions and the return ports. Lesson: Stateful vs stateless
status: status shows state and recent log lines. Lesson: Changing unit states
sticky: sticky (1000, t in the others x spot) on a directory means only a file's owner may delete it: /tmp is 1777. Lesson: setuid, setgid and sticky
strace: strace -p PID shows its system calls live: a process stuck on read() of a network socket, or failing open() on a missing file, tells you exactly what it's waiting for. Lesson: Looking inside one process
string: string: "db01", with methods like .split() and .strip() Lesson: Data types and structures
su: su - switches to root with a full login environment, but needs ROOT's password, which then has to be shared. Lesson: sudo -i vs su -
Subnet: Subnet: a wrong prefix (/16 instead of /24) reaches some hosts and not others. Lesson: Link, address, route, name
subshell: A subshell (commands in parentheses) runs in a child copy of the shell, so a cd or variable inside it doesn't affect the script. Lesson: Expansions and subshells
sudo: Members of wheel (RHEL family) or sudo (Debian/Ubuntu) get full sudo by default; add admins with usermod -aG. Lesson: wheel, sudo, NOPASSWD and NOEXEC
sufficient: sufficient: success is enough on its own if nothing required failed before it. Lesson: Control flags
Swapping: Swapping means RAM is full and the kernel moves pages to disk: vmstat si/so non-zero and free -h showing swap in use. Lesson: Memory: swapping and OOM
Symbolic link: A symbolic link (ln -s target name) is a tiny file holding a path. Lesson: Hard links and symbolic links
Symmetric: Symmetric: gpg -c file asks for a passphrase, good for a quick archive. Lesson: File encryption with GPG
sysctl: sysctl: kernel settings at runtime (sysctl -w vm.swappiness=10); make them permanent in /etc/sysctl.d/*.conf and load with sysctl --system Lesson: The systemd toolbox
System accounts: System accounts: UID 1-999, made with useradd -r: no aging, usually no home Lesson: User, system and service accounts
System unresponsiveness: Everything slows down, often to system unresponsiveness and sluggish terminal behavior. Lesson: Memory: swapping and OOM
systemctl: systemctl edit nginx opens a drop-in file (/etc/systemd/system/nginx.service.d/override.conf) that changes only the lines you add and survives package updates. Lesson: edit and daemon-reload
Systemctl daemon-reload: If you change unit files by hand, run systemctl daemon-reload so systemd re-reads them; otherwise it keeps using the old version and warns you. Lesson: edit and daemon-reload
systemd: The kernel starts the first process, systemd (PID 1), which brings up services until it reaches a target such as multi-user. Lesson: The boot chain, link by link
systemd-analyze: systemd-analyze: boot time; systemd-analyze blame lists units by start time; critical-chain shows what delayed boot Lesson: The systemd toolbox
Systemd-analyze blame: systemd-analyze: boot time; systemd-analyze blame lists units by start time; critical-chain shows what delayed boot Lesson: The systemd toolbox
systemd-resolved: On Ubuntu it's a link to the systemd-resolved stub (nameserver 127.0.0.53), and NetworkManager rewrites it on RHEL. Lesson: Who writes resolv.conf?
