Career path

Linux Administrator

Keep Linux servers available, secure and up to date, put them into service reproducibly and bring them back when they break.

Aim for this jobWhat this job does

• 7 responsibilities
• 16 missions
• 62 skills
• 258 hours of work an estimate, starting from zero

Your gap

What you are missing

Aiming for this job computes your path from what you have already read and passed (quizzes, labs). You then see everything that remains from your first step.

367

lessons

~258 h

from zero

Aim for this job

Saved in this browser. Can be changed at any time.

The job

What a Linux Administrator does

Seven responsibilities. Each one is carried out through concrete missions, which require skills.

1

Put secure servers into service

Do on your own 5 missions · 22 skills

Missions that make it up

• Migrate a service and its data to a new server

  Deliverablea service and its data moved, checked and back in service on a new server

  • Administer a systemd service
  • Configure and troubleshoot a server's network
  • Prepare local storage: disks, partitions, file systems and mounting
  • Back up and restore a directory tree with tar

  4 skills No lab yet

• Manage a team's accounts and access

  Deliverableaccounts and groups created, privileged rights restricted, key-based SSH access

  • Manage users, permissions and processes
  • Access a machine over SSH
  • Harden a server's access and privileges: SSH, PAM, sudo, permissions and scheduling

  3 skills No lab yet

• Put a server into production

  Deliverablea hardened Linux server, its storage configured, its services started at boot and checked after a reboot

  • Administer a systemd service
  • Prepare local storage: disks, partitions, file systems and mounting
  • Manage a server's accounts and delegation: users, groups, LDAP directory, sudo and ACLs
  • Filter a server's traffic with a host firewall, NAT included
  • Run a server under SELinux or AppArmor: modes, contexts and troubleshooting
  • Manage logical volumes, software RAID and disk encryption

  6 skills Proof lab

• Harden a server and measure its compliance

  Deliverablea hardened server (access, confined services) and a replayable gap report against a baseline

  • Manage a server's accounts and delegation: users, groups, LDAP directory, sudo and ACLs
  • Filter a server's traffic with a host firewall, NAT included
  • Run a server under SELinux or AppArmor: modes, contexts and troubleshooting
  • Measure a server's gap to a hardening baseline and prioritize the measures (ANSSI-BP-028, CIS)
  • Harden a server's access and privileges: SSH, PAM, sudo, permissions and scheduling
  • Harden boot, mounts and the local session: GRUB, nodev, nosuid, noexec, banners, dconf
  • Harden the running kernel: persistent sysctl parameters and blocked modules
  • Confine a service: mandatory access control (SELinux or AppArmor), then systemd sandboxing

  8 skills No lab yet

• Configure a server's network and troubleshoot it

  Deliverablean interface, its routes and name resolution made persistent, the local firewall set, a fault located layer by layer

  • Address in IPv4 and read a routing table
  • Configure and troubleshoot a server's network
  • Troubleshoot a DNS failure
  • Filter traffic with a stateful firewall
  • Translate addresses: SNAT, DNAT and port forwarding
  • Troubleshoot an unreachable service end to end

  6 skills No lab yet

Also required, outside missions

• Install a Linux system and identify its distribution
• Trace who did what on a Linux server with auditd: persistent rules, ausearch and aureport

2

Diagnose and repair a server

Design and improve 1 mission · 2 skills

Missions that make it up

• Bring a broken server back

  Deliverablea repaired server whose services are restored and stay so after a reboot

  • Maintain a server's software and monitor its resources
  • Troubleshoot a Linux server

  2 skills Proof lab

3

Run and maintain a fleet

Do on your own 4 missions · 15 skills

Missions that make it up

• Grow a server's storage without downtime

  Deliverablea volume extended online, a network share mounted, persistent mounts

  • Prepare local storage: disks, partitions, file systems and mounting
  • Manage logical volumes, software RAID and disk encryption
  • Mount network storage: NFS, SMB and iSCSI

  3 skills No lab yet

• Apply a change with a planned rollback

  Deliverablea change applied after a snapshot or a reversible transaction, documented, and its rollback tested

  • Manage logical volumes, software RAID and disk encryption
  • Maintain a server's software and monitor its resources
  • Document operations: runbooks, checklists, decisions

  3 skills No lab yet

• Keep a server fleet up to date and under control

  Deliverablea fleet updated without downtime, its drift detected, its recurring tasks automated and monitored

  • Monitor processes and performance
  • Automate in the shell and schedule tasks
  • Maintain a fleet: updates, drift, debt
  • Maintain a server's software and monitor its resources

  4 skills No lab yet

• Monitor a service and act on alerts

  Deliverablemetrics collected, a dashboard and actionable routed alerts

  • Collect a service's metrics and check their quality
  • Build a dashboard that answers an operations question
  • Define an actionable alert and route it without noise

