RED HAT ENTERPRISE LINUX

Navigating the
Filesystem Hierarchy

Understanding the Linux Directory Structure

CIS126RH | RHEL System Administration 1
Mesa Community College

Learning Objectives

Understand the FHS structure

Learn the purpose of major directories in the hierarchy

Navigate with paths

Use absolute and relative paths effectively

Master navigation commands

Use pwd, cd, ls, and tree to explore the filesystem

Locate important system files

Know where to find configs, logs, binaries, and data

We have four learning objectives for this module. First, we'll understand the Filesystem Hierarchy Standard - the organized structure that defines where different types of files belong in Linux. You'll learn the purpose of major directories like /etc, /var, /usr, and /home. Second, we'll master using paths - both absolute paths that start from root and relative paths that start from your current location. Understanding paths is fundamental to working with files. Third, we'll learn the essential navigation commands: pwd to know where you are, cd to move around, ls to see what's there, and tree to visualize directory structures. Finally, we'll develop practical knowledge of where to find important files - configuration files, log files, executables, and user data. This knowledge is constantly applied in system administration and is tested on the RHCSA exam.

The Filesystem Hierarchy Standard

The Filesystem Hierarchy Standard (FHS) defines the directory structure and contents in Unix-like operating systems. It provides predictability - administrators know where to find files regardless of which Linux distribution they use.

Key Principles:

Single root (/) hierarchy
Everything is a file
Separation of static vs variable data
Separation of shareable vs local data

Benefits:

Consistent across distributions
Easier system administration
Simplified software packaging
Clear organization of data

The Filesystem Hierarchy Standard is a document maintained by the Linux Foundation that defines where files should be located in Linux systems. It's why you can switch from Fedora to RHEL to Debian and find configuration files in /etc, logs in /var/log, and user home directories in /home. The FHS embodies several key principles. First, there's a single root hierarchy - unlike Windows with C:, D:, and other drives, Linux has one tree starting at /. Other filesystems are mounted into this tree. Second, "everything is a file" - devices, processes, and even system information are represented as files. Third, the FHS separates static data (like programs that don't change during operation) from variable data (like logs that change constantly). Fourth, it separates shareable data (that can be shared across machines) from local data (specific to one machine). These principles drive the directory structure we'll explore. Understanding the FHS makes you more effective because you'll know intuitively where to look for any type of file.

The Root Directory

/ ← Root of the entire filesystem
├── bin/ Essential user binaries
├── boot/ Boot loader files, kernel
├── dev/ Device files
├── etc/ System configuration
├── home/ User home directories
├── root/ Root user's home
├── tmp/ Temporary files
├── usr/ User programs and data
└── var/ Variable data (logs, spool)

Note: The root directory (/) is different from the root user's home directory (/root).

The root directory, represented by a single forward slash, is the top of the filesystem hierarchy. Every file and directory on a Linux system exists somewhere under this single root. This diagram shows the major first-level directories you'll encounter. /bin contains essential user commands like ls, cp, and cat - commands needed even in single-user mode. /boot contains the bootloader and Linux kernel - critical for system startup. /dev contains device files - representations of hardware like disks, terminals, and random number generators. /etc holds system configuration files - this is where you'll spend a lot of time as an administrator. /home contains user home directories - each user gets a subdirectory here. /root is the home directory for the root user - note the distinction from / itself. /tmp is for temporary files that don't persist across reboots. /usr contains user programs, libraries, and documentation - the bulk of installed software. /var holds variable data that changes during operation - logs, mail spools, databases. We'll explore each of these in more detail.

Essential Directories Part 1

Directory	Purpose	Examples
/bin	Essential user commands	ls, cp, mv, cat, bash
/sbin	Essential system binaries	fdisk, fsck, init, ip
/boot	Boot loader and kernel	vmlinuz, initramfs, grub2
/dev	Device files	sda, tty, null, random
/etc	System configuration	passwd, fstab, ssh/sshd_config
/lib, /lib64	Essential shared libraries	libc.so, ld-linux.so

RHEL 9 Note: /bin, /sbin, /lib, /lib64 are now symlinks to their equivalents under /usr.

Let's examine the essential directories in detail. /bin contains binaries that must be available even in single-user mode or during recovery. These are fundamental commands every user needs. Historically separate from /usr/bin, in modern RHEL these are unified. /sbin contains system binaries - administrative commands typically requiring root privileges. Commands like fdisk for disk partitioning, fsck for filesystem checks, and ip for network configuration live here. /boot contains everything needed to boot the system before the root filesystem is fully available - the kernel image (vmlinuz), initial RAM filesystem (initramfs), and bootloader configuration (grub2). /dev contains device files - special files representing hardware. /dev/sda is your first hard drive, /dev/null discards anything written to it, /dev/random provides random numbers. /etc is perhaps the most important directory for administrators - it contains nearly all system configuration files. When you configure a service, you're usually editing files in /etc. /lib and /lib64 contain essential shared libraries that programs in /bin and /sbin need. In RHEL 9, these directories at the root level are actually symbolic links pointing to /usr, part of a simplification called the usr merge.

