Files

Files#

Configuration and runtime files an operator reaches for when the network is misbehaving. ip and ss show the live picture, but these on-disk files are the source of truth for what the box will do at the next boot or service restart.

Name resolution#

  • /etc/hosts, static hostname → IP mappings; consulted before DNS (per nsswitch.conf).

  • /etc/hostname, the system’s own hostname.

  • /etc/resolv.conf, DNS resolver config (nameserver, search, options). On systemd-resolved systems this is a symlink to /run/systemd/resolve/stub-resolv.conf.

  • /etc/nsswitch.conf, order of name-service sources (files, dns, mdns, resolve).

  • /etc/services, standard mapping of service names to port numbers (e.g. ssh 22/tcp).

  • /etc/protocols, IP protocol numbers and names.

  • /etc/networks, named networks (rare).

Network configuration#

  • /etc/network/interfaces, Debian / older Ubuntu (ifupdown).

  • /etc/netplan/*.yaml, modern Ubuntu (renders to systemd-networkd / NetworkManager).

  • /etc/sysconfig/network-scripts/ifcfg-*, RHEL 7-8 / CentOS.

  • /etc/NetworkManager/system-connections/*.nmconnection, NetworkManager profiles.

  • /etc/systemd/network/*.network, systemd-networkd.

  • /etc/dhcp/dhclient.conf, DHCP client.

  • /etc/wpa_supplicant/wpa_supplicant.conf, WiFi credentials.

SSH config#

  • /etc/ssh/sshd_config, SSH daemon (server) configuration.

  • /etc/ssh/ssh_config, system-wide SSH client defaults.

  • /etc/ssh/ssh_host_*, host keys (private + public).

  • ~/.ssh/config, per-user client config.

  • ~/.ssh/authorized_keys, public keys allowed to log in.

  • ~/.ssh/known_hosts, remembered host fingerprints.

  • ~/.ssh/id_ed25519 / id_ed25519.pub, key pair (mode 600 on the private).

Firewall#

  • /etc/iptables/rules.v4 / rules.v6, saved iptables rules (Debian / Ubuntu).

  • /etc/nftables.conf, nftables rules.

  • /etc/ufw/user.rules, UFW persisted rules.

  • /etc/firewalld/zones/*.xml, firewalld zones.

Mail and proxies#

  • /etc/aliases, local mail aliases.

  • /etc/environment, system-wide env vars (http_proxy, https_proxy, no_proxy).

Runtime / virtual filesystems#

  • /proc/net/{tcp,tcp6,udp,udp6}, raw socket tables.

  • /proc/net/route, routing table.

  • /proc/net/arp, ARP cache.

  • /proc/net/dev, per-interface counters.

  • /proc/sys/net/, tunable kernel parameters (net.ipv4.ip_forward, net.core.somaxconn, …).

  • /sys/class/net/, per-interface kernel objects.

  • /run/systemd/resolve/, systemd-resolved runtime state.

Logs#

  • /var/log/syslog (Debian) / messages (RHEL), general.

  • /var/log/auth.log (Debian) / secure (RHEL), sshd auth.

  • journalctl -u {NetworkManager,systemd-networkd,systemd-resolved}.

Contents