CertGrid CertGrid
Hands-on Lab·Red Hat Certified System Administrator

Shell Help and Command Discovery

Two objectives in one guide: issuing commands with correct syntax, and locating documentation in man, info and /usr/share/doc. The second is worth more than it looks - with no internet, being fast in `man` is the difference between recalling an option and losing four minutes to it.

Essential Tools Guide 4 of 67 Beginner

Written against the versions above. `man -k` and `apropos` are the same program. Both search a pre-built index of one-line descriptions, which is why the results below are so much narrower than people expect - and why `man -K`, capital K, exists.

Every command on this page runs on RHCSA-A01.
Server NameIP AddressOSRolesCPURAMHDD
RHCSA-A01192.168.0.31RHEL 10.0 (Coughlan)Practice node (graded) - spare /dev/sda2 Core4 GB50 GB + 15 GB

Before you start

  1. The machine this guide assumes

    Every command in this guide was run on RHCSA-A01, a Red Hat Enterprise Linux 10.0 machine in the state below. Three things about it are worth reading before anything else, because they are the difference between a command working and a command failing for reasons that have nothing to do with what is being taught.

    sysadmin is in the wheel group, so sudo works. The exam gives you root or a sudo-capable account; this path uses sudo explicitly on every command that needs it rather than assuming a root shell, so you can see exactly which ones do.

    SELinux is Enforcing and firewalld is running. Both are on by default in RHEL and both are examined, so neither is ever switched off here to make an example work. When something is blocked by one of them, that is the lesson rather than an obstacle to it.

    bash Example session 
    cat /etc/redhat-release; uname -rRed Hat Enterprise Linux release 10.0 (Coughlan)6.12.0-55.9.1.el10_0.x86_64id; sudo -n true && echo "sudo: works without a password prompt"uid=1000(sysadmin) gid=1000(sysadmin) groups=1000(sysadmin),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023sudo: works without a password promptgetenforce; sestatus | grep -E "SELinux status|Current mode|Loaded policy"EnforcingSELinux status:                 enabledLoaded policy name:             targetedCurrent mode:                   enforcing

    Expected resultRHEL 10.0, a sudo-capable account, and SELinux enforcing.

    Success conditionYour machine matches the one every command in this guide was run on.

  2. What you are typing into

    /bin/bash
bash
GNU bash, version 5.2.26(1)-release (x86_64-redhat-linux-gnu)

    Bash, which is what RHEL gives you and what the exam gives you. Worth confirming rather than assuming - the machines these captures ran on were originally set to zsh, and that changes enough to matter.

    The more useful habit is type, which answers *what will actually run*:

    cd is a shell builtin
ls is /usr/bin/ls
echo is a shell builtin
echo is /usr/bin/echo

    Three names, three different kinds of thing. cd is a builtin - there is no /usr/bin/cd, which is why it cannot be run under sudo or find -exec. echo is both a builtin and a binary, and type -a shows the builtin listed first because that is the one that wins.

    That last one is a real source of confusion: man echo documents the binary, while what you ran was the builtin, and their options differ. When a man page seems to describe a different command from the one you are using, type is why - and for a builtin the right reference is help echo.

    One thing to read carefully: ls is /usr/bin/ls here, not an alias. Interactively RHEL aliases it to ls --color=auto from /etc/profile.d, but this command ran non-interactively over ssh, where those files are not sourced. That is exactly why a command can behave one way at your prompt and another way inside a script or a cron job - the aliases and functions simply are not there.

    bash Example session 
    echo $SHELL; echo $0; bash --version | head -1/bin/bashbashGNU bash, version 5.2.26(1)-release (x86_64-redhat-linux-gnu)type cd; type ls; type -a echocd is a shell builtinls is /usr/bin/lsecho is a shell builtinecho is /usr/bin/echocommand -v systemctl; which systemctl/usr/bin/systemctl/usr/bin/systemctl

    Expected resultBash, and three names resolving to three different kinds of thing.

    Success conditionYou can tell a builtin from a binary from an alias.

