WEBVTT 1 00:00:00.120 --> 00:00:02.359 You know, it's kind of incredible when you stop and 2 00:00:02.399 --> 00:00:06.000 think about it. So much of our digital world, I 3 00:00:06.000 --> 00:00:09.119 mean really, so much is built on something most people 4 00:00:09.160 --> 00:00:13.359 barely notice. Linux. You might not realize it, but it's 5 00:00:13.439 --> 00:00:18.519 literally everywhere your Internet router, proble, Linux, Android phone, yep, 6 00:00:18.600 --> 00:00:22.320 Linux kernel, even like smart thermostats and stuff. It's this 7 00:00:22.480 --> 00:00:23.920 silent workhorse. 8 00:00:24.079 --> 00:00:27.039 It really is the backbone for a huge amount of tech. 9 00:00:27.280 --> 00:00:29.559 Okay, so let's unpack this a bit, because, you know, 10 00:00:29.640 --> 00:00:32.119 for something that's so pervasive, jumping into Linux for the 11 00:00:32.119 --> 00:00:34.399 first time, it can feel really complex, like looking at 12 00:00:34.399 --> 00:00:37.039 this massive technical diagram. 13 00:00:36.679 --> 00:00:38.280 Definitely daunting at first glance. 14 00:00:38.359 --> 00:00:41.320 Yeah, but what if what if understanding just a few 15 00:00:41.359 --> 00:00:44.920 core ideas could actually give you this like superpower, real 16 00:00:44.920 --> 00:00:48.479 control and insight into how these digital systems actually work. 17 00:00:48.560 --> 00:00:50.960 Well, that's exactly what we're aiming for today. We've gone 18 00:00:50.960 --> 00:00:54.840 through a pretty hefty Linux certification guide and pulled out 19 00:00:54.880 --> 00:00:58.600 the absolute foundational stuff you need. Our mission basically is 20 00:00:58.640 --> 00:01:01.840 to demistify the Linux five system, gets you comfortable with 21 00:01:01.880 --> 00:01:05.239 some key command line tools, show you how to manage 22 00:01:05.319 --> 00:01:08.480 running programs, the actual processes, and also lay down the 23 00:01:08.480 --> 00:01:10.040 groundwork for essential security. 24 00:01:10.280 --> 00:01:13.200 So The goal isn't just memorizing commands. 25 00:01:12.760 --> 00:01:14.920 No, not at all. It's about understanding how it all 26 00:01:14.959 --> 00:01:17.719 fits together, turning that feeling of whoa, this is too 27 00:01:17.799 --> 00:01:22.359 much into those aha moments, really getting how Linux operates 28 00:01:22.400 --> 00:01:22.920 under the hood. 29 00:01:22.959 --> 00:01:25.400 All right, let's dive in. Where do we start? The 30 00:01:25.439 --> 00:01:26.120 ground floor? 31 00:01:26.159 --> 00:01:28.200 The ground floor is perfect. Yeah, let's talk about how 32 00:01:28.280 --> 00:01:32.799 Linux organizes information. It's structure unlike say Windows, where you 33 00:01:32.840 --> 00:01:34.799 often see different drives like CD. 34 00:01:34.680 --> 00:01:36.120 Whatever, multiple partitions. 35 00:01:36.159 --> 00:01:39.840 Yeah, Linux uses a single unified directory tree. Everything starts 36 00:01:39.840 --> 00:01:42.640 from the root, represented by a forward slash trick. And 37 00:01:42.680 --> 00:01:45.879 this whole structure follows a standard. It's called the File 38 00:01:45.959 --> 00:01:49.159 System Hierarchy Standard or FHS. 39 00:01:49.359 --> 00:01:49.840 FHS. 40 00:01:49.879 --> 00:01:53.040 Okay, so it's like a blueprint, exactly standardized blueprint. So 41 00:01:53.319 --> 00:01:55.840 whether you're on Fedora or open sets or a Buntu, 42 00:01:56.319 --> 00:01:58.560 you generally know where to look for things. Core system 43 00:01:58.599 --> 00:02:00.959 can fig files, they'll be in its own user home 44 00:02:01.000 --> 00:02:05.079 directories under home the kernel itself. Boot files they live 45 00:02:05.120 --> 00:02:09.599 in boot. This consistency is well, it's incredibly valuable. Makes 46 00:02:09.599 --> 00:02:11.840 an administration much more predictable. 47 00:02:11.400 --> 00:02:14.039 Like a universal address system for files. Then, and the 48 00:02:14.120 --> 00:02:16.319 main way you navigate this is using the shell right 49 00:02:17.159 --> 00:02:18.719 Bash usually yeah. 50 00:02:18.719 --> 00:02:21.599 The basa shell is your command line interface. It's where 51 00:02:21.639 --> 00:02:24.759 you type your commands. But it's worth asking, you know 52 00:02:25.000 --> 00:02:27.719 what actually happens when you type a command and press enter. 