# Linux File System Hunting Most Linux beginners interact with the system through commands, but the real architecture of Linux is exposed through its file system. Everything from hardware to processes are files. This exploration focuses on understanding how different parts of the Linux file system reveal system behavior, configuration, and internal state. ## `/etc`: The Control Center of System Behavior The `/etc` directory is the primary location for system-wide configuration. It does not contain binaries; instead, it defines how the system behaves. **User Management** * `/etc/passwd`: Stores user account details * `/etc/shadow`: Stores hashed passwords (restricted access) ```shell cat /etc/passwd sudo cat /etc/shadow ``` > Passwords are not stored in plain text. The separation improves security by restricting access to sensitive data. **Hostname and Hosts** * `/etc/hostname`: Defines system name * `/etc/hosts`: Local DNS overrides ```shell cat /etc/hostname cat /etc/hosts ``` ![](https://cdn.hashnode.com/uploads/covers/69517a606bf7cdecb321e01e/6df9c4fd-5d8f-460e-9c11-4622de83e92c.png align="center") > `/etc/hosts` allows bypassing external DNS resolution. Useful for testing or blocking domains. ## DNS Configuration: `/etc/resolv.conf` DNS resolution in Linux is typically controlled via: ```shell cat /etc/resolv.conf ``` ![](https://cdn.hashnode.com/uploads/covers/69517a606bf7cdecb321e01e/8170f301-91c0-4830-8c9a-ab0a4ffd5372.png align="center") These entries define which DNS servers your system queries. On current computers, this file is often dynamically managed by services like **Network Manager** or systemd-resolved. It is necessary to know because DNS misconfiguration directly impacts internet connectivity. Understanding this file helps debug network issues. ## Network Interfaces and Routing **Network Interfaces:** ```shell ip addr ``` In older systems try this: `/etc/network/interfaces` **Routing Table:** ```shell ip route ``` ![](https://cdn.hashnode.com/uploads/covers/69517a606bf7cdecb321e01e/664f20d5-087b-479f-9c58-5722c96dbb95.png align="center") It defines how packets leave your system and also misconfigured routes can isolate a machine from networks. ## `/proc:` The Kernal's Live Dashboard The `/proc` directory is not a real file system; it is a virtual interface to kernel data. **CPU Info:** ```shell cat /proc/cpuinfo ``` **Memory Info:** ```shell cat /proc/meminfo ``` **Running Processes:** Each process has a directory. ```shell ls /proc | grep [0-9] ``` Process ID 1 is usually the `init/systemd` process. You can inspect runtime details without special tools. It matters because this is a direct interface to the kernel state. Monitoring tools internally rely on `/proc`. ## `/dev`: Devices as Files For Linux hardware devices are also files. ```shell ls /dev ls /dev/sda #Hard disk ls /dev/null #Discards all data ls /dev/random #Random number generator ``` ![](https://cdn.hashnode.com/uploads/covers/69517a606bf7cdecb321e01e/0e5444fd-68d6-4778-a56b-ece022c8ffa7.png align="center") Writing to `/dev/null` discards output. Device abstraction simplifies hardware interaction. ## System Logs: `/var/log` Logs provide historical insight into system behavior. ```shell tail -f /var/log/syslog ``` It tracks system events, errors, and services. Authentication logs reveal login attempts. Logs are essential for debugging, auditing, and security monitoring. ## Boot Process: `/boot` The `/boot` directory contains files required during system startup. ```shell ls /boot ``` Usually it contains kernel images, bootloader configs etc. ![](https://cdn.hashnode.com/uploads/covers/69517a606bf7cdecb321e01e/22a2690b-7424-4476-a710-f5c069a49c35.png align="center") Corruption here can prevent system boot. Multiple kernels may exist for fallback. ## Systemd Services: `/etc/systemd` Modern Linux systems use systemd for service management. **Service files:** ```shell ls /etc/systemd/system ``` ![](https://cdn.hashnode.com/uploads/covers/69517a606bf7cdecb321e01e/e1304955-fb6a-4297-89b7-e508803fff63.png align="center") Service file structure defines what to run and when to start. It also stores dependencies. Understanding services helps control background processes and system startup behavior. ## Permissions and Security Model Every file has permissions: ```shell ls -l ``` ![](https://cdn.hashnode.com/uploads/covers/69517a606bf7cdecb321e01e/c1cf8586-bb17-425e-a11a-fcc5ff6ee7e1.png align="center") * **d**: Directory * **rwx** (Owner): Read (4) + Write (2) + Execute (1) = **7** * **r-x** (Group): Read (4) + Execute (1) = **5** * **r-x** (Others): Read (4) + Execute (1) = **5** The `drwxr-xr-x` permission string corresponds to the numerical code **755** in Linux. This sets a directory (d) to be readable, writable, and executable by the owner, and only readable and executable by the group and others. **To modify permissions:** ```shell chmod 755 file chown user:group file ``` > Misconfigured permissions can expose sensitive data. Root-owned files are critical to system integrity. ## Process and Resource Control Inspect running processes: ```shell ps aux ``` Real-time monitoring: ```shell top ``` Deep dive: ```shell cat /proc//fd ``` ![](https://cdn.hashnode.com/uploads/covers/69517a606bf7cdecb321e01e/7864b28c-ea19-4cec-bd0d-febd94fd7ad9.png align="center") It helps to detect leaks or resource misuse. ## Conclusion Linux reveals its internal design clearly once the file system is treated as the primary interface rather than just a storage hierarchy. The principle that everything is treated as a file is not theoretical. It directly shapes how configuration, hardware interaction, and runtime state are exposed. Directories like `/etc`, `/proc`, and `/dev` are not arbitrary. They form a structured mapping between system behavior, live kernel data, and physical or virtual devices. This exploration reveals that Linux is not difficult. It is designed to be inspectable. Instead of relying on high-level tools, direct interaction with the file system exposes how the system operates internally.