61 hands-on labs to practise for the Linux Foundation Certified System Administrator, roughly 27 hours of work, each one graded on the state of your machine rather than on the commands you typed. They run on your own hardware with the `dsoxlab` command line, and cost nothing.
The same job as the RHCSA, without a mandated distribution: the exam runs in a terminal, on a distribution you pick from those offered.
- 61labs
- 27hours of practice
- 44on real VMs
Levels 18 beginner 37 intermediate 6 advanced
Official exam objectives published by The Linux Foundation
These are not exam questions. They are hands-on exercises on the skills the exam measures, graded on the state of your machine.
Linux, RHCSA and LFCS
Add this catalogue dsoxlab catalog add https://github.com/stephrobert/linux-dsoxlab-training
Fundamentals
-
First steps in the terminal
Run basic commands (whoami, pwd, hostname, date) and capture the output in a file.
dsoxlab start l1-first-terminal -
Map Linux: kernel, distribution and key directories
Explore what Linux is made of: run real commands on your own system to discover the kernel, your distribution and the role of /etc, /var/log and /proc. Fill in a knowledge map.
dsoxlab start l1-discover-linux-map -
Choose your reference Linux distribution
Compare Debian/Ubuntu and RHEL-based distributions, understand the criteria for choosing between them, and document your choice for three practical scenarios.
dsoxlab start l1-choose-distro -
Identify your Linux machine
Run commands to collect your system's hostname, distribution, kernel version and IP address. Produce a machine identity card stored in vm-info.txt.
dsoxlab start l1-prepare-vm -
Read and decode a command
Decompose 5 Linux commands into their command/options/arguments parts and fix 3 broken commands.
dsoxlab start l1-read-a-command -
Get help from the command line
Use man, --help, and apropos to find the right command options without searching the web.
dsoxlab start l1-get-help -
Linux filesystem hierarchy (FHS)
Match the standard Linux directories to their roles and classify files by location.
dsoxlab start l1-linux-filesystem -
Navigate the filesystem
Use cd, ls, mkdir, cp, mv, rm to build a target directory tree from scratch.
dsoxlab start l1-navigate-filesystem -
Absolute and relative paths
Copy a file using an absolute path and a relative path, then solve 5 path navigation puzzles.
dsoxlab start l1-paths-absolute-relative -
Filter a log with grep and regular expressions
Use grep with anchors, character classes, invert-match and count to extract exact facts from an access log.
dsoxlab start l1-grep-regex -
Transform and aggregate text with cut, sort, uniq, sed and awk
Slice columns, deduplicate, count occurrences, sum a field and rewrite a delimiter to turn a raw record file into exact facts.
dsoxlab start l1-text-processing -
Locate files with find by name, size and permissions
Extract a project tree and use find to list files by name pattern, by size and by exact permissions , producing the results into files that are checked against the real tree.
dsoxlab start l1-find-files -
Set exact file permissions with chmod (octal and symbolic)
Give each file the right owner/group/other bits: a private secret, an executable script, a group-readable note and a private directory.
dsoxlab start l1-permissions-ugo -
Write a first Bash script: variables, a loop and a condition
Write rapport.sh that reads a status file passed as an argument, counts UP/DOWN with a loop, prints them, and exits non-zero when any host is down.
dsoxlab start l1-bash-script -
Initialize a Git repo: commit, history and a branch
Create a repository, make two commits tracking real files, and open a feature branch , proven by inspecting the repository state itself.
dsoxlab start l1-git-basics -
Environment variables: export, PATH and a sourced env file
Write env.sh that, when sourced, exports variables, reuses one in another, and prepends a bin directory to PATH , proven by sourcing it in a subshell.
dsoxlab start l1-env-profiles -
Inspect a TLS certificate with openssl
Read a delivered X.509 certificate: extract its subject, validity dates, SHA-256 fingerprint and public key with openssl x509.
dsoxlab start l1-ssl-certificates
Operating and maintaining
-
Add and manage swap space
Create a secure swap file, activate it, make it persistent in /etc/fstab and tune vm.swappiness.
dsoxlab start l2-swap-management -
Mount a filesystem persistently by UUID in /etc/fstab
Mount a pre-formatted extra disk at /srv/data through /etc/fstab, referenced by UUID (not device name) so it survives a reboot, and prove the line with mount -a AND findmnt --verify.
dsoxlab start l2-fstab-persist-uuid -
Create GPT partitions on a disk with parted
Put a GPT label on the spare disk and carve two partitions (512 MiB and 1 GiB), then make the kernel re-read the table.
dsoxlab start l2-partition-gpt -
Create and label an XFS filesystem, then mount it
Format a prepared partition as XFS with a label, create a mount point and mount it , proven by the filesystem type, its label and the active mount.
dsoxlab start l2-filesystem-create-xfs -
Diagnose a full filesystem and reclaim space
A filesystem is full. Find the culprit with df/du, remove the junk without deleting the legitimate data, and bring usage back down.