53 00:02:28.039 --> 00:02:29.599 How does the shell process that? 54 00:02:29.680 --> 00:02:30.199 Good question? 55 00:02:30.319 --> 00:02:33.479 That uses something called file descriptors. Every command inherently has 56 00:02:33.520 --> 00:02:37.400 three of these, standard input or stend in okay, input 57 00:02:37.639 --> 00:02:40.400 like the keyboard usually yeah. By default, stending comes from 58 00:02:40.400 --> 00:02:40.960 your keyboard. 59 00:02:41.039 --> 00:02:41.280 Yeah. 60 00:02:41.319 --> 00:02:44.199 Then their standard output stand out, which is the normal 61 00:02:44.240 --> 00:02:48.000 result of the command, and standard error stender for any 62 00:02:48.080 --> 00:02:50.759 error messages. And those both go to the screen by default. Yes, 63 00:02:51.080 --> 00:02:53.960 stid out and stender both display on your terminal. But 64 00:02:54.520 --> 00:02:56.719 and this is where gets really interesting. You can mess 65 00:02:56.719 --> 00:02:58.039 with these. You can redirect them. 66 00:02:58.080 --> 00:02:59.919 Redirect how so Well. 67 00:03:00.000 --> 00:03:02.680 Instead of sending the output to the screen, you can 68 00:03:02.719 --> 00:03:05.439 send it directly into a file. You use the symbol 69 00:03:05.439 --> 00:03:07.960 to overwrite a file or to just add the output 70 00:03:08.039 --> 00:03:08.680 to the end of it. 71 00:03:08.840 --> 00:03:12.520 Ah okay, So you can save command results easily. 72 00:03:12.240 --> 00:03:16.599 Exactly, and even more powerful, you can pipe output. Use 73 00:03:16.599 --> 00:03:19.439 the symbol the vertical bar to take the standard output 74 00:03:19.439 --> 00:03:21.960 of one command and use it directly as the standard 75 00:03:21.960 --> 00:03:23.120 input for another command. 76 00:03:23.280 --> 00:03:26.919 WHOA Okay, So you can chain commands together precisely. 77 00:03:27.000 --> 00:03:31.400 You build pipelines, filter data, process text, complex operations from 78 00:03:31.400 --> 00:03:35.919 simple building blocks. It's fundamental to the Unix philosophy. Really, 79 00:03:35.919 --> 00:03:37.039 it makes you way more efficient. 80 00:03:37.159 --> 00:03:39.479 I could see that. Well, let's be AHH has those 81 00:03:39.479 --> 00:03:41.960 wildcard things too, right, like oh yeah. 82 00:03:41.719 --> 00:03:45.639 Meta characters, Yeah, matches anything. Media matches a single character. 83 00:03:46.280 --> 00:03:48.560 Huge time savers when you're looking for files or working 84 00:03:48.599 --> 00:03:52.560 with multiple files at once. Knowing redirection, piping and meta 85 00:03:52.599 --> 00:03:54.240 characters really unlocks the command line. 86 00:03:54.280 --> 00:03:57.599 Okay, So with that power, what are the essential commands for? Just, 87 00:03:57.719 --> 00:04:00.240 you know, interacting with files day to day, listing them, 88 00:04:00.240 --> 00:04:01.159 seeing what's inside? 89 00:04:01.240 --> 00:04:03.319 All right, Well, you'll live in l's. That's for listing 90 00:04:03.319 --> 00:04:06.280 directory contents. Just l's gives you names, simple enough, but 91 00:04:06.560 --> 00:04:08.599 l's L is often what you really want. The LLL 92 00:04:08.719 --> 00:04:14.639 gives you a long listing shows permissions, owner, group size, modification, date, 93 00:04:15.360 --> 00:04:16.399 tons is useful info. 94 00:04:16.519 --> 00:04:19.040 Okay, that's the detailed view. If you're not even sure 95 00:04:19.040 --> 00:04:21.279 what kind of file something is like? Is it text? 96 00:04:21.399 --> 00:04:22.439 Is it a program? 97 00:04:22.680 --> 00:04:25.399 A good one? For that? You use the file command. 98 00:04:25.920 --> 00:04:28.199 Just file in a file name. It'll inspect the file 99 00:04:28.279 --> 00:04:32.120 until you it's best guess ye asci text ELF sixty 100 00:04:32.120 --> 00:04:35.560 four bit executable symbolic link, that kind of thing. It's 101 00:04:35.600 --> 00:04:37.160 like a quick detective tool neat. 102 00:04:37.399 --> 00:04:42.120 Okay, So we can list files, identify them. What about 103 00:04:42.120 --> 00:04:44.600 actually looking inside them? Assuming they're text files? 