Linux administration final review cheat sheet

The chapter on one page, and the whole course in a table: where each skill lives, so you can find the right chapter when a real fault shows up.

The chapter in eight sentences

Write the service contract first: each requirement gets a named proof.
Four kinds of proof: configuration, live inspection, a client operation, and a lifecycle test after a reboot.
Build in order: identity and software, content and labels, the service, the network, then logs and recovery; test after every step.
Diagnose with one method: state the failure, take a narrow baseline, rank hypotheses, change one thing, repeat the failing request.
Refused means nothing listens, no route means the firewall rejected, a timeout means a drop, and 403 means mode, ACL or label.
A port that httpd cannot bind needs semanage port; content needs a stored semanage fcontext and restorecon.
Back up with tar --acls --selinux, restore into a staging directory, replace only what is needed, and test the restore.
Write the handover: purpose, changes, operation, recovery, known failures and the limits of your testing.

Symptom	Go to
Cannot log in, wrong owner or mode	accounts, permissions
Service stopped or failing	services, logs
SSH problems	SSH
No network, wrong name	networking
Package or repository	dnf
403 or a failed bind	SELinux
Full or missing disk	storage, LVM
Remote files	NFS and autofs
Blocked connection	firewall
Container service	containers

Layer	Commands
Identity	`id`, `ls -l`, `getfacl`
Service	`systemctl status
Network	`ss -tlnp`, `firewall-cmd --list-all`, `curl -m 3`
SELinux	`getenforce`, `ls -Z`, `semanage port
Recovery	`systemctl list-timers`, `tar -tzf`, `sha256sum`

The four kinds of proof?: Configuration (saved intent) · live inspection · a client operation · a lifecycle test after reload or reboot
Build order?: Contract → identity and software → files, labels, service → network → persistence and recovery
The diagnosis loop?: State the failure → narrow baseline → rank hypotheses → one change → repeat the failing request → record
refused / no route / timeout?: Not listening / firewall reject / dropped
403 on the portal?: Mode and ACL for apache, the SELinux label (restorecon), the path
Service will not bind a port?: semanage port -a -t http_port_t -p tcp PORT, then restart
Label the content permanently?: semanage fcontext -a -t httpd_sys_content_t "/srv/portal(/.*)?" · restorecon -Rv /srv/portal
One caller only?: Zone with --add-source=IP and --add-port=PORT/tcp, then --reload
Scheduled backup?: oneshot service + timer with OnCalendar=daily, Persistent=true; tar --acls --selinux
Safe restore?: Unpack to a staging directory · inspect · cp -a --preserve=all · restorecon -v · repeat the request
Handover?: Purpose · changes · operation · recovery · known failures · limits
Next?: Automate the manual state with Ansible