T
tag: A tag names a version: shop-api:1.4. Lesson: Images, tags and layers
tail: head/tail show the start/end (tail -f follows a growing log). Lesson: Sorting, counting and viewing
tar: tar bundles files into one archive and keeps permissions and owners. Lesson: tar: the archiver everyone uses
task: A service says what to run and how many copies; each copy is a task placed on some node. Lesson: Docker Swarm
tcpdump: tcpdump captures packets: tcpdump -i ens3 port 53 shows DNS traffic live, and -w saves a file for Wireshark. Lesson: Looking at the wire and the link
tee: tee copies its input to a file and to the screen, so a pipeline can save and continue. Lesson: tee: write and keep watching
Telnet: Telnet (23) sends everything, passwords included, in clear text: use SSH. Lesson: Retire the cleartext protocols
TFTP: PXE (Preboot Execution Environment) boots with no disk at all: the network card gets an address from DHCP, learns a boot server, and downloads the bootloader over TFTP. Lesson: initrd, and booting over the network
Third-party: Third-party repositories (EPEL, vendor repos) add software and add risk: you trust whoever signs them. Lesson: Repository files
threshold: A threshold is a limit on a metric: disk over 85%, p95 latency over 300 ms for 5 minutes. Lesson: Thresholds, events, alerts, notifications
timedatectl: timedatectl: time zone (set-timezone), NTP on or off (set-ntp true), clock status Lesson: The systemd toolbox
TLS: TLS protects web, mail and API traffic. Lesson: TLS, OpenSSL and LibreSSL
TLS 1.2 and 1.3: Allow TLS 1.2 and 1.3; SSL 2/3 and TLS 1.0/1.1 are obsolete. Lesson: TLS, OpenSSL and LibreSSL
tmpfs: tmpfs: lives in RAM (and swap); fast and gone at reboot (/run, often /tmp) Lesson: Four filesystem formats
top: top shows CPU, memory and the busiest processes live (press P for CPU, M for memory, k to kill). Lesson: Live monitors
touch: mkdir -p makes parents as needed; touch creates an empty file or updates its time Lesson: Everyday utilities, precisely
tracepath: tracepath does the same without root and also reports the path MTU. Lesson: Is it reachable, and where does it stop?
traceroute: traceroute lists each router on the path. Lesson: Is it reachable, and where does it stop?
Traps: Traps are messages the device sends unprompted when something happens (UDP 162). Lesson: SNMP, agents and agentless
Trusted root certificate: A browser or tool trusts a certificate because it chains up to a trusted root certificate in its trust store. Lesson: Trusted roots
type: SELinux gives every process and file a context: user:role:type:level. Lesson: Labels and type enforcement
U
UEFI Secure Boot: UEFI Secure Boot checks signatures from the firmware up: the firmware verifies the signed shim, the shim verifies GRUB, and GRUB verifies the kernel, which then checks modules. Lesson: Secure boot
ufw: firewalld and ufw are friendlier front ends that write the rules for you. Lesson: One engine, many dashboards
UID: UID identifies the user and GID the primary group. Lesson: UIDs, GIDs and the effective IDs
umask: The umask removes bits from that. Lesson: umask: the default mode filter
umount: mount attaches a filesystem to a directory; umount detaches it (it fails with "target is busy" while something uses it). Lesson: Mounting and /etc/fstab
unalias: alias/unalias make or remove command shortcuts; they're for interactive shells and are off in scripts by default. Lesson: Assignments and scope
uname: Check with uname -m or lscpu. Lesson: Server architectures
uniq: uniq collapses repeated adjacent lines (-c counts them), so sort first. Lesson: Sorting, counting and viewing
units: systemd manages units, each described by a file. Lesson: Four unit types
unmask: mask links the unit to /dev/null so nothing can start it, not even a dependency; unmask undoes that. Lesson: Changing unit states
unmounted: fsck checks and repairs ext filesystems, and must run on an unmounted filesystem. Lesson: Space and speed utilities
Unpatched vulnerable systems: Unpatched vulnerable systems: check pending updates (dnf check-update, apt list --upgradable) and compare installed versions against advisories. Lesson: Exposed services and unpatched systems
Unresponsive process: Unresponsive process: check its state. Lesson: Killed, unresponsive, leaking, crashing
unset: unset VAR removes it. Lesson: Assignments and scope
until: for walks a list; while repeats while a command succeeds; until repeats until one succeeds. Lesson: Loops
unzip: unzip (.zip): opens zip files from Windows and Macs (zip makes them) Lesson: Compression tools compared