104 00:04:44.680 --> 00:04:47.240 Sure, for text you've got a few options. The cat 105 00:04:47.319 --> 00:04:49.680 just concatenates and displays the whole file to the screen. 106 00:04:50.240 --> 00:04:50.920 Quick and dirty. 107 00:04:50.959 --> 00:04:52.879 Okay. Good for short files, maybe. 108 00:04:52.680 --> 00:04:55.680 Yeah, exactly. For longer files, more is useful. It shows 109 00:04:55.720 --> 00:04:57.639 the file one page at a time. You hit spacebar 110 00:04:57.720 --> 00:05:00.360 to go down a page, Enter for a line, que quit. 111 00:05:00.680 --> 00:05:02.360 It even shows you the percentage viewed. 112 00:05:02.480 --> 00:05:02.920 Got it? 113 00:05:03.199 --> 00:05:07.079 But honestly, less is often preferred. There's like more but 114 00:05:07.199 --> 00:05:10.480 more powerful. You can scroll backwards as well as forwards 115 00:05:10.600 --> 00:05:14.040 using arrow keys or page upage down. Much more flexible 116 00:05:14.079 --> 00:05:16.639 For examining long files like logs. 117 00:05:16.480 --> 00:05:19.720 Less is more and searching within files if I'm looking 118 00:05:19.759 --> 00:05:21.839 for a specific word or error message. 119 00:05:21.879 --> 00:05:24.839 That's g REP stands for a global regular expression print. 120 00:05:25.000 --> 00:05:26.879 You give it a pattern and a file name, and 121 00:05:26.920 --> 00:05:30.240 it prints lines that match. Incredibly powerful, especially with the 122 00:05:30.240 --> 00:05:33.160 log files. There's also e g REP for extended patterns 123 00:05:33.160 --> 00:05:35.800 and f GP, which is faster for simple fixed strengths 124 00:05:35.800 --> 00:05:38.720 because it doesn't do the complex pattern matching crap. 125 00:05:38.839 --> 00:05:41.279 Okay, that sounds indispensable for troubleshooting. 126 00:05:41.319 --> 00:05:43.680 Oh absolutely, yeah, And then you have your basics dot 127 00:05:43.720 --> 00:05:47.279 CP to copy files, PP for copy, MV to move 128 00:05:47.319 --> 00:05:49.000 files or actually to rename them too. 129 00:05:49.439 --> 00:05:52.480 The rename okay, RM to remove. 130 00:05:52.240 --> 00:05:54.839 Files, be careful that one right RM is delete. And 131 00:05:54.879 --> 00:05:57.399 for directories ramder deer to make a directory, and are 132 00:05:57.480 --> 00:05:58.839 malage to remove an empty directory. 133 00:05:58.879 --> 00:06:02.199 Okay, standard stuff. Now you mentioned linking earlier, hard links 134 00:06:02.240 --> 00:06:05.319 and symbolic links. That sounds important, very important concept. Yeah. 135 00:06:05.720 --> 00:06:08.120 Linking lets you have multiple names point to the same 136 00:06:08.160 --> 00:06:12.759 actual data. Save space. Helps organize two types hard links 137 00:06:12.800 --> 00:06:13.839 and symbolic links. 138 00:06:14.120 --> 00:06:14.879 What's the difference? 139 00:06:15.279 --> 00:06:19.040 Okay, A hard link made with LNN filename link name 140 00:06:19.399 --> 00:06:22.560 is basically just another directory entry pointing to the exact 141 00:06:22.600 --> 00:06:26.279 same underlying data block on the disc card air the 142 00:06:26.319 --> 00:06:28.160 inode technically. 143 00:06:27.680 --> 00:06:31.000 So like two names for the very same file data exactly. 144 00:06:31.279 --> 00:06:33.399 And because of that, hard links have to be on 145 00:06:33.439 --> 00:06:36.360 the same filesystem, the same disc partition. If you delete 146 00:06:36.399 --> 00:06:38.839 the original filename, the data is still there as long 147 00:06:38.879 --> 00:06:41.600 as a hard link exists. That data only goes away 148 00:06:41.639 --> 00:06:43.519 when the last link pointing to it is removed. 149 00:06:43.839 --> 00:06:46.399 Interesting data sticks around. What about symbolic links? Then? 150 00:06:46.439 --> 00:06:49.680 Symbolic links or sim links made with LNS target file 151 00:06:49.720 --> 00:06:52.319 link name are different. They're more like shortcuts and windows 152 00:06:52.399 --> 00:06:55.079 or aliases on a Mac. A sim link is actually 153 00:06:55.120 --> 00:06:57.199 a tiny file that just contains the path to the 154 00:06:57.360 --> 00:06:58.639 target file or directory. 