Hands-on Lab·Linux Foundation Certified System Administrator

Files, directories and where things live

The commands in this guide are the ones you will type most and get wrong least - until a filename has a space in it, or a cp -r puts a directory somewhere you did not expect. This covers ls -l field by field, what stat knows that ls does not, the five file types, and the two shell behaviours - globbing and quoting - that make the difference between a command that works and one that half works.

Essential Commands Guide 5 of 38 Beginner

OSUbuntu 26.04 LTS
LVM2.03.31 (Ubuntu) / 2.03.36 (AlmaLinux)
nftables1.1.6 (Ubuntu) / 1.1.5 (AlmaLinux)
TimeAbout 18 min

GNU coreutils. cp -T and --strip-components are GNU extensions and are what the exam images have. The globbing behaviour differs by SHELL rather than by distribution, and the login shell here is zsh.

Firewallufw 0.36.2 enabled but reporting inactive / firewalld active
Network confignetplan + systemd-networkd / NetworkManager 1.56.0

Everything on this page runs on the one Ubuntu host.
Server Name	IP Address	OS	Roles	CPU	RAM	HDD
LFCS-A01	192.168.0.70	Ubuntu 26.04 LTS	Primary host - most guides run only here	2 Core	4 GB	50 GB

This guide includes

Use this for the commands you will type most and get wrong quietly. This matters because cp -r changes meaning depending on whether the destination already exists - which is how a script that worked yesterday nests a directory inside itself.

reading everything ls -l tells you, and the flags worth adding
finding what stat knows that ls does not, and the five file types
meeting the destination that changes what cp -r means, and using -T when a script depends on it
seeing that globbing is the shell's work and the command never sees it
quoting a filename with a space, and removing things with the two safeties

Before you start

guide 4 - the shell you are typing into.

What ls -l actually tells you

One directory containing a file, two directories, a symlink and a hidden file.

bash Example session

$mkdir -p ~/ess/files && cd ~/ess/files && printf 'one\ntwo\nthree\n' > report.txt && mkdir -p logs archive && ln -s report.txt current.txt && touch .hidden && lsarchivecurrent.txtlogsreport.txt$cd ~/ess/files && ls -ltotal 12drwxrwxr-x 2 sysadmin sysadmin 4096 Aug 29 09:40 archivelrwxrwxrwx 1 sysadmin sysadmin   10 Aug 29 09:40 current.txt -> report.txtdrwxrwxr-x 2 sysadmin sysadmin 4096 Aug 29 09:40 logs-rw-rw-r-- 1 sysadmin sysadmin   14 Aug 29 09:40 report.txt$cd ~/ess/files && ls -la --time-style=long-isototal 20drwxrwxr-x 4 sysadmin sysadmin 4096 2026-08-29 09:40 .drwxrwxr-x 3 sysadmin sysadmin 4096 2026-08-29 09:40 ..-rw-rw-r-- 1 sysadmin sysadmin    0 2026-08-29 09:40 .hiddendrwxrwxr-x 2 sysadmin sysadmin 4096 2026-08-29 09:40 archivelrwxrwxrwx 1 sysadmin sysadmin   10 2026-08-29 09:40 current.txt -> report.txtdrwxrwxr-x 2 sysadmin sysadmin 4096 2026-08-29 09:40 logs-rw-rw-r-- 1 sysadmin sysadmin   14 2026-08-29 09:40 report.txt

Expected resultls omitting .hidden entirely; ls -l showing the symlink as current.txt -> report.txt; ls -la adding ., .. and the hidden file.

Success conditionYou can read a directory listing field by field.

The other flags worth having
-d, -h, -F and -i.
bash Example session
```
$cd ~/ess/files && ls -ldh logs; echo "---"; ls -1F; echo "---"; ls -i report.txtdrwxrwxr-x 2 sysadmin sysadmin 4.0K Aug 29 09:40 logs---archive/current.txt@logs/report.txt---789196 report.txt
```
Note
-d is the one people forget. Without it, ls -l somedir lists what is inside; with it, you get the directory's own line. Essential when you are checking a directory's mode.

-F appends a type character - / directory, @ symlink, * executable, | fifo - which is faster to scan than -l when you only want shapes.

