CompTIA A+ · Operating Systems
The Linux commands, configuration files, and OS components a technician must know for A+ — from file operations and permissions to package management, network tools, and the files that control how the system works.
35 min read · Linux on the Desktop
// CHECK YOUR KNOWLEDGE
Linux is the third workstation in the A+ scope — after Windows and macOS — and the lesson that most closely resembles a vocabulary exercise. The A+ exam tests command names and their primary functions; you will not be asked to write shell scripts or administer a server. What you will be asked: which command lists directory contents, which file stores hashed passwords, which package manager belongs to Ubuntu vs Red Hat, and what makes sudo safer than su. This lesson gives you exactly that map.
Two commands establish where you are and what is around you.
ls — list directory contents. Running ls alone lists the files and directories in the current location. Two flags to know:
ls -l — long format; shows permissions, owner, file size, and modification date for each itemls -a — show all files, including hidden files. Linux hides files whose names begin with a dot (.bashrc, .ssh/) — these are called dotfiles. The -a flag reveals them.Flags combine: ls -la shows all files in long format.
pwd — print working directory. Shows the full absolute path of the directory you are currently in. When navigating a deep filesystem tree, pwd tells you exactly where you are.
▸ EXAM TIP
ls flags: ls -l = long format (permissions, owner, size, date); ls -a = include hidden files (dotfiles, which start with .). pwd = print working directory — shows your current location as a full path.
mv — move or rename. mv source destination moves a file to a new location. When source and destination are in the same directory with different names, it renames the file in place. mv report.txt archive/report.txt moves; mv report.txt summary.txt renames.
cp — copy. cp source destination copies a file. For directories, use cp -r (recursive) to copy the directory and all its contents — without -r, cp cannot copy a directory.
rm — remove (delete). rm filename deletes a file. Two flags to know:
rm -r — recursive; deletes a directory and everything inside itrm -f — force; removes files without confirmation, including read-only files▸ WARNING
rm deletes permanently. Unlike Windows File Explorer or macOS Finder, rm from the command line does not send files to a Recycle Bin or Trash — deletion is immediate and irreversible without a backup. rm -rf is the most dangerous combination: it recursively force-deletes a directory tree with no confirmation and no recovery path. Verify the path before running it.
Linux controls access to files through three permission types — read, write, and execute — applied to three categories: the file's owner, the owner's group, and other (everyone else).
chmod — change file permissions. The A+ exam tests the numeric notation system:
| Permission | Symbol | Numeric value | |---|---|---| | Read | r | 4 | | Write | w | 2 | | Execute | x | 1 |
Add the values to get the permission for each category. 7 = 4+2+1 = read, write, execute. 5 = 4+1 = read and execute (no write). 6 = 4+2 = read and write (no execute).
A three-digit chmod value sets permissions for owner, group, and other — in that order:
chmod 755 script.sh → owner gets 7 (rwx), group gets 5 (r-x), other gets 5 (r-x) — common for executable scriptschmod 644 file.txt → owner gets 6 (rw-), group gets 4 (r--), other gets 4 (r--) — common for documents▸ EXAM TIP
chmod numeric values — memorize these three:
chmod 755 = owner rwx (4+2+1), group r-x (4+1), other r-x (4+1)chmod 755 is the classic permission for a script that everyone can run but only the owner can editchown — change file owner (and optionally group). chown user:group filename sets both; chown alice file.txt changes owner only. Requires root or sudo to run.
grep — search file contents for a pattern. grep "pattern" filename prints every line that matches. Commonly used in a pipeline to filter another command's output:
cat /var/log/syslog | grep "error"
This passes the output of cat into grep, which filters it to lines containing "error". grep searches inside files — it operates on content.
find — search for files or directories. find /path -name "filename" searches the specified directory tree for items matching the name. Unlike grep, find searches the filesystem by file name, type, or other attributes — not by file contents.
▸ NOTE
grep vs find:
grep searches inside files (content matching)find searches for files (name, type, location)"Find all files named config.txt" → find. "Search a log file for lines containing 'failed'" → grep.
fsck (filesystem check) — checks a filesystem for errors and attempts repairs. It is the Linux equivalent in function to Windows chkdsk (covered in the Core 1 ts-storage lesson). The critical constraint: fsck must be run on an unmounted filesystem. Running fsck on a mounted, active partition risks data corruption — the OS may be writing to the disk while fsck is checking it. Unmount the partition first, or run fsck at boot before filesystems are mounted.
mount — attaches a filesystem to a directory in the Linux filesystem tree. In Linux, all storage — drives, devices, network shares — is accessed through a single unified tree rooted at /. To use a USB drive, you mount it to a directory (the "mount point") and its contents appear there. umount detaches a mounted filesystem — note the spelling: no 'n', not "unmount" — flag for verification.