155 00:06:58.720 --> 00:07:01.000 Ah, so it's just a pointer exactly, It's. 156 00:07:00.800 --> 00:07:03.920 Just a pointer. Because of this, sim links can point 157 00:07:03.920 --> 00:07:07.600 across different filesystems. But the downside is if you delete 158 00:07:07.879 --> 00:07:11.279 or move the original target file, the semb link becomes broken. 159 00:07:11.720 --> 00:07:12.600 It points to nothing. 160 00:07:12.920 --> 00:07:15.519 Okay, So why choose one over the other. When would 161 00:07:15.519 --> 00:07:17.680 you use a hard link versus a symbolic one? 162 00:07:17.839 --> 00:07:22.480 Good question. It's about resilience versus flexibility. Hard links give 163 00:07:22.519 --> 00:07:25.360 you that data resilience on a single file system. The 164 00:07:25.439 --> 00:07:28.839 data won't disappear until all names are gone. Symbolic links 165 00:07:28.839 --> 00:07:32.160 give you massive flexibility, linking across disks, creating easy to 166 00:07:32.240 --> 00:07:36.639 update pointers, organizing complex structures without moving the actual data around. 167 00:07:36.959 --> 00:07:39.079 You choose based on whether you need the data backup 168 00:07:39.120 --> 00:07:42.120 inherent in hard links or the organizational flexibility of semb 169 00:07:42.120 --> 00:07:43.120 links makes sense. 170 00:07:43.279 --> 00:07:46.800 Resilience on one desk versus flexible pointing anywhere pretty much. Okay, 171 00:07:46.800 --> 00:07:49.319 so we've mapped the territory with fahs. We've got tools 172 00:07:49.360 --> 00:07:53.600 like l's kat grap ln. But any shared system needs rules, 173 00:07:53.680 --> 00:07:56.800 right Who gets to actually use these tools on which files? 174 00:07:57.079 --> 00:07:58.839 That sounds like permissions precisely. 175 00:07:59.079 --> 00:08:01.959 File permissions are the aid keepers. Every single file and 176 00:08:02.000 --> 00:08:05.839 directory in Linux has permissions defined for three categories of users. 177 00:08:06.000 --> 00:08:07.240 Three categories, yep. 178 00:08:07.279 --> 00:08:10.319 First, the actual user who owns the file, usually the 179 00:08:10.319 --> 00:08:13.360 person who created it. Second, the group that owns the file, 180 00:08:13.839 --> 00:08:16.879 think of groups like teams or departments. And third everyone 181 00:08:16.959 --> 00:08:18.759 else on the system, often just called. 182 00:08:18.600 --> 00:08:22.639 Other user group other. Okay, and what permissions can they have. 183 00:08:23.079 --> 00:08:25.959 For each of those three categories? User group, other? You 184 00:08:26.000 --> 00:08:30.439 can grant or deny three basic permissions read, write, and execute, 185 00:08:30.800 --> 00:08:33.080 often shown as r W and X. 186 00:08:33.480 --> 00:08:37.639 Read write execute r WX makes sense for files, Read 187 00:08:37.720 --> 00:08:41.519 means view, right means change. Execute means run if it's 188 00:08:41.559 --> 00:08:45.480 a program. What about for directories? Execute seems weird for 189 00:08:45.519 --> 00:08:46.679 a directory. 190 00:08:46.240 --> 00:08:49.399 That's a key point. For a directory, execute permission means 191 00:08:49.399 --> 00:08:51.960 something different. It means you're allowed to enter the directory 192 00:08:52.080 --> 00:08:54.600 like using the CD command. If you also have red 193 00:08:54.600 --> 00:08:57.440 permission on the directory, you can list its contents with LS, 194 00:08:57.799 --> 00:08:59.639 but without execute you can't even get inside. 195 00:09:00.039 --> 00:09:03.240 Ah, okay, execute, let's you traverse into the directory. Got it? 196 00:09:03.480 --> 00:09:05.720 So how do we change these permissions. 197 00:09:05.320 --> 00:09:09.559 With the chmud command change mode? You can use symbolic notation, 198 00:09:09.720 --> 00:09:12.480 which is maybe more intuitive at first, like chmud U 199 00:09:12.600 --> 00:09:15.240 plus x file name adds execute permission for the user, 200 00:09:15.559 --> 00:09:18.679 GW removes right for the group. Jerry R sets other 201 00:09:18.679 --> 00:09:20.000 permissions to only read. 202 00:09:20.080 --> 00:09:24.679 User, group other dot. Yougo plus minus equals okay. 203 00:09:24.840 --> 00:09:27.159 Or and this is very common, you use numeric occal codes. 