  3. Manual sections, and why passwd has two pages

    passwd (1)           - update user's authentication tokens
passwd (5)           - password file

    The same name in two sections. Section 1 is the command you run; section 5 is the file format. man passwd gives you the lowest-numbered match, which is the command - so if you wanted the layout of /etc/passwd, the default is the wrong page and it will not tell you so.

    man 5 passwd

    The sections worth knowing for EX200: 1 user commands, 5 file formats, 8 administration commands. crontab is the other one that catches people - man 1 crontab is the command, man 5 crontab is the syntax of the file, and the file syntax is what the exam task needs.

    bash Example session 
    man -f passwd 2>&1 | head -5passwd (1)           - change user passwordpasswd (1ossl)       - OpenSSL application commandspasswd (5)           - password fileman 1 passwd | head -12PASSWD(1)                        User Commands                       PASSWD(1) NAME       passwd - change user password SYNOPSIS        passwd [options] [LOGIN] DESCRIPTION       The passwd command changes passwords for user accounts. A normal user       may only change the password for their own account, while the superuserman 5 passwd | head -14passwd(5)                     File Formats Manual                    passwd(5) NAME       passwd - password file DESCRIPTION       The  /etc/passwd file is a text file that describes user login accounts       for the system.  It should have read permission allowed for  all  users       (many  utilities,  like ls(1) use it to map user IDs to usernames), but       write access only for the superuser.        In the good old days there was no great problem with this general  read       permission.   Everybody  could  read  the  encrypted passwords, but the

    Expected resultTwo different pages for one name.

    Success conditionYou will reach for man 5 when you need a file format.

  4. Searching when you do not know the command's name

    This is where it gets interesting. Ask for the tool that manages password aging:

    boltd (8)            - thunderbolt device managing system daemon
daemon (7)           - Writing and packaging system daemons
git-stage (1)        - Add file contents to the staging area
gnome-extensions (1) - Command line tool for managing GNOME extensions

    Not one of those is related. man -k matched the letters aging inside managing, packaging and staging. And the command it should have found is missing:

    chage (1)            - change user password expiry information

    chage is exactly the right answer, and man -k aging cannot find it - because man -k searches only the one-line description, and that line says *expiry*, not *aging*. Two failures at once: noise from substring matches, and a miss on the word the objective itself uses.

    The fallback is capital -K, which searches the full text of every page:

    LOGIN(1)                         User Commands

    It finds pages containing the phrase - here login(1) first, not chage - and it is slow enough that you would not use it casually. Search for the word the documentation would use, not the word the task uses: man -k password, man -k expiry, man -k shadow.

    bash Example session 
    man -k aging 2>&1 | head -5boltd (8)            - thunderbolt device managing system daemondaemon (7)           - Writing and packaging system daemonsgit-stage (1)        - Add file contents to the staging areagnome-extensions (1) - Command line tool for managing GNOME extensionsscalar (1)           - A tool for managing large Git repositoriesman -k chage 2>&1 | head -2; whatis chagechage (1)            - change user password expiry informationchage (1)            - change user password expiry informationtimeout 60 man -K "password aging" 2>&1 | head -4LOGIN(1)                         User Commands                        LOGIN(1) NAME       login - begin session on the systemapropos umask 2>&1 | head -4pam_umask (8)        - PAM module to set the file mode creation maskumask (1)            - bash built-in commands, see bash(1)umask (2)            - set file mode creation mask

    Expected resultIrrelevant substring matches, and the right command found only by its own name.

    Success conditionYou know what man -k does and does not search.

  5. The two sources that are not man pages

    chrony
coreutils
curl
dnf
...

    /usr/share/doc carries what man pages leave out: full example configurations. For a task like configuring chrony, the shipped example is more useful than the man page, and rpm -qd lists exactly what a package installed:

    rpm -qd chrony

    That is the trick worth keeping. Given a package name, rpm -qd tells you every document it shipped - man pages and /usr/share/doc alike - without guessing at paths.

    info is the third source. GNU tools document themselves there in more depth than in their man page; info coreutils 'ls invocation' is the canonical example. It is worth knowing exists, and in a timed exam man is almost always faster.

    One more, not shown: many commands answer --help more usefully than either, and it costs nothing to try first.

    bash Example session 
    ls /usr/share/doc | head -12accountsserviceadcliadobe-mappings-cmapadobe-mappings-pdfalsa-libalsa-utilsappstreamatat-spi2-coreattrauditauthselectls /usr/share/doc/chrony/ 2>/dev/null; rpm -qd chrony 2>/dev/null | head -5chrony.keys.exampleFAQNEWSREADME/usr/share/doc/chrony/FAQ/usr/share/doc/chrony/NEWS/usr/share/doc/chrony/README/usr/share/doc/chrony/chrony.keys.example/usr/share/man/man1/chronyc.1.gzinfo coreutils 'ls invocation' 2>/dev/null | head -10 || echo "info not installed"

    Expected resultPackage documentation directories, and the files chrony shipped.

    Success conditionYou can find a worked example on a machine with no internet.

Troubleshooting

Official sources

← All RHCSA guides