▸ EXAM TIP
fsck must run on an unmounted filesystem — running it on an active, mounted partition risks corruption. umount (no 'n') detaches a mounted filesystem — this spelling trips up technicians who expect "unmount."
Linux has a superuser called root with unrestricted access to every file, process, and configuration on the system. Two commands manage access to that power:
su — switch user. su alone switches to the root account (requires root's password). su username switches to a specific user. After su root, every subsequent command in that shell runs as root until you type exit. The root shell prompt is #; a regular user's prompt is $.
sudo — superuser do. Executes one command with root privileges, then returns you to your regular session. sudo apt update runs as root, then the privilege expires. Sudo is safer than su for two reasons: it is per-command (you do not stay root afterward) and it logs every command executed with sudo to the system log — providing an audit trail of who ran what elevated command.
▸ WARNING
Never log in directly as root for daily use. Root can accidentally delete critical system files or be exploited by malware with no safeguards. Use sudo for individual elevated commands and a regular user account for everything else.
▸ EXAM TIP
su vs sudo:
su = switches user entirely; the whole subsequent shell session runs as that user; no per-command loggingsudo = elevates one command; returns to regular session automatically; every sudo command is loggedExam scenario: "An administrator needs to determine which elevated commands were recently run on a Linux machine." The answer involves sudo logging, not su.
Root's home directory is /root — not /home/root. Regular user home directories live under /home/username (e.g., /home/alice). Root's home is separate from the /home tree by design — flag the /root path for verification.
Linux software is distributed through package managers — tools that download, install, update, and remove software from official repositories. The correct package manager depends on the distribution family:
apt (Advanced Package Tool) — used on Debian and Ubuntu-based distributions. Key commands:
apt update — refreshes the local list of available packages from the repository (does not install anything)apt upgrade — installs available updates for all installed packagesapt install [package] — installs a specific package (e.g., sudo apt install curl)dnf (Dandified YUM) — used on Red Hat, Fedora, and CentOS distributions. It is the successor to the older yum command — flag the predecessor relationship for verification. Key commands:
dnf install [package] — installs a packagednf update — updates installed packages▸ EXAM TIP
Package manager → distribution family:
apt = Debian and Ubuntu familydnf = Red Hat, Fedora, CentOS family (successor to yum)Exam pattern: the scenario names the distro — Ubuntu → apt install; RHEL or Fedora → dnf install. The distribution name in the scenario is the cue.
ip — the modern network configuration tool. Replaces the older ifconfig command — flag this replacement for verification. Common uses:
ip addr — shows network interfaces and their assigned addresses ( and )ip route — shows the routing tableping — tests network reachability using , exactly as on Windows. You covered the ICMP concept in the Core 1 Networking module — the Linux command name is identical: ping.
curl — transfers data to or from a URL. Used to test and endpoints from the command line: curl https://example.com fetches the page. curl -I https://example.com shows only the HTTP response headers without the body — flag the -I flag for verification. Used to verify that a web server or API is responding.
dig — lookup tool. Queries DNS servers to resolve a domain: dig example.com. It is the Linux equivalent in function to the Windows nslookup command covered in the Core 1 Networking module.
traceroute — traces the network path to a destination, showing each hop. It is the Linux equivalent of the Windows tracert command covered in the Core 1 ts-network lesson. Note the name difference: Windows = tracert; Linux = traceroute.
▸ EXAM TIP
Linux network command equivalents:
ip addr replaces ifconfig for showing IP addressesdig = Linux equivalent of Windows nslookuptraceroute = Linux equivalent of Windows tracertWhen a Core 1 networking concept (DNS lookup, trace route, ping) appears in a Linux scenario, the Linux command name is the exam answer.
man — manual pages. man [command] opens the full documentation for any Linux command — syntax, all flags, description, and examples. Press q to quit the man page viewer and return to the terminal — flag the quit key for verification.
cat — display file contents. cat filename prints the file to the terminal. Also concatenates multiple files: cat file1.txt file2.txt outputs both in sequence.
top — real-time process viewer. Shows running processes with live and memory usage, updated continuously. Press q to quit. The closest Linux equivalent to Windows 's Processes tab.
ps — list running processes (, not live). ps aux is the common form: a shows all users' processes, u shows the owning user for each process, x includes processes not attached to a terminal. Unlike top, ps captures the state at the moment it runs.
du — disk usage. Reports how much space a file or directory is using. du -h shows sizes in human-readable format (KB, MB, GB instead of raw bytes).
df — disk free. Shows available and used space for each mounted filesystem. df -h shows human-readable sizes. Where du reports on specific files and directories, df reports on entire mounted partitions.
