Linux

Architecture of Linux

Linux is a layered, multiuser, multitasking, open-source operating system. Its architecture has four main layers.

1. Hardware: CPU, memory, disks and peripheral devices.
2. Kernel: the core of the OS, which runs in privileged mode and directly controls hardware. It is monolithic but supports loadable modules. Its major parts are:
   • process management and scheduling,
   • memory management (virtual memory, paging),
   • file system management (ext4, XFS, etc., through the virtual file system),
   • device drivers,
   • networking stack (TCP/IP),
   • system call interface.
3. Shell: the command interpreter between user and kernel, which reads commands and passes them to the kernel. Examples: bash, zsh, sh, csh.
4. Utilities and applications: user programs and system tools such as editors, compilers, the desktop environment (GNOME, KDE) and servers.

Flow: an application issues a library call or system call, the kernel executes it on the hardware and returns the result. User space is separated from kernel space for protection.

Types of Linux distributions

A distribution (distro) packages the Linux kernel with utilities, a package manager and applications. The main families are:

• Debian family: Debian, Ubuntu, Linux Mint (.deb, apt).
• Red Hat family: RHEL, Fedora, CentOS, Rocky, AlmaLinux (.rpm, yum/dnf).
• SUSE family: openSUSE, SLES.
• Arch family: Arch, Manjaro (rolling release).
• Others: Slackware, Gentoo, Kali (security), Alpine (light).

Two distributions explained

Ubuntu: based on Debian, released twice yearly with long-term support (LTS) versions every two years. It is user-friendly, has a large community, uses apt and the GNOME desktop, and is popular on desktops, cloud and servers.

Red Hat Enterprise Linux (RHEL): a commercial, enterprise distribution with paid support and certification, using rpm, yum/dnf and SELinux. It is stable and secure, widely used in data centres, and is the base for Fedora (upstream) and CentOS/Rocky/AlmaLinux (free clones).

Booting

Booting is the process of starting a computer: from power on until the operating system is loaded into memory and ready for use. The Linux boot sequence is:

1. BIOS/UEFI: performs the power-on self test (POST), initialises hardware and finds the boot device.
2. MBR/EFI partition and boot loader (GRUB): the boot loader is loaded, shows the menu and loads the kernel and initramfs.
3. Kernel: initialises hardware, mounts the root file system and starts the first process.
4. init/systemd (PID 1): starts services according to the runlevel or target.
5. Login prompt or display manager appears.

Commands with examples

MBR and GPT

MBR (Master Boot Record) is the older partitioning scheme, kept in the first 512-byte sector of the disk. It holds the boot code and a partition table of four primary partitions (or three primary plus one extended with logical drives). It supports disks up to 2 TB only and works with legacy BIOS. It has no backup of the table, so damage to it can lose the partitions.

GPT (GUID Partition Table) is the modern scheme, part of UEFI. It supports up to 128 partitions by default, disks larger than 2 TB (up to about 9.4 ZB), stores partition data at both the start and end of the disk with CRC checks for recovery, and identifies partitions by GUIDs. It needs UEFI (BIOS boot also possible with a BIOS boot partition).

Steps to install Red Hat Linux

1. Check requirements (RAM at least 2 GB, 20 GB disk) and download the RHEL ISO; create a bootable DVD or USB.
2. Set the BIOS/UEFI to boot from the DVD/USB and boot the installer.
3. Choose Install Red Hat Enterprise Linux from the boot menu.
4. Select the language and keyboard.
5. On the Installation Summary screen configure: date and time zone, software selection (Server with GUI, minimal, etc.), and network and host name.
6. Choose Installation Destination: select the disk and either automatic partitioning or custom (e.g. /boot 1 GB, swap, / root, /home). The installer uses MBR or GPT depending on firmware and disk size.
7. Set the root password and create a normal user account.
8. Click Begin Installation; files are copied and packages installed.
9. When it completes, click Reboot and remove the media.
10. On first boot accept the licence, register the system, then log in.

Monitoring system performance in Linux

System performance is monitored by observing CPU, memory, disk I/O, network and running processes, using command-line tools that read the kernel's /proc information. This helps find bottlenecks, runaway processes and capacity problems early.

