Here are 100 Linux interview questions and answers, covering file systems, commands, processes, permissions, networking, shell scripting, performance tuning, security, and troubleshooting. Each question is in bold, followed by a detailed answer. No dividing lines.
What is Linux and what are its main components?
Answer: Linux is an open-source, Unix-like operating system kernel first developed by Linus Torvalds. Main components: Kernel (core, manages hardware, memory, processes), System libraries (glibc), System utilities (coreutils), Shell (command interpreter), and optionally a graphical user interface (X11, Wayland). Linux distributions bundle these with package managers.
What is the difference between Linux and Unix?
Answer: Linux is a Unix-like operating system but is not directly derived from Unix source code. Linux is open source and free, runs on many architectures. Unix is a family of proprietary systems (AIX, HP-UX, Solaris) developed by various companies. Linux follows POSIX standards, making it compatible with Unix commands and APIs.
What is a Linux distribution? Name some popular ones.
Answer: A Linux distribution is an operating system built around the Linux kernel with additional software, package managers, and desktop environments. Popular: Ubuntu (Debian-based, user-friendly), Red Hat Enterprise Linux (RHEL, enterprise), CentOS Stream (RHEL development), Fedora (cutting-edge), Debian (stable, community), SUSE, Arch (rolling release), Alpine (lightweight).
What is the difference between a process and a thread?
Answer: A process is an independent program in execution with its own memory space, file descriptors, and process ID. A thread is a lightweight unit of execution within a process, sharing memory (heap, global variables) and resources with other threads of the same process. Threads are cheaper to create and switch, but require synchronization to avoid race conditions.
What is the Linux file system hierarchy (FHS)?
Answer: The Filesystem Hierarchy Standard defines directory structure. Key directories: / (root), /bin (essential user binaries), /sbin (system binaries), /etc (configuration files), /var (variable data – logs, spool), /home (user home directories), /root (root home), /tmp (temporary files), /usr (user system resources), /opt (optional add‑on software), /proc (virtual process filesystem), /dev (device files).
What is an inode in Linux?
Answer: An inode is a data structure that stores metadata about a file (excluding its name): permissions, ownership, timestamps, size, and pointers to data blocks. Each file has one inode. Directories contain entries mapping filenames to inodes. Use ls -i to view inode numbers.
What is a hard link vs a symbolic (soft) link?
Answer: A hard link is an additional directory entry pointing to the same inode; all hard links are equal and removing one does not affect the file until all links are removed. Hard links cannot cross file systems or link to directories. A symbolic link is a special file containing a path to another file; it can cross file systems and link to directories; removing the original file breaks the symlink. Create with ln (hard) or ln -s (soft).
What is the difference between kill and kill -9?
Answer: kill sends the SIGTERM (15) signal, allowing the process to terminate gracefully (clean up resources, close files). kill -9 sends SIGKILL (9), which forces immediate termination without cleanup; the process cannot catch or ignore it. Use SIGTERM first, then SIGKILL only if the process does not respond.
What are file permissions in Linux? Explain the numeric (octal) notation.
Answer: File permissions are read (r=4), write (w=2), execute (x=1) for three classes: owner (u), group (g), others (o). Numeric notation: sum of permissions per class. Example: 755 means owner: rwx (4+2+1=7), group: r-x (4+0+1=5), others: r-x (5). Use chmod to change.
What is the difference between su and sudo?
Answer: su (substitute user) switches to another user (usually root) and requires the target user’s password. sudo allows authorized users to run specific commands as root (or another user) with their own password, and provides fine‑grained control via /etc/sudoers. sudo is more secure and auditable.
How do you change a file’s ownership?
Answer: Use chown to change owner and group. Examples: chown user file (change owner), chown :group file (change group), chown user:group file (both). chgrp changes group only. Only root can change ownership, but group changes can be done by file owner if they belong to the target group.
What is the purpose of the /etc/passwd and /etc/shadow files?
Answer: /etc/passwd stores user account information (username, UID, GID, home directory, shell) – historically also had password hashes but now uses ‘x’. /etc/shadow stores encrypted password hashes and password aging information, readable only by root. This separation improves security.
How do you view and manage running processes?
Answer: Use ps (snapshot), top (dynamic, real‑time), htop (interactive), pgrep (search). To manage, use kill (send signals), nice/renice (change priority), pkill (kill by name), killall. Also systemctl for system services.
What is the difference between a zombie process and an orphan process?
Answer: A zombie process is a process that has terminated but still has an entry in the process table because its parent has not read its exit status. It consumes no resources (except process ID). An orphan process is a process whose parent has terminated; it is adopted by the init process (PID 1) and cleans up normally.
What is a daemon in Linux?
Answer: A daemon is a background process that runs continuously, often started at boot, and provides services (e.g., sshd, httpd, cron). Daemons usually have no controlling terminal and end with ‘d’. Managed by systemd (unit files) or SysV init scripts.
What is the Linux boot process?
Answer: 1) BIOS/UEFI – hardware initialization, boot device selection. 2) Bootloader (GRUB) – loads kernel and initramfs. 3) Kernel initializes devices, mounts root filesystem (read‑only), runs init. 4) init (systemd or SysV) starts user‑space services, mounts other filesystems, and presents login.
What is systemd?
Answer: systemd is a system and service manager for Linux, replacing SysV init. It uses unit files to manage services, sockets, timers, mounts, etc. Key commands: systemctl (control services), journalctl (logs), systemd-analyze (boot performance). It parallelizes service startup and supports on‑demand activation.
How do you check available disk space and inode usage?
Answer: df -h (disk free in human‑readable), df -i (inode usage). du -sh (disk usage of a directory). ncdu (interactive). Full filesystem can cause write failures even if space exists if inodes are exhausted.
What is the difference between soft and hard ulimits?
Answer: Soft limits are the current enforced limits that users can increase up to the hard limit. Hard limits are the maximum values that a non‑root user can set as soft limits. Root can change both. ulimit -a shows current settings.
How do you schedule recurring tasks in Linux?
Answer: Use cron: edit user crontab with crontab -e. Format: * * * * * command (minute, hour, day of month, month, day of week). Also /etc/crontab, /etc/cron.d/, and anacron for systems not running 24/7. Use systemd timers as modern alternative.
What are runlevels in SysV init and how do they differ from systemd targets?
Answer: Runlevels are numbered states (0-6): 0 (halt), 1 (single‑user), 3 (multi‑user without GUI), 5 (multi‑user with GUI), 6 (reboot). Systemd uses targets (e.g., multi-user.target, graphical.target) which are more flexible and can be customized. systemctl get-default shows current target.
How do you find IP address of a Linux machine?
Answer: ip addr (or ip a), hostname -I, ifconfig (deprecated but may still work). For public IP: curl ifconfig.me.
What is the difference between TCP and UDP?
Answer: TCP is connection‑oriented, reliable, ordered, error‑checked, slower. UDP is connectionless, unreliable, no ordering, faster. Use TCP for HTTP, SSH, SMTP. Use UDP for DNS, DHCP, streaming, VoIP.
What is SSH and how does it work?
Answer: SSH (Secure Shell) is a cryptographic network protocol for secure remote access and command execution. It uses public‑key cryptography for authentication and encrypts all traffic. Default port 22. Commands: ssh user@host, ssh-keygen, scp, sftp.
How do you transfer files between Linux machines?
Answer: scp (secure copy over SSH), rsync (efficient sync, can resume), sftp (interactive), ftp (insecure, not recommended). For large transfers, use rsync -avz source/ user@host:/dest/.
What is a Linux bridge and how is it used?
Answer: A Linux bridge is a software construct that acts like a network switch, forwarding packets between interfaces (e.g., for virtual machines or containers). Use brctl or ip link commands. Commonly used in virtualization (KVM, Docker networking).
What is the purpose of the /proc filesystem?
Answer: /proc is a virtual filesystem that provides process and kernel information in real‑time. Contains /proc/cpuinfo, /proc/meminfo, /proc/[PID]/ for each process. Used for debugging and monitoring. Modifiable entries (like /proc/sys) tune kernel parameters.
How do you monitor system performance in real‑time?
Answer: top, htop (more user‑friendly), vmstat (memory, processes, paging), iostat (disk I/O), netstat/ss (network), iotop (disk I/O by process), dstat (aggregated), sar (historical). Also glances for comprehensive overview.
What is load average? How do you interpret it?
Answer: Load average is the average number of processes in the run queue (running or waiting for CPU) over 1, 5, and 15 minutes. For a single‑core system, load >1 indicates saturation. For multi‑core, divide by number of cores. Example: load 4 on 8‑core is 50% utilization.
How do you find the largest files or directories?
Answer: du -sh /path/* | sort -rh | head -10. Or use find / -type f -size +100M -exec ls -lh {} \; 2>/dev/null. ncdu gives interactive explorer. df -h first to find full filesystems.
What is a symbolic link and how do you create one?
Answer: A symbolic link (symlink) is a special file that points to another file or directory by path. Create with ln -s target link_name. The link can be broken if target moves or is deleted. ls -l shows links.
Explain the difference between fork() and exec() system calls.
Answer: fork() creates a new process (child) by duplicating the calling process (copy of memory, file descriptors). exec() replaces the current process image with a new program (loads a new binary). Together they are used to start new programs: fork then exec in the child.
What are stdin, stdout, stderr?
Answer: Standard input (0) – data stream into a program (keyboard). Standard output (1) – normal output (terminal). Standard error (2) – error messages (terminal). They can be redirected: command > file (stdout), command 2> error.log (stderr), command &> all.log (both).
How do you use pipes in Linux?
Answer: Pipes (|) send the stdout of one command as stdin of another. Example: cat file | grep "error" | wc -l. Chains multiple commands without intermediate files.
What is the difference between $ and # in shell prompts?
Answer: $ indicates a normal user shell. # indicates a root shell (superuser). The prompt can be customized by PS1 environment variable.
Explain shell variables vs environment variables.
Answer: Shell variables are local to the shell session (e.g., myvar=hello). Environment variables are inherited by child processes (e.g., export PATH). Use set to view all, env for environment.
How do you debug a shell script?
Answer: Run with bash -x script.sh (trace execution). Use set -x inside the script to turn on tracing, set +x to turn off. Also set -e to exit on error, set -u to treat unset variables as errors.
What is the purpose of sudo and how do you configure it?
Answer: sudo allows authorized users to run commands with elevated privileges. Configuration is in /etc/sudoers (edit with visudo). Example: username ALL=(ALL) ALL gives full sudo access. Can restrict commands, require password, or set NOPASSWD.
What is the difference between a soft link and a hard link?
Answer: (Already covered) Hard links same inode, cannot cross filesystems or link directories; symlinks separate inode pointing to path, can cross filesystems.
What is a Linux namespace?
Answer: Namespaces are kernel feature that isolate and virtualize system resources for processes. Types: PID, mount, network, UTS, IPC, user, cgroup. Used by containers (Docker) to provide isolation: each container sees its own network, process tree, etc.
What is a cgroup (control group)?
Answer: Cgroups limit, account, and isolate resource usage (CPU, memory, disk I/O, network) for groups of processes. Used by systemd, containers, and to enforce resource limits. Example: cgcreate, cgset, or systemd unit directives.
How do you configure a static IP address in Linux?
Answer: Methods vary by distribution. For NetworkManager: nmcli con mod eth0 ipv4.addresses 192.168.1.100/24 ipv4.gateway 192.168.1.1 ipv4.method manual. For ifupdown (Debian): edit /etc/network/interfaces. For netplan (Ubuntu): edit YAML in /etc/netplan/. For systemd-networkd: create .network file.
What is systemctl used for?
Answer: systemctl controls systemd services. Commands: start, stop, restart, reload, enable (start at boot), disable, status, list-units, is-active, show. Also systemctl daemon-reload after changing unit files.
How do you view and manage logs in Linux?
Answer: Traditional logs in /var/log/ (syslog, messages, auth.log). With systemd, use journalctl. Examples: journalctl -u sshd (service logs), journalctl -f (follow), journalctl --since "1 hour ago". Persistence can be configured.
What is the purpose of tar command?
Answer: tar (tape archive) bundles multiple files/directories into a single archive file (.tar). Often combined with compression: tar czf archive.tar.gz /path (gzip), tar xzf archive.tar.gz (extract). Options: c(create), x(extract), v(verbose), f(file), z(gzip), j(bzip2), J(xz).
How do you find a file by name?
Answer: find / -name "filename" 2>/dev/null (search from root, suppress permission errors). locate filename (database faster, updated via updatedb). which for executables in PATH, whereis for binary/source/man.
What is the difference between grep, egrep, and fgrep?
Answer: grep uses basic regular expressions. egrep (or grep -E) uses extended regular expressions (+, ?, |). fgrep (or grep -F) treats patterns as fixed strings (no regex). Modern grep supports -E and -F options, making egrep and fgrep obsolete.
How do you schedule a one‑time task?
Answer: Use at command. at 15:30 then enter commands, Ctrl+D to finish. atq list pending jobs, atrm remove. Also can use systemd-run with --on-active.
What are SUID, SGID, and sticky bits?
Answer: SUID (Set User ID): when set on an executable, runs with owner’s privileges (e.g., passwd). SGID: on file, runs with group’s privileges; on directory, new files inherit directory’s group. Sticky bit on directory (e.g., /tmp) restricts file deletion to owner/root. Set with chmod u+s, g+s, +t. Numeric: 4xxx for SUID, 2xxx for SGID, 1xxx for sticky (e.g., chmod 1777 /tmp).
How do you add a new user and grant sudo access?
Answer: useradd -m -s /bin/bash username (add with home and shell). passwd username (set password). To grant sudo: usermod -aG wheel (RHEL) or usermod -aG sudo (Debian). Or edit /etc/sudoers with visudo to add username ALL=(ALL) ALL.
What is a Linux kernel module and how do you manage it?
Answer: Kernel modules are loadable pieces of code that add functionality (device drivers, filesystems) without rebooting. Commands: lsmod (list), modprobe modname (load), rmmod modname (remove), modinfo (details). Persistent via /etc/modules or /etc/modules-load.d/.
How do you change the hostname?
Answer: Temporarily: hostname newname (or sysctl kernel.hostname=newname). Permanently: on systemd, hostnamectl set-hostname newname (updates /etc/hostname). Also update /etc/hosts.
What is rsync and how does it differ from scp?
Answer: rsync is a fast, versatile file copying tool that transfers only differences between source and destination (delta transfer). Supports compression, preserving permissions, ownership, and can resume interrupted transfers. scp copies whole files; simpler but less efficient for large or repeated transfers.
Explain the concept of a Linux boot loader (GRUB).
Answer: GRUB (Grand Unified Bootloader) is the most common bootloader. It loads the kernel and initial RAM disk. Features: support for multiple OSes, boot menu, command line, editing kernel parameters, chainloading. Configuration at /boot/grub/grub.cfg (generated by update-grub or grub2-mkconfig).
What is the difference between /etc/fstab and /etc/mtab?
Answer: /etc/fstab is the configuration file for static filesystem mount definitions (used at boot). /etc/mtab is a dynamic file showing currently mounted filesystems (updated by mount/umount). On many modern systems, /etc/mtab is a symlink to /proc/self/mounts.
How do you troubleshoot a system that cannot boot?
Answer: Boot from rescue/live CD. Check root filesystem: fsck /dev/sda1. Review logs in /var/log/ (using chroot). Check GRUB configuration. Examine kernel parameters. Use single‑user or emergency mode (systemd.unit=emergency.target). Restore from backups.
What is a swap space and how do you add a swap file?
Answer: Swap space is disk area used as virtual memory when RAM is full. Add swap file: dd if=/dev/zero of=/swapfile bs=1M count=2048 (2GB), chmod 600 /swapfile, mkswap /swapfile, swapon /swapfile. Add to /etc/fstab for persistence.
How do you check memory usage?
Answer: free -h (human‑readable), vmstat, top/htop (RES column), cat /proc/meminfo, smem for PSS/USS (shared memory breakdown). Also ps aux --sort=-%mem.
What are the different runlevels in Linux?
Answer: (Already covered runlevels) SysV: 0 (halt), 1 (single‑user), 2 (multi‑user without NFS), 3 (full multi‑user text), 4 (unused), 5 (X11), 6 (reboot). systemd targets map similarly.
How do you check which services are listening on which ports?
Answer: ss -tulpn (sockets statistics), netstat -tulpn (deprecated). lsof -i -P -n. For specific port: ss -tulpn | grep :80.
What is a Linux distribution package manager?
Answer: Package managers install, update, and remove software. Debian-based: apt (APT), dpkg. RHEL-based: dnf (or yum), rpm. SUSE: zypper. Arch: pacman. Also universal tools like snap, flatpak.
How do you update all packages on an Ubuntu system?
Answer: sudo apt update (refresh package list), sudo apt upgrade (upgrade packages without removing), sudo apt full-upgrade (handles dependencies more aggressively). sudo apt autoremove cleans unused dependencies.
What is the purpose of chroot?
Answer: chroot changes the root directory for a process and its children, creating a jail. Used for system recovery, building environments, and container‑like isolation. Requires root privileges. Example: chroot /mnt/oldroot /bin/bash.
How do you monitor network connections and traffic?
Answer: ss (socket stats), netstat, iftop (bandwidth per connection), nethogs (per process), tcpdump (packet capture), iptraf, vnstat (historical). For real‑time: bmon, nload.
What is the difference between a process and a service?
Answer: A process is any running program instance. A service is a long‑running process managed by init system (systemd, SysV) that provides system functionality (e.g., web server, sshd). Services are often started at boot and can be controlled via service management commands.
How do you check which processes are using a particular file?
Answer: lsof /path/to/file. fuser -v /path. These show process IDs and users. Useful for identifying which process holds a lock or is writing to a file.
What is the strace command used for?
Answer: strace traces system calls and signals made by a process. Useful for debugging “no such file” errors, permission issues, or performance bottlenecks. Example: strace -e open cat file.txt.
How do you compress and decompress files in Linux?
Answer: gzip: gzip file (creates file.gz), gunzip file.gz. bzip2: higher compression, slower. xz: highest compression. tar with compression: tar czf archive.tar.gz dir/ (gzip), tar xjf archive.tar.bz2 (bzip2). zip/unzip for Windows‑compatible archives.
What is the purpose of umask?
Answer: umask sets the default permissions for newly created files and directories (by subtracting from 666 and 777). Example: umask 022 gives new files 644 (rw-r–r–), directories 755. umask without argument shows current value.
How do you find all files modified in the last 24 hours?
Answer: find / -type f -mtime -1 2>/dev/null. mtime (modification time), -ctime (change time), -atime (access time). Use -mmin -1440 for minutes.
What is a Linux standard streams?
Answer: (Already covered) stdin (0), stdout (1), stderr (2).
Explain the difference between $@ and $* in shell scripting.
Answer: $@ expands each positional argument as a separate quoted string ("$1" "$2" "$3"). $* expands all arguments as a single string ("$1 $2 $3"). Use $@ to preserve argument boundaries, especially when arguments contain spaces.
What are the exit codes of a command?
Answer: Exit code 0 means success, non‑zero indicates error (different numbers can indicate different errors). Check with echo $? after a command. Shell scripts can exit 1 to signal failure.
How do you run a command in the background?
Answer: Append & to the command: long_running_command &. The job runs in background, shell prints job ID and PID. Use jobs to list, fg to bring to foreground, bg to resume background.
What is the nohup command?
Answer: nohup allows a command to continue running even after the user logs out (ignores HUP signal). Output is appended to nohup.out. Example: nohup long_script &.
How do you kill a process by name?
Answer: pkill process_name (sends SIGTERM), killall process_name, pkill -9 (SIGKILL). pgrep process_name to list PIDs first.
What is the difference between halt, poweroff, and shutdown?
Answer: halt stops all processes and halts the CPU (may not power off). poweroff halts and turns off power. shutdown -h now is a more graceful method that sends warnings to users. shutdown -r now reboots.
How do you check the kernel version?
Answer: uname -r (kernel release), uname -a (all system info). Also cat /proc/version.
What is the purpose of watch command?
Answer: watch runs a command repeatedly, displaying its output full‑screen. Useful for monitoring: watch -n 1 'df -h', watch -n 2 'ps aux'.
How do you search and replace text in a file?
Answer: Use sed: sed -i 's/old text/new text/g' file. -i edits in place. Also using awk, perl -pi -e, or vim in ex mode.
What is the difference between diff and patch?
Answer: diff compares files line by line and outputs differences. patch applies those differences to a file or directory. Workflow: diff -u original modified > changes.patch; patch original < changes.patch.
What is an alias in Linux?
Answer: Aliases are shortcuts for commands. Define in ~/.bashrc or ~/.bash_aliases: alias ll='ls -la'. Use alias to list. Remove with unalias.
How do you find the path of an executable?
Answer: which command (searches PATH), type command (shows if builtin or alias), whereis command (finds binary, source, man).
What is a .bashrc file?
Answer: ~/.bashrc is a shell script that runs for interactive non‑login bash shells. It sets aliases, functions, prompt, environment variables. Login shells read ~/.bash_profile first.
What is the difference between a login shell and a non‑login shell?
Answer: A login shell is started after user authentication (console, SSH). It reads /etc/profile and ~/.bash_profile. A non‑login shell is started from within a session (terminal emulator). It reads ~/.bashrc. Use echo $0 to see shell type.
How do you use awk to print specific columns?
Answer: awk '{print $1, $3}' file prints first and third columns (space‑separated). -F, for comma‑separated. Also awk 'NR>1 {print $2}' skips header line.
What is a here document?
Answer: A here document allows multi‑line input redirection. Example: cat << EOF > file.txt then lines, then EOF. Variables are expanded; use <<'EOF' to prevent expansion.
How do you check if a directory exists in a shell script?
Answer: if [ -d "/path" ]; then echo "exists"; fi. Other test operators: -f (file), -e (exists), -s (non‑empty), -r (readable), -w (writable), -x (executable).
What is the difference between $? and $$?
Answer: $? exit status of the last command. $$ process ID of the current shell.
What is a cron job?
Answer: A cron job is a scheduled task defined in crontab. Format: minute hour day month weekday command. * means any. Example: 0 2 * * * /usr/bin/backup.sh runs daily at 2 AM.
How do you set environment variables for all users?
Answer: Add to /etc/environment (simple key=value) or /etc/profile.d/ scripts (export statements). For systemd services, use Environment= directives.
What is the purpose of /tmp and how is it different from /var/tmp?
Answer: /tmp is for temporary files that are usually cleared on reboot (often mounted as tmpfs). /var/tmp persists across reboots (preserved). Both allow any user read/write access but with sticky bit to prevent deletion of others’ files.
What is a process ID (PID) and parent process ID (PPID)?
Answer: PID is a unique number identifying a process. PPID is the PID of the process that spawned it. The kernel assigns PIDs. The init process (systemd) has PID 1.
How do you check the open file limits for a process?
Answer: ulimit -n (soft limit for current shell). For a running process: cat /proc/<PID>/limits. lsof -p <PID> | wc -l shows open file count.
What are the signals in Linux? Name a few.
Answer: Signals are software interrupts. Common: SIGHUP (1) – hangup, SIGINT (2) – interrupt (Ctrl+C), SIGQUIT (3) – quit, SIGKILL (9) – kill, SIGTERM (15) – terminate, SIGSTOP (19) – stop, SIGCONT (18) – continue. Use kill -l to list.
How do you trace which files a process is accessing?
Answer: strace -e open,openat -p PID. Also lsof -p PID shows open files. auditd can track system calls.
What is ss command and why is it better than netstat?
Answer: ss (socket statistics) is faster, provides more detailed information, and is the modern replacement for netstat. It shows listening ports, connections, and socket state. Example: ss -tunlp.
How do you check system uptime?
Answer: uptime (load averages, time since boot). Also top or htop, and cat /proc/uptime.
How do you create a new group and add a user to it?
Answer: groupadd groupname, then usermod -aG groupname username. The -a (append) flag prevents removing user from other groups. Verify with id username.
What is the purpose of /etc/hosts?
Answer: /etc/hosts is a static file that maps hostnames to IP addresses, overriding DNS. Used for local resolution, blocking domains, and development.
How do you copy permissions from one file to another?
Answer: chmod --reference=source_file target_file. Also chown --reference=source target. Or use stat to read permissions and apply.
What is a Linux container (LXC)?
Answer: LXC (Linux Containers) is OS‑level virtualization that runs isolated Linux systems (containers) on a single host using kernel namespaces and cgroups. Lighter than virtual machines. Docker originally used LXC.
Why should we hire you as a Linux administrator?
Answer: I have deep understanding of Linux internals, command line proficiency, shell scripting, user and permission management, service configuration, and troubleshooting. I can automate tasks with cron and systemd timers, monitor performance, and secure systems using firewalls, SSH hardening, and auditing. I am comfortable with both RHEL and Debian families, and I continuously learn new tools like systemd, journalctl, and container orchestration. I solve problems systematically and document solutions.