-i prints the inode, which is the number that identifies the file itself. Two names sharing an inode are the same file, and that is the whole of guide 10.

Expected result4.0K for the directory itself, then archive/, current.txt@, logs/ with type suffixes, then the inode number.

Success conditionYou can list a directory without listing its contents.
What stat knows that ls does not
The same file, fully described.
bash Example session
```
$cd ~/ess/files && stat report.txt  File: report.txt  size: 14        	Blocks: 8          IO Block: 4096   regular fileDevice: 252,0	Inode: 789196      Links: 1Access: (0664/-rw-rw-r--)  Uid: ( 1000/sysadmin)   Gid: ( 1000/sysadmin)Access: 2026-08-29 09:40:52.878729254 +0000Modify: 2026-08-29 09:40:52.878729254 +0000Change: 2026-08-29 09:40:52.878729254 +0000 Birth: 2026-08-29 09:40:52.878729254 +0000$cd ~/ess/files && stat -c '%A %a %h %U:%G %s %y %n' report.txt logs current.txt-rw-rw-r-- 664 1 sysadmin:sysadmin 14 2026-08-29 09:40:52.878729254 +0000 report.txtdrwxrwxr-x 775 2 sysadmin:sysadmin 4096 2026-08-29 09:40:52.879729251 +0000 logslrwxrwxrwx 777 1 sysadmin:sysadmin 10 2026-08-29 09:40:52.880729247 +0000 current.txt
```
Note
Three timestamps you will be asked about. *Modify* is when the contents changed, *Change* is when the inode changed - a chmod updates ctime and not mtime - and *Access* is when it was last read. Birth is creation, which older filesystems do not record.

stat -c is the scriptable form, and it is far better than parsing ls. %a gives the octal mode, %A the symbolic one, %U:%G owner and group, %s size, %h link count.

Blocks 8 against size 14 - the file occupies one 4 KiB block minimum, reported as 8 512-byte units. That gap between size and space is why du and ls -l disagree.

Expected resultInode, blocks, device, the mode as both 0664 and -rw-rw-r--, and four timestamps - Access, Modify, Change and Birth.

Success conditionYou can get any single fact about a file, scriptably.
The five file types
The first character of the mode, and what each one means.
bash Example session
```
$cd ~/ess/files && for f in report.txt logs current.txt /dev/null /dev/sda; do printf '%-14s %s\n' "$(basename $f)" "$(stat -c '%F  mode=%A' $f)"; donereport.txt     regular file  mode=-rw-rw-r--logs           directory  mode=drwxrwxr-xcurrent.txt    symbolic link  mode=lrwxrwxrwxnull           character special file  mode=crw-rw-rw-sda            block special file  mode=brw-rw----$mkdir -p ~/ess/files && cd ~/ess/files && printf 'one\ntwo\nthree\n' > report.txt && mkdir -p logs archive && ln -s report.txt current.txt && touch .hidden && lsarchivecurrent.txtlogsreport.txt
```
Note
- d l c b and, less often, p for a named pipe and s for a socket. /dev/sda being a block device and /dev/null a character device is the distinction Domain 5 rests on: block devices are the things you can put a filesystem on.

file reads the contents, not the name. The maybe.gz here is four bytes of gzip magic and nothing else, and file still says gzip compressed data - so an extension is a hint and file is evidence.

random.bin comes back as data, which is what file says when it recognises nothing. Useful: it means the file is not text and not a format it knows.

Expected resultregular file, directory, symbolic link, character special file (/dev/null), block special file (/dev/sda) - and file identifying a gzip header and an ELF binary.

Success conditionYou can tell what kind of thing you are looking at.
cp, and the destination that changes the meaning
The same cp -r command, run against a destination that does and does not already exist.

Read the find output each time.
bash Example session
```
$mkdir -p ~/ess/n/logs && cd ~/ess/n && printf 'x\n' > logs/report.txt && mkdir -p dest && cp -r logs dest && find dest | sortdestdest/logsdest/logs/report.txt$cd ~/ess/n && cp -r logs dest && find dest | sort; echo "--- identical: the second copy MERGED into dest/logs, it did not nest"destdest/logsdest/logs/report.txt--- identical: the second copy MERGED into dest/logs, it did not nest$cd ~/ess/n && rm -rf dest && cp -r logs dest && find dest | sort; echo "--- dest did NOT exist, so it BECAME the copy of logs"destdest/report.txtdest/second.txt--- dest did NOT exist, so it BECAME the copy of logs
```
Note
Whether the destination exists changes what the command means. cp -r logs dest creates dest/logs if dest is a directory, and creates dest *as* a copy of logs if it is not. Same command, two outcomes, decided by the state of the filesystem.

It merges rather than nesting on a repeat run, which is the opposite of what I expected when I wrote this - the second cp -r copies the contents into the existing dest/logs instead of creating dest/logs/logs. The capture is what settled it.

A new file inside logs shows up inside dest/logs on the next run, so it behaves as a one-way sync of contents rather than a snapshot.

Expected resultWith dest existing: dest/logs/report.txt. Run again: identical - it merged. With dest absent: dest/report.txt - dest became the copy.

Success conditionYou can predict where a recursive copy lands.
So use -T when a script depends on it
cp -T says "the destination is the thing itself", whether or not it exists.
bash Example session
```
$cd ~/ess/n && rm -rf dest && mkdir dest && cp -rT logs dest && find dest | sort; echo "--- cp -T ignores whether dest exists and always means 'dest IS the copy'"destdest/report.txtdest/second.txt--- cp -T ignores whether dest exists and always means 'dest IS the copy'$cd ~/ess/n && cp -rT logs dest && find dest | sort; echo "--- so -T is repeatable, which is what you want in a script"destdest/report.txtdest/second.txt--- so -T is repeatable, which is what you want in a script
```
Note
-T removes the ambiguity, which is exactly what a script needs: the outcome no longer depends on whether a previous run left the directory behind.

-a is the other flag to know - archive mode, which preserves mode, ownership and timestamps and follows no symlinks. The capture of cp -av shows the mtime coming through byte for byte, which plain cp does not do.

rsync -a src/ dest/ is the tool once this gets complicated - the trailing slashes there mean the same thing -T means here, and getting them wrong has the same consequence.

Expected resultdest/report.txt both times - the same result whether it is the first run or the fifth.

Success conditionYou have a copy that is safe to repeat.
Globbing, which the shell does and the command never sees
The expansion happens before the command runs - and what happens when nothing matches depends on the shell.
zsh Example session
```
$cd ~/ess/files && bash -c 'echo *.txt; echo "---"; echo *.nomatch; echo "---"; echo logs/*'current.txt---*.nomatch---logs/renamed.txt logs/report-backup.txt logs/report.txt$cd ~/ess/files && bash -c 'ls -d [cm]*; echo "---"; ls -d ??????.bin 2>&1; echo "---"; shopt -s nullglob; echo "with nullglob: [$(echo *.nomatch)]"'current.txtmaybe.gz---random.bin---with nullglob: []$cd ~/ess/files && echo *.nomatch 2>&1 | head -2; echo "--- zsh errors where bash passes the pattern through"zsh:2: no matches found: *.nomatch--- zsh errors where bash passes the pattern through
```
Note
**ls *.txt never receives *.txt.** The shell expands it and ls gets a list of names, which is why ls has no wildcard syntax of its own and why a pattern matching 50,000 files can fail with Argument list too long.

The no-match behaviour differs by shell, not by distribution. bash passes the pattern through, so a loop body runs once with a literal *.nomatch as its argument - a classic bug. zsh refuses the whole command instead. The login shell on this host is zsh, so both behaviours are one bash -c apart.

shopt -s nullglob makes bash expand to nothing instead, which is usually what a script wants. failglob makes it behave like zsh.

**[cm]* is a character class and ??????.bin is six single-character wildcards** - both are shell globbing, not regular expressions, and * here means something different from * in grep.

Expected resultbash printing *.nomatch unchanged when nothing matches; nullglob making it empty; and zsh giving **no matches found: *.nomatch**.

Success conditionYou know who expands your wildcards.
Quoting, and the space in a filename
One file called two words.txt, and the difference one pair of quotes makes.
bash Example session
```
$cd ~/ess/files && touch 'two words.txt' && bash -c 'for f in *.txt; do printf "[%s]\n" "$f"; done'[current.txt][two words.txt]$cd ~/ess/files && bash -c 'f="two words.txt"; ls -l $f 2>&1 | tail -2; echo "--- quoted:"; ls -l "$f"'ls: cannot access 'two': No such file or directoryls: cannot access 'words.txt': No such file or directory--- quoted:-rw-rw-r-- 1 sysadmin sysadmin 0 Aug 29 09:40 two words.txt$cd ~/ess/files && bash -c 'v=world; echo "double: $v"; echo "escaped: \$v"'double: worldescaped: $v
```
Note
$f unquoted is split on whitespace before ls sees it, so one filename became two arguments. This is the single most common shell bug there is, and it only appears once a name contains a space.

Always "$f". Double quotes expand variables and prevent splitting; single quotes prevent expansion entirely; a backslash escapes one character.

**for f in *.txt is safe** even with spaces, because glob expansion does not word-split - it is the *unquoted variable* that breaks, not the loop.

A leading dash is the other awkward name, and -- is the fix: rm -- -weird-name tells rm that everything after it is a filename rather than an option.

Expected resultUnquoted $f producing two errors - cannot access 'two' and cannot access 'words.txt' - and the quoted form working.

Success conditionYou can handle filenames you did not choose.
Removing things, and the two safeties
rmdir, rm -r, and the file whose name looks like a flag.
bash Example session
```
$cd ~/ess/files && ls; echo "--- rmdir only removes empty:"; rmdir dest 2>&1 | tail -1; rmdir archive/logs-copy 2>&1 | tail -1archivecurrent.txtdestlogsmaybe.gzprograndom.bintwo words.txt--- rmdir only removes empty:rmdir: failed to remove 'dest': Directory not emptyrmdir: failed to remove 'archive/logs-copy': Directory not empty$cd ~/ess/files && rm -r dest && echo "dest gone" && ls -d dest 2>&1 | tail -1dest gonels: cannot access 'dest': No such file or directory$cd ~/ess/files && touch -- -weird-name && ls -l -- -weird-name && rm -- -weird-name && echo "removed a file whose name starts with a dash"-rw-rw-r-- 1 sysadmin sysadmin 0 Aug 29 09:40 -weird-nameremoved a file whose name starts with a dash
```
Note
rmdir only removes an empty directory, which makes it the safe one. In a script, rmdir failing tells you something is still there - information that rm -rf would have destroyed silently.

rm -rf has no undo and no confirmation. The habits worth having: ls the path first, never build the argument from an unquoted variable, and never let a trailing slash and a variable meet (rm -rf "$dir/" when $dir is empty means rm -rf /). --one-file-system limits the damage.

-i prompts per file and -I prompts once for more than three - the second is the one you can live with interactively.

Expected resultrmdir: failed to remove 'dest': Directory not empty twice, then rm -r working, then a file called -weird-name created and removed.

Success conditionYou can remove what you meant to remove.

Troubleshooting

No such file or directory for a file you can see in ls.

Why: The name has a space or a special character and the variable was unquoted.

Fix:Quote it: "$f". ls -b shows escapes, ls -Q shows names in quotes.
cp -r put the directory one level deeper than expected.

Why: The destination already existed, so the source went inside it.

Fix:cp -rT src dest, or remove the destination first.
Argument list too long.

Why: A glob expanded to more filenames than the kernel allows in one exec.

Fix:find ... -exec ... + or xargs - see guide 7.
A loop over *.log ran once with a literal *.log.

Why: bash passes an unmatched pattern through unchanged.

Fix:shopt -s nullglob, or test the file exists inside the loop.
no matches found and the command did not run at all.

Why: That is zsh refusing an unmatched glob.

Fix:Quote the pattern if the command should receive it literally, or run it under bash -c.
rm treats a filename as an option.

Why: The name starts with a dash.

Fix:rm -- -name, or rm ./-name.
du and ls -l disagree about a file's size.

Why: ls reports the logical size and du the blocks allocated.

Fix:Both are right. stat shows size and blocks together.

Official sources

← All LFCS guides

Files, directories and where things live

This guide includes

Before you start

What ls -l actually tells you

The other flags worth having

What stat knows that ls does not

The five file types

cp, and the destination that changes the meaning

So use -T when a script depends on it

Globbing, which the shell does and the command never sees

Quoting, and the space in a filename

Removing things, and the two safeties

Troubleshooting

Official sources