Three commonly used commands:

1. top: gives a continuously updated view of the system: uptime and load average, number of tasks, CPU usage (user, system, idle, wait), memory and swap, and a process list sorted by CPU use. Keys: k kill, M sort by memory, q quit. Example: top. (htop is an improved version.)
2. vmstat: reports virtual memory, processes, paging, block I/O and CPU activity. Example: vmstat 2 5 prints a report every 2 seconds, 5 times. A high si/so (swap in/out) shows memory shortage; a high wa shows disk wait.
3. free -m: shows total, used, free, shared and cached memory and swap in megabytes. Example: free -m.

Other useful tools: iostat (disk I/O and CPU), sar (history of activity), ps aux (process list), uptime (load average), df -h (disk space), netstat/ss (network connections), and iotop.

Disk quota

A disk quota is a limit set by the administrator on the amount of disk space (blocks) or the number of files (inodes) that a user or group may use on a file system. It prevents any user from filling the disk. It has a soft limit (can be exceeded temporarily during a grace period) and a hard limit (never exceeded).

Steps to set user disk quotas

1. Install the quota tools: yum install quota (or apt install quota).
2. Edit /etc/fstab and add the usrquota (and grpquota) option to the file system, e.g. /dev/sdb1 /home ext4 defaults,usrquota,grpquota 0 2
3. Remount the file system: mount -o remount /home.
4. Create the quota files and scan the disk: quotacheck -cug /home (use -avugm for all).
5. Turn quotas on: quotaon -v /home.
6. Edit the quota for a user: edquota -u ram. In the editor set the soft and hard limits for blocks and inodes, then save.
7. Set the grace period: edquota -t.
8. Check the result: quota -u ram for one user, repquota -a for a report of all users.

User management in Linux

User management is the administrator's work of creating, modifying, controlling and deleting user accounts and groups so that only authorised people use the system and each gets suitable permissions. Its main activities are:

• creating and deleting user accounts and groups,
• setting and changing passwords and password ageing,
• assigning home directory, shell and group membership,
• locking and unlocking accounts,
• setting file permissions and quota.

Account information is stored in /etc/passwd (user details), /etc/shadow (encrypted passwords) and /etc/group (groups).

Creating accounts

• useradd -m -s /bin/bash -c "Ram Sharma" ram creates user ram with a home directory and shell.
• useradd -m -g staff -G sales,dev ram sets the primary and secondary groups.
• passwd ram sets the password.
• groupadd sales creates a group.

Modifying accounts

• usermod -l newname ram changes the login name.
• usermod -aG dev ram adds ram to the group dev.
• usermod -s /bin/sh ram changes the shell; usermod -d /home/new -m ram moves the home directory.
• usermod -L ram / usermod -U ram lock and unlock the account.
• chage -M 90 ram sets the maximum password age.

Deleting accounts

• userdel -r ram removes the user and the home directory.
• groupdel sales removes a group.

Use id ram or groups ram to check the result.

Need for backup and restore

A backup is a copy of data stored separately so that it can be restored if the original is lost; restoring is copying the data back. They are needed for:

• recovery from hardware failure, disk crash or accidental deletion,
• protection against viruses, ransomware and hacking,
• disaster recovery (fire, flood, theft),
• recovery from software or human error,
• legal and audit requirements to keep records,
• migration, testing and keeping the business running with little downtime.

Backup strategies

1. Full backup: copies all selected data every time. It gives the simplest and fastest restore, but takes the most time and space.
2. Incremental backup: copies only data changed since the last backup of any kind. It is quick and small, but restore needs the last full backup plus all incrementals in order.
3. Differential backup: copies data changed since the last full backup. It is bigger than incremental, but restore needs only the full backup plus the latest differential.
4. Mirror/replication: a live copy kept on another disk or server (RAID 1, rsync).
5. Snapshot: a point-in-time image of a volume (LVM snapshots).

Common schedule: a full backup weekly (Sunday) with incremental or differential backups daily.

Other considerations: the 3-2-1 rule (three copies, on two kinds of media, one off-site), regular testing of restores, encryption, and automation with cron.

Linux tools: tar, dump/restore, rsync, cpio, dd. Example: tar -czvf backup.tar.gz /home and tar -xzvf backup.tar.gz -C /.

