Based on the Linux Master 2 exam syllabusReport an error
command [options] [arguments], and a path starting with / is absolute.-r (recursive) and what doesn't — cp -r and rm -r need it, mv doesn't.find finds files, grep finds contents. This one sentence separates the two commands./etc/passwd is 7 colon-separated fields, UID 0 = root, and passwords are in /etc/shadow.su switches users (target's password), sudo runs one command (your own password) — memorize them as a pair. Location pwd · cd · ls
│
Viewing cat (all) · less (page through) · head (first 10) · tail (last 10) · tail -f (real time)
│
Create/delete touch · mkdir (-p) · rmdir (empty only) · rm (-r, -f)
│
Copy/move cp (-r needed) · mv (-r not needed, also renames) · ln (-s symbolic)
│
Finding find (files, path first) · locate (index, fast) · grep (contents)
│
Counting/chaining wc -l · | (pipe)
│
Accounts useradd (-m) · passwd · usermod (-aG) · userdel (-r) · id · su · sudoThe same letter is used with similar meanings across several commands.
| Letter | Meaning | Where it's used |
|---|---|---|
-a | all — everything | ls -a (include hidden), usermod -aG (append) |
-r / -R | recursive — through subdirectories | cp -r, rm -r, grep -r, ls -R |
-i | Three meanings ⚠️ | cp -i (confirm), grep -i (ignore case), ls -i (inode) |
-l | long / line | ls -l (detailed), wc -l (line count) |
-n | number | head -n (line count), grep -n (line numbers) |
-f | force / follow ⚠️ | rm -f (force), tail -f (follow) |
-p | parents / preserve ⚠️ | mkdir -p (intermediate paths), cp -p (preserve attributes) |
-v | invert | grep -v (lines that don't match) |
⚠️ The ones marked have different meanings in each command.
-fis force inrmbut follow intail. Spots like these show up as trick questions.
Even the same letter, uppercase and lowercase are completely different options. Some questions give four choices that differ only in case.
| Lowercase | Uppercase |
|---|---|
ls -r reverse sort | ls -R recursive through subdirectories |
ls -a everything including . and .. | ls -A everything except . and .. |
ls -s show block count | ls -S sort by size |
useradd -g primary group | useradd -G secondary group |
usermod -l change login name | usermod -L lock account |
grep -i ignore case | grep -E extended regular expressions |
man -k keyword search (apropos) | man -f one-line description by name (whatis) |
This week's content comes down to whether you can read a command by breaking it into chunks. Try splitting the lines below from the left.
find /var/log -type f -name "*.log" -mtime -7find the command / /var/log the starting path / -type f files only / -name "*.log" whose name ends in .log / -mtime -7 modified within the last 7 days.- before a number means "more recent than that," and + means "older than that."grep -v "^#" /etc/fstab | wc -lgrep -v lines that don't match / "^#" that start with # / /etc/fstab in this file / | pass that result along / wc -l count the lines.^ is the start of a line and $ is the end of a line.cp -rp /home/user/docs /backup/ && ls -ld /backup/docscp -rp copy the directory through its subdirectories (-r), preserving permissions and times (-p) / && if it succeeds / ls -ld look at the detailed info of the directory itself./backup is an existing directory, the result becomes /backup/docs.sudo useradd -m -g dev -G wheel -s /bin/bash kimsudo just this one command with administrator privileges / useradd -m along with a home directory / -g dev the primary group is dev / -G wheel the secondary group is wheel / -s /bin/bash login shell / kim the name of the account to create.kim:x:UID:GID of dev::/home/kim:/bin/bash appears in /etc/passwd. Each option fills one of the seven fields.| Path | What | What to remember |
|---|---|---|
/etc/passwd | Basic account info | 7 fields, readable by anyone |
/etc/shadow | Encrypted passwords and expiry policy | 9 fields, only root can read |
/etc/group | Group info | 4 fields, members separated by commas |
/etc/sudoers | sudo permission settings | Edit with visudo |
/etc/skel | Default files copied into a new home directory | Used by useradd -m |
/etc/login.defs | Defaults for UID range and password policy | |
/sbin/nologin | A shell that blocks login | Field ⑦ of system accounts |
/home/user | A regular user's home | ~ |
/root | root's home | Different from / (the root directory) |
| What you want to know | Command |
|---|---|
| Where are the files matching conditions | find path conditions |
| Quickly find by name alone | locate name (refresh the index with updatedb) |
| Is that text inside the file | grep pattern file |
| Where is the executable of this command | which command |
| The executable plus even the manual location | whereis command |
| Is this name a builtin or an alias | type command |
| The usage of this command | man command, command --help |
| What this command is in one line | whatis command |
| Which command does this kind of job | apropos keyword |
| Who am I | whoami, id |
| Who is connected | who, w |
[root@www ~]# ls -l /etc/passwd /tmp -d
-rw-r--r--. 1 root root 2104 Sep 3 09:00 /etc/passwd
drwxrwxrwt. 12 root root 4096 Sep 3 09:10 /tmp| Slot | How to read it |
|---|---|
root · # in the prompt | Logged in as root. It would be $ for a regular user |
~ in the prompt | The current location is the home directory (/root, since it's root) |
- / d at the start of the line | Regular file / directory (l link, b block device, c character device) |
The number 1 / 12 | Hard link count |
root root | Owner / owning group |
2104 | Size (bytes). With -h it looks like 2.1K |
Sep 3 09:00 | Last modified time |
| Key | Result |
|---|---|
Ctrl + C | Ends the running command |
Ctrl + Z | Suspends the command (it hasn't ended) |
Ctrl + D | Signals the end of input / logs out at an empty prompt |
Tab | Auto-complete; press twice for a list of candidates |
q | Quit man and less |
| Comparison | A | B | Deciding criterion |
|---|---|---|---|
find vs grep | Finds files | Finds contents | Is the target a file or a line |
find vs locate | Direct search, accurate | Index search, fast | Freshness vs speed |
cp -r vs mv | Needs -r | Doesn't need -r | How directories are handled |
rmdir vs rm -r | Empty only | Deletes with contents | Whether it's OK with contents inside |
cat vs less | Dumps everything | Pages through | File length |
head vs tail | First 10 lines | Last 10 lines | Which end |
/etc/passwd vs /etc/shadow | Account info, anyone | Passwords, root only | Read permission |
su vs sudo | Switch user, target's password | One command, your own password | What you enter |
su vs su - | Keeps environment | Switches the environment too | Presence of the hyphen |
usermod -G vs -aG | Overwrites | Appends | Preserving existing groups |
| Hard link vs symbolic link | Same inode | Path shortcut | When the original is deleted |
-r to mv → No. mv simply moves directories too. -r is needed for cp and rm.find -name "*.txt" /home → The path comes first. find /home -name "*.txt".usermod -G → It wipes out the existing secondary groups. You must use -aG.rmdir → It doesn't work. You must use rm -r./etc/passwd → It is in /etc/shadow. The x in passwd is the marker for that.su → It is the target account's password. Using your own is sudo...| Value | What |
|---|---|
| 7 | Number of fields in /etc/passwd |
: | Delimiter of /etc/passwd |
| 0 | root's UID |
| 1000 | Where regular user UIDs start (500 on some distributions) |
| 10 | Default line count of head and tail |
x | passwd field 2 — marker that the password is in shadow |
Next week is about permissions attached to files — we will cover rwx and octal, ownership, and special permissions.
-r/-R options.less, more.|) : A symbol that passes the output of the previous command as the input of the next command./sbin/nologin.sudo is recommended.Click a choice to reveal the answer and explanation.
Question 1
Which of the following commands does not need a recursive option when moving a directory?
Question 2
Which of the following commands finds a specific string in the file contents, not in file names?
Question 3
Which of the following commands deletes a non-empty directory along with its contents?
Question 4
What does the x in the second field of the /etc/passwd file mean?
Question 5
Which of the following commands switches users while also applying that user's environment variables and working directory?
Question 6
Which of the following commands prints only the first 5 lines of a file?