204 00:09:27.600 --> 00:09:30.480 Each permission gets a number. Read is four, right is 205 00:09:30.519 --> 00:09:33.559 to execute is one. You add them up for each category. 206 00:09:33.200 --> 00:09:35.639 So read and wright would be four plus two equals six. 207 00:09:35.799 --> 00:09:38.600 Exactly, read write execute is four plus two plus one 208 00:09:38.600 --> 00:09:41.440 equal seven. Read and execute is four plus one eqals five. 209 00:09:41.759 --> 00:09:44.480 So the very common permission set is to mode seven 210 00:09:44.519 --> 00:09:45.519 five file. 211 00:09:45.360 --> 00:09:47.840 Name seven fifty five okay. Seven for the user read 212 00:09:47.879 --> 00:09:51.080 write execute, five for the group read execute, and five 213 00:09:51.120 --> 00:09:52.279 for others read. 214 00:09:52.039 --> 00:09:54.320 Execute You got it. It seems our kane at first, 215 00:09:54.320 --> 00:09:56.720 but you get used to it fast and getting permissions wrong. 216 00:09:57.039 --> 00:09:59.559 It's a huge source of security problem, so understanding mode 217 00:09:59.639 --> 00:10:01.200 is critical definitely. 218 00:10:00.919 --> 00:10:03.840 Now I remember reading about special permissions too, suid and 219 00:10:03.840 --> 00:10:04.360 things like that. 220 00:10:04.399 --> 00:10:07.519 Ah. Yes, Beyond the basic arius there are special permission bits. 221 00:10:07.799 --> 00:10:11.440 The SUID bit or set user id bit is fascinating. 222 00:10:11.600 --> 00:10:13.679 If you set this on an executable. 223 00:10:13.080 --> 00:10:15.559 File only executables, right when a. 224 00:10:15.519 --> 00:10:18.399 Regular user runs that file, the process runs not with 225 00:10:18.440 --> 00:10:21.519 their permissions, but with the permissions of the owner of 226 00:10:21.559 --> 00:10:22.000 the file. 227 00:10:22.240 --> 00:10:24.159 WHOA why would you want that? 228 00:10:24.440 --> 00:10:27.879 Think about the password command you need to change your password, 229 00:10:28.120 --> 00:10:31.480 which involves modifying the protected etsetter shadow file. You don't 230 00:10:31.519 --> 00:10:34.720 have permission right there, but the password program is owned 231 00:10:34.720 --> 00:10:38.840 by Route and has the suid bit set, so when 232 00:10:38.879 --> 00:10:41.519 you run it, it temporarily runs as Route just to 233 00:10:41.600 --> 00:10:42.759 change your password safely. 234 00:10:42.879 --> 00:10:46.440 Ah okay, controlled privileged escalation. Very clever. 235 00:10:46.679 --> 00:10:50.759 Very There's also the SGID bit set group ID, which 236 00:10:50.799 --> 00:10:54.679 works similarly for group permissions and is especially useful on directories. 237 00:10:55.399 --> 00:10:58.399 If SGID is set on a directory, any new file 238 00:10:58.480 --> 00:11:03.039 or subdirectory created inside it automatically inherits the directory's group ownership, 239 00:11:03.159 --> 00:11:06.279 not the user's primary group. Great for shared project folders. 240 00:11:06.480 --> 00:11:08.440 Keeps everything in the right group automatically. 241 00:11:08.600 --> 00:11:11.080 Nice and the sticky bit. You often see this on 242 00:11:11.159 --> 00:11:14.080 shared directories like tabaquin. If the sticky bit is set 243 00:11:14.120 --> 00:11:16.799 on a directory, a user can only delete or rename 244 00:11:16.840 --> 00:11:19.440 files within that directory if they own the file, even 245 00:11:19.480 --> 00:11:21.720 if they have right permission on the directory itself. 246 00:11:21.840 --> 00:11:23.759 So I can put files in TAMP. You can put 247 00:11:23.799 --> 00:11:27.200 files in TAMP, but I can't delete your files, even 248 00:11:27.240 --> 00:11:30.200 though we can both write to the directory exactly. 249 00:11:30.399 --> 00:11:33.399 It prevents users from messing with each other's stuff in 250 00:11:33.440 --> 00:11:35.919 a common space like a bubble locker room. 251 00:11:35.960 --> 00:11:38.799 Okay, this is getting deep. What about protecting files even 252 00:11:39.080 --> 00:11:44.480 from accidental deletion by the root user? If root can 253 00:11:44.480 --> 00:11:45.960 bypass normal permissions. 