Overview of the Linux filesystem hierarchy with what each top-level directory is used for, plus a focused list of important configuration, user, network, SSH, logs, and service files (passwd/shadow, hosts, resolv.conf, fstab, cron, Apache logs, etc.).

FileSystem.md

Linux File System Structure & Key Files (Quick Reference)

Overview of the Linux filesystem hierarchy with what each top-level directory is used for, plus a focused list of important configuration, user, network, SSH, logs, and service files (passwd/shadow, hosts, resolv.conf, fstab, cron, Apache logs, etc.).

---

File system structure (directories)

Path	Explanation
/bin	Essential user command binaries (basic tools needed for boot/single-user). On many systems now merged into /usr/bin.
/boot	Bootloader files, kernels, initramfs, GRUB config.
/dev	Device files/interfaces (disks, terminals, random, etc.). Managed dynamically by udev.
/etc	System-wide configuration files (services, networking, users, policies).
/home	Home directories for non-root users (user files and per-user config).
/opt	Optional/third‑party software installed outside the distro package layout.
/proc	Virtual filesystem exposing kernel and process info (/proc/<pid>, sysctl knobs, etc.). Not real files on disk.
/root	Home directory for the root user.
/sbin	System/admin binaries (often require root). On many systems now merged into /usr/sbin.
/tmp	Temporary files (often world-writable; frequently cleared on reboot).
/usr	The bulk of userland programs and libraries (/usr/bin, /usr/lib, /usr/share). Not “unnecessary”; it’s the main software tree on modern Linux.
/var	Variable data that changes during runtime: logs, spool, caches, databases, web content, mail, etc.

---

Important files and locations

File/Path	Explanation
/etc/shadow	Password hashes and password policy data for local users (root-only).
/etc/passwd	Local user accounts (username, UID, GID, home, shell). Modern systems store hashes in /etc/shadow.
/etc/group	Local group definitions (group name, GID, members).
/etc/rc.d/	Legacy SysV-style startup scripts layout (common on some distros).
/etc/init.d/	SysV init service scripts (start/stop services). On systemd systems these may exist for compatibility.
/etc/hosts	Static hostname ↔ IP mappings (local override before/alongside DNS).
/etc/hostname	System hostname (usually just the short name). (Your /etc/HOSTNAME corrected to the common Linux path.)
/etc/network/interfaces	Debian/Ubuntu (ifupdown) network interface config (legacy on many modern installs).
/etc/profile	System-wide shell environment defaults for login shells.
/etc/apt/sources.list	APT repository sources (Debian/Ubuntu).
/etc/resolv.conf	DNS resolver configuration (nameserver/search). Often managed by NetworkManager/systemd-resolved.
/home/<user>/.bash_history	Bash command history for a user. (Your /horne/ user /.bash history corrected.) Also /root/.bash_history for root.
/usr/share/wireshark/manuf	Wireshark OUI/MAC vendor mapping database (MAC → manufacturer).
~/.ssh/	SSH user keys and config: id_rsa, authorized_keys, known_hosts, config. (Your -/.ssh/ corrected.)
/var/log/	Linux log directory (auth, syslog, kernel, services).
/var/adm/	Traditional Unix log/admin directory on some Unix systems. (Your /var/adrn corrected.)
/var/spool/cron/	Per-user cron spools on some distros (implementation varies).
/var/log/apache2/access.log	Apache access log on Debian/Ubuntu-based systems (path may differ).
/etc/fstab	Static filesystem mount configuration (mount points, options, UUIDs).

---

Common “good to know” related paths (often used with the above)

Path	Explanation
/var/log/auth.log	Auth events (Debian/Ubuntu). On RHEL-based systems often /var/log/secure.
/var/log/syslog	General system log (Debian/Ubuntu).
/var/log/messages	General system log on some distros (often RHEL/CentOS).
/etc/ssh/sshd_config	SSH server configuration.
/etc/sudoers and /etc/sudoers.d/	Sudo policy configuration.
/etc/crontab, /etc/cron.d/, /etc/cron.daily/	System-wide cron configuration and scheduled jobs.
/var/www/html/	Common web root (varies by distro/web server config).
/etc/systemd/system/	Systemd unit overrides and custom services.
/usr/bin/, /usr/sbin/	Main executable locations on modern systems (often where /bin and /sbin effectively point).

If you want, I can format this as a one-page printable table (A4) or expand each key file with “what to look for” examples (users/shells in passwd, sudo rules, DNS search domains, fstab options like noexec, etc.).