update-alternatives: update-alternatives (alternatives on RHEL) manages a link like /usr/bin/java when several versions are installed: --config java picks one. Lesson: Exclusions, holds and alternatives
update-ca-certificates: On Linux the system store is managed by the distro: RHEL adds anchors in /etc/pki/ca-trust/source/anchors/ then runs update-ca-trust; Debian/Ubuntu use /usr/local/share/ca-certificates/ and update-ca-certificates. Lesson: Trusted roots
update-ca-trust: On Linux the system store is managed by the distro: RHEL adds anchors in /etc/pki/ca-trust/source/anchors/ then runs update-ca-trust; Debian/Ubuntu use /usr/local/share/ca-certificates/ and update-ca-certificates. Lesson: Trusted roots
update-crypto-policies: On RHEL, update-crypto-policies --set DEFAULT (or FUTURE, stricter) sets the allowed algorithms for OpenSSL, SSH, GnuTLS and more at once; LEGACY re-enables old ones only for compatibility. Lesson: Removing weak algorithms
update-grub: Debian/Ubuntu: update-grub. Lesson: Bootloader configuration files
USER: USER: your login name Lesson: Six variables the exam names
User accounts: User accounts: people, from UID 1000 up (UID_MIN in login.defs) Lesson: User, system and service accounts
useradd: useradd is the low-level tool on every distro: useradd -m (make home) -s /bin/bash -G warehouse tomas. Lesson: Add and delete
userdel: To remove: userdel -r (home and mail too), Debian's deluser --remove-home, and groupdel. Lesson: Add and delete
usermod: usermod changes an existing account: -s shell, -d home, -l login name, -e expiry date, and -G groups. Lesson: Modify: the -aG trap
UUID: blkid prints each filesystem's UUID, label and type, which is what /etc/fstab should use because device names can change between boots. Lesson: Seeing the disks
V
variables: Volumes: storage mounted into pods; variables: environment values set in the pod spec, often from ConfigMaps and Secrets Lesson: Kubernetes objects
Version control: It starts with version control: playbooks, Dockerfiles, Kubernetes files and OpenTofu code all live in Git, so every change is reviewed, logged and reversible. Lesson: Pipelines and version control
vgextend: VG: vgcreate, vgs, vgdisplay, vgscan, vgremove, vgextend (add a PV), vgchange -ay (activate), vgexport/vgimport (move a VG to another host) Lesson: The command families
vgreduce: To pull an old disk out of a VG: pvmove /dev/sdc moves its extents onto other PVs in the VG (there must be enough free space), vgreduce vg_web /dev/sdc takes it out of the group, and pvremove /dev/sdc wipes the LVM… Lesson: Retiring a disk with no downtime
vi/vim: vi/vim is on every server, so learn its modes. Lesson: vi/vim and nano
virsh: virsh is its command line; virt-manager is the desktop GUI for the same thing. Lesson: libvirt, virsh and virt-manager
virt-manager: virsh is its command line; virt-manager is the desktop GUI for the same thing. Lesson: libvirt, virsh and virt-manager
VirtIO: On KVM that's VirtIO: virtio-net for networking and virtio-blk or virtio-scsi for disks. Lesson: Paravirtualized drivers: VirtIO
Virtual machine: A virtual machine shares a host with others: you can snapshot, clone, resize and move it, at a small performance cost. Lesson: Bare metal vs virtual machines
visudo: Always edit with visudo (visudo -f /etc/sudoers.d/rosa for a drop-in): it checks the syntax before saving, because a broken sudoers file can lock everyone out of sudo. Lesson: sudoers, safely
Volume group (VG): PVs pool into a volume group (VG). Lesson: PV, VG, LV
volumes: Container layers vanish with the container, so data goes in volumes. Lesson: Volumes and bind mounts
W
Wayland: Wayland is its modern replacement, where the compositor does the drawing itself. Lesson: GUI pieces, and licenses
wc: wc -l counts lines. Lesson: Sorting, counting and viewing
webhook: A webhook pushes an event as an HTTP request to a URL: an alert into the team chat, or a ticket opened automatically. Lesson: Webhooks, health checks, log aggregation
wheel: Members of wheel (RHEL family) or sudo (Debian/Ubuntu) get full sudo by default; add admins with usermod -aG. Lesson: wheel, sudo, NOPASSWD and NOEXEC
while: for walks a list; while repeats while a command succeeds; until repeats until one succeeds. Lesson: Loops
whoami: whoami prints your user name; id your IDs and groups; groups just the groups. Lesson: Who is here, and who was
Winbind: Winbind, from Samba, is the older alternative for joining Active Directory. Lesson: SSSD, Winbind and realm