254 00:11:46.200 --> 00:11:48.399 That's where file attributes come in. Yeah, managed by the 255 00:11:48.480 --> 00:11:51.600 check at command. These are separate from the standard artob permissions. 256 00:11:51.759 --> 00:11:55.120 One really important attribute is immutable. If you set chat 257 00:11:55.159 --> 00:11:57.000 tree plus i on. 258 00:11:57.000 --> 00:11:59.600 A file, plus i for immutable, right, that. 259 00:11:59.519 --> 00:12:02.919 File can be modified, deleted, renamed, or even linked to 260 00:12:03.320 --> 00:12:07.000 even by the root user until someone explicitly removes that attribute. 261 00:12:07.000 --> 00:12:10.399 With chat tree, it's like a superlock essential for protecting 262 00:12:10.519 --> 00:12:12.679 really critical system configuration files. 263 00:12:12.759 --> 00:12:15.320 Wow. Okay, so chatplus i is serious protection. 264 00:12:15.480 --> 00:12:18.799 It is an extra layer against mistakes or even malicious actions. 265 00:12:18.879 --> 00:12:23.039 All right, we've covered the static landscape, files, directories, permissions, attributes. 266 00:12:23.240 --> 00:12:27.519 But Linux isn't static, right, It's alive with running programs processes. 267 00:12:27.559 --> 00:12:28.519 How do we manage those? 268 00:12:28.799 --> 00:12:32.200 Yeah? Processes are the dynamic part. Everything running is a process. 269 00:12:32.559 --> 00:12:35.519 Each one gets a unique number. It's process ID. 270 00:12:35.440 --> 00:12:37.759 Or PID PID unique number. 271 00:12:37.559 --> 00:12:40.559 And every process except the very first one also has 272 00:12:40.559 --> 00:12:44.080 a parent process ID, the PPID that's the PID of 273 00:12:44.080 --> 00:12:45.159 the process that started it. 274 00:12:45.240 --> 00:12:47.200 So there's a family tree exactly. 275 00:12:47.600 --> 00:12:50.240 You can trace the lineage of any process back up 276 00:12:50.240 --> 00:12:54.039 through its parents. And the ultimate ancestor PID one is 277 00:12:54.080 --> 00:12:58.559 the NIT process or on most modern systems systemed it's 278 00:12:58.600 --> 00:13:01.039 the first process started by the current a boot, and 279 00:13:01.080 --> 00:13:02.600 it's the ancestor of everything else. 280 00:13:02.679 --> 00:13:04.080 Can you actually see that tree? 281 00:13:04.159 --> 00:13:07.200 Yep? The street command displays it visually. Should you which 282 00:13:07.200 --> 00:13:11.799 process spond? Which really helpful for understanding relationships, especially something 283 00:13:11.840 --> 00:13:13.000 unexpected is running? 284 00:13:13.039 --> 00:13:15.399 Cool? So how do we just see what's running now? 285 00:13:15.440 --> 00:13:18.759 The main command is PS for Process status. Just PS 286 00:13:18.759 --> 00:13:21.720 by itself usually shows only processes running in your current terminal. 287 00:13:22.200 --> 00:13:24.320 Not very useful, Okay, So what options do we need? 288 00:13:24.519 --> 00:13:27.600 Common ones are psee to show every process on the system, 289 00:13:28.039 --> 00:13:30.799 or PSO, which is a popular combination, giving lots of 290 00:13:30.840 --> 00:13:34.639 detail in the user friendly format. Ps gives a long, 291 00:13:34.759 --> 00:13:39.159 more technical format. PSF gives a full format, often showing 292 00:13:39.159 --> 00:13:40.080 the parent PID. 293 00:13:40.440 --> 00:13:43.559 PSO seems like a good starting point then, but that's 294 00:13:43.600 --> 00:13:45.679 just a snapshot, right. What if I want to see 295 00:13:45.679 --> 00:13:48.320 what's happening in real time, like which process is suddenly 296 00:13:48.360 --> 00:13:49.440 eating all the CPU? 297 00:13:49.720 --> 00:13:53.080 Ah for that? Your go to is TOP. It's a dynamic, 298 00:13:53.200 --> 00:13:57.279 real time view of running processes. It updates continuously, usually 299 00:13:57.360 --> 00:14:01.240 sorted by CPU usage. By default, you can see memory usage, 300 00:14:01.399 --> 00:14:05.159 uptime load average. It's the system administrator's dashboard TOP. 301 00:14:05.440 --> 00:14:07.159 That's how you spot a runaway. 