Linux Directory Structure Explained: A Guide for New System Administrators
Network engineers transitioning to Linux administration often struggle with directory navigation. Unlike Windows with its drive letters (C:\, D:\), Linux uses a single hierarchical tree structure starting from the root directory (/).
The Linux directory structure follows the Filesystem Hierarchy Standard (FHS). This standard ensures consistency across different Linux distributions. Understanding this structure is essential for:
- System configuration management
- Troubleshooting network services
- Security hardening
- Performance optimization
- Backup and recovery operations
This guide provides a complete roadmap for mastering Linux directories. You will learn directory purposes, common use cases, and practical examples relevant to network administration.
Table of Contents
The Root Directory (/) – Foundation of Linux Directory Structure
What is the Root Directory in Linux?
The root directory (/) is the top-level directory in Linux. All other directories branch from this single point. Do not confuse the root directory (/) with the root user’s home directory (/root).
Key characteristics of the root directory:
- Contains all system directories and files
- Requires administrative privileges for modifications
- Forms the base for absolute paths
- Cannot be unmounted while system is running
Navigating from Root: Essential Commands
Master these basic navigation commands:
# Display current directory pwd # List root directory contents ls / # List with detailed information ls -la / # Change to root directory cd / # Return to previous directory cd - # Go to home directory cd ~
Absolute vs. Relative Paths:
- Absolute path: Starts with / (example: /etc/ssh/sshd_config)
- Relative path: Starts from current directory (example: ./scripts/backup.sh)
Essential System Directories Every Linux Administrator Must Know
/bin – Essential User Command Binaries
The /bin directory contains essential command binaries needed for single-user mode and basic system operation.
Common commands in /bin:
ls– List directory contentscp– Copy filesmv– Move filesrm– Remove filescat– Display file contentsecho– Display textgrep– Search text patternsping– Test network connectivity
# View all binaries in /bin ls /bin # Check if a command is in /bin which ping # Output: /bin/ping # Count binaries in /bin ls /bin | wc -l
/sbin – System Administration Binaries
The /sbin directory contains system administration commands typically requiring root privileges.
Important network-related tools in /sbin:
ifconfig– Configure network interfaces (deprecated)ip– Modern network configuration tooliptables– Firewall managementroute– Routing table managementsystemctl– Service managementfdisk– Disk partitioning
# Configure network interface sudo /sbin/ip addr add 192.168.1.100/24 dev eth0 # View routing table sudo /sbin/ip route show # Manage firewall rules sudo /sbin/iptables -L -n -v # Restart network service sudo /sbin/systemctl restart NetworkManager
/etc – System Configuration Files Directory
The /etc directory stores system-wide configuration files. Network administrators spend significant time working with files in this directory.
Critical network configuration locations:
# Network configuration files /etc/network/interfaces # Debian/Ubuntu network config /etc/sysconfig/network-scripts/ # RedHat/CentOS network config /etc/netplan/ # Ubuntu 18.04+ network config /etc/hosts # Static hostname mappings /etc/resolv.conf # DNS resolver configuration /etc/hostname # System hostname
Service configuration examples:
# SSH configuration /etc/ssh/sshd_config # SSH server configuration /etc/ssh/ssh_config # SSH client configuration # Apache web server /etc/apache2/apache2.conf # Main Apache config (Debian) /etc/httpd/conf/httpd.conf # Main Apache config (RedHat) # Nginx configuration /etc/nginx/nginx.conf # Main Nginx configuration /etc/nginx/sites-available/ # Available site configurations /etc/nginx/sites-enabled/ # Enabled site configurations
Example: Configure static IP on Ubuntu 20.04 using Netplan:
# Edit Netplan configuration
sudo nano /etc/netplan/00-installer-config.yaml
# Configuration content:
network:
version: 2
ethernets:
eth0:
addresses:
- 192.168.1.100/24
gateway4: 192.168.1.1
nameservers:
addresses:
- 8.8.8.8
- 8.8.4.4
# Apply configuration
sudo netplan apply
/var – Variable Data Files in Linux
The /var directory contains variable data that changes during system operation.
Important subdirectories:
/var/log/– System and application logs/var/cache/– Application cache data/var/spool/– Print and mail queues/var/lib/– Variable state information/var/www/– Web server document root (common location)/var/tmp/– Temporary files preserved between reboots
Log file locations for troubleshooting:
# System logs /var/log/syslog # System messages (Debian/Ubuntu) /var/log/messages # System messages (RedHat/CentOS) /var/log/auth.log # Authentication logs /var/log/kern.log # Kernel logs # Service-specific logs /var/log/apache2/access.log # Apache access log /var/log/apache2/error.log # Apache error log /var/log/nginx/access.log # Nginx access log /var/log/nginx/error.log # Nginx error log /var/log/mysql/error.log # MySQL error log # Network service logs /var/log/secure # SSH login attempts (RedHat) /var/log/auth.log # SSH login attempts (Debian)
Monitor logs in real-time:
# Follow system log tail -f /var/log/syslog # Monitor SSH authentication tail -f /var/log/auth.log | grep sshd # Watch Apache access log tail -f /var/log/apache2/access.log # Check disk usage in /var du -sh /var/* df -h /var
User and Application Directories in Linux Systems
/home – User Home Directories
The /home directory contains personal directories for regular users. Each user gets a subdirectory matching their username.
Home directory structure:
/home/ ├── user1/ │ ├── .bashrc # Bash configuration │ ├── .profile # Shell profile │ ├── .ssh/ # SSH keys and config │ │ ├── authorized_keys # Public keys for SSH access │ │ ├── id_rsa # Private SSH key │ │ └── id_rsa.pub # Public SSH key │ ├── Documents/ │ ├── Downloads/ │ └── Scripts/ └── user2/
Managing user home directories:
# Create new user with home directory sudo useradd -m -s /bin/bash newuser # Set permissions for home directory sudo chmod 755 /home/newuser # Set disk quota for user sudo setquota -u newuser 1000000 1500000 0 0 /home # Generate SSH keys for user su - newuser ssh-keygen -t rsa -b 4096 -C "newuser@example.com"
/root – System Administrator Home Directory
The /root directory is the home directory for the root user. Unlike regular users, root’s home is not under /home.
Security considerations for /root:
- Restricted permissions (typically 700)
- Contains sensitive administrative scripts
- Stores root’s SSH keys
- Should not be accessible to regular users
# Check /root permissions ls -ld /root # Output: drwx------ root root /root # Access root's home directory sudo su - cd ~ pwd # Output: /root
/usr – User System Resources
The /usr directory contains user utilities and applications. Modern Linux systems merge /bin with /usr/bin through symbolic links.
Important /usr subdirectories:
/usr/ ├── bin/ # User commands ├── sbin/ # System administration commands ├── local/ # Locally installed software │ ├── bin/ │ ├── sbin/ │ └── share/ ├── lib/ # Libraries for /usr/bin and /usr/sbin ├── share/ # Architecture-independent data │ ├── doc/ # Documentation │ └── man/ # Manual pages └── src/ # Source code (often kernel sources)
Installing custom software in /usr/local:
# Compile and install software from source cd /tmp wget https://example.com/software.tar.gz tar -xzf software.tar.gz cd software/ ./configure --prefix=/usr/local make sudo make install # Add /usr/local/bin to PATH echo 'export PATH=$PATH:/usr/local/bin' >> ~/.bashrc source ~/.bashrc
/opt – Optional Application Software
The /opt directory stores self-contained third-party applications.
Common applications in /opt:
- Google Chrome (/opt/google/chrome)
- Slack (/opt/slack)
- Custom enterprise applications
- Proprietary software packages
# Example: Install custom application sudo mkdir /opt/myapp sudo tar -xzf myapp.tar.gz -C /opt/myapp/ # Create symbolic link for easy access sudo ln -s /opt/myapp/bin/myapp /usr/local/bin/myapp # Set permissions sudo chown -R root:root /opt/myapp sudo chmod -R 755 /opt/myapp
Critical Runtime and Temporary Directories
/tmp – Temporary File Storage
The /tmp directory stores temporary files. Most systems clear /tmp on reboot.
Security features of /tmp:
- Sticky bit enabled (only owner can delete their files)
- World-writable permissions
- Often mounted as tmpfs (RAM-based filesystem)
# Check /tmp permissions ls -ld /tmp # Output: drwxrwxrwt root root /tmp # Note: 't' indicates sticky bit # Create temporary file safely mktemp /tmp/myfile.XXXXXX # Clean files older than 7 days find /tmp -type f -atime +7 -delete # Monitor /tmp usage watch -n 1 'du -sh /tmp; ls -la /tmp | wc -l'
/dev – Device Files Directory
The /dev directory contains device files representing hardware and virtual devices.
Important device files:
/dev/null # Null device (discards all data) /dev/zero # Produces null bytes /dev/random # Random number generator /dev/urandom # Non-blocking random generator /dev/sda # First SATA drive /dev/sda1 # First partition of first SATA drive /dev/tty # Terminal devices /dev/pts/ # Pseudo-terminal devices
Network-related devices:
# List network interfaces ls -la /sys/class/net/ # Create virtual network interface sudo ip link add veth0 type veth peer name veth1 # View disk devices lsblk fdisk -l
/proc – Process Information Pseudo-Filesystem
The /proc directory is a virtual filesystem providing kernel and process information.
Network configuration via /proc:
# Enable IP forwarding echo 1 > /proc/sys/net/ipv4/ip_forward # Disable ICMP redirects echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects # View network statistics cat /proc/net/dev # Check system memory cat /proc/meminfo # View CPU information cat /proc/cpuinfo # List all network connections cat /proc/net/tcp cat /proc/net/udp
Process information:
# Each process has a directory with its PID ls /proc/1/ # Init process information cat /proc/1/cmdline # Command line of process cat /proc/1/status # Process status
/sys – Linux System Information Directory
The /sys directory exposes kernel objects and their attributes.
Network interface management:
# View network interface information ls /sys/class/net/ # Check interface status cat /sys/class/net/eth0/operstate # View MAC address cat /sys/class/net/eth0/address # Check interface speed cat /sys/class/net/eth0/speed # View interface statistics cat /sys/class/net/eth0/statistics/rx_bytes cat /sys/class/net/eth0/statistics/tx_bytes
Boot and Mount Directories Explained
/boot – Linux Boot Files Location
The /boot directory contains files needed to boot the system.
Contents of /boot:
/boot/
├── vmlinuz-5.4.0-42-generic # Linux kernel
├── initrd.img-5.4.0-42-generic # Initial RAM disk
├── config-5.4.0-42-generic # Kernel configuration
├── System.map-5.4.0-42-generic # Kernel symbol table
└── grub/ # GRUB bootloader files
├── grub.cfg # GRUB configuration
└── fonts/ # GRUB fonts
Managing boot directory:
# List installed kernels ls /boot/vmlinuz-* # Check boot partition usage df -h /boot # Remove old kernels (Ubuntu/Debian) sudo apt autoremove --purge # Remove old kernels (RedHat/CentOS) sudo package-cleanup --oldkernels --count=2 # Update GRUB configuration sudo update-grub # Debian/Ubuntu sudo grub2-mkconfig -o /boot/grub2/grub.cfg # RedHat/CentOS
/mnt and /media – Mount Points for File Systems
These directories serve as mount points for temporary filesystems and removable media.
Differences:
- /mnt – Temporary mount point for administrators
- /media – Automatic mount point for removable media
Mounting filesystems:
# Mount USB drive sudo mount /dev/sdb1 /mnt/usb # Mount network share (NFS) sudo mount -t nfs 192.168.1.100:/share /mnt/nfs # Mount Windows share (CIFS) sudo mount -t cifs //192.168.1.100/share /mnt/windows \ -o username=user,password=pass # View mounted filesystems mount | column -t df -h # Unmount filesystem sudo umount /mnt/usb # Create persistent mount in /etc/fstab echo "192.168.1.100:/share /mnt/nfs nfs defaults 0 0" | \ sudo tee -a /etc/fstab
Advanced Directories for System Administrators
/lib and /lib64 – Shared Libraries
These directories contain shared libraries needed by system binaries.
Library management:
# View library dependencies ldd /bin/ls # Find library location ldconfig -p | grep libssl # Update library cache sudo ldconfig # View loaded libraries for running process lsof -p $(pidof nginx) | grep lib # Fix missing library sudo apt install lib-missing # Debian/Ubuntu sudo yum install lib-missing # RedHat/CentOS
/run – Runtime Variable Data
The /run directory stores runtime data since boot. It uses tmpfs (RAM-based filesystem).
Contents of /run:
/run/ ├── systemd/ # Systemd runtime data ├── lock/ # Lock files ├── user/ # User runtime directories └── *.pid # Process ID files # View services PID files ls /run/*.pid # Check systemd service status files ls /run/systemd/system/
/srv – Service Data Directory
The /srv directory contains data for services provided by the system.
Common uses:
/srv/ ├── www/ # Web server data │ ├── example.com/ │ └── test.com/ ├── ftp/ # FTP server files └── git/ # Git repositories # Configure web server to use /srv/www # Apache configuration sudo nano /etc/apache2/sites-available/000-default.conf # Change DocumentRoot to /srv/www/example.com # Set appropriate permissions sudo chown -R www-data:www-data /srv/www sudo chmod -R 755 /srv/www
Linux Directory Permissions and Security Best Practices
Understanding Directory Permission Structure
Directory permissions control access to files and subdirectories.
Permission meanings for directories:
- Read (r): List directory contents
- Write (w): Create/delete files in directory
- Execute (x): Enter directory
# View directory permissions ls -ld /var/log # Output: drwxr-xr-x root root /var/log # Permission breakdown: # d = directory # rwx = owner permissions (read, write, execute) # r-x = group permissions (read, execute) # r-x = other permissions (read, execute) # Set directory permissions chmod 755 /path/to/directory # rwxr-xr-x chmod 700 /path/to/private # rwx------ chmod 775 /path/to/shared # rwxrwxr-x # Set ownership chown user:group /path/to/directory chown -R user:group /path/to/directory # Recursive
Special permissions:
# Set SGID on directory (files inherit group) chmod g+s /shared/directory # Set sticky bit (only owner can delete) chmod +t /tmp/shared # Combined special permissions chmod 1755 /tmp/shared # Sticky bit + 755 chmod 2755 /shared/dir # SGID + 755
Security Hardening for Critical Directories
Restrict access to sensitive directories:
# Secure configuration directories chmod 700 /root chmod 755 /etc chmod 644 /etc/passwd chmod 640 /etc/shadow chmod 600 /etc/ssh/sshd_config # Audit directory access auditctl -w /etc/passwd -p wa -k passwd_changes auditctl -w /var/log -p wa -k log_changes # View audit logs ausearch -k passwd_changes # SELinux context management ls -Z /var/www/html restorecon -Rv /var/www/html semanage fcontext -a -t httpd_sys_content_t "/srv/www(/.*)?"
Practical Directory Management for Network Engineers
Common Directory Operations and Commands
Finding files across directories:
# Find files by name find / -name "*.conf" 2>/dev/null find /etc -name "*apache*" # Find files modified in last 24 hours find /var/log -mtime -1 # Find large files find / -size +100M 2>/dev/null # Locate command (uses database) sudo updatedb # Update database locate sshd_config # Which command (find executable) which python3 whereis nginx
Disk usage analysis:
# Check disk usage by directory du -sh /* du -sh /var/* du -h --max-depth=1 /var # Sort by size du -sh /* | sort -rh # Filesystem usage df -h df -i # Inode usage # Interactive disk usage analyzer ncdu /var
Directory synchronization:
# Sync directories with rsync rsync -avz /source/ /destination/ rsync -avz --delete /source/ /destination/ # Backup configuration files rsync -avz /etc/ /backup/etc/ # Remote sync over SSH rsync -avz -e ssh /local/dir/ user@remote:/remote/dir/ # Exclude certain files rsync -avz --exclude='*.log' --exclude='cache/' /source/ /dest/
Network Service Directory Locations
Common network service directories:
# SSH Service /etc/ssh/ # Configuration /var/log/auth.log # Logs (Debian) /var/log/secure # Logs (RedHat) ~/.ssh/ # User SSH files # Apache Web Server /etc/apache2/ # Configuration (Debian) /etc/httpd/ # Configuration (RedHat) /var/www/html/ # Default web root /var/log/apache2/ # Logs # Nginx Web Server /etc/nginx/ # Configuration /usr/share/nginx/html/ # Default web root /var/log/nginx/ # Logs # MySQL/MariaDB /etc/mysql/ # Configuration /var/lib/mysql/ # Database files /var/log/mysql/ # Logs # BIND DNS /etc/bind/ # Configuration (Debian) /etc/named/ # Configuration (RedHat) /var/cache/bind/ # Cache files # Network Manager /etc/NetworkManager/ # Configuration /var/lib/NetworkManager/ # State files
Linux Directory Structure Troubleshooting Guide
Common Issues and Solutions
“No space left on device” diagnosis:
# Check disk usage df -h df -i # Check inode usage # Find large files find / -size +1G 2>/dev/null # Find directories consuming space du -sh /* | sort -rh | head -20 # Clean package cache sudo apt clean # Debian/Ubuntu sudo yum clean all # RedHat/CentOS # Clean log files sudo journalctl --vacuum-time=7d sudo find /var/log -name "*.log" -mtime +30 -delete # Clear /tmp safely sudo find /tmp -type f -atime +7 -delete
Permission denied errors:
# Diagnose permission issues ls -la /path/to/file namei -l /path/to/file # Fix common permission problems chmod 644 file.txt # Read for all, write for owner chmod 755 script.sh # Executable chown user:group file.txt # Check effective permissions sudo -u username test -r /path/to/file && echo "Can read" sudo -u username test -w /path/to/file && echo "Can write" sudo -u username test -x /path/to/file && echo "Can execute"
Missing directory problems:
# Create missing directory structure
mkdir -p /path/to/nested/directory
# Restore default directory structure
mkdir -p /var/log/apache2
chown root:adm /var/log/apache2
chmod 750 /var/log/apache2
# Verify directory exists in script
if [ ! -d "/path/to/directory" ]; then
mkdir -p /path/to/directory
fi
Performance Optimization
Filesystem optimization strategies:
# Check filesystem type mount | grep "^/dev" df -T # Monitor I/O performance iostat -x 1 iotop # Optimize mount options in /etc/fstab /dev/sda1 / ext4 defaults,noatime 0 1 /dev/sda2 /var ext4 defaults,noatime,nodiratime 0 2 # Separate partitions for better performance / 20GB # Root filesystem /var 50GB # Logs and variable data /home 100GB # User data /tmp 10GB # Temporary files
Directory Structure Comparison: Different Linux Distributions
Red Hat/CentOS vs Debian/Ubuntu Differences
| Purpose | RedHat/CentOS | Debian/Ubuntu |
|---|---|---|
| Network Configuration | /etc/sysconfig/network-scripts/ | /etc/network/ or /etc/netplan/ |
| Apache Config | /etc/httpd/ | /etc/apache2/ |
| Package Cache | /var/cache/yum/ | /var/cache/apt/ |
| System Logs | /var/log/messages | /var/log/syslog |
| Cron Jobs | /var/spool/cron/ | /var/spool/cron/crontabs/ |
Container and Cloud Considerations
Docker filesystem structure:
# Docker storage locations /var/lib/docker/ ├── containers/ # Container configurations ├── images/ # Image layers ├── volumes/ # Named volumes └── overlay2/ # Storage driver data # View Docker storage usage docker system df # Clean Docker resources docker system prune -a
Kubernetes persistent volumes:
# Kubernetes storage paths /var/lib/kubelet/pods/ # Pod volumes /var/lib/kubelet/plugins/ # Volume plugins /etc/kubernetes/ # Cluster configuration # Cloud-init directories /var/lib/cloud/ # Cloud-init data /etc/cloud/ # Cloud-init config
Conclusion: Mastering Linux Directory Navigation
Key takeaways for system administrators:
- The Linux directory structure follows a logical hierarchy starting from root (/)
- System binaries reside in /bin and /sbin directories
- Configuration files live in /etc
- Variable data including logs stored in /var
- User data organized under /home
- Temporary files use /tmp and /var/tmp
- Device and process information available through /dev and /proc
Quick reference for daily tasks:
- Check logs: /var/log/
- Modify configurations: /etc/
- Find binaries: /bin, /sbin, /usr/bin, /usr/sbin
- User files: /home/username/
- Temporary space: /tmp
Next steps for deepening Linux expertise:
- Practice navigating directories using command line only
- Set up a test environment to experiment with permissions
- Implement automated backup scripts for critical directories
- Learn advanced find and grep commands for efficient searching
- Master rsync for directory synchronization
- Study SELinux/AppArmor for enhanced security
Appendices
Linux Directory Structure Cheat Sheet
| Directory | Purpose | Common Commands |
|---|---|---|
| / | Root directory | cd /, ls / |
| /bin | Essential user binaries | ls, cp, mv, mkdir |
| /boot | Boot loader files | ls /boot, df -h /boot |
| /dev | Device files | ls /dev, lsblk |
| /etc | Configuration files | ls /etc, grep -r “string” /etc |
| /home | User home directories | cd ~, ls /home |
| /lib | Shared libraries | ldd, ldconfig |
| /mnt | Mount point | mount, umount |
| /opt | Optional software | ls /opt |
| /proc | Process information | cat /proc/cpuinfo |
| /root | Root user home | sudo su -, cd /root |
| /sbin | System binaries | ifconfig, iptables |
| /tmp | Temporary files | mktemp, find /tmp |
| /usr | User programs | ls /usr/bin |
| /var | Variable data | tail -f /var/log/syslog |
Hands-On Lab Exercises
Exercise 1: Directory Navigation
# Navigate to root and list contents cd / ls -la # Count directories in root ls -d */ | wc -l # Find your current location pwd # Navigate to /etc and back to previous directory cd /etc cd -
Exercise 2: Permission Management
# Create test directory structure
mkdir -p /tmp/test/{dir1,dir2,dir3}
touch /tmp/test/dir1/file{1..5}.txt
# Set different permissions
chmod 755 /tmp/test/dir1
chmod 700 /tmp/test/dir2
chmod 777 /tmp/test/dir3
# Test access as different user
sudo -u nobody ls /tmp/test/dir1
sudo -u nobody ls /tmp/test/dir2
Exercise 3: Service Configuration
# Backup SSH configuration sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup # View current configuration grep -v "^#" /etc/ssh/sshd_config | grep -v "^$" # Monitor SSH logs tail -f /var/log/auth.log | grep sshd
Frequently Asked Questions (FAQs)
Q: What is the difference between /bin and /usr/bin?
A: Historically, /bin contained essential system binaries needed for single-user mode, while /usr/bin held user commands. Modern Linux distributions often merge these through symbolic links.
Q: Why can’t I delete files in /tmp even with write permission?
A: The /tmp directory has the sticky bit set. Only the file owner, directory owner, or root can delete files, regardless of directory write permissions.
Q: Where should I install custom applications?
A: Use /opt for self-contained third-party applications or /usr/local for software you compile from source.
Q: How do I find which directory is consuming the most disk space?
A: Use the command: du -sh /* | sort -rh | head -10
Q: What is the /proc directory, and is it using disk space?
A: /proc is a virtual filesystem that exists in memory. It provides kernel and process information but uses no disk space.
Q: Should I store web files in /var/www or /srv/www?
A: Both are acceptable. /var/www is traditional, while /srv/www follows FHS recommendations for service data. Choose based on your distribution’s defaults or organizational standards.
Q: How can I quickly find configuration files for a specific service?
A: Use: find /etc -name "*servicename*" 2>/dev/null
Q: What happens to /tmp files after reboot?
A: Most distributions clear /tmp on reboot, but /var/tmp preserves files. Check your system’s configuration in /etc/default/rcS or systemd settings.
Q: Can I move or resize system directories like /var or /home?
A: Yes, but it requires careful planning. Best practice is to use separate partitions or logical volumes that can be resized or moved to different disks.
Q: How do I set up quotas for the /home directory?
A: Install quota tools, edit /etc/fstab to add usrquota and grpquota options, remount the filesystem, create quota database with quotacheck, and set limits with edquota.