  3 skills No lab yet

Also required, outside missions

• Build a pipeline that extracts, sorts, counts, compares and follows a text stream
• Transform files and streams with sed, awk and regular expressions
• Edit a configuration file in Vim: modes, motions, substitution
• Download a file and check its integrity and authenticity

4

Ensure continuity and capacity

Do on your own 2 missions · 4 skills

Missions that make it up

• Ensure a service's continuity and capacity

  Deliverablea recovery plan proven by a drill, recovery objectives (RTO, RPO) met and anticipated capacity

  • Plan a fleet's capacity
  • Ensure continuity: high availability, recovery, backups

  2 skills No lab yet

• Back up a server and prove it restores

  Deliverablea scheduled off-machine backup and a timed restore, checked file by file

  • Prepare local storage: disks, partitions, file systems and mounting
  • Back up and restore a directory tree with tar
  • Ensure continuity: high availability, recovery, backups

  3 skills No lab yet

5

Run operations over time: on-call and documentation

Do on your own 1 mission · 5 skills

Missions that make it up

• Hold on-call and document operations

  Deliverablean on-call rota and its escalation defined, every alert linked to its runbook, an incident handled through to recovery

  • Write a clear, accessible and verifiable technical page
  • Document operations: runbooks, checklists, decisions
  • Keep documentation alive: owner, review, freshness
  • Respond to an incident and write a postmortem
  • Run a sustainable on-call rotation

  5 skills No lab yet

6

Automate fleet administration

Do on your own 2 missions · 16 skills

Missions that make it up

• Configure a fleet as code

  Deliverableservers configured by idempotent Ansible roles, replayed without drift

  • Predict what an IaC tool will create, change or destroy: declarative model, idempotence, state and plan
  • Write a readable, idempotent Ansible playbook
  • Parameterise an Ansible playbook: variables, facts, precedence and Jinja2 filters
  • Structure Ansible into roles and collections

  4 skills No lab yet

• Replay a server's commissioning as code

  Deliverablethe production server rebuilt by a playbook: inventory described, packages and repositories, services and scheduled tasks, accounts and keys, storage, files rendered from templates or edited, hardening; replayed with no change

  • Describe a fleet in a static Ansible inventory: groups, variables and patterns
  • Make Ansible tasks conditional and repeat them with when and loop
  • Copy, fetch and archive files with Ansible idempotently
  • Edit an existing configuration file with Ansible without rewriting it
  • Drive a host's services, scheduled tasks, hostname and reboots with Ansible
  • Manage accounts, groups, SSH keys and sudo rights with Ansible
  • Harden a host with Ansible: firewall, SELinux and kernel parameters
  • Partition, format and mount storage with Ansible, LVM included
  • Generate a configuration file through Ansible from a Jinja2 template
  • Install packages and declare repositories with Ansible across distributions

  10 skills No lab yet

Also required, outside missions

• Work with branches and merge
• Collaborate on a remote repository and resolve a conflict

7

Provide disposable, reproducible virtual machines

Do on your own 1 mission · 4 skills

Missions that make it up

• Build a disposable, reproducible virtualised environment

  Deliverablea hypervisor whose hardware virtualisation is verified, virtual machines created from an image and configured from their first boot, connected to the network with a published service, destroyed then recreated identically

  • Set up a hypervisor and check that it works
  • Connect instances to the network and expose their services: NAT, bridge, VLAN and troubleshooting
  • Create ready-to-use instances: storage, creation, configured first boot and guest agent

  3 skills No lab yet

Also required, outside missions

• Choose a type of virtualization and explain what a VM shares with its host

The means

With which tools?

Choose your tools: the choice changes the lessons to read, never the responsibilities.

Automation language

Python Go

Hypervisor

KVM Incus Proxmox

Going further

Specialisations

Optional, measured apart from the job.

Automate and tool up in Python

• Read and transform data (JSON, YAML, APIs)
• Write a tested command-line tool
• Manipulate lists, tuples, sets and slices in Python
• Process and generate text in Python: strings, regex, dates and Jinja templates
• Organize code into modules and publish a package on PyPI
• Manage Python versions, dependencies and installed tools (pyenv, pipx, Poetry)
• Test in isolation and across Python versions (unittest, mock, tox)
• Audit the quality and security of a project's code and dependencies
• Read, install and modify a small Python tool
• Run pytest tests, read a failure and fix a simple defect

Run containers

• Place and drive a container's execution layers: OCI runtime, engine and orchestrator
• Run containers, persist data and connect them
• Operate and troubleshoot Docker containers: lifecycle, logs, inspection and daemon
• Explain and inspect a Linux container's isolation: namespaces, cgroups, capabilities, seccomp
• Set up rootless Podman and explain its daemonless model
• Group containers into pods and replay a Kubernetes manifest locally
• Run Podman containers as systemd services with Quadlet

Diagnose a service backed by a relational database

• Read a schema and query relational data with SQL
• Diagnose a slow SQL query with indexes and EXPLAIN