Window manager: The window manager places and decorates windows. Lesson: GUI pieces, and licenses
WireGuard: WireGuard is a modern VPN built into the Linux kernel: small code, fast, fixed modern ciphers (Curve25519, ChaCha20-Poly1305), nothing to negotiate. Lesson: WireGuard
X
X Server: The X Server (X11) is the classic display system: network-transparent, which is why the DISPLAY variable exists. Lesson: GUI pieces, and licenses
X11Forwarding no: X11Forwarding no: disable X forwarding on servers that need no GUI Lesson: sshd_config hardening
xargs: xargs turns input lines into arguments: find /tmp -name '*.tmp' | xargs rm. Lesson: Building and repeating commands
xfs: xfs: RHEL default; great for big files; grows online with xfs_growfs but can never shrink; repaired with xfs_repair Lesson: Four filesystem formats
xfs_growfs: xfs: RHEL default; great for big files; grows online with xfs_growfs but can never shrink; repaired with xfs_repair Lesson: Four filesystem formats
xfs_quota: Check with quota -u rosa or the report repquota -a; raise limits with edquota (ext4) or xfs_quota (XFS). Lesson: Quota issues
xfs_repair: xfs: RHEL default; great for big files; grows online with xfs_growfs but can never shrink; repaired with xfs_repair Lesson: Four filesystem formats
Z
zcat: You don't need to unpack them: zcat prints a .gz file, zless pages through it, zgrep searches it. Lesson: Reading compressed files in place
zgrep: You don't need to unpack them: zcat prints a .gz file, zless pages through it, zgrep searches it. Lesson: Reading compressed files in place
zless: You don't need to unpack them: zcat prints a .gz file, zless pages through it, zgrep searches it. Lesson: Reading compressed files in place
zones: firewalld groups rules into zones (public, internal, trusted, dmz, drop, block...). Lesson: firewalld: zones and services

Acronyms

Acronym	Stands for	What it means
AAAA	IPv6 Address record	DNS record mapping a name to an IPv6 address. If IPv6 is broken, clients may stall trying it first.
ACL	Access Control List	Extra per-user or per-group permissions on a file beyond owner/group/other. setfacl sets them, getfacl shows them.
ACME	Automated Certificate Management Environment	The protocol certbot uses to prove you own a domain and get or renew certificates (for example from Let's Encrypt) automatically.
AD	Active Directory	Microsoft's directory service. Linux joins it with realm join and SSSD or Winbind.
AES	Advanced Encryption Standard	The standard symmetric cipher; LUKS usually uses AES-XTS for disks.
AI	Artificial Intelligence	Software that generates text, code or answers from patterns it learned. Useful for drafts, but its output must be reviewed.
AIDE	Advanced Intrusion Detection Environment	File integrity checker: aide --init records file hashes, aide --check reports anything that changed since.
API	Application Programming Interface	A defined way for programs to ask another system for data or actions, such as the cloud API OpenTofu calls.
ARM	Advanced RISC Machine	A family of power-efficient processors. AArch64 is 64-bit ARM, used in many cloud servers and boards.
ARP	Address Resolution Protocol	Finds the MAC address for an IPv4 address on the local network. ip neigh shows the cache.
AVC	Access Vector Cache	SELinux's decision cache; 'avc: denied' lines in the audit log record blocked actions.
BIOS	Basic Input/Output System	Old-style PC firmware that starts the boot loader from the MBR. Replaced by UEFI on modern servers.
BMC	Baseboard Management Controller	A small computer on the server board for remote power, console and hardware logs, even when the OS is down.
CA	Certificate Authority	An organization (or internal server) that signs certificates. Clients trust certificates chained to a root CA they have.
CI/CD	Continuous Integration/Continuous Deployment	Automated pipelines that build and test every change, then deliver it to servers.
CIFS	Common Internet File System	An older name for the SMB file-sharing protocol. mount -t cifs mounts a Windows or Samba share.
CIS	Center for Internet Security	Publishes the CIS Benchmarks: free hardening guides for operating systems and apps, with Level 1 and Level 2 profiles.
CLI	Command-Line Interface	A text interface where you type commands, like bash.
CMS	Content Management System	Web software for editing site content without code, such as WordPress.
CPU	Central Processing Unit	The processor. top, vmstat and mpstat show how busy it is; lscpu describes it.
CSV	Comma-Separated Values	Plain-text table format with one record per line and fields split by commas.
