Storage, File Systems and Networking in Linux

Every Linux path starts in one directory tree rooted at /. A second disk joins that tree at a directory when it is mounted. The Filesystem Hierarchy Standard (FHS) describes the usual purpose of each directory; version 3.0 dates from 2015.

Programs and settings

The FHS separates static files from files that change, and shared files from machine-specific ones. That puts installed programs under /usr, changing data under /var, and this machine's settings under /etc.

The older /bin, /sbin and /lib locations hold essential commands and libraries in the FHS layout. Many current distributions use merged /usr: these paths are symbolic links into /usr. Thus /bin/ls and /usr/bin/ls can reach the same program. /etc excludes executable binaries, but administrative scripts may be kept there.

Personal files and running data

Regular users usually keep their own files in /home/NAME; ~ means your home directory. User settings such as ~/.bashrc are hidden entries there. /root is the root user's home. The root directory / is the start of the whole tree, not that user's home.

Under /var, the second directory narrows the purpose:

• /var/log holds logs.
• /var/cache holds data that can be downloaded or rebuilt.
• /var/lib holds program state, including databases and package records.
• /var/spool holds queued work, such as print jobs.
• /var/tmp holds temporary files that survive rebooting.

/tmp is for shorter-lived temporary files. /run holds data for the current boot, such as sockets and process ID files, and is cleared at reboot. /boot contains the kernel, initial RAM disk and boot loader files. /dev, /proc and /sys expose devices and the kernel's current information.

Mounts and service data

/mnt is the usual place for a temporary manual mount. Desktop systems commonly mount removable drives below /media/USER/LABEL, or /run/media/USER/LABEL on Fedora. /opt holds add-on software in separate package directories. /srv holds data served to other machines; some distributions use locations such as /var/www for websites.

Consider a packaged nginx server on Debian or Ubuntu. Its executable is /usr/sbin/nginx, its main settings are /etc/nginx/nginx.conf, and requests are logged in /var/log/nginx/access.log. Documentation is under /usr/share/doc/nginx. The directory's purpose tells you where to investigate a settings change or growing log.

Install your own command under /usr/local/bin, keeping it apart from package-managed files. An update can replace files under /usr. For a systemd service, use the override location under /etc/systemd/system instead of editing its shipped unit under /usr/lib/systemd/system.

Temporary files need both a suitable lifetime and suitable permissions. A file can survive a reboot yet still be scheduled for cleanup, and protection against deletion is different from protection against reading.

Choose a lifetime

Use /tmp for short-lived work that a program will not need on its next run. FHS recommends clearing it at boot. Fedora and Debian 13 commonly mount it as tmpfs, which uses memory and swap; its contents disappear at shutdown. Its default size limit is half of physical RAM, so a large temporary job can fill it even when the main disk has room.

Use /var/tmp when temporary work must survive rebooting. FHS requires its contents to remain across boot. It is still temporary storage: systemd's upstream cleanup rules commonly age out unused entries after 10 days in /tmp and 30 days in /var/tmp. Distribution and local settings can change those ages. Save lasting work in your home or another permanent data directory.

Read the directory permissions

Inspect the directory entry itself:

ls -ld /tmp

An example permission string is drwxrwxrwt. The initial d means directory. The three permission groups allow everyone to read, write and enter it. The final t marks the sticky bit, replacing the usual execute character for others.

Write permission on a directory normally lets a user remove or rename entries there, including other people's files. In a sticky directory, deletion and renaming are restricted to the file's owner, the directory's owner or root, subject to the usual access rules. The bit is useful precisely because many users share /tmp.

For example, Mina creates /tmp/draft.txt, mode 644, in a root-owned sticky directory. Tomas can read that file because its own permissions allow it. He cannot remove it merely because he can write to /tmp. Mina and root can remove it. Changing the file to mode 600 also protects its contents from other ordinary users.

Set and recognize the sticky bit

On a shared directory you administer:

sudo chmod 1777 /srv/shared

The leading 1 sets the sticky bit; the remaining 777 allows all users full directory access. sudo chmod +t /srv/shared adds the bit without replacing the other permissions. chmod -t removes it when you have permission to change the mode.

A lowercase t means the sticky bit and others' execute permission are both set. An uppercase T means sticky is set but others lack execute permission. For example, mode 1770 appears as drwxrwx--T. Linux ignores the sticky bit on regular files; its historical name comes from keeping program code in memory or swap on early Unix.

Let mktemp choose the name

mktemp creates a file with a unique random name, permissions 600, and prints its path. mktemp -d creates a private temporary directory. In a shell script, keep the printed name in a variable, use that name for the work, then remove the file when finished.

A fixed name such as /tmp/results.txt can already belong to someone else or be created before your program starts. A unique name avoids that collision. The sticky bit does not make predictable names safe and does not make a mode-644 file private.

A link gives a file another route through the directory tree. A symbolic link stores a path. A hard link supplies another name for the same underlying file. Their different behavior matters when the original name moves or disappears.

