Day 2 - Configuration File Paths and Key Directives: Precise Memorization for Fill-in-the-Blank Questions

📌 Key Points

• The second hurdle of the practical exam is filling in blanks in configuration files. One wrong path, one wrong field order, or one misspelled directive costs you the points.
• Field counts of the three core account files: passwd 7 / shadow 9 / group 4. In shadow, the 4th field is the minimum change interval and the 5th is the maximum number of days of use.
• /etc/fstab has 6 fields. The 5th is the dump backup flag, and the 6th is the fsck check order (root=1, others=2, no check=0).
• The crontab time fields are minute-hour-day-month-weekday. Only /etc/crontab has an additional field for the user to run as.
• Write kernel parameters in /etc/sysctl.conf and apply them with sysctl -p. Default password policy for new accounts is set by the PASS_* directives in /etc/login.defs.
• Networking: the static name-to-IP mapping is /etc/hosts, and DNS servers are specified with nameserver in /etc/resolv.conf.

The Three Core Account Management Files: passwd / shadow / group

• Linux user account information is split across three files.
• You must memorize the paths and field structures as a whole.

# /etc/passwd - basic user account info (7 colon-separated fields)
root:x:0:0:root:/root:/bin/bash
#  1 2 3 4  5    6      7
# 1.username 2.password (x = uses shadow) 3.UID 4.GID
# 5.description (GECOS) 6.home directory 7.login shell

# /etc/shadow - encrypted password + policy (9 colon-separated fields)
alice:$6$xyz...:19700:0:90:7:14::
#  1     2        3   4  5 6  7  8 9
# 1.username 2.encrypted password 3.last change date (days since 1970)
# 4.minimum days 5.maximum days 6.warning days
# 7.inactivity days 8.account expiration date 9.reserved field

/etc/passwd has 7 fields and /etc/shadow has 9 fields. The second field x in passwd indicates "the real password is in shadow". UID 0 is always root.

# /etc/group - group info (4 colon-separated fields)
staff:x:1001:alice,bob
#  1   2  3     4
# 1.group name 2.group password (x) 3.GID 4.group members (comma-separated)
 
# /etc/gshadow - encrypted group info

⚠️ Trap: The 5th field of shadow is the "maximum days of use" and the 4th is the "minimum change interval". If you memorize the order the wrong way around, you will get the fill-in-the-blank wrong. Also, if the 7th field (shell) of /etc/passwd contains /sbin/nologin or /bin/false, it means the account is blocked from logging in.

$6$ in the 2nd field of shadow means a SHA-512 hash. $1$ is MD5, $5$ is SHA-256, and $6$ is SHA-512. If the field starts with * or !, that account's password login is locked.

Disk Mount File: /etc/fstab

• /etc/fstab defines the filesystems to be mounted automatically at boot.
• The order of its 6 fields is tested.

# /etc/fstab - automatic mount configuration (space/tab separated, 6 fields)
/dev/sda1   /        ext4    defaults        0 1
UUID=abc... /home    ext4    defaults        0 2
/dev/sdb1   /data    xfs     defaults,noatime 0 2
/swapfile   none     swap    sw              0 0
tmpfs       /tmp     tmpfs   defaults        0 0

The 6th field of fstab is the fsck check order. The root filesystem (/) must be 1, others are 2, and anything not to be checked is 0. The 5th field is the dump backup flag. It is easy to mix up the meanings of these two numeric fields.

The mount option defaults bundles rw,suid,dev,exec,auto,nouser,async. ro (read-only), noexec (no execution), nosuid (ignore SetUID), and noatime (do not record access time, better performance) are used often. For swap, use sw in options and swap as the type.

Job Scheduling: crontab-Related Files

# System crontab
/etc/crontab              # system-wide cron configuration (has a user field)
/etc/cron.d/              # directory of additional cron job fragment files
/etc/cron.daily/          # scripts run daily
/etc/cron.hourly/         # scripts run hourly
/etc/cron.weekly/         # scripts run weekly
/etc/cron.monthly/        # scripts run monthly
/var/spool/cron/         # where per-user crontabs are stored
/etc/cron.allow           # list of users allowed to use cron
/etc/cron.deny            # list of users denied use of cron

• A crontab line consists of 5 time fields + a command.

# minute hour day month weekday [user] command
# *  *  *  *  *
# │  │  │  │  └─ weekday (0-7, 0 and 7 = Sunday)
# │  │  │  └──── month (1-12)
# │  │  └─────── day (1-31)
# │  └────────── hour (0-23)
# └───────────── minute (0-59)
 
30 2 * * *    /backup.sh           # every day at 02:30
0 */6 * * *   /check.sh            # every 6 hours
0 0 1 * *     /monthly.sh          # 00:00 on the 1st of every month
*/10 * * * *  /poll.sh             # every 10 minutes
0 9 * * 1-5   /report.sh           # weekdays (Mon-Fri) at 09:00

The crontab time field order is minute-hour-day-month-weekday. /etc/crontab (for the system) has an additional user to run as field after the 5 time fields, but a user's personal crontab (crontab -e) has no user field. This difference is easy to confuse.