CUPS	Common UNIX Printing System	The standard Linux print server (cupsd). lpstat and lp talk to it.
CVE	Common Vulnerabilities and Exposures	A public ID for one known vulnerability, such as CVE-2024-6387.
CVSS	Common Vulnerability Scoring System	Rates a vulnerability's severity from 0.0 to 10.0. In v3, 7.0-8.9 is High and 9.0-10.0 Critical.
DHCP	Dynamic Host Configuration Protocol	Hands out IP addresses, masks, gateways and DNS servers. Server port UDP 67, client UDP 68.
DKMS	Dynamic Kernel Module Support	Rebuilds third-party kernel modules for each new kernel. With Secure Boot they must be signed.
DNAT	Destination Network Address Translation	Rewrites the destination address of incoming packets, as in port forwarding to an internal server.
DNS	Domain Name System	Turns names into IP addresses. dig, host and resolvectl query it; port 53.
EGID	Effective Group Identifier	The group ID a process uses for permission checks. A setgid program runs with the file's group as its EGID.
EOF	End of File	Where input ends; a here document stops at its EOF marker line.
EPEL	Extra Packages for Enterprise Linux	A Fedora-run repository of extra packages for RHEL and its rebuilds.
EUID	Effective User Identifier	The user ID a process uses for permission checks. A setuid program runs with the file owner's EUID.
FEC	Forward Error Correction	Extra data sent on a link so the receiver can fix bit errors without a resend; used on fast Ethernet links.
FHS	Filesystem Hierarchy Standard	The agreed Linux directory layout: /etc settings, /var changing data, /usr programs, /home users.
FIPS	Federal Information Processing Standards	US government crypto standards; RHEL's FIPS mode allows only approved algorithms.
FQDN	Fully Qualified Domain Name	A host's complete DNS name, such as web01.kibbleco.example.
FTP	File Transfer Protocol	Old file transfer on TCP 20/21 that sends logins in cleartext. Use SFTP instead.
FUSE	Filesystem in Userspace	Lets normal programs provide a filesystem (sshfs, rclone) without kernel code.
GDPR	General Data Protection Regulation	EU privacy law for personal data, with rules on consent, breach notice and data rights.
GID	Group Identifier	The number Linux uses for a group. /etc/group maps names to GIDs.
GNU	GNU's Not Unix	The free software project behind bash, coreutils and the GPL license.
GPG	GNU Privacy Guard	Open-source OpenPGP tool: encrypts files (gpg -e, gpg -c) and signs or verifies them (gpg --verify).
GPG2	GNU Privacy Guard 2	Version 2 of GnuPG. On older systems the command is gpg2; on current ones gpg is already version 2.
GPL	GNU General Public License	The copyleft license of the Linux kernel: changes you distribute must stay open source.
GPT	GUID Partition Table	Modern partition table with up to 128 partitions and disks over 2 TiB; used with UEFI. gdisk and parted edit it.
GPU	Graphics Processing Unit	Graphics processor also used for AI and video work. nvtop shows its load.
GRUB	Grand Unified Bootloader	The usual Linux boot loader (GRUB 2). Settings go in /etc/default/grub, then regenerate grub.cfg.
GUI	Graphical User Interface	Windows, icons and menus. Linux GUIs run on X or Wayland with a display manager to log in.
GUID	Globally Unique Identifier	A 128-bit ID; GPT gives every disk and partition one.
HMAC	Hash-based Message Authentication Code	A hash made with a secret key, proving a message was not changed and came from someone with the key.
HTTP	Hypertext Transfer Protocol	Web protocol on TCP 80, unencrypted. curl speaks it from the command line.
HTTPD	Hypertext Transfer Protocol Daemon	A web server process; on RHEL it is Apache's httpd service.
HTTPS	Hypertext Transfer Protocol Secure	HTTP encrypted with TLS on TCP 443.
I/O	Input/Output	Reading and writing data to disks, networks and devices. High I/O wait means the CPU waits on storage.
IaC	Infrastructure as Code	Defining servers, networks and settings in version-controlled files (Ansible, Puppet, OpenTofu) instead of by hand.
ICMP	Internet Control Message Protocol	Carries ping and error messages such as 'destination unreachable'.