Create a symbolic link

The syntax is ln -s TARGET LINKNAME: target first, new name second. For example:

ln -s /srv/manuals ~/manuals
ls -ld ~/manuals
readlink ~/manuals

ls -l starts a symbolic link's permission string with l and prints an arrow to its target. Its displayed size is the byte length of the stored path, not the size of the target directory. For ordinary Linux symlinks, the displayed rwxrwxrwx permissions do not grant access to the target; the target's own permissions still apply.

ls -ld /etc lists the directory entry and permissions. ls -l /etc lists its contents. A trailing slash on a directory symlink follows it: ls -l manuals/ lists the linked directory's contents.

Resolve a relative target

A relative target starts from the directory containing the link. Suppose /home/lee/notes.txt exists and /home/lee/backup is a directory. From /home/lee, run:

ln -s ../notes.txt backup/notes-link

To follow the link, start inside backup, move up with .., then find notes.txt. Writing ln -s notes.txt backup/notes-link instead stores a path to backup/notes.txt. Your working directory when creating the link does not become part of that stored relative path. An absolute target avoids this particular ambiguity.

A dangling link remains after its target path is moved or deleted. Opening it fails with "No such file or directory." readlink LINK shows the stored target; readlink -f LINK resolves the full path when it can. find . -xtype l locates broken links below the current directory. Recreate a broken link with the right target, for example ln -sfn NEWTARGET LINKNAME.

Compare with a hard link

printf 'hello\n' > original.txt
ln original.txt second.txt
ln -s original.txt shortcut.txt
rm original.txt

cat second.txt still prints "hello." A hard link is another directory entry for the same inode, the filesystem's file record. There is no special original name that must remain. cat shortcut.txt fails because its stored target path no longer exists.

ls -i shows the same inode number for two hard links on one filesystem. The second column of ls -l shows their link count. Removing the last name releases the file once no process still holds it open.

Remove a symlink with rm LINKNAME or unlink LINKNAME. For a directory link, leave off the trailing slash: rm manuals removes only the link. A recursive command on manuals/ can reach and delete the target's contents. System paths such as /bin, versioned command names and enabled systemd services often use symlinks.

A path in Linux can name a disk, a terminal or live kernel information. The first character in ls -l tells you the kind of entry before you treat it like an ordinary document.

Recognize file types

The markers are - for a regular file, d for a directory, l for a symbolic link, b for a block device, c for a character device, p for a named pipe and s for a socket. A block device, such as /dev/sda1, provides storage in blocks that can be accessed in any order. A character device, such as /dev/tty1, provides a byte stream.

A device listing can look like this:

brw-rw---- 1 root disk 8, 1 Oct 22 08:00 /dev/sda1

The b identifies a block device. The numbers 8, 1 replace the ordinary size field: the major and minor numbers identify the driver and device to the kernel. /dev is normally provided in memory by devtmpfs and populated as hardware appears, with help from udev. Plugging in a USB drive can create /dev/sdb and /dev/sdb1.

Writing to a disk device directly can overwrite its data without a confirmation question. Check the device's identity with lsblk before any such write.

Use pseudo-devices

/dev/null discards written bytes and immediately returns end of file when read. This command hides error messages while leaving normal results visible:

find / -name '*.conf' 2>/dev/null

The 2> redirects standard error. Anything sent there is discarded.

/dev/zero supplies zero bytes. For example, dd if=/dev/zero of=test.img bs=1M count=100 creates a regular 100 MiB file of zeros: 104,857,600 bytes. The output here is test.img, not a disk device. /dev/urandom supplies random bytes; head -c 16 /dev/urandom | base64 makes 16 of them printable.

Once Linux's random generator is initialized, both /dev/random and /dev/urandom provide cryptographically secure random bytes. On kernels from 5.6 onward, /dev/random waits for that initialization early in boot; /dev/urandom can return bytes before it finishes.

Read live information

procfs, mounted at /proc, creates information on demand. Many entries show a size of zero yet return text when read. /proc/cpuinfo describes processors, /proc/meminfo describes memory, and /proc/mounts lists mounts. Numbered directories describe running processes; /proc/sys exposes kernel settings. Tools such as ps, top and free read this information.

cat /proc/uptime might print 86400.52 340000.10. The first value is seconds since boot: about 24 hours. The second adds idle time across processors, so it can exceed elapsed time.

sysfs, mounted at /sys, describes devices, drivers and buses. ls /sys/class/net/ lists interfaces, ls /sys/block/ lists block devices, and cat /sys/class/net/enp0s3/address reads one interface's MAC address. Writing to writable settings under /proc or /sys changes the running kernel and normally needs root. When making a whole-system backup, configure exclusions for /proc, /sys, /dev and /run; the running system recreates them.

A disk is a storage device, physical or virtual. A partition is a region of it. The partition table records those regions, while a filesystem inside a partition organizes its files and directories. A partition can also hold swap, which supports memory instead of storing ordinary files.

Decode the device name

SATA, SAS and USB drives commonly use /dev/sda, /dev/sdb and so on; their partitions add a number, such as /dev/sdb1. NVMe names already contain digits, so a partition adds p: /dev/nvme0n1p2 is partition 2 of /dev/nvme0n1. SD and eMMC devices use names such as /dev/mmcblk0p1; many virtual machines use /dev/vda1.