Administer the network of servers and site

• Understand the local network: Ethernet, MAC and ARP
• Operate IPv6: link-local, SLAAC, NDP and dual-stack
• Understand and troubleshoot DHCP address assignment
• Segment a network with VLANs
• Capture and read network traffic
• Read an HTTP(S) exchange and troubleshoot an application error
• Troubleshoot email deliverability
• Inventory the exposed services of a host or a network
• Troubleshoot a TLS error and produce a certificate

Run Ansible across a production fleet

• Query structured output with JMESPath (AWS CLI, Azure CLI, Ansible)
• Control playbook execution: parallelism, async, delegation and inclusion
• Connect Ansible to a Windows fleet
• Discover a fleet's hosts automatically with an Ansible inventory plugin
• Handle a failed Ansible task: recover, ignore or stop the play
• Run a raw command through Ansible idempotently and report it correctly
• Download a verified artifact and talk to an HTTP API from a playbook
• Build an Ansible inventory during the play or with a custom script
• Check preconditions and synchronize a playbook's execution
• Assemble Ansible roles in a playbook

Manage a fleet with Chef (CINC)

• Write a Chef cookbook and converge it idempotently, in a container then on a VM
• Make a cookbook configurable and portable: attributes, templates, Ohai
• Structure a maintainable cookbook: recipes, custom resources, notifications, lint
• Test a cookbook before and after convergence: ChefSpec, InSpec, Test Kitchen, CI
• Lock cookbooks with Policyfiles and deliver them without a server
• Run a fleet with a CINC server: enrollment, search, policy groups, pull mode
• Measure and fix a server's compliance with InSpec and Chef
• Protect a Chef fleet's secrets: encrypted data bags and chef-vault

Manage a fleet with Salt

• Drive a fleet remotely with Salt: master, minions, keys and targeting
• Describe a server's desired state in idempotent Salt states
• Make states generic with grains, pillars, Jinja and managed files
• Coordinate a Salt fleet: multi-node orchestration, Salt SSH and Reactor
• Industrialize Salt: GPG secrets, states from Git, a hardened master, automatic enrollment

Configure and audit a fleet with Rudder

• Set up Rudder and apply a first rule to a group of nodes
• Audit a fleet's compliance with Rudder: Audit mode, Rudder Score and OpenSCAP

Run KVM and libvirt

• Operate KVM VMs day to day with virsh, the guest agent and remote access
• Confine a KVM VM with libvirt: sVirt, Secure Boot, vTPM and nwfilter filtering
• Fit a KVM VM to the host hardware: CPU, virtio, disk cache and VFIO passthrough
• Back up, clone and live-migrate a KVM VM with libvirt

Run Incus and migrate a fleet to it

• Operate Incus instances: OCI images, storage, profiles, projects and GPUs
• Secure an Incus server and its remote administration
• Troubleshoot an Incus VM stuck at boot
• Automate Incus with Ansible: connection plugin, provisioning and custom images
• Migrate to Incus: VMware VMs, an LXD installation, a physical or virtual machine

Run Proxmox VE

• Design Proxmox access rights: roles, paths, groups and tokens
• Back up and restore VMs with Proxmox Backup Server
• Drive Proxmox with Ansible: dynamic inventory and community.proxmox modules

Trace and harden the kernel with eBPF

• Trace the Linux kernel live with bpftrace: choose a probe, write a one-liner and aggregate into counters and histograms
• Restrict and audit eBPF on a server: block unprivileged loading, delegate CAP_BPF, harden the JIT and inventory loaded programs

Harden an immutable server declaratively (NixOS)

• Harden a NixOS server declaratively: versioned measures, test before switching, runtime checks and rollback to a healthy generation

Administer a self-hosted Git forge (Forgejo)

• Set up Forgejo on PostgreSQL behind a TLS proxy, reachable over HTTPS and SSH, then configure mail, LFS and sign-ups
• Govern access to Forgejo: organisations, teams and permissions, sign-in through an OIDC provider with an enforced second factor, and account support from the command line
• Monitor Forgejo through its logs and Prometheus metrics, fire an alert and diagnose a database outage
• Secure a Forgejo instance: webhooks kept off the internal network, brute force banned with fail2ban, a break-glass administrator account, scoped tokens and signed commits
• Back up Forgejo, copy the encrypted backup off the machine, restore it on a blank stack and write the recovery runbook
• Maintain Forgejo and upgrade it: scheduled tasks, doctor and quotas, an upgrade rehearsed on a copy with validation criteria and rollback from the backup

What the site does not cover yet

Monitoring: taught by the Observability training, whose labs run on Minikube; knowing how to run containers (container.run) is therefore a prerequisite. A container-free path (node_exporter and Prometheus under systemd) is being prepared.

Around this job

Compare with another job →

All the skills →

×

See in the glossary →