dsoxlab start l2-disk-space-troubleshoot -
Tune a mount for performance with noatime (persistently)
A read-heavy filesystem wastes I/O writing access times. Add the noatime mount option, make it active and persistent in /etc/fstab.
dsoxlab start l2-storage-performance -
Extend a logical volume and prove the mount survives a reboot
Extend an LVM logical volume, grow the XFS filesystem, and make the mount persistent via /etc/fstab by UUID.
dsoxlab start l2-lvm-extend-persist -
Mount an NFS export persistently from a server
A second host exports an NFS share. Mount it on the client at /mnt/nfs, make it persistent in /etc/fstab with _netdev so it survives a reboot.
dsoxlab start l2-nfs-mount-persist -
Mount a filesystem on demand with autofs
Configure autofs so that accessing /autofs/data mounts the spare disk automatically, and unmounts it after idle , a master map plus a mount map.
dsoxlab start l2-autofs-ondemand -
Build a software RAID 1 with mdadm
Assemble two disks into a redundant RAID 1 array with mdadm, format and mount it, and make it persistent.
dsoxlab start l2-raid-mdadm -
Create a local account with exact UID, shell and groups
Onboard a user with a specific UID, home, login shell, a primary group and a supplementary group , the RHCSA account-creation drill.
dsoxlab start l2-user-lifecycle -
Enforce password aging and complexity policy
Set per-account password aging with chage, the system default max age in login.defs, and a minimum password length via pwquality.
dsoxlab start l2-password-policy -
Delegate limited sudo rights with a sudoers drop-in
Grant the operators group password-less sudo for systemctl only, via a validated /etc/sudoers.d drop-in , least privilege, not full root.
dsoxlab start l2-sudo-delegation -
Grant fine-grained access with POSIX ACLs
Go beyond ugo: give one user rw on a file and a group rx on a directory, with a default ACL so new files inherit it , using setfacl/getfacl.
dsoxlab start l2-acl-posix -
Set up a collaborative directory with the set-GID bit
Give a shared directory the devteam group and the set-GID bit so files created inside inherit the group , proven by the directory mode and a member's new file.
dsoxlab start l2-collaborative-setgid
Services and troubleshooting
-
Set the default systemd boot target
A server has no business booting into a graphical target. Set the default to multi-user.target and confirm it.
dsoxlab start l3-boot-target -
Create and enable a systemd service unit
Wrap a program in a systemd .service unit, start it and enable it at boot , proven by the service being active, enabled and doing its job.
dsoxlab start l3-service-create-unit -
Diagnose and fix a systemd service stuck in a crash loop
A systemd service keeps restarting because of a missing config file. Use systemctl + journalctl to find the root cause and fix it permanently.
dsoxlab start l3-service-diagnose -
Make the systemd journal persistent across reboots
By default logs vanish on reboot. Enable persistent journald storage so /var/log/journal keeps history , proven by config, directory and a real journal file.
dsoxlab start l3-journald-persist -
Schedule a recurring job with cron
Run /usr/local/bin/report.sh every day at 02:30 through a cron entry , proven by the actual schedule the cron daemon will honour.
dsoxlab start l3-scheduling-cron -
Schedule a one-shot job with at
Queue a command to run once at a later time with at, and prove it is scheduled , the one-off counterpart to cron.
dsoxlab start l3-scheduling-at -
Schedule a recurring job with a systemd timer
Create a .service and its .timer (OnCalendar), enable it, and prove it is active and persistent , the systemd way to schedule recurring work.
dsoxlab start l3-scheduling-timers -
Set per-user resource limits (open files) with limits.d
Give the appuser account a higher open-files limit via /etc/security/limits.d , proven by the effective ulimit in a real login session.
dsoxlab start l3-app-constraints -
Lower a service's scheduling priority with Nice
A batch worker hogs the CPU. Give its service a nice value of 10 so it yields to interactive work , proven by the live process priority and the unit config.
dsoxlab start l3-process-signals-priority -
Recover a read-only mount caused by a broken fstab
A bad /etc/fstab option left /srv/data mounted read-only. Fix the entry, remount read-write, and make mount -a clean again.
dsoxlab start l3-fs-readonly-recover -
Repair a broken sshd config before it locks you out
A drop-in left an invalid directive: sshd -t fails, so the next reload or reboot would kill remote access. Fix the config, keep root login disabled, and reload cleanly.
dsoxlab start l3-ssh-access-recovery
Network, security and containers
-
Load-balance a web backend with HAProxy
Configure HAProxy on the front host to reverse-proxy and load-balance to a backend web server, persistently , proven by a request through the proxy returning the backend's page.
dsoxlab start l4-reverse-proxy-lb -
Aggregate links: an active-backup bond under a bridge with nmcli
Build an active-backup bond over two slave interfaces and put a bridge on top, persistently with NetworkManager , proven by the bonding state and the bridge port.