Detection order can change these names. Identify a drive by several clues, not yesterday's letter:

lsblk -o NAME,SIZE,MODEL,RM,TYPE,MOUNTPOINTS
lsblk -f
sudo blkid
sudo fdisk -l

lsblk displays the disk and its partitions as a tree. RM=1 identifies a device marked removable; TYPE distinguishes disk and part. A mount point of / identifies the root filesystem. lsblk -f adds filesystem types, labels and UUIDs. blkid provides identifiers and types, while fdisk -l shows partition boundaries and the table type. These inspection commands do not repartition anything.

Separate table type from filesystem type

MBR allows four primary partitions; one can be an extended partition containing logical partitions numbered from 5. With 512-byte sectors, its addressing limit is 2 TiB. GPT handles larger drives and commonly provides 128 partition entries. UEFI systems boot using an EFI System Partition, formatted with FAT and often mounted at /boot/efi.

Debian and Ubuntu commonly use ext4; RHEL uses XFS by default; Fedora Workstation and openSUSE commonly use Btrfs. FAT32 appears as vfat in Linux and cannot hold a single file of 4 GiB or more. exFAT suits larger removable-media files; NTFS is common on Windows disks. A partition's existence alone does not mean it already has a filesystem.

Read the size units

lsblk, df -h and du -h use binary units: G represents a GiB, or 1,073,741,824 bytes. Drive makers use decimal GB, each containing 1,000,000,000 bytes. Thus a drive holding 500,107,862,016 bytes appears as 465.8G; 32,000,000,000 bytes is about 29.8G. lsblk -b shows exact byte counts. This difference in labels is not lost capacity.

Preparing a new empty drive requires a partitioning step followed by filesystem creation, for example sudo mkfs.ext4 /dev/sdb1. Before changing partitions or formatting, verify the target by size, model and removable status, confirm that its data may be destroyed, and unmount it. fdisk -l only lists; interactive fdisk writes changes when you use w.

Mounting attaches a filesystem to a directory, its mount point. A filesystem mounted at /data becomes accessible through paths such as /data/report.pdf. The directory tree stays continuous even when several disks supply its contents.

Mount and inspect

Suppose lsblk -f identifies /dev/sdb1 as the filesystem you want to read. Make an empty mount directory, then mount it:

sudo mkdir -p /mnt/usb
sudo mount /dev/sdb1 /mnt/usb
findmnt /mnt/usb

mount usually detects the type. Supply -t ext4 when you need to name it explicitly. findmnt shows TARGET, SOURCE, FSTYPE and OPTIONS. mount without arguments lists mounts, including virtual filesystems; df -h reports their space, and lsblk shows mount points beside block devices.

Mounting over a directory hides its existing contents. If /mnt/usb/local.txt was there first, it disappears from view while the USB filesystem is mounted and reappears after unmounting. It was not copied to the drive or erased.

Choose options for the job

Use -o for a comma-separated option list. sudo mount -o ro /dev/sdb1 /mnt/usb disallows normal file writes through this mount. It is useful for inspection, though mounting itself can still write to the device. rw permits writes.

noexec prevents direct execution of files on the mount. It does not stop an interpreter from reading a script: bash /mnt/usb/script.sh can still run a readable script. Treat this as a direct-execution restriction, not a complete barrier to running its contents.

FAT and exFAT do not store Unix owners. When root mounts such a drive, supply the desired owner through mount options. Check both IDs with id -u and id -g. If both print 1000:

sudo mount -o uid=1000,gid=1000 /dev/sdb1 /mnt/usb
cp report.pdf /mnt/usb/

This assigns Linux's displayed ownership for the mount. Changing permissions with chmod is not the same ownership mechanism as on ext4.

Finish the work

Leave the filesystem and close programs using it, then run:

sudo umount /mnt/usb

The spelling is umount. Detach removable storage before pulling it out so buffered writes reach the drive. A file manager's Eject action performs this job on a desktop.

If the command reports "target is busy," a process still uses the filesystem. A shell whose current directory is /mnt/usb is enough. Run cd in that shell, close open files, and try again. fuser -vm /mnt/usb or lsof /mnt/usb helps identify users of the filesystem.

Desktop systems normally arrange automatic removable-media mounts through udisks2, under /media/USER/LABEL or Fedora's /run/media/USER/LABEL. Servers generally rely on configured boot mounts or manual commands. Mounts can also expose a file image, memory or a network share. For example, after creating /mnt/iso, sudo mount -o loop,ro ubuntu.iso /mnt/iso presents an ISO image as a directory.

A manual mount does not create a boot rule. /etc/fstab supplies those rules, one entry per filesystem or swap area. On a systemd machine, a generator turns filesystem entries into mount units and swap entries into swap units.

Read all six fields

An ext4 data filesystem can use this entry:

UUID=3f2c9a1e-7b4d-4e8a-9c61-2d5f0b8e4a17 /data ext4 defaults,nofail 0 2

Spaces or tabs separate the six fields. Commas join options within one field; do not put spaces inside that list.

1. Source: a UUID, label or device path.
2. Mount point: here, /data.
3. Type: here, ext4.
4. Options: here, defaults,nofail.
5. Dump flag: normally 0, disabling the old dump backup flag.
6. Filesystem check order: 1 for root, 2 for other filesystems that need checking, 0 to skip; XFS and Btrfs normally use 0.