Characteristics of the Apache web server

Apache HTTP Server is a free, open-source web server maintained by the Apache Software Foundation. Its characteristics are:

• open source and free, with a large community;
• cross-platform (Linux, Unix, Windows);
• modular design: features added through loadable modules (mod_ssl, mod_rewrite, mod_php);
• supports virtual hosting (many sites on one server);
• supports HTTP/1.1 and HTTP/2, SSL/TLS (HTTPS), authentication and access control;
• supports CGI, PHP, Perl and Python dynamic content;
• configurable through plain text files, including per-directory .htaccess;
• reliable, stable and secure, with logging and URL rewriting, proxy and load balancing.

Primary server configuration

On Red Hat systems the main file is /etc/httpd/conf/httpd.conf (on Debian /etc/apache2/apache2.conf); extra files live in /etc/httpd/conf.d/. It consists of directives, one per line, such as Directive value, and container sections.

Important directives

Container directives

<Directory "/var/www/html">
    Options Indexes FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>

<VirtualHost *:80>
    ServerName www.example.com
    DocumentRoot /var/www/example
</VirtualHost>

<Directory> sets options and access for a folder, <VirtualHost> defines a separate site, and <Location>/<Files> apply rules to URLs or files. After editing, check with apachectl configtest and reload with systemctl restart httpd.

Function of a DHCP server

The Dynamic Host Configuration Protocol (DHCP) server automatically assigns network configuration to clients, so the administrator need not configure each host by hand. It supplies:

• an IP address from a pool (scope),
• subnet mask,
• default gateway,
• DNS server addresses and domain name,
• a lease time.

It prevents address conflicts, lets addresses be reused, and eases management of large networks. DHCP uses UDP port 67 (server) and 68 (client). Addresses may be allocated dynamically (leased), automatically (permanent) or manually (reserved by MAC address).

DORA process

DORA is the four-step exchange by which a client gets an address.

1. Discover: a client with no IP address broadcasts a DHCPDISCOVER message (source 0.0.0.0, destination 255.255.255.255) to find DHCP servers.
2. Offer: each DHCP server that receives it replies with a DHCPOFFER, proposing an unused IP address, mask, gateway, DNS and lease duration.
3. Request: the client chooses one offer and broadcasts a DHCPREQUEST asking for that address, which also tells other servers that their offers are declined.
4. Acknowledge: the chosen server sends a DHCPACK confirming the lease and the configuration. The client now configures its interface and can use the network.

The client tries to renew the lease at 50% of the lease time (T1) and at 87.5% (T2), and may send DHCPRELEASE when it no longer needs the address. A server can refuse a request with DHCPNAK.

MySQL database server

MySQL is an open-source relational database management system (RDBMS) that stores data in tables and is queried with SQL. It runs as the server daemon mysqld (or mariadb on Red Hat), serves clients over TCP port 3306 or a Unix socket, and is widely used for web applications (LAMP stack). It supports multiple users, transactions (InnoDB), replication and security through privileges.

Configuration file

The server reads its options at start-up from /etc/my.cnf (Red Hat) or /etc/mysql/my.cnf (Debian), plus files in /etc/my.cnf.d/ or /etc/mysql/conf.d/ and ~/.my.cnf. The file is divided into sections headed by square brackets, each holding option=value lines:

[client]
port=3306
socket=/var/lib/mysql/mysql.sock

[mysqld]
datadir=/var/lib/mysql
socket=/var/lib/mysql/mysql.sock
port=3306
user=mysql
bind-address=127.0.0.1
max_connections=150
character-set-server=utf8mb4
default-storage-engine=InnoDB
innodb_buffer_pool_size=512M
log-error=/var/log/mysqld.log
pid-file=/var/run/mysqld/mysqld.pid

[mysqld_safe]
log-error=/var/log/mysqld.log

[mysql]
default-character-set=utf8mb4

Meaning of the important parts:

• [client]: options for client programs, such as the port and socket.
• [mysqld]: options for the server. datadir is where databases are stored, port the listening port, user the account the server runs as, bind-address the network address to accept connections on, max_connections the number of simultaneous clients, innodb_buffer_pool_size the cache memory, log-error the error log.
• [mysqld_safe]: options for the wrapper script that starts and restarts the server.

After changing the file, restart the service with systemctl restart mysqld (or mariadb).