Essential Directories Part 2

Directory	Purpose	Examples
/home	User home directories	/home/student, /home/admin
/root	Root user's home directory	.bashrc, .ssh/
/tmp	Temporary files (cleared on boot)	Session data, downloads
/var	Variable data	logs, mail, databases
/proc	Process and kernel information (virtual)	cpuinfo, meminfo, [pid]/
/sys	Device and kernel information (virtual)	block/, class/, devices/

⚠ Important: /proc and /sys are virtual filesystems - they don't exist on disk but provide real-time system information.

Continuing with essential directories. /home is where regular users store their personal files. Each user gets a subdirectory matching their username. Users have full control over their home directory. /root is the home directory for the root user - it's separate from /home because /home might be on a separate partition that isn't available during early boot or recovery. /tmp stores temporary files. It's typically cleared on each boot and has special permissions allowing any user to create files. Programs use it for scratch space. /var contains variable data - files that change during system operation. This includes /var/log for log files, /var/spool for print and mail queues, /var/lib for application state data, and /var/tmp for temporary files that should survive reboots. /proc and /sys are special virtual filesystems. They don't contain real files on disk - instead, they provide interfaces to kernel data structures. /proc gives information about processes and system configuration. /sys provides information about devices and drivers. Reading files here gives you real-time system information; writing to some files configures the system.

The /usr Directory

/usr (Unix System Resources) contains the majority of user applications, libraries, and documentation. It's often the largest directory on a system.

/usr/
├── bin/ User commands (merged with /bin)
├── sbin/ System admin commands (merged with /sbin)
├── lib/ Libraries for /usr/bin, /usr/sbin
├── lib64/ 64-bit libraries
├── local/ Locally installed software
├── share/ Architecture-independent data
│ ├── doc/ Documentation
│ └── man/ Manual pages
└── src/ Source code

The /usr directory hierarchy deserves special attention because it contains the bulk of installed software. The name stands for Unix System Resources, though historically it was where user directories lived before /home existed. /usr/bin and /usr/sbin contain most executables. With the usr merge in modern systems, /bin and /sbin are now symbolic links to these directories, making /usr/bin the canonical location for all user commands. /usr/lib and /usr/lib64 contain shared libraries that programs depend on. The lib64 directory specifically holds 64-bit libraries. /usr/local is important - it's reserved for software installed locally by the administrator, not by the package manager. If you compile software from source, it typically installs to /usr/local to avoid conflicting with packaged software. /usr/share contains architecture-independent data that can be shared across different machine types. This includes /usr/share/doc for package documentation and /usr/share/man for manual pages. /usr/src is where kernel source code and headers are typically installed. Understanding /usr helps you know where software ends up when installed and where to look for documentation.

The /var Directory

/var contains variable data - files that change during normal system operation, like logs, mail spools, and database files.

/var/log

System and application log files (messages, secure, audit)

/var/tmp

Temporary files that persist across reboots

/var/spool

Queued data (print jobs, mail, cron)

/var/lib

Application state data (databases, package info)

/var/cache

Application cache data (dnf, man-db)

/var/www

Web server document root (Apache/Nginx)

The /var directory contains data that changes during system operation. While /usr is relatively static after installation, /var changes constantly. /var/log is crucial for system administrators - it's where log files are stored. /var/log/messages contains general system logs, /var/log/secure contains authentication logs, and /var/log/audit contains SELinux audit logs. When troubleshooting, /var/log is often your first stop. /var/tmp is similar to /tmp but files here are preserved across reboots. Use this for temporary data that needs to survive a restart. /var/spool contains queued data waiting to be processed - print jobs, outgoing mail, and cron job queues. /var/lib stores application state information. Package managers store their databases here, databases like MariaDB store their data here, and various services maintain state files here. /var/cache holds cached data that can be regenerated if deleted. The dnf package manager caches downloaded packages here, and man-db caches its database here. /var/www is the traditional location for web server content. Understanding /var helps you manage system resources - if your disk fills up, it's often because logs in /var/log grew too large.

The /etc Directory

/etc (Editable Text Configuration) contains system-wide configuration files. This is where administrators spend much of their time.

/etc/passwd

User account information

/etc/shadow

Encrypted passwords (restricted access)

/etc/fstab

Filesystem mount configuration

/etc/ssh/

SSH server and client configuration

/etc/sysconfig/

RHEL-specific system configuration

/etc/systemd/

Systemd unit file overrides

Pro Tip: Always back up files in /etc before editing. Use cp file file.bak before making changes.