A line beginning with # is a comment. A swap entry uses none as its mount-point field, type swap, and commonly ends in 0 0.

Choose a lasting identifier

Find the filesystem UUID with lsblk -f or sudo blkid. Unlike a name such as /dev/sdb1, the UUID stays with the filesystem when drive detection order changes. Reformatting creates a new filesystem with a new UUID, so update its fstab entry afterward.

defaults includes read-write access and automatic mounting. nofail allows boot to continue if an optional drive is absent. noauto skips automatic mounting; the entry can still support sudo mount /data later. ro means read-only and noexec blocks direct execution. user permits an ordinary user to mount the entry.

Add and test an entry

For an already prepared ext4 data partition:

sudo cp /etc/fstab /etc/fstab.bak
lsblk -f
sudo mkdir -p /data

Edit /etc/fstab to add the line using the UUID actually reported. Then test before rebooting:

sudo findmnt --verify
sudo systemctl daemon-reload
sudo mount -a
findmnt /data

findmnt --verify checks the table, including problems with its fields and sources. The reload makes systemd reread the changed configuration. mount -a mounts eligible entries that are not already mounted. findmnt /data then confirms the source, type and current options. A successful mount -a does not mean a noauto entry was tested; mount that entry explicitly.

The root of a newly mounted ext4 filesystem may belong to root. Once the correct filesystem is mounted, sudo chown lee:lee /data gives Lee ownership of that directory. Doing this before mounting would change the underlying mount-point directory instead.

A wrong UUID, wrong type or unavailable required device can interrupt boot and leave the system in emergency mode. Correct such errors while the system is running. systemctl list-units --type=mount shows the resulting active mount units.

df reports space for mounted filesystems. It answers "How full is the filesystem containing this path?" It does not add up a directory's own files. That difference lets you identify the affected storage before searching for its largest contents.

Read a space report

Use df -h /var/log to inspect the filesystem containing the log directory. A report might show:

Filesystem Size Used Avail Use% Mounted on
/dev/vda1   98G  61G   32G  66% /
/dev/vdb1  916G 210G  660G  25% /data

Here, logs under /var/log use the root filesystem unless a separate filesystem is mounted there. The /data filesystem's free space cannot help a write to /var/log simply because both belong to one computer.

The columns describe the filesystem's size, used space, space available to ordinary users, usage percentage and mount point. GNU df calculates Use% from Used divided by Used plus Avail, rounded up. For the root example, 61 divided by 93 is about 65.6%, displayed as 66%. Human-readable figures themselves are rounded.

Size can exceed Used + Avail. An ext4 filesystem normally reserves 5% of its blocks for root, helping essential services keep working when users fill the rest. Five percent of 98G is about 4.9G. Those unused reserved blocks are excluded from ordinary-user Avail; they are not file data in Used. The reserve can be adjusted with tune2fs -m, such as to 1% for a large data filesystem. Metadata also uses space.

Choose a useful view

df -h uses binary K, M and G units. df -H uses decimal powers of 1000. Plain df normally reports 1024-byte blocks, and df -T adds the filesystem type. To reduce clutter from memory filesystems:

df -h -x tmpfs -x devtmpfs

A tmpfs entry is memory-backed storage, while efivarfs exposes firmware variables. free measures RAM and swap, so it cannot replace df for disk capacity. lsblk tells you how large a disk or partition is, not how much free space its filesystem has.

Check the file records too

An inode is a filesystem record for a file or directory. Hard-linked names share one record. An ext4 filesystem has a fixed supply of inodes created with the filesystem. Very many tiny files can consume them while leaving gigabytes of data space unused.

df -i /var/log

Read IUsed, IFree and IUse%. If IFree is zero, making a new file can fail with "No space left on device" even when df -h shows free space. Removing a few large files releases blocks but very few inodes; cleaning up many unwanted session or cache files addresses inode exhaustion.

When root storage fills, databases may stop, logs fail, updates break and logins can fail. Check both df -h PATH and df -i PATH early. The reports identify which resource is exhausted and which mounted filesystem needs attention.

Once df identifies the full filesystem, use du to find the directories using it. Inspect before deleting: application state and replaceable cache files can be large for very different reasons.

Work down the directory tree

sudo du -h -d 1 /var | sort -h
sudo du -sh /var/log

-d 1 gives totals one directory level down, and -s prints one summary total. sort -h understands sizes such as 900M and 2.1G. Use sudo to include directories your ordinary account cannot read. If /var/log is large, repeat the first command there to locate its growing subdirectory.

du -sh * skips names beginning with a dot because the shell's * does not match them. du -h -d 1 ~ | sort -h includes hidden directories, such as .cache and .local, while inspecting a home directory.

To locate large individual files on the root filesystem:

sudo find / -xdev -type f -size +500M 2>/dev/null

-xdev stays on the starting filesystem; -type f selects regular files; M here means MiB. ls -lhS sorts one directory's files from largest to smallest.

Understand different totals

ls -l reports a file's logical length. du normally counts allocated storage. A file containing "hi" and a newline is 3 bytes long but may occupy one 4 KiB block, shown as 4.0K. A sparse virtual-disk image can have a long logical length while consuming much less actual space. du --apparent-size reports logical lengths instead.