dsoxlab start l4-bridge-bonding
Debian and Ubuntu variants
-
Manage Debian packages with apt and dpkg
Install a package with apt, pin it with a hold so updates skip it, and identify which package owns a file , the Debian package-management skills for LFCS.
dsoxlab start lfcs-package-apt -
Open a service through the firewall with ufw
Allow the http service and enable ufw so it filters at boot, without ever locking out SSH , the Debian firewall counterpart to firewalld, proven by ufw status.
dsoxlab start lfcs-firewall-ufw -
Manage an AppArmor profile: switch it to complain mode
Put a loaded AppArmor profile into complain (learning) mode with aa-complain and prove it with aa-status , the Debian mandatory-access-control counterpart to SELinux.
dsoxlab start lfcs-apparmor -
Configure a static IP and route with netplan
Declare a static IPv4 address and a static route in a netplan file and apply it on a dedicated interface , the Debian/Ubuntu network configuration, proven by the live address and route.
dsoxlab start lfcs-netplan-static -
Enable XFS user quotas and enforce a limit
Format a dedicated disk as XFS, mount it with user quotas enabled persistently, and enforce a block quota on a user , proven by the live quota state and the enforced limit.
dsoxlab start lfcs-storage-quotas -
Mount an SMB/CIFS share persistently and safely
A second host serves an SMB share. Mount it on the client, make it persistent in /etc/fstab with _netdev, and keep the password out of the world-readable fstab by using a 0600 credentials file.
dsoxlab start lfcs-mount-cifs
Exam-condition drills
-
Drill , essential commands under exam conditions
5 tasks, 100 points, 20 minutes, no hints: find by size, build a frequency report, links, ownership and permissions, and split stdout from stderr. Playable on RHEL or Debian , the skills are identical.
dsoxlab start drill-essential-commands -
Drill , users, groups and delegation under exam conditions
5 tasks, 100 points, 20 minutes, no hints: create an account to exact specs, enforce password aging, build a collaborative directory, delegate sudo narrowly, and lock a departing account. Playable on RHEL or Debian , user management is identical.
dsoxlab start drill-users-groups -
Drill , systemd units, timers and scheduling under exam conditions
5 tasks, 100 points, 25 minutes, no hints: write a service unit with a restart policy, schedule a weekly timer, add a cron job, fix the default boot target, and mask a service for good. Playable on RHEL or Debian , systemd is systemd.
dsoxlab start drill-systemd -
Drill , partitions, LVM and swap under exam conditions
5 tasks, 100 points, 25 minutes, no hints: partition a disk in GPT, build an LVM stack, mount by UUID persistently, add swap, and extend a logical volume online. Playable on RHEL or Debian , parted, LVM and XFS are identical.
dsoxlab start drill-storage -
Drill , package management under exam conditions
5 tasks, 100 points, 20 minutes, no hints: install a package, freeze it against upgrades, find which package owns a file, list what a package installed, and remove one. The objective is shared by RHCSA and LFCS , only the tool changes (dnf or apt), and you use your distribution's.
dsoxlab start drill-packages -
Drill , firewall under exam conditions
5 tasks, 100 points, 20 minutes, no hints: bring the firewall up, open two ports so they survive a reload, keep SSH alive, and explicitly reject a port. The objective is shared by RHCSA and LFCS , only the tool changes (firewalld or ufw).
dsoxlab start drill-firewall -
Drill , AppArmor under exam conditions
4 tasks, 100 points, 15 minutes, no hints: confirm AppArmor is up, put one profile in complain, and bring two others back to enforce. LFCS only , RHEL uses SELinux, see drill-selinux.
dsoxlab start drill-apparmor -
Drill , static networking under exam conditions
4 tasks, 100 points, 20 minutes, no hints: a static address, a static route and an MTU on a dedicated interface, plus local name resolution. The objective is shared by RHCSA and LFCS , only the tool changes (nmcli or netplan).
dsoxlab start drill-network
Capstones
-
Put a server into production: one mission, nine deliverables, one reboot
A fresh VM, a delivered application, and one mission: put it into service. Storage on LVM, service account, application on port 8080, SELinux port label and context, permanent firewall rule, persistent journal, hardened SSH, scheduled backup. Nothing is scored on the commands typed: every test reads observable state, and the last one reboots the machine and checks again. What does not survive the reboot scores zero.
dsoxlab start capstone-mise-en-production -
LFCS mock exam , 17 tasks on Ubuntu 24.04
Performance-based LFCS mock exam mapped task by task onto the published objectives of the 5 official domains: Essential Commands (20%: Git, service troubleshooting, disk space, SSL), Operations Deployment (25%), Users and Groups (10%: accounts and ACLs), Networking (25%), Storage (20%: LVM, automount, swap). 17 tasks scored on 100 points on a single Ubuntu VM. 70/100 to pass. No hints.
dsoxlab start lfcs-mock-exam