⚠️ Trap: */10 * * * * means "every 10 minutes", while 10 * * * * means "once an hour at minute 10". With a slash (/) it is an interval (every); without one it runs at a fixed time. For weekday, both 0 and 7 mean Sunday.

Kernel Parameters: /etc/sysctl.conf

• /etc/sysctl.conf defines kernel parameters to be applied at boot.
• It maps one-to-one to the values under /proc/sys/.

# /etc/sysctl.conf example
net.ipv4.ip_forward = 1                  # IP forwarding (router/NAT)
net.ipv4.icmp_echo_ignore_all = 1        # block ping replies
kernel.hostname = server01               # hostname
vm.swappiness = 10                       # how aggressively swap is used
fs.file-max = 100000                     # maximum number of file handles
 
# Apply commands
sysctl -p                # re-read /etc/sysctl.conf and apply
sysctl -a                # print all current kernel parameters
sysctl net.ipv4.ip_forward   # query a specific value
sysctl -w net.ipv4.ip_forward=1   # set immediately (runtime)

To build a router/NAT, put net.ipv4.ip_forward = 1 in /etc/sysctl.conf and apply it with sysctl -p. sysctl -p means "re-read the configuration file". echo 1 > /proc/sys/net/ipv4/ip_forward has the same effect but disappears after a reboot.

Default Password Policy: /etc/login.defs

• Defines the default password policy applied when creating new accounts, along with the UID/GID ranges.

# Key directives in /etc/login.defs
PASS_MAX_DAYS   90        # maximum days a password can be used
PASS_MIN_DAYS   0         # minimum interval between password changes
PASS_MIN_LEN    8         # minimum password length
PASS_WARN_AGE   7         # days of warning before expiry
UID_MIN         1000      # start of regular user UIDs
UID_MAX         60000     # end of regular user UIDs
GID_MIN         1000      # start of regular group GIDs
CREATE_HOME     yes       # automatically create the home directory
UMASK           022       # default umask

login.defs sets the defaults for newly created accounts. To change the policy of an existing account, use the chage command. For example: chage -M 60 alice (change alice's maximum days of use to 60). The trap is that editing login.defs is not applied retroactively to existing users.

Network Configuration Files

/etc/hosts            # static IP-hostname mapping (can be consulted before DNS)
/etc/resolv.conf      # specifies DNS servers (nameserver)
/etc/nsswitch.conf    # name lookup order (hosts: files dns)
/etc/hostname         # system hostname
/etc/host.conf        # auxiliary name resolution order settings
/etc/services         # port-to-service name mapping (80=http, etc.)
/etc/protocols        # protocol number mapping

# /etc/resolv.conf
nameserver 8.8.8.8
nameserver 168.126.63.1
search example.com
domain example.com
 
# /etc/hosts
127.0.0.1   localhost
192.168.0.10  server01 web

The file that specifies DNS servers is /etc/resolv.conf, and its directive is nameserver. The file that maps IPs directly to names is /etc/hosts. The two are easy to confuse. The lookup order (files first or DNS first) is decided on the hosts: line of /etc/nsswitch.conf.

Path and Directive Short-Answer Memorization Cards

Try It Yourself

# Open the real files to get used to the field structure
cat /etc/passwd | head -5      # verify 7 fields
sudo cat /etc/shadow | head -3 # verify 9 fields (root privileges required)
cat /etc/group | head -5       # verify 4 fields
cat /etc/fstab                 # verify 6 fields
cat /etc/resolv.conf           # check nameserver
 
# Check/change policy
grep PASS /etc/login.defs      # default password policy
sudo chage -l alice            # alice's current password policy (if she exists)
 
# Query sysctl
sysctl net.ipv4.ip_forward

Open the files with cat yourself and look at the real contents to get a feel for field positions. Tomorrow, building on this knowledge, we cover task-style questions where you actually perform disk, LVM, and permission work.

📖 Glossary

• /etc/passwd : The 7-field file holding basic user account information. The 2nd field x indicates "the real password is in shadow".
• UID / GID : User number / group number. UID 0 is always root.
• GECOS : The 5th field of /etc/passwd. It holds a human-readable description such as name or phone.
• /etc/shadow : The 9-field file holding encrypted passwords and expiry policy. Regular users cannot read it.
• /sbin/nologin : A special shell placed in the login shell field to block that account's login. /bin/false serves the same purpose.
• /etc/fstab : The 6-field file that defines filesystems to mount automatically at boot.
• dump field : The 5th field of fstab. It marks with 0/1 whether the filesystem is a backup target.
• fsck order : The 6th field of fstab. The check order at boot: root is 1, others are 2, excluded from checking is 0.
• crontab time fields : Five fields in the order minute-hour-day-month-weekday. */N means every N, and a plain number means a fixed time.
• sysctl -p : The command that re-reads /etc/sysctl.conf and applies kernel parameters.
• PASS_MAX_DAYS : The directive in /etc/login.defs that sets the maximum password age for new accounts. Existing accounts are changed with chage.
• /etc/resolv.conf : The file where the DNS servers to use are written with the nameserver directive.
• /etc/nsswitch.conf : The file that decides the lookup order: consult files (files) first or DNS first.