A higher df usage than a directory scan can also come from unreadable directories, files hidden beneath mount points, or deleted open files. Deleting a name does not release the data while a process keeps the file open.

For example, removing a 20G live application log may leave df unchanged. Inspect such files with sudo lsof +L1. Restarting the owning service releases its open file, allowing the storage to be freed. To empty a known disposable active log without leaving an unlinked open file, sudo truncate -s 0 /var/log/app/app.log keeps the name and file in place. This erases its recorded contents.

Use the owner of the data to clean it

Package tools know which downloaded files can be replaced. Use sudo apt clean on Debian or Ubuntu, or sudo dnf clean all on Fedora or RHEL. Review proposed changes from apt autoremove or dnf autoremove before removing unused packages. Clear your own unwanted downloads and trash. Do not hand-delete files from /usr, /boot or /var/lib to make room.

For journal growth, sudo journalctl --vacuum-size=1G removes old archived journal files until their total fits the limit. Active files can leave overall journal use above that size. For lasting control, set SystemMaxUse=1G in /etc/systemd/journald.conf and restart systemd-journald.

After cleanup, rerun df -h PATH or df -i PATH to confirm that the resource which caused the failure is available again. If the journal or another log repeatedly grows, inspect the messages causing the growth as well as its retention settings.

A network interface is a connection point through which the kernel sends traffic. It can be Ethernet, Wi-Fi, loopback or a virtual connection such as a VPN. Names such as enp0s3, eno1 and wlp2s0 describe physical adapters; lo is loopback. Some virtual and cloud systems use eth0.

Read IPv4 and its prefix

Ethernet and Wi-Fi interfaces have a 48-bit MAC address, written as six hexadecimal pairs, used for delivery on the local network. An IP address identifies a host for communication across networks. One interface can have several IP addresses.

IPv4 has 32 bits, written as four numbers from 0 to 255. In 192.168.1.50/24, the first 24 bits identify the network and eight bits remain for addresses within it. The network is 192.168.1.0/24, with netmask 255.255.255.0.

Those eight bits provide 256 addresses. The first names the network, and the last, 192.168.1.255, is its broadcast address, leaving 254 host addresses. A /26 has six host bits: 64 total addresses and 62 ordinary host addresses. /24 counts network bits, not machines.

The private ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. They are not publicly routed; a home router commonly uses NAT to translate private traffic to its public address. 127.0.0.1 is loopback, meaning the machine running the command. A 169.254.x.x link-local address often points to failed DHCP configuration. Documentation uses 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24.

Recognize IPv6

IPv6 has 128 bits in eight hexadecimal groups. Remove leading zeros within a group and replace one run of zero groups with ::: 2001:0db8:0000:0000:0000:0000:0000:0042 becomes 2001:db8::42. Use :: only once in one address. ::1 is loopback; fe80: addresses are link-local on IPv6-enabled Ethernet and Wi-Fi links. Local IPv6 networks commonly use /64, and one host often has several addresses.

Reach networks and services

A host sends traffic directly to destinations on a directly connected network. Its default gateway handles destinations for which there is no more specific route. The gateway is a router reachable on the local link. Without a matching route or default route, other networks are unreachable.

A port identifies a service at an address: SSH uses TCP 22, DNS uses UDP and TCP 53, HTTP uses TCP 80 and HTTPS commonly uses TCP 443. TCP provides reliable connections; UDP carries independent messages. A socket endpoint combines an address and port, such as 192.168.1.50:22.

Learn or set the configuration

DHCP for IPv4 leases an address, prefix, gateway and DNS settings. Static configuration sets fixed values, commonly for servers. IPv6 SLAAC forms an address from router-advertised information. DHCPv6 can supply IPv6 addresses and DNS servers; IPv6 default-router information comes from router advertisements. A DHCPv6 address alone does not supply that route.

The ip command shows the network's current state. Its objects describe different parts: addr for addresses, link for interface state, route for routing and neigh for local neighbors. ss shows sockets and their listening services.

Inspect an interface

ip -br addr
ip addr show dev enp0s3
ip link show

The brief view might show enp0s3 UP 192.168.1.50/24 fe80::a00:27ff:fe3a:5c71/64. The interface is up, with one IPv4 address and one IPv6 link-local address. The longer output separates these fields:

link/ether 08:00:27:3a:5c:71 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.50/24 brd 192.168.1.255 scope global dynamic enp0s3
inet6 fe80::a00:27ff:fe3a:5c71/64 scope link

link/ether gives the MAC address. inet introduces IPv4, and inet6 introduces IPv6. The IPv4 brd value is the broadcast address, not the gateway. dynamic indicates a dynamically assigned address, and valid_lft shows how long it remains valid. UP is administrative state; LOWER_UP indicates a working lower-level link.

ip -4 addr and ip -6 addr select an address family. ip link omits IP addresses. hostname -I prints the machine's configured addresses. Do not select 127.0.0.1 when giving another computer an address for this host.

Read the route separately

default via 192.168.1.1 dev enp0s3 proto dhcp src 192.168.1.50 metric 100
192.168.1.0/24 dev enp0s3 proto kernel scope link src 192.168.1.50 metric 100

ip route show produces this kind of output. The local 192.168.1.0/24 network is directly reachable through enp0s3. Other destinations use gateway 192.168.1.1 under the default route. proto dhcp indicates where that route came from; src supplies the preferred source address.