302 00:14:06.759 --> 00:14:10.159 Process exactly identify the resource ocs now. Once you see 303 00:14:10.200 --> 00:14:12.440 these processes, how do you manage them? Sometimes the command 304 00:14:12.480 --> 00:14:14.279 takes a long time and it just sits there in 305 00:14:14.320 --> 00:14:15.720 your terminal right the. 306 00:14:15.679 --> 00:14:17.279 Foreground Yeah, ties up the prompt. 307 00:14:17.320 --> 00:14:19.080 You can run a command in the background by just 308 00:14:19.120 --> 00:14:22.120 adding an amper sand at the end of theman line. 309 00:14:22.440 --> 00:14:25.559 Just then hit enter. The command starts, The system gives 310 00:14:25.559 --> 00:14:27.960 you a job number and the PID, and you immediately 311 00:14:28.000 --> 00:14:31.120 get your shell prompt back. You can keep working. Simple 312 00:14:31.480 --> 00:14:33.639 but incredibly useful for multitasking. 313 00:14:33.960 --> 00:14:37.919 Backgrounding with enter. Okay. What if a process foreground or 314 00:14:37.960 --> 00:14:41.679 background is stuck or misbehaving, how do I stop it? 315 00:14:41.919 --> 00:14:44.879 You kill it using the kill command. But kill is 316 00:14:44.919 --> 00:14:47.679 a bit of a misnomer. You're actually sending a signal 317 00:14:47.720 --> 00:14:48.000 to the. 318 00:14:47.960 --> 00:14:50.799 Process, signals like telling it what to do, kind of. 319 00:14:51.039 --> 00:14:53.480 There are many different signals. The default signal if you 320 00:14:53.519 --> 00:14:57.000 just type kill pid is sigturn signal number fifteen. This 321 00:14:57.080 --> 00:15:00.559 is a plight request, please terminate gracefully. It gives the 322 00:15:00.600 --> 00:15:04.480 process a chance to shut down cleanly, save data, release resources. 323 00:15:04.480 --> 00:15:06.399 Hey, the nice way sigterm right. 324 00:15:06.639 --> 00:15:09.559 But sometimes a process ignores sigterm or is totally frozen. 325 00:15:09.799 --> 00:15:12.960 Then you bring out the big gun, sigkill signal number nine, 326 00:15:13.159 --> 00:15:14.679 kill number nine PID. 327 00:15:14.399 --> 00:15:15.720 The famous kill mon of nine. 328 00:15:15.799 --> 00:15:18.759 That's the one sigkill is into requests and order directly 329 00:15:18.799 --> 00:15:22.600 to the colonel, terminate this process immediately. Now the colonel 330 00:15:22.639 --> 00:15:25.000 just yanks its resources away. It doesn't get a chance 331 00:15:25.000 --> 00:15:27.440 to clean up. It's forceful. Use it when sigterm fails. 332 00:15:27.799 --> 00:15:30.679 Hard reset for a process. Got it? What about running 333 00:15:30.720 --> 00:15:32.960 things later? Not now, not in the background, but like 334 00:15:33.519 --> 00:15:34.840 tomorrow at two. 335 00:15:34.679 --> 00:15:39.399 Am, scheduling for one time tasks in the future. You 336 00:15:39.519 --> 00:15:42.159 use the at command and it's damon at FALB. You'd 337 00:15:42.159 --> 00:15:44.679 say something like it two point am tomorrow, hit enter, 338 00:15:44.960 --> 00:15:47.200 then type the commands you want to run one per line, 339 00:15:47.480 --> 00:15:49.799 Press foryal plus D when you're done, and it just 340 00:15:50.080 --> 00:15:53.000 remembers ye AT wakes up at the specified time and 341 00:15:53.080 --> 00:15:55.000 runs your commands. It gives you a job I D 342 00:15:55.080 --> 00:15:56.840 when you schedule it, so you can check the queue 343 00:15:56.840 --> 00:15:58.759 of that queue or remove a job with that room. 344 00:15:58.720 --> 00:16:01.399 At for one off future ta asks. What about repetitive 345 00:16:01.399 --> 00:16:03.159 stuff like run a backupscript every. 346 00:16:03.080 --> 00:16:05.879 Night for recurring tasks. That's the job of the kron 347 00:16:05.960 --> 00:16:09.879 demon Trond. It reads configuration files called kron tables or 348 00:16:10.000 --> 00:16:11.320 kron tabs corontabs. 