Linux Fundamentals
— Complete Notes

# Where am I right now?
pwd
# Output: /home/kamran

# List files (l=detailed, a=show hidden, h=human readable sizes)
ls -lah

# Go to /etc directory (main config folder in Linux)
cd /etc

# Go back to home directory
cd ~

# Create a directory
mkdir /tmp/mylab

# Create an empty file
touch /tmp/mylab/test.txt

# Write text into a file
echo "Hello Linux" > /tmp/mylab/test.txt

# Read the file
cat /tmp/mylab/test.txt

# Search for a word in a file
grep "Hello" /tmp/mylab/test.txt

# Copy the file
cp /tmp/mylab/test.txt /tmp/backup.txt

# Rename or move
mv /tmp/backup.txt /tmp/renamed.txt

# Delete a file
rm /tmp/renamed.txt

# Delete a folder and everything in it
rm -rf /tmp/mylab

# Open a file with nano
nano /etc/hostname

# Now you're in nano. Just type — no mode switching needed.
# Edit the file normally.

# Save (Write Out):
Ctrl + O  → press Enter to confirm filename

# Exit nano:
Ctrl + X

# Save and exit in one go: Ctrl+X → Y → Enter

# Other useful nano shortcuts:
Ctrl + K  → cut (delete) a line
Ctrl + U  → paste the cut line
Ctrl + W  → search (find) text in file
Ctrl + G  → show help

# Open a file with vim
vim /etc/hostname

# Vim starts in NORMAL mode — keys are commands, not text input.
# To start typing, press:
i  → enters INSERT mode (now you can type)

# After typing, press Escape to go back to NORMAL mode
Esc

# To save and exit (from NORMAL mode):
:wq  → write (save) and quit

# To exit WITHOUT saving:
:q!  → force quit, discard changes

# Other useful vim commands (all from NORMAL mode):
dd    → delete (cut) current line
yy    → copy current line
p     → paste
:set number  → show line numbers
/word  → search for "word" in file
u     → undo last action
G     → jump to end of file
gg    → jump to start of file

# Create a new user
useradd ahmed

# Set or change password
passwd ahmed

# Create user with home directory and specific shell
useradd -m -s /bin/bash ahmed

# Delete user and their home folder
userdel -r ahmed

# Create a group
groupadd developers

# Add user to a group (without removing existing groups)
usermod -aG developers ahmed

# Check which groups a user belongs to
groups ahmed

# Switch to another user
su - ahmed

# Run a command as root without logging in as root
sudo dnf update

# See permissions on files
ls -la /etc/nginx/nginx.conf
# Output: -rw-r--r-- 1 root root 2048 Jan 1 nginx.conf
#          ↑↑↑↑↑↑↑↑↑  = permissions | owner | group

# chmod — change permissions
# Numeric method (most common):
# 4=read, 2=write, 1=execute. Add them up:
# 7 = rwx (4+2+1), 6 = rw- (4+2), 5 = r-x (4+1), 4 = r--

chmod 755 script.sh   # owner: rwx | group: r-x | others: r-x
chmod 644 config.txt  # owner: rw- | group: r-- | others: r--
chmod 600 id_rsa      # owner: rw- | group: --- | others: ---  ← SSH keys use this

# chown — change who owns a file
chown ahmed file.txt           # change owner to ahmed
chown ahmed:developers file.txt # change owner + group
chown -R ahmed /var/www/html   # change owner of folder + everything inside

# Install a package
dnf install nginx -y       # -y means yes to all prompts
dnf install httpd git vim -y  # install multiple at once

# Remove a package
dnf remove nginx -y

# Update everything
dnf update -y

# Update only one package
dnf update nginx -y

# Search for a package
dnf search "web server"

# Get info about a package
dnf info nginx

# List all installed packages
dnf list installed

# Clean cache
dnf clean all

# Same concept, different command
apt update               # refresh package list (do this first)
apt install nginx -y
apt remove nginx -y
apt upgrade -y           # update all installed packages
apt search nginx
apt show nginx

# Step 1: Create a Physical Volume from a disk
pvcreate /dev/sdb

# Step 2: Create a Volume Group (a pool of storage)
vgcreate myvg /dev/sdb

# Step 3: Create a Logical Volume (like a partition, but flexible)
lvcreate -L 10G -n mydata myvg

# Step 4: Format it
mkfs.xfs /dev/myvg/mydata

# Step 5: Create a mount point and mount it
mkdir /data
mount /dev/myvg/mydata /data

# Step 6: Auto-mount on boot — add to /etc/fstab
echo "/dev/myvg/mydata /data xfs defaults 0 0" >> /etc/fstab

# --- Later: Extend the volume (add 5 more GB live) ---
lvextend -L +5G /dev/myvg/mydata
xfs_growfs /data     # resize the filesystem to use new space

# Check disk usage
df -h
lvdisplay

# Start, stop, restart a service
systemctl start nginx
systemctl stop nginx
systemctl restart nginx
systemctl reload nginx    # reload config without full restart

# Enable/disable auto-start on boot
systemctl enable nginx    # start automatically when server boots
systemctl disable nginx

# Check if service is running
systemctl status nginx

# Start AND enable in one command
systemctl enable --now nginx

# List all running services
systemctl list-units --type=service --state=running

# View logs for a service (live)
journalctl -u nginx -f    # -f = follow (like tail -f)

# View last 50 lines of logs
journalctl -u nginx -n 50

# See all running processes
ps aux

# Live process monitor (like Task Manager)
top       # basic
htop      # better (install with: dnf install htop -y)

# Find a process by name
ps aux | grep nginx

# Kill a process by PID
kill 1234         # polite kill (asks process to stop)
kill -9 1234      # force kill (process has no choice)

# Kill by name
pkill nginx

# Check your IP address
ip addr show
ip addr show ens33  # specific interface

# Test connectivity
ping 8.8.8.8        # Google DNS — tests internet access
ping -c 4 8.8.8.8   # stop after 4 packets

# DNS lookup
dig google.com
nslookup google.com

# Set a static IP using nmcli
nmcli con mod "ens33" ipv4.addresses 192.168.1.100/24
nmcli con mod "ens33" ipv4.gateway 192.168.1.1
nmcli con mod "ens33" ipv4.dns 8.8.8.8
nmcli con mod "ens33" ipv4.method manual
nmcli con up "ens33"

# SSH into a remote server
ssh ahmed@192.168.1.50
ssh -i ~/.ssh/id_rsa ahmed@192.168.1.50   # with SSH key

# Firewall — open a port
firewall-cmd --permanent --add-port=80/tcp
firewall-cmd --permanent --add-service=http
firewall-cmd --reload

# Check which ports are listening
ss -tulnp

# Check current SELinux mode
getenforce
# Outputs: Enforcing | Permissive | Disabled

# Enforcing  = actively blocks violations
# Permissive = logs violations but does NOT block (good for troubleshooting)
# Disabled   = completely off (not recommended on production)

# Temporarily set to permissive (resets on reboot)
setenforce 0   # permissive
setenforce 1   # enforcing

# Permanently change mode — edit config file
nano /etc/selinux/config
# Change: SELINUX=enforcing  →  SELINUX=permissive

# Check SELinux context (label) on a file
ls -Z /var/www/html/index.html

# Fix context on web files (common fix for Apache permission denied)
restorecon -Rv /var/www/html/

# Check what SELinux blocked recently
ausearch -m avc -ts recent

# Install Apache (called httpd on RHEL)
dnf install httpd -y

# Start and enable on boot
systemctl enable --now httpd

# Open firewall for web traffic
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

# Create a test web page
echo "<h1>Hello from Devriston</h1>" > /var/www/html/index.html

# Fix SELinux context on web files
restorecon -Rv /var/www/html/

# Now visit http://your-ip in a browser

# Check Apache logs
tail -f /var/log/httpd/access_log
tail -f /var/log/httpd/error_log

# Install Nginx
dnf install nginx -y

# Start and enable
systemctl enable --now nginx

# Open firewall
firewall-cmd --permanent --add-service=http
firewall-cmd --reload

# Test config before applying changes
nginx -t

# Reload config without downtime
systemctl reload nginx

# Nginx logs
tail -f /var/log/nginx/access.log
tail -f /var/log/nginx/error.log

# Install DHCP server
dnf install dhcp-server -y

# Edit config file
nano /etc/dhcp/dhcpd.conf

# Global settings
default-lease-time 600;     # lease for 600 seconds (10 min)
max-lease-time 7200;        # max lease 2 hours

# Subnet definition
subnet 192.168.1.0 netmask 255.255.255.0 {
  range 192.168.1.100 192.168.1.200;  # IP range to hand out
  option routers 192.168.1.1;          # default gateway
  option domain-name-servers 8.8.8.8, 8.8.4.4;  # DNS servers
  option domain-name "devriston.local";
}

# Enable and start
systemctl enable --now dhcpd

# Open firewall for DHCP
firewall-cmd --permanent --add-service=dhcp
firewall-cmd --reload

# Check active leases
cat /var/lib/dhcpd/dhcpd.leases

# Install BIND
dnf install bind bind-utils -y

# Edit main config
nano /etc/named.conf

# Add inside named.conf:
zone "devriston.local" IN {
    type master;
    file "/var/named/devriston.local.zone";
    allow-update { none; };
};

$TTL 86400
@   IN  SOA  ns1.devriston.local. admin.devriston.local. (
            2024010101  ; Serial
            3600        ; Refresh
            900         ; Retry
            604800      ; Expire
            86400 )     ; Minimum TTL

; Name servers
@   IN  NS   ns1.devriston.local.

; A Records (name → IP)
ns1     IN  A   192.168.1.10
www     IN  A   192.168.1.20
mail    IN  A   192.168.1.30

# Check config for errors
named-checkconf
named-checkzone devriston.local /var/named/devriston.local.zone

# Start DNS
systemctl enable --now named

# Open firewall
firewall-cmd --permanent --add-service=dns
firewall-cmd --reload

# Test it
dig @192.168.1.10 www.devriston.local
nslookup www.devriston.local 192.168.1.10

# Install Samba
dnf install samba samba-client samba-common -y

# Create a shared folder
mkdir -p /srv/shared
chmod 0775 /srv/shared

# Edit Samba config
nano /etc/samba/smb.conf

[shared]
    comment = Devriston File Share
    path = /srv/shared
    browseable = yes
    writable = yes
    valid users = ahmed

# Add Samba password for a Linux user
smbpasswd -a ahmed

# Enable and start Samba services
systemctl enable --now smb nmb

# Open firewall
firewall-cmd --permanent --add-service=samba
firewall-cmd --reload

# Fix SELinux for Samba
setsebool -P samba_export_all_rw 1

# Test config
testparm

# On Windows: open File Explorer and type:
# \\192.168.1.10\shared

# On your LOCAL machine — generate SSH key pair
ssh-keygen -t ed25519 -C "ahmed@devriston"
# Creates: ~/.ssh/id_ed25519 (private key — never share this)
#          ~/.ssh/id_ed25519.pub (public key — goes on server)

# Copy public key to server
ssh-copy-id ahmed@192.168.1.50
# Now you can SSH without password:
ssh ahmed@192.168.1.50

# On the SERVER — disable password login (after key works!)
nano /etc/ssh/sshd_config
# Change these lines:
PasswordAuthentication no
PermitRootLogin no
Port 2222           # optional: change default port

# Restart SSH
systemctl restart sshd

# Install fail2ban
dnf install fail2ban -y

# Create local config (don't edit the main file)
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
nano /etc/fail2ban/jail.local

# Set these values:
[sshd]
enabled  = true
maxretry = 3        # ban after 3 failed attempts
bantime  = 3600     # ban for 1 hour
findtime = 600      # count attempts in 10 minute window

# Start fail2ban
systemctl enable --now fail2ban

# Check banned IPs
fail2ban-client status sshd

# Unban an IP
fail2ban-client set sshd unbanip 192.168.1.99

#!/bin/bash
# The first line (shebang) tells the system to run this with bash

# Variables
NAME="Ahmed"
DATE=$(date +%Y-%m-%d)   # capture command output into variable

# Print
echo "Hello $NAME"
echo "Today is $DATE"

# Conditions
if [ -f "/etc/nginx/nginx.conf" ]; then
    echo "Nginx config exists"
else
    echo "Nginx not installed"
fi

# Loops
for USER in ahmed kamran ali; do
    echo "Creating user: $USER"
    useradd $USER
done

#!/bin/bash
# Alert if any disk is over 80% full

THRESHOLD=80

df -h | grep -vE '^Filesystem|tmpfs' | awk '{ print $5 " " $6 }' | while read USAGE MOUNT; do
    USE=$(echo $USAGE | sed 's/%//')
    if [ "$USE" -gt "$THRESHOLD" ]; then
        echo "WARNING: $MOUNT is at $USAGE"
    fi
done

# Open crontab editor
crontab -e

# Cron format: minute hour day month weekday command
# Examples:

# Run disk check every day at 6am
0 6 * * * /home/ahmed/scripts/disk-alert.sh

# Run backup every Sunday at 2am
0 2 * * 0 /home/ahmed/scripts/backup.sh

# Run every 5 minutes
*/5 * * * * /home/ahmed/scripts/check.sh

# List all scheduled cron jobs
crontab -l