Use ip route get 203.0.113.10 to inspect the selected path to one destination. ip -6 route show lists IPv6 routes. ip neigh shows learned local IP-to-MAC mappings; a FAILED gateway entry means neighbor resolution did not receive the needed local reply.

Check where a service listens

sudo ss -tulnp

The flags mean TCP, UDP, listening, numeric addresses and process details. Read the local address column. 0.0.0.0:22 accepts traffic on all local IPv4 addresses, while 127.0.0.1:5432 is local-only. [::]:80 names all IPv6 addresses. Listening is only one requirement; network reachability and access rules still matter. ss -tn lists current TCP connections without selecting listeners only.

Older guides use ifconfig, route, arp and netstat. Their current counterparts are ip addr/ip link, ip route, ip neigh and ss. Missing ifconfig is a missing tool, not a failed network. Short forms such as ip a, ip r and ip l are accepted abbreviations.

A temporary command and a saved network profile serve different purposes. ip changes the running kernel state immediately; the distribution's network manager restores saved settings at boot and may replace temporary changes sooner.

Make a temporary change

On a practice interface named enp0s8:

sudo ip link set dev enp0s8 up
sudo ip addr add 192.168.50.10/24 dev enp0s8
sudo ip route add default via 192.168.50.1

Include the prefix. Without /24, an added IPv4 address gets /32, so the expected route to the local /24 network is absent. ip addr del removes the specified address, ip route del default removes the default route, and ip link set ... down disables the interface.

Changing the interface carrying a remote SSH session can disconnect you. Use console access or a configuration tool with rollback for that work.

Save settings with the active manager

Fedora, RHEL and many desktops use NetworkManager. Find the profile with nmcli device status, then modify its connection name:

sudo nmcli connection modify "Wired connection 1" ipv4.method manual ipv4.addresses 192.168.1.60/24 ipv4.gateway 192.168.1.1 ipv4.dns 192.168.1.1
sudo nmcli connection up "Wired connection 1"

Setting ipv4.method auto returns the profile to DHCP. Ubuntu commonly uses netplan YAML under /etc/netplan/; other systems use systemd-networkd's .network files or Debian ifupdown's /etc/network/interfaces. Cloud systems often rely on DHCP and cloud-init.

A netplan static configuration can read:

network:
  version: 2
  ethernets:
    enp0s3:
      dhcp4: false
      addresses: [192.168.1.60/24]
      routes:
        - to: default
          via: 192.168.1.1
      nameservers:
        addresses: [192.168.1.1]

Use spaces for indentation. sudo netplan try applies the configuration with a 120-second confirmation window before rollback. sudo netplan apply applies it directly.

Test one layer at a time

Start with ip -br link, then ip -br addr, then ip route. No active link, no suitable address and no default route are different faults. Test the gateway with ping -c 3 192.168.1.1, then an external address, then a name. The -c count makes Linux ping stop after a fixed number of requests; otherwise use Ctrl+C.

A reply reports round-trip time, while the summary reports packet loss. No echo reply can reflect ICMP filtering as well as a down host or broken route. If an address works but a name produces "Temporary failure in name resolution," inspect name lookup. If ping prints the resolved address and then gets no replies, lookup already succeeded.

tracepath or traceroute shows responding routers along the path. Test the actual application too: curl -I https://example.com asks for HTTP headers. If a local web request succeeds but remote ones fail, inspect sudo ss -tlnp. A service bound to 127.0.0.1:80 needs a network-facing bind address for remote use, as well as the necessary network access rules.

Names let people use web1.example.com instead of remembering an address. DNS, the Domain Name System, stores records in a distributed hierarchy of domains. A short hostname such as web1 names a machine; its fully qualified domain name identifies it within the full hierarchy.

Recognize what a record answers

DNS servers use port 53 over both UDP and TCP. A record's time to live (TTL) tells caches how long they may keep it, in seconds. A TTL of 3600 is one hour. Changing a record does not instantly remove the older answer from every cache.

The resolver is the client side of name lookup: library code and often a service such as systemd-resolved. Its configured nameservers are typically recursive resolvers operated by a router, provider, organization or public service. They find answers and cache them for clients.

Check the system's source order

Linux applications generally use the lookup sources configured by the hosts: line in /etc/nsswitch.conf. A simple example is:

hosts: files dns

Here files means /etc/hosts, checked before DNS. Other installations include sources such as resolve or mdns4_minimal. Read the actual line when comparing two systems.

/etc/hosts contains an address followed by its main name and optional aliases:

127.0.0.1 localhost
::1 localhost ip6-localhost
192.168.1.20 nas.home.arpa nas

With the shown lookup order, nas resolves to 192.168.1.20 on this computer. home.arpa is reserved for home networks. Hosts-file changes take effect without rebooting, but they affect only the machine whose file you edit. The file does not accept wildcards or port numbers: 192.168.1.20:8080 nas is invalid.

Use local entries deliberately

A hosts-file entry can name a device on a small network or point your computer to a replacement web server before public DNS changes. Mapping a name to 0.0.0.0 is also used to block it locally. Each use changes address lookup, not the service's port or configuration.