349 00:16:11.360 --> 00:16:11.639 Okay. 350 00:16:11.639 --> 00:16:13.840 Each line in a corontab specifies a schedule in a 351 00:16:13.879 --> 00:16:17.519 command as six fields minute zero five nine hour zero 352 00:16:17.519 --> 00:16:20.320 twenty three, day of the month, one thirty one month, 353 00:16:20.360 --> 00:16:23.320 one twelve, day of the week zero seven we're both 354 00:16:23.360 --> 00:16:25.600 zero zero and seven or Sunday, and then the command to. 355 00:16:25.639 --> 00:16:28.679 Run whoa okay, minute, our day, month, day of week. 356 00:16:28.720 --> 00:16:30.799 Command precise scheduling. 357 00:16:30.759 --> 00:16:34.399 Very precise. There's a system wide corontab usually et cetera 358 00:16:34.480 --> 00:16:37.320 tab and each user can also have their own personal 359 00:16:37.399 --> 00:16:40.879 contab managed with the corontab e command. This is how 360 00:16:40.879 --> 00:16:43.799 cissimmins automate pretty much all routine maintenance. 361 00:16:43.919 --> 00:16:47.600 Kron for automation makes sense. Now, all this process management, 362 00:16:47.639 --> 00:16:51.559 file ownership, permissions, it all comes back to users in 363 00:16:51.639 --> 00:16:52.279 groups right. 364 00:16:52.440 --> 00:16:56.559 Absolutely. Linux is fundamentally a multi user system. It needs 365 00:16:56.600 --> 00:16:59.159 to know who is who. Every user account has a 366 00:16:59.240 --> 00:17:02.799 unique user ID or UID. Every group has a unique 367 00:17:02.799 --> 00:17:04.279 group ID or GID. 368 00:17:04.640 --> 00:17:07.759 UID and GID numbers identify users and groups. 369 00:17:07.880 --> 00:17:11.000 Correct the mapping between user names and UIDs. Plus basic 370 00:17:11.079 --> 00:17:14.079 info like their home directory and default login shell is 371 00:17:14.119 --> 00:17:15.680 stored in the et cetera pass wood. 372 00:17:15.519 --> 00:17:17.519 File, et cetera. Past I've heard of thought, does it 373 00:17:17.559 --> 00:17:18.640 actually have passwords in it? 374 00:17:18.880 --> 00:17:20.920 Not anymore. That used to be the case long ago, 375 00:17:21.039 --> 00:17:24.279 big security risk. Now the encrypted passwords, along with password 376 00:17:24.319 --> 00:17:26.720 aging policies and stuff like that, are stored in a separate, 377 00:17:26.799 --> 00:17:30.119 highly protected file etcetera shadow. Only rood can read. 378 00:17:30.000 --> 00:17:33.519 It, ETCETERA shadow for the secret stuff. Good? What about groups? 379 00:17:33.799 --> 00:17:37.680 Group definitions? The group name, the GID and which users 380 00:17:37.720 --> 00:17:40.119 are members of that group are in the etcetera group file. 381 00:17:40.039 --> 00:17:42.960 Et cetera pass good, etcetera shadow etcetera group, the core 382 00:17:43.079 --> 00:17:43.960 identity file. 383 00:17:43.880 --> 00:17:45.559 Those of the main ones. Yeah. Yeah. When you create 384 00:17:45.599 --> 00:17:48.160 a file, its owner is your UID and its group 385 00:17:48.200 --> 00:17:51.039 owner is typically your primary group, which is also defined 386 00:17:51.039 --> 00:17:55.240 in etcetera. Pass route. Admins use commands like userrad, user mod, 387 00:17:55.400 --> 00:17:59.119 pass route group pad group mod to manage all these accounts. 388 00:17:58.759 --> 00:18:02.240 And groups, and you mention groups being important for permissions. Yeah, 389 00:18:02.400 --> 00:18:05.279 any specific examples like that? Wheel group, right. 390 00:18:05.400 --> 00:18:08.079 The Wheel group is a common convention on many systems. 391 00:18:08.680 --> 00:18:11.319 Often only users who are members of the Wheel group 392 00:18:11.640 --> 00:18:14.519 are allowed to use commands like sue to switch user 393 00:18:14.599 --> 00:18:17.519 often to root, or pseudo to execute a command as 394 00:18:17.519 --> 00:18:19.000 another user, again usually root. 395 00:18:19.160 --> 00:18:21.559 So being in wheel gives you admin privileges. 396 00:18:21.680 --> 00:18:25.279 Essentially, it's a mechanism for delegating admin privileges. Instead of 397 00:18:25.359 --> 00:18:28.359 giving everyone the root password, you put trusted users in 398 00:18:28.440 --> 00:18:31.000 the Wheel group and configure pseudo to let them run 399 00:18:31.079 --> 00:18:34.440 specific commands as root, usually after re entering their own password. 400 00:18:34.799 --> 00:18:35.599 Much more secure and. 401 00:18:35.599 --> 00:18:39.960