Managing file systems and storage is fundamental for cybersecurity professionals working with Linux systems in Kenya. Proper understanding of the Linux file system hierarchy enables secure and efficient organization of data critical to protecting sensitive information. Disk partitioning and formatting are essential skills to optimize storage, isolate data, and ensure system integrity against cyber threats. Mastery of these concepts supports effective incident response, forensic analysis, and secure system configuration in environments such as county government offices and financial institutions.

3.1 Understanding Linux File System Hierarchy

The Linux file system hierarchy is a structured directory layout that organizes files and directories in a predictable manner. Cybersecurity professionals in Kenya must understand this hierarchy to navigate, secure, and manage system files effectively. For example, when securing a university server, knowing where configuration files reside helps in hardening the system against unauthorized access.

3.1.1 Key Directories and Their Functions

The Linux file system contains several key directories, each with a specific role in the operating system's functionality. Understanding these directories aids cybersecurity experts in identifying where critical files are stored and how to protect them.

/ (Root Directory)

• The root directory is the top-level directory in the Linux file system, containing all other directories and files.
• It serves as the starting point for the directory tree, and its security is paramount because compromise here affects the entire system.
• For instance, in a hospital server, unauthorized changes in root could disrupt access to patient records.
• Proper permissions and monitoring of the root directory prevent escalation of privileges by attackers.
• Root directory integrity checks are part of routine security audits in financial institutions.

/etc (Configuration Files)

• This directory stores system-wide configuration files essential for system operation.
• Cybersecurity practitioners must secure /etc to prevent attackers from altering system configurations.
• Files such as /etc/passwd and /etc/shadow contain user account information critical for authentication.
• Regular backups and access restrictions on /etc protect against tampering in government IT systems.
• Monitoring changes in /etc files can help detect intrusion attempts early.

/var (Variable Data)

• /var holds variable data files like logs, mail, and spool files, which change frequently.
• Logs stored here are vital for forensic investigations after a security incident.
• In a banking environment, /var/log contains audit trails that must be preserved for compliance.
• Protecting /var from unauthorized access ensures log integrity and reliability.
• Log rotation in /var prevents disk space exhaustion, maintaining system availability.

/home (User Directories)

• /home contains personal directories for users, where they store files and settings.
• In a university setting, securing /home prevents students or staff from accessing others’ data.
• Implementing quotas and encryption in /home helps manage storage and data confidentiality.
• Malware often targets user directories, so monitoring /home is crucial for early detection.
• Backup policies for /home ensure data recovery in case of ransomware attacks.

/usr (User Programs and Data)

• This directory holds user-installed applications and read-only data.
• Cybersecurity teams must validate software in /usr to avoid executing malicious programs.
• In retail business servers, /usr/bin contains essential utilities that support transactions.
• Restricting write access to /usr prevents unauthorized software installation.
• Regular integrity checks of /usr files help maintain a trusted computing environment.

Chapter Summary

This chapter provides a comprehensive overview of managing file systems and storage in Linux. It begins by explaining the Linux file system hierarchy, detailing key directories and their specific functions within the operating system. The discussion then moves to disk partitioning and formatting, covering essential commands such as fdisk for partitioning, mkfs for formatting, and lsblk for listing block devices. Following this, the chapter explores mounting and unmounting file systems, distinguishing between manual mounts and persistent mounts that survive system reboots. It further introduces the Logical Volume Manager (LVM), guiding through the creation and management of logical volumes to enhance storage flexibility. Finally, the chapter addresses RAID configuration as a method for improving data redundancy and performance through various RAID levels. Together, these topics equip learners with the necessary skills to effectively organize, allocate, and secure storage resources in a Linux environment.