DNS (Domain Name System) translates domain names into IP addresses. In Linux the DNS server is BIND (named). Configuration steps:

1. Install:

   yum install bind bind-utils
   

2. Edit the main file /etc/named.conf: set the listening address, allow queries and declare the zones.

   options {
       listen-on port 53 { 127.0.0.1; 192.168.1.10; };
       directory "/var/named";
       allow-query { localhost; 192.168.1.0/24; };
       recursion yes;
   };
   zone "example.com" IN {
       type master;
       file "example.com.zone";
   };
   zone "1.168.192.in-addr.arpa" IN {
       type master;
       file "192.168.1.rev";
   };
   

3. Forward zone file /var/named/example.com.zone:

   $TTL 86400
   @   IN  SOA ns1.example.com. admin.example.com. (
               2024010101 ; serial
               3600       ; refresh
               1800       ; retry
               604800     ; expire
               86400 )    ; minimum
       IN  NS   ns1.example.com.
       IN  MX 10 mail.example.com.
   ns1  IN  A   192.168.1.10
   www  IN  A   192.168.1.20
   mail IN  A   192.168.1.30
   ftp  IN  CNAME www
   

4. Reverse zone file /var/named/192.168.1.rev:

   $TTL 86400
   @   IN  SOA ns1.example.com. admin.example.com. ( 2024010101 3600 1800 604800 86400 )
       IN  NS  ns1.example.com.
   10  IN  PTR ns1.example.com.
   20  IN  PTR www.example.com.
   

5. Set the client resolver in /etc/resolv.conf: nameserver 192.168.1.10.
6. Check, start and open the firewall:

   named-checkconf
   named-checkzone example.com /var/named/example.com.zone
   systemctl enable --now named
   firewall-cmd --add-service=dns --permanent
   

7. Test: nslookup www.example.com or dig www.example.com.

ISP simulation means building a computer model of an Internet Service Provider to study its behaviour and performance before building or changing the real system.

System modelled: Customers dial in or connect through access servers, modems or routers; their requests go to servers (web, mail, DNS, proxy) and to the upstream link; requests queue when resources are busy.

Elements

• Entities: users/sessions, packets or requests
• Resources: modems or ports, bandwidth, servers, routers
• Arrival process: random (usually Poisson, with exponential inter-arrival times)
• Service times: random, from a measured distribution
• Queues: where requests wait; blocked requests are lost when no port is free

Performance measures: Average and maximum waiting time, port/link utilisation, queue length, blocking probability, throughput and response time.

Uses: Capacity planning (how many modems or how much bandwidth), checking the effect of peak load, deciding on adding servers and testing Quality of Service at low cost and without disturbing customers. It may be implemented in GPSS, SIMSCRIPT or a network simulator such as NS-2/NS-3.

NIS (Network Information Service), originally Sun's Yellow Pages (YP), is a client-server directory service that shares system configuration data, mainly user accounts, passwords, groups and host names, among the computers of a network from a central place.

Components

• NIS domain: The group of machines sharing the same maps.
• Master server: Holds the original maps and is where changes are made.
• Slave server: Keeps copies of the maps for redundancy and load sharing.
• Clients: Query the servers instead of using local files.
• Maps: Database files built from /etc/passwd, /etc/group, /etc/hosts and so on (built with ypinit and make in /var/yp).
• Daemons: ypserv, ypbind, yppasswdd, ypxfrd; commands ypcat, ypmatch, yppasswd.
• Uses RPC (portmap/rpcbind).

Advantage: One login works on every machine and administration is centralised. Disadvantages: Passwords are sent with weak security and there is no encryption, so it is replaced by LDAP and Kerberos in modern networks.

Root login means logging in directly as the root user (UID 0), the Linux administrator account that has unrestricted access to the whole system. The prompt ends with #. Everything is done with full privileges, and it is risky because a mistake or an attack can damage the entire system. Many systems disable direct root login, especially over SSH.

Super login (superuser access using su) means that an ordinary user logs in first and then becomes the superuser temporarily with su or su - (providing the root password) or with sudo (providing their own password). Activity is logged, privileges can be limited by /etc/sudoers, and the user returns to normal rights with exit.

Good practice is to avoid direct root login and use sudo.