Suppose a website moves and works on other machines but not yours. An old /etc/hosts entry can keep sending your browser to its previous address even when DNS is correct. Compare the local entry with the current intended destination before changing network routes.

The machine's own hostname is a separate setting. hostname prints it; sudo hostnamectl set-hostname web1 changes it. /etc/hostname stores the configured name. Debian and Ubuntu commonly also map it in /etc/hosts, for example 127.0.1.1 web1. After a rename, update that mapping too. A mismatch can cause the warning "unable to resolve host web1" when using sudo. Changing your hostname does not create a public DNS record for it.

Use a test that matches the question you are asking. A direct query checks a DNS server's answer. A system lookup checks the sources Linux applications normally use, which may include local files as well as DNS.

Read the resolver configuration

/etc/resolv.conf can contain nameserver 192.168.1.1 and search example.com. The nameserver line identifies a DNS server; the search suffix lets a short name such as web1 be tried as web1.example.com. The traditional resolver uses up to three configured nameservers, normally in order. Options can tune timeout and retry behavior.

This file is often generated by a network service. A comment or symlink reveals the owner. Changes made directly can disappear at the next network update, so change saved DNS values through NetworkManager, netplan or the active manager.

On a system using systemd-resolved, the file commonly links to /run/systemd/resolve/stub-resolv.conf and names 127.0.0.53. That is a local DNS stub, not an external server accidentally replaced with loopback. It forwards queries and caches answers. Use:

resolvectl status
resolvectl query example.com
resolvectl flush-caches

The first shows real upstream DNS servers, including per-interface settings. Flush the cache when you need to discard cached results while investigating a change.

Choose the lookup tool

host web1.example.com asks DNS for a name. host 203.0.113.10 performs a reverse lookup; host -t MX example.com requests mail records. dig example.com A +short prints a compact IPv4 answer, and dig @1.1.1.1 example.com A explicitly selects a DNS server. nslookup is an older DNS-query tool. The tools are commonly packaged as dnsutils or bind-utils.

getent hosts nas follows the system lookup order from /etc/nsswitch.conf, as most applications do. dig, host and nslookup do not read /etc/hosts themselves. However, querying systemd-resolved's stub can return an answer that the service obtains from that file. Select a known upstream server explicitly when you want to compare its DNS data with local lookup.

Interpret the result before changing settings

NXDOMAIN means the queried DNS server answered that the name does not exist. SERVFAIL means the server could not complete the lookup. A timeout means no usable reply arrived before the deadline. "Name or service not known" from a program is a system lookup error, not a DNS response code by itself.

Suppose ping to an external address succeeds, but lookup of example.com reports a temporary failure. Inspect the configured resolver and compare a direct query to it with a query to another known resolver. A valid answer from the second server narrows the problem toward the configured server, its path or local resolver settings. If both fail, distinguish actual error replies from timeouts before blaming a firewall. DNS traffic and ICMP ping are different traffic, even when they use the same network.

SSH, Secure Shell, encrypts remote sessions and file transfers. The ssh client connects to sshd, normally on TCP port 22. OpenSSH is the usual Linux implementation. Older tools such as telnet and FTP expose passwords as plain text.

Verify and enter the remote session

Connect with ssh lee@web1.example.com; omit lee@ to use your local username. For a different port, use ssh -p 2222 lee@web1.example.com. Check the remote machine's identity before running commands; exit or Ctrl+D returns to the local shell.

On first contact, SSH displays a host-key fingerprint. Compare it through a trusted route with the server administrator or provider. The administrator can print it with ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub. Accepting it stores the key in your ~/.ssh/known_hosts file for later comparison.

A changed-host-key warning means the presented identity differs from the saved one. A rebuild or reused address can explain it, but so can an attacker. Verify the new fingerprint first. Once the change is confirmed, ssh-keygen -R 203.0.113.10 removes the old entry for that address so you can connect and record the new one.

Run a command without staying logged in

ssh lee@web1.example.com 'df -h /'

The command runs remotely, its output appears locally, and the connection ends. A following local pipe can process that output. Programs needing a terminal, including interactive sudo, can use ssh -t, for example ssh -t lee@web1.example.com sudo systemctl restart nginx.

Choose a transfer tool

scp report.pdf lee@web1.example.com:/home/lee/ uploads a file. scp lee@web1.example.com:/home/lee/results.csv . downloads into the current local directory. The colon marks the remote path; without it, lee@web1.example.com is a local filename. -r copies directories, and -P 2222 selects a port, with a capital P. Modern scp uses SFTP underneath.

sftp lee@web1.example.com opens an interactive session. Use get to download, put to upload, cd for the remote directory, lcd for the local one, and bye to finish. For repeated directory copies, rsync -av site/ lee@web1.example.com:/srv/site/ sends changes over SSH; rsync must be installed at both ends.

Store repeated connection details in ~/.ssh/config:

Host web1
    HostName 203.0.113.10
    User lee
    Port 2222
    IdentityFile ~/.ssh/id_ed25519

Then ssh web1 and scp notes.txt web1: use those settings.

Read the failure stage

"Connection refused" indicates an active rejection, commonly no listener on the chosen port. A timeout means no answer arrived; possible causes include routing, filtering or a down host. "Permission denied (publickey)" means the connection reached authentication but your account or offered key was not accepted. ssh -v shows progress through connection and authentication so you can investigate the stage that failed.

Key login proves that your client holds a private key corresponding to an authorized public key. The client signs authentication data; it does not send the private key to the server. The two files therefore have different destinations and protection needs.

Generate and protect the pair

On your own computer:

ssh-keygen -t ed25519 -C "lee@laptop"

Choose a passphrase when prompted. The default files are ~/.ssh/id_ed25519, the private key, and ~/.ssh/id_ed25519.pub, the public key. The -C text is an identifying comment. Ed25519 has been ssh-keygen's default since OpenSSH 9.5; explicitly naming it makes the example clear. For an older server requiring RSA, ssh-keygen -t rsa -b 4096 generates a 4096-bit RSA key.

A passphrase encrypts the private key file. It protects the stored key if someone obtains the file; it is different from the remote account password. Automated jobs sometimes use keys without passphrases, with limited account rights. Keep the private key on the client and secret.

An SSH agent holds unlocked keys in memory so you do not reenter the passphrase for every connection. Desktop sessions commonly start an agent. Add the key with ssh-add ~/.ssh/id_ed25519 and enter its passphrase when requested.

Authorize the public key on one account

ssh-copy-id lee@web1.example.com

After authenticating to Lee's server account, the command appends a public key to that account's ~/.ssh/authorized_keys. If several client keys exist, ssh-copy-id -i ~/.ssh/id_ed25519.pub lee@web1.example.com explicitly selects the public key. Cloud provisioning can install it when the server is created.

Each authorized_keys line contains a key type, encoded public-key data and usually a comment. Several keys can authorize separate devices or people. A key in Lee's file grants access to Lee's account, not root's account. Removing its line revokes that key there; after a leak, remove its public key from every affected server.

Check ownership and permissions

On the server, in the intended account:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Keep the home directory from being writable by group or others. With normal strict checks, sshd rejects unsafe writable authorization files or parent directories. On the client, mode 600 protects the private key; overly open permissions can produce "UNPROTECTED PRIVATE KEY FILE!" The public .pub file can be readable at mode 644.

Confirm the login path

Open a fresh connection with ssh lee@web1.example.com. A passphrase prompt unlocks the local private key; an already loaded agent can make that unnecessary. In verbose output, look for successful authentication using "publickey."

If login fails, check the account name first, then its public-key entry, ownership and permissions, then the offered client key. ssh -i ~/.ssh/other_key lee@web1.example.com selects a particular private key; IdentityFile makes that selection part of a saved host configuration. Generating another key does not repair a missing authorization entry for the existing one.

The server program is sshd, provided by openssh-server. Debian and Ubuntu call its systemd service ssh; Fedora, RHEL, openSUSE and Arch generally call it sshd. Use the name your distribution provides when checking status, enabling or reloading the service.

Locate the effective configuration

Install with sudo apt install openssh-server or sudo dnf install openssh-server. For a Fedora or RHEL service, sudo systemctl enable --now sshd starts it and enables startup at boot. systemctl status sshd reports its state.

The server reads /etc/ssh/sshd_config. /etc/ssh/ssh_config is for the client. Many systems include /etc/ssh/sshd_config.d/*.conf near the beginning of the server file. For most directives, the first value read wins. Appending a different value to the bottom of the main file may have no effect.

Use sudo sshd -T to print effective settings. If it shows passwordauthentication yes despite a later no, check included files. On an Ubuntu cloud image, 50-cloud-init.conf can supply the earlier value. An earlier applicable file such as 10-no-passwords.conf, or a change to the controlling setting, must be followed by validation and reload.

Require the intended authentication

After key login works, these settings establish key-only access:

PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
AuthenticationMethods publickey
PermitRootLogin no

The first enables keys. The next two disable password and keyboard-interactive methods, which can both accept passwords. AuthenticationMethods publickey explicitly requires public-key authentication. PermitRootLogin no blocks root SSH login; administrators log in as themselves and use sudo. The default prohibit-password is different: it still permits root key login. AllowUsers lee deploy can restrict which accounts may enter.

Apply and test safely

Keep the working session open, and confirm key login in a second terminal before removing password access. After editing:

sudo sshd -t
sudo systemctl reload sshd

Use reload ssh on Debian or Ubuntu. sshd -t prints nothing on a valid configuration; correct errors before reloading. A reload keeps existing sessions, so a new connection is the test of the changed policy. Keep the old session until that test succeeds.

Check access and logs

journalctl -u sshd or journalctl -u ssh shows attempts. Traditional log files include /var/log/auth.log on Debian/Ubuntu and /var/log/secure on RHEL. Repeated invalid-user password attempts are common on internet-facing servers; key-only access removes password guessing as a login route.

Permit the SSH service through the active firewall: Ubuntu's sudo ufw allow OpenSSH, or Fedora/RHEL's sudo firewall-cmd --permanent --add-service=ssh followed by sudo firewall-cmd --reload. A cloud provider's rule must also permit the listening port. Moving SSH to port 2222 can reduce scan noise, but keys, restricted login and OpenSSH updates provide the real protection.