The /etc directory contains system-wide configuration files. The name originally stood for "et cetera" but is now often interpreted as "Editable Text Configuration." As an administrator, you'll work with files here constantly. Key files include /etc/passwd which lists user accounts (though passwords are now in /etc/shadow), /etc/group which lists groups, /etc/fstab which defines filesystem mounts, and /etc/hosts for local hostname resolution. Service configurations typically have their own subdirectories or files. SSH configuration is in /etc/ssh/, Apache in /etc/httpd/, and so on. The /etc/sysconfig/ directory is RHEL-specific, containing configuration for system services in a traditional format. The /etc/systemd/ directory contains local systemd customizations and overrides. Configuration files are almost always plain text, following the Unix philosophy. You edit them with standard text editors like vim or nano. A critical best practice: always back up configuration files before editing. If a change breaks something, you want the original to restore. Some administrators use version control like git for /etc to track all changes over time.

Absolute vs Relative Paths

Absolute Path

Starts from root (/)
Complete path to file
Works from anywhere

/home/student/documents/report.txt

Relative Path

Starts from current directory
Shorter to type
Context-dependent

documents/report.txt

# Absolute path - starts with /
cat /etc/passwd
cd /var/log

# Relative path - from current directory
[student@server ~]$ cd documents
[student@server documents]$ cat report.txt

# Special relative references
.     # Current directory
..    # Parent directory
~     # Home directory

Understanding paths is fundamental to working with files. An absolute path starts with a forward slash and specifies the complete path from the root of the filesystem. /home/student/documents/report.txt is absolute - it uniquely identifies a file regardless of where you currently are. A relative path doesn't start with a slash and is interpreted relative to your current working directory. If you're in /home/student, then documents/report.txt refers to /home/student/documents/report.txt. Relative paths are shorter to type but depend on context. Special path components are essential. A single dot (.) refers to the current directory - useful in commands like ./script.sh to run a script in the current directory. Two dots (..) refer to the parent directory - cd .. moves you up one level. The tilde (~) is a shortcut for your home directory - ~/documents means /home/yourname/documents. You can combine these: ../sibling refers to a sibling directory, ../../grandparent goes up two levels. Choosing between absolute and relative paths depends on context - scripts often use absolute paths for reliability, while interactive use often favors shorter relative paths.

Path Examples

# Starting position: /home/student
[student@server ~]$ pwd
/home/student

# Relative navigation
[student@server ~]$ cd documents         # → /home/student/documents
[student@server documents]$ cd ..        # → /home/student
[student@server ~]$ cd ../admin          # → /home/admin
[student@server admin]$ cd ~             # → /home/student

# Absolute navigation
[student@server ~]$ cd /var/log          # → /var/log
[student@server log]$ cd /etc/ssh        # → /etc/ssh

# Return to previous directory
[student@server ssh]$ cd -               # → /var/log
/var/log

Let's walk through practical path examples. The pwd command shows your current working directory - always know where you are before using relative paths. From your home directory, cd documents is relative - it enters the documents subdirectory. cd .. goes up to the parent, returning to /home/student. You can combine these: cd ../admin goes up one level and then into the admin sibling directory. cd ~ returns to your home directory from anywhere. Absolute paths ignore your current location. cd /var/log takes you directly there regardless of where you started. From /var/log, cd /etc/ssh goes directly to the SSH configuration directory. A very useful shortcut is cd - (cd dash), which returns to your previous directory. This is great for toggling between two locations. The output shows where you ended up. Notice how the bash prompt often shows your current directory (or an abbreviated version), helping you track your location. Understanding these navigation patterns makes command-line work efficient.

Navigation: pwd and cd

# pwd - Print Working Directory
pwd
/home/student

# cd - Change Directory
cd /var/log           # Go to absolute path
cd log                # Go to subdirectory (relative)
cd ..                 # Go to parent directory
cd ../..              # Go up two levels
cd                    # Go to home directory
cd ~                  # Go to home directory (explicit)
cd ~username          # Go to another user's home
cd -                  # Go to previous directory

# Common mistake: space in path
cd /home/My Documents         # ERROR - sees two arguments
cd "/home/My Documents"       # Correct - quoted
cd /home/My\ Documents        # Correct - escaped space

The pwd and cd commands are your primary navigation tools. pwd simply prints your current working directory - use it whenever you're unsure where you are. It takes no arguments and always shows the absolute path. cd changes your current directory. Without arguments, cd takes you to your home directory - the same as cd ~ or cd $HOME. With an absolute path, it goes directly there. With a relative path, it goes relative to your current location. cd .. is extremely common - it moves up one level. You can chain these: cd ../.. goes up two levels. cd - is a toggle that returns to wherever you were before the last cd. The tilde with a username (cd ~admin) goes to that user's home directory. A common gotcha is paths containing spaces. The shell interprets spaces as argument separators, so "cd /home/My Documents" tries to cd to "/home/My" with "Documents" as a second argument. Either quote the entire path or escape the space with a backslash. Tab completion helps avoid these issues by automatically escaping special characters.

Listing Files: ls

# Basic listing
ls                    # List current directory
ls /etc               # List specific directory

# Common options
ls -l                 # Long format (permissions, size, date)
ls -a                 # Show hidden files (starting with .)
ls -la                # Long format + