Linux Tutorial: Learn Administration from Scratch (2026)
I started my career as a Windows administrator. The first time I was handed a Linux server, I typed dir and got nothing. I felt completely lost. But I persisted because Linux is the operating system of the cloud — every container, every cloud VM, every CI runner runs Linux. Learning Linux administration is the single most career-defining skill in DevOps. This tutorial covers the essential commands, filesystem layout, process management, networking, and scripting skills that every DevOps engineer uses daily. If you master these fundamentals, you can troubleshoot any server, automate any task, and understand how the tools you use really work under the hood.
The Linux Filesystem and Navigation
The Linux filesystem is a single tree starting at /. Unlike Windows drives C: and D:, everything — hard drives, USB devices, network shares — is mounted under this tree. The Filesystem Hierarchy Standard defines the purpose of each directory: /bin and /usr/bin for user binaries, /etc for configuration files, /var for variable data like logs and databases, /tmp for temporary files, and /home for user home directories. I use the phrase bin, etc, var, tmp, home to orient new learners. The proc filesystem at /proc exposes kernel data structures as files — cat /proc/cpuinfo shows CPU details. Knowing this layout helps you find configuration files quickly and write scripts that follow conventions. Use cd, ls, pwd for navigation; find and locate for searching; and tree for visual representation.
ls -la /etc/ | head -20
tree -d -L 2 /usr/local
find /var/log -name "*.log" -mtime -7
df -h /varUser Permissions and Ownership
Linux is multi-user from the ground up. Every file has an owner and a group, with read, write, and execute permissions for each of owner, group, and others. The chmod command modifies permissions symbolically or numerically. The numeric mode is additive: read=4, write=2, execute=1. chmod 755 gives owner rwx, group rx, others rx. I teach the special permissions too: setuid (chmod u+s) runs an executable with the owner's privileges — think passwd; setgid (g+s) on directories makes new files inherit the group; the sticky bit (o+t) on /tmp prevents users from deleting each other's files. ACLs provide finer-grained control with setfacl and getfacl. Umask defines default permissions for new files and directories. Understanding these is essential for security hardening.
chmod 750 /opt/myapp
chown appuser:appgroup /opt/myapp -R
ls -ld /tmp
getfacl /etc/shadowProcess Management and System Monitoring
Every running program is a process with a PID. The ps command lists processes; ps aux shows all processes with detailed information. The top and htop commands provide real-time process monitoring. Systemd replaced SysV init as the standard service manager in most distributions. Use systemctl to start, stop, enable, and check the status of services. journalctl reads the systemd journal — logs are centralized and structured. For resource monitoring, I rely on free -h for memory, df -h for disk, and netstat or ss for network connections. The /proc filesystem again: cat /proc/meminfo, cat /proc/loadavg. When a server is slow, my diagnostic sequence is: check load average, check memory, check disk I/O with iostat, check network with iftop, and finally check specific process resource usage.
ps aux --sort=-%mem | head -10
systemctl status nginx
journalctl -u nginx --since "1 hour ago" --no-pager
htopNetworking Configuration and Troubleshooting
Linux networking involves configuring interfaces, routing, DNS, and firewall rules. ip addr shows network interfaces and IP addresses — the modern replacement for ifconfig. ip route shows the routing table. ss -tlnp lists listening TCP sockets with their associated processes — my go-to command for checking if a service is running on the expected port. DNS resolution is configured in /etc/resolv.conf, though NetworkManager and systemd-resolved often manage it dynamically. The firewall is configured with iptables or its modern replacement nftables. Most distributions ship with ufw (Ubuntu) or firewalld (RHEL) as front-ends. For troubleshooting connectivity, I follow the path: ping, traceroute, ss, curl, and finally tcpdump or wireshark for packet-level analysis.
ip addr show eth0
ss -tlnp
curl -v http://localhost:8080/health
ping -c 4 google.comPackage Management and System Updates
Package managers install, update, and remove software while resolving dependencies. Debian-based distributions use apt (apt-get, apt-cache), and RHEL-based distributions use dnf (formerly yum). The package files are .deb and .rpm respectively. I keep a cheat sheet for the equivalents: apt update refreshes the package index, dnf update does the same. apt install nginx, dnf install nginx. apt remove vs dnf remove. dpkg and rpm are the low-level tools for querying installed packages and installing individual package files. Flatpak and Snap are gaining traction for desktop applications, and AppImage for portable apps. On servers, I configure unattended-upgrades for security patches and use a staging environment to test critical package updates before applying to production.
sudo apt update && sudo apt upgrade -y
sudo apt install nginx certbot python3-certbot-nginx
dpkg -l | grep nginx
sudo apt autoremove --purgeShell Scripting and Automation
The shell is the most powerful tool in a Linux administrator's arsenal. Bash scripting lets you automate repetitive tasks: log rotation, backup jobs, user creation, health checks. A script starts with #!/bin/bash and consists of variables, conditionals, loops, and functions. I use set -euo pipefail at the top of every script to exit on errors, catch undefined variables, and detect pipe failures. Scheduled tasks use cron — crontab -e edits the user's crontab. Systemd timers provide a more flexible alternative with logging and dependency management. I write wrapper scripts for complex systemctl operations and deployment workflows. Well-written shell scripts are readable, idempotent, and fail fast with meaningful error messages.
#!/bin/bash
set -euo pipefail
BACKUP_DIR="/var/backups/postgres"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
pg_dump mydb | gzip > "${BACKUP_DIR}/mydb_${TIMESTAMP}.sql.gz"
find "${BACKUP_DIR}" -name "*.sql.gz" -mtime +30 -delete
echo "Backup complete: mydb_${TIMESTAMP}.sql.gz"Frequently Asked Questions
Which Linux distribution should I start with?
Ubuntu is the most beginner-friendly with excellent documentation and a large community. For servers, either Ubuntu LTS or Rocky Linux (RHEL-compatible) are safe choices. I recommend starting with Ubuntu Desktop for daily use and Ubuntu Server for your lab environment. The concepts transfer across distributions.
How do I recover the root password on a Linux server?
Reboot into single-user mode or recovery mode by editing the GRUB boot parameters. Append init=/bin/bash or rd.break to the kernel line to get a root shell without a password. Once in, remount the filesystem as read-write and run passwd to set a new root password. This requires physical or console access — remote servers should use a recovery console provided by the cloud provider.
What is the difference between a hard link and a symbolic link?
A hard link is a directory entry pointing directly to the inode of the original file. Hard links cannot cross filesystem boundaries or point to directories. A symbolic link (symlink) is a special file that contains a path to the target file or directory. Symlinks can point anywhere, including different filesystems, and can be broken if the target is deleted.
How do I find which process is using a specific port?
Use ss -tlnp | grep :PORT to find the PID and process name. The -p flag shows the process. On older systems, use netstat -tlnp instead. Both require root to see process information for all users. For a specific port like 8080: sudo ss -tlnp | grep :8080 shows the listening process.
Originally published on Ayodhyyya. Last updated June 1, 2026.