▸ EXAM TIP
du vs df:
du = disk usage by files and directories (how much space is this folder using?)df = disk free — space per mounted filesystem (how full is this partition?)Both support -h for human-readable output. Know both the command names and the distinction between them.
nano is a simple terminal-based text editor designed for beginners — commands are displayed at the bottom of the screen, using ^ to represent Ctrl. Open a file with nano filename. Key commands:
Ctrl+O — write out (save); the editor asks you to confirm the filenameCtrl+X — exit; if you have unsaved changes, nano asks whether to save firstThe A+ objective specifies nano. vi/vim are NOT in scope — nano is the only text editor this exam tests.
Five files in /etc/ that a technician must know by path and purpose:
/etc/passwd — despite the name, this file does not store passwords. It stores user account information: username, user ID (UID), group ID (GID), home directory, and default shell for every account on the system. The password field in each entry shows an x — a placeholder that redirects to /etc/shadow. The name "passwd" is historical: early Unix stored passwords here, but that changed decades ago. Every user can read /etc/passwd.
/etc/shadow — this is where password security actually lives. /etc/shadow stores hashed passwords for each user account. Access is restricted to root only — regular users cannot read this file. The hash in shadow is what the system checks when a user logs in.
▸ EXAM TIP
/etc/passwd vs /etc/shadow — a commonly tested distinction:
/etc/passwd = user account information (usernames, UIDs, home directories, shells) — does NOT store passwords, despite the name/etc/shadow = hashed passwords — readable by root onlyThe filename /etc/passwd is the distractor. The password has lived in /etc/shadow for decades.
/etc/hosts — maps hostnames to IP addresses locally, before DNS is consulted. An entry here overrides DNS for that hostname on this machine. You covered DNS resolution in the Core 1 Networking module — /etc/hosts is the file that provides the local pre-DNS override.
/etc/fstab — the filesystem table. Lists the filesystems that Linux should mount automatically at boot: the device, mount point, filesystem type, and mount options. If a drive should be available at startup, it is configured here.
/etc/resolv.conf — configures the DNS resolver. Specifies which DNS server addresses the system queries when resolving hostnames. If DNS is broken on a Linux machine, /etc/resolv.conf is one of the first places to inspect.
▸ EXAM TIP
/etc configuration files — path and purpose:
| File | Purpose |
|---|---|
| /etc/passwd | User accounts (usernames, UIDs, home dirs, shells) — NOT passwords |
| /etc/shadow | Hashed passwords — root access only |
| /etc/hosts | Local hostname-to-IP mappings (checked before DNS) |
| /etc/fstab | Filesystems to mount automatically at boot |
| /etc/resolv.conf | DNS server configuration |
Kernel — the core of the OS. The kernel manages hardware (CPU, memory, devices), schedules processes, and provides the interface between software and hardware. "Linux" technically refers to the kernel — distributions (Ubuntu, Fedora, Debian) are the kernel bundled with tools, a package manager, and a desktop environment.
systemd — the modern init system and service manager. When Linux finishes booting, the kernel hands control to systemd, which starts system services, manages dependencies, and controls services throughout the system's runtime. Technicians interact with systemd through systemctl: systemctl start nginx, systemctl stop nginx, systemctl status sshd. The A+ objective focuses on the component name — know that systemctl is the command that controls it.
▸ EXAM TIP
systemd = the init system (manages startup and services). systemctl = the command that controls systemd. The exam distinguishes these: "Which component manages Linux startup?" → systemd. "Which command starts and stops Linux services?" → systemctl.
Bootloader () — runs before the OS and loads the kernel into memory. GRUB (GNU GRand Unified Bootloader) is the most common Linux bootloader. On a dual-boot machine, GRUB presents a menu to choose which OS to start. Know the name GRUB and its role: loading the kernel at startup.
Sandboxed terminal challenges. Type the right command for each task — no real shell, no real filesystem, just realistic simulated output.
The check questions below test your ability to match Linux commands to their functions, apply chmod numeric values to a permission scenario, distinguish /etc/passwd from /etc/shadow, choose the correct package manager for a given distribution, and identify the right configuration file for a technician problem.
Sign in to check your knowledge and earn XP. Sign in