Linux Foundation Certified System Administrator

Access starts with accounts. You create and manage users and groups, set up shell profiles and defaults for new accounts, limit resources per user, apply ACLs beyond basic permissions, and connect the system to a directory service.

• Local accounts, groups and the files behind them
• Password policy, aging and locked accounts
• Profiles, skeleton files and the login environment
• sudo rules and delegated administration
• Resource limits with ulimit and limits files
• File permissions and ACLs
• Authenticating users against LDAP

You build A server with team accounts, shared directories using ACLs, resource limits and LDAP login.

A server is a set of running services. You write and debug systemd units, control and inspect processes, read the journal, and schedule jobs with cron and timers.

• Anatomy of a systemd unit
• Writing a service for your own program
• Targets, dependencies and start-up order
• Reading logs with journalctl
• Signals, priorities and runaway processes
• Scheduling with cron, at and systemd timers

You build A custom service with dependency ordering, restart behavior and a timer-driven maintenance job.

Software arrives as packages, and trust arrives with signatures. You install, query, upgrade and remove software with both major package families, add repositories safely, and track what changed on a system.

• Package databases and what a package contains
• apt and dpkg on Debian-family systems
• dnf and rpm on Red Hat-family systems
• Adding repositories and verifying signing keys
• Holding, pinning and rolling back versions
• Finding which package owns a file

You build A repository configuration and an update routine that keeps selected packages at fixed versions.

Sooner or later a machine will not boot. You follow the boot sequence from firmware to a login, tune the kernel at run time and at boot, and recover through rescue modes when configuration is wrong.

• Firmware, the bootloader, kernel and init
• Kernel modules and runtime tuning with sysctl
• Editing boot parameters in the bootloader
• Rescue and emergency targets
• Repairing a broken fstab or a damaged filesystem
• Regenerating the initial RAM disk
• Recovering a lost root password

You build A recovery runbook, tested on a deliberately broken virtual machine.

One host often runs many isolated workloads. You create virtual machines with KVM and libvirt, run containers with Podman, and learn what each isolates, what each costs and how to start them with the system.

• Hardware virtualization and KVM
• Creating and managing guests with libvirt
• Images, storage and networks for virtual machines
• Running containers with Podman, rootless
• Container images, volumes and published ports
• Starting containers as systemd services

You build A host running a virtual machine and a containerized service that both start at boot.

Mandatory access control stops a compromised service from reaching everything else. You read SELinux labels, switch modes, set booleans and file contexts, and work out from the audit log why something was denied.

• Types, labels and policy in outline
• Enforcing, permissive and disabled modes
• File contexts, restorecon and semanage
• Booleans and non-standard ports
• Reading denials with ausearch and audit2why
• Where other confinement systems such as AppArmor fit

You build A web service running in enforcing mode on a non-standard port and directory, with every denial resolved.

Storage grows, shrinks and fails. You partition disks, build logical volumes you can resize live, create and tune filesystems, mount them reliably by identifier, and configure swap.

• Partition tables and the tools for them
• Physical volumes, volume groups and logical volumes
• Extending and shrinking volumes
• ext4 and XFS: creating, checking and resizing
• Mounting by UUID and writing fstab entries
• Swap partitions, swap files and tuning
• Snapshots of logical volumes

You build A volume group with logical volumes that are grown online, mounted persistently and snapshotted.

Not every disk is local. You share and mount filesystems over the network, attach block devices from a remote server, mount on demand with an automounter, and watch the performance of the whole path.

• NFS exports and client mounts
• Mount options for reliability and security
• Network block devices and iSCSI targets
• Automounting with autofs maps
• Measuring I/O with iostat and related tools
• Troubleshooting hung mounts

You build A shared directory exported by one server and automounted on another, with an I/O baseline recorded.

A server that cannot be reached is not a server. You configure IPv4 and IPv6 addresses, static routes, bridges and bonds with your distribution’s tools, set up name resolution, and keep clocks in sync.

• Addresses, netmasks and IPv6 basics
• Configuring interfaces with the distribution’s tools
• Static routes and the routing table
• Bridges and bonded interfaces
• Name resolution and the resolver configuration
• Time synchronization with chrony

You build A two-interface server with a bond, a bridge, a static route and synchronized time.

Remote access and packet filtering protect and expose a machine at once. You configure OpenSSH with keys and sensible defaults, filter packets with nftables or firewalld, and translate addresses for routing and forwarding.

• SSH keys, agents and client configuration
• Hardening sshd
• Tunnels, jump hosts and port forwarding
• Packet filtering with nftables and firewalld
• Source and destination NAT
• Enabling forwarding and testing the rules

You build A gateway host that forwards traffic with NAT, filters packets by policy and accepts only key-based SSH.

Many services sit behind a proxy that terminates TLS and shares load. You configure reverse proxies, balance across backends with health checks, and create, inspect and renew SSL certificates with OpenSSL.

• Reverse proxy configuration with nginx or HAProxy
• Balancing algorithms and health checks
• Terminating TLS at the proxy
• Generating keys and certificate requests with OpenSSL
• Inspecting certificates and chains
• Diagnosing expired or mismatched certificates

You build A proxy fronting two backends over TLS, with a health check and a certificate renewal procedure.

Slow and full are the two commonest complaints. You find what is using CPU, memory and I/O, chase down missing disk space including deleted files still held open, and manage logs so they stop growing unchecked.

• CPU, memory and load with top, vmstat and sar
• Memory pressure, swapping and the OOM killer
• Finding large files and directories with du and find
• Inode exhaustion
• Deleted files still held open
• Log rotation and journal limits

You build A performance and capacity checklist, with scripts that report on each resource and warn before it runs out.

Build a server from nothing: storage, users, networking, services and security. Then someone else breaks it, and you find and fix each fault under time pressure.

• Planning the build from a specification
• Configuring storage, users, services and network
• Hardening access and confinement
• Diagnosing faults you did not introduce
• Recovering from a boot failure
• Writing the handover documentation

You build A complete, documented server with a recovery runbook, proven against faults someone else injected.