IFS	Internal Field Separator	The bash variable that sets how words and read input are split; by default space, tab and newline.
IMAP4	Internet Message Access Protocol 4	Mail clients read mail kept on the server; TCP 143, or 993 with TLS.
initrd	Initial RAM Disk	A small temporary root filesystem the boot loader loads with the kernel, holding drivers to mount the real root.
IOC	Indicator of Compromise	Evidence of an intrusion, such as a known-bad IP in logs, an odd cron job or a changed system binary.
IOPS	Input/Output Operations Per Second	How many reads and writes storage can do each second; key for database disks.
IP	Internet Protocol	Addresses and routes packets between networks. ip addr and ip route show its settings.
IPMI	Intelligent Platform Management Interface	Standard for talking to a server's BMC; ipmitool checks power, sensors and the event log.
ISO	International Organization for Standardization	A standards body; also the name for disc image files (.iso) used to install systems.
JSON	JavaScript Object Notation	A text data format of objects and lists, used by APIs. jq and Python's json module read it.
KDC	Key Distribution Center	The Kerberos server that issues tickets; in Active Directory it runs on domain controllers.
KRB5	Kerberos 5	Ticket-based network login. kinit gets a ticket, klist shows it; clocks must be in sync.
KVM	Kernel-based Virtual Machine	The Linux kernel's built-in hypervisor; QEMU and libvirt use it to run fast VMs.
LACP	Link Aggregation Control Protocol	Negotiates bonded links with the switch (802.3ad, bonding mode 4).
LAN	Local Area Network	The network in one building or site.
LDAP	Lightweight Directory Access Protocol	Protocol for central directories of users and groups. TCP 389, or 636 for LDAPS.
LLM	Large Language Model	An AI model trained on huge amounts of text that generates answers and code; it can be confidently wrong.
LUKS	Linux Unified Key Setup	The standard Linux disk encryption format, managed with cryptsetup.
LUKS2	Linux Unified Key Setup 2	The current LUKS format, with a sturdier header and Argon2id key derivation by default.
LV	Logical Volume	A flexible LVM volume carved from a volume group; it holds a filesystem.
LVM	Logical Volume Manager	Pools disks (PVs) into volume groups (VGs) and carves flexible logical volumes (LVs) you can resize.
MAC	Media Access Control	The hardware address of a network card, such as 52:54:00:1a:2b:3c. ip link shows it.
MBR	Master Boot Record	Old partition scheme in the disk's first sector: 4 primary partitions, 2 TiB limit.
MCE	Machine Check Exception	A CPU report of a hardware error (cache, memory, bus); seen in dmesg or rasdaemon.
MFA	Multifactor Authentication	Login that needs two or more factor types, such as an SSH key plus a TOTP code.
MIB	Management Information Base	The definitions of what an SNMP device reports, naming each numeric OID.
MOK	Machine Owner Key	Your own key enrolled in shim with mokutil so Secure Boot accepts modules you signed.
MTU	Maximum Transmission Unit	The largest packet a link carries, usually 1500 bytes. A mismatch breaks big transfers.
NAS	Network-attached Storage	A storage box sharing files over the network with NFS or SMB.
NAT	Network Address Translation	Rewrites addresses as packets pass a router, so private networks can share public addresses.
NFS	Network File System	Linux/UNIX file sharing over TCP 2049; shares are listed in /etc/exports.
NIC	Network Interface Card	A network adapter; ip link lists them and ethtool shows speed and link state.
NSS	Name Service Switch	Decides where user, group and host lookups go; set in /etc/nsswitch.conf.
NTP	Network Time Protocol	Keeps clocks in sync (chronyd, systemd-timesyncd) over UDP 123.
NVMe	Non-Volatile Memory Express	A fast interface for SSDs on PCIe. Disks appear as /dev/nvme0n1.
OCI	Open Container Initiative	Open standards for container images and runtimes used by Docker and Podman.
OFS	Output Field Separator	awk's variable for the text printed between fields; a space unless you set it, e.g. BEGIN{OFS=","}.
OID	Object Identifier	A dotted number naming one SNMP value, such as 1.3.6.1.2.1.1.3.0 for uptime.
OOM	Out of Memory	When RAM and swap run out, the kernel's OOM killer ends a process to keep the system alive.
OpenSCAP	Open Security Content Automation Protocol	Open-source tool (oscap) that checks systems against security profiles and writes compliance reports.
OpenSSL	Open Secure Sockets Layer	The common TLS and crypto library and command: s_client, x509, req, dgst and more.
OS	Operating System	The core software that runs a computer, such as RHEL or Ubuntu.
PAM	Pluggable Authentication Modules	The stack of modules in /etc/pam.d that decides how each service checks logins and passwords.
PAT	Port Address Translation	Many private hosts share one public address; port numbers keep their connections apart.
PBKDF	Password-Based Key Derivation Function	Turns a passphrase into an encryption key slowly to resist guessing; LUKS2 uses Argon2id.
PEP	Python Enhancement Proposal	A Python design document. PEP 8 is the style guide; PEP 668 marks distro Python as externally managed.
PHP	PHP: Hypertext Preprocessor	A server-side web language run by Apache or PHP-FPM.
PID	Process Identifier	The number Linux gives each running process. ps and top show it; kill uses it.
PKI	Public Key Infrastructure	The system of CAs, certificates and keys that lets clients trust servers.
POSIX	Portable Operating System Interface	Standards for UNIX-like systems: shell, commands and ACL behavior.
PPID	Parent Process Identifier	The PID of the process that started this one.
PTP	Precision Time Protocol	IEEE 1588 clock sync, far more precise than NTP; UDP 319/320. ptp4l runs it.
PV	Physical Volume	A disk or partition prepared for LVM with pvcreate.
PXE	Preboot Execution Environment	Network boot: firmware gets an address from DHCP and loads a boot image over TFTP.
qcow2	QEMU Copy On Write version 2	QEMU's disk image format with thin provisioning and snapshots.
QEMU	Quick Emulator	Open-source machine emulator; with KVM it runs fast virtual machines.
RAID	Redundant Array of Independent Disks	Combines disks for speed or redundancy (RAID 1, 5, 6, 10). mdadm manages software RAID.
RAM	Random Access Memory	Fast working memory that is lost at power-off. free -h shows how much is used.
RBAC	Role-Based Access Control	Rights are given to roles and users get roles, as in Kubernetes RBAC.
RHEL	Red Hat Enterprise Linux	Red Hat's enterprise distribution, using dnf, firewalld and SELinux. Rocky and AlmaLinux rebuild it.
RISC	Reduced Instruction Set Computer	A CPU design with a small, simple instruction set, as in ARM and RISC-V.
RPM	RPM Package Manager	The package format and tool of RHEL-family distros (rpm, dnf). Originally Red Hat Package Manager.
RSA	Rivest-Shamir-Adleman	A public-key algorithm used for keys and certificates. ssh-rsa with SHA-1 signatures is now disabled.
RSS	Resident Set Size	The RAM a process really uses right now; ps -o rss shows it in KiB.
SAN	Storage Area Network	A dedicated network that gives servers block storage (LUNs) over Fibre Channel or iSCSI.
SBOM	Software Bill of Materials	A list of every component and version in a piece of software, for supply-chain checks.
SCAP	Security Content Automation Protocol	Standard formats for security checks and results that OpenSCAP reads.
SEL	System Event Log	The BMC's log of hardware events; ipmitool sel list shows it.
SELinux	Security-Enhanced Linux	Mandatory access control on RHEL-family systems: labels on files and processes decide access.
SFTP	SSH File Transfer Protocol	Encrypted file transfer over SSH, port 22. Replaces FTP.
SGID	Set Group ID	On a program it runs as the file's group; on a directory new files inherit the directory's group.
SHA	Secure Hash Algorithm	A hash family. SHA-256 is current; SHA-1 is weak and being removed.
SIGKILL	Signal: kill (9)	Ends a process at once; it cannot be caught. Use it after SIGTERM fails.
SIGSEGV	Signal: segmentation violation (11)	Sent when a program touches memory it may not use; logged as a segfault.
SIGTERM	Signal: terminate (15)	The polite stop request kill sends by default.
SLA	Service-level Agreement	A formal promise to a customer about service levels, such as 99.9% uptime.
SLES	SUSE Linux Enterprise Server	SUSE's enterprise Linux; RPM-based with zypper.
SLI	Service-level Indicator	The measured value of a service, such as the percent of requests answered in time.
SLO	Service-level Objective	The internal target for an SLI, such as 99.95% of requests under 300 ms.
SMART	Self-Monitoring, Analysis and Reporting Technology	Disk health data; smartctl -a shows reallocated sectors and errors.
SMB	Server Message Block	Windows file sharing protocol on TCP 445; Samba provides it on Linux.
SMTP	Simple Mail Transfer Protocol	Sends mail between servers on TCP 25; clients submit on 587.
SNAT	Source Network Address Translation	Rewrites the source address of outgoing packets; masquerade is SNAT with a changing address.
SNMP	Simple Network Management Protocol	Monitors devices: managers poll on UDP 161, agents send traps to UDP 162.
SOCKS	Socket Secure	A proxy protocol; ssh -D opens a local SOCKS proxy through the SSH server.
SR-IOV	Single Root Input/Output Virtualization	Lets one physical NIC appear as many virtual ones that VMs use directly for speed.
SSD	Solid-state Drive	Flash storage with no moving parts; overwrite tools like shred cannot reach every block.
SSH	Secure Shell	Encrypted remote login and tunneling on TCP 22; also carries SFTP and scp.
SSHD	Secure Shell Daemon	The SSH server (sshd); its settings live in /etc/ssh/sshd_config.
SSL	Secure Sockets Layer	TLS's broken predecessor; SSLv2 and SSLv3 must be disabled.
SSO	Single Sign-On	Log in once and reach many services, as with Kerberos tickets.
SSSD	System Security Services Daemon	Connects Linux logins to LDAP, Kerberos or Active Directory and caches identities.
STIG	Security Technical Implementation Guide	US DoD hardening guides, also offered as OpenSCAP profiles.
SUID	Set User ID	Special permission: a program runs as its file's owner. Shown as s in the owner's x spot (rwsr-xr-x).
TCP	Transmission Control Protocol	Reliable, connection-based transport used by SSH and the web. ss -t lists TCP sockets.
TFTP	Trivial File Transfer Protocol	Simple UDP 69 transfer with no login or encryption; used for PXE boot files.
TLS	Transport Layer Security	Encrypts network connections such as HTTPS. Allow only TLS 1.2 and 1.3.
TOTP	Time-based One-time Password	A six-digit code from an app that changes every 30 seconds; a common second factor.
TTL	Time to Live	A hop count in each packet, or how long a DNS answer may be cached.
UDP	User Datagram Protocol	Fast, connectionless transport with no resending; DNS, DHCP and NTP use it.
UEFI	Unified Extensible Firmware Interface	Modern firmware that boots from an EFI system partition and supports Secure Boot.
UFW	Uncomplicated Firewall	Ubuntu's simple firewall front end: ufw allow, ufw deny, ufw status.
UID	User Identifier	The number Linux uses for each user. UID 0 is root; the id command shows yours.
USB	Universal Serial Bus	The common port for drives and devices; lsusb lists what is connected.
UUID	Universally Unique Identifier	A 128-bit ID given to filesystems; blkid shows it and fstab can mount by it.
VG	Volume Group	An LVM pool made of physical volumes, from which logical volumes are carved.
Vim	Vi Improved	The standard Linux text editor: i to insert, Esc then :wq to save and quit.
VLAN	Virtual Local Area Network	Splits one switch into separate networks; Linux can tag traffic with ip link add ... type vlan.
VM	Virtual Machine	A software computer running on a hypervisor such as KVM.
VPN	Virtual Private Network	An encrypted tunnel between sites or hosts, such as WireGuard or IPsec.
WAN	Wide Area Network	A network linking sites over long distances, such as the internet.
XML	Extensible Markup Language	A tagged text format for data and configs, such as libvirt VM definitions.
YAML	YAML Ain't Markup Language	Indentation-based data format used by Ansible playbooks, Compose files and Kubernetes.

Practice it in Ranger's TerminalThe same lessons as a story, with drills, hands-on labs and mock exams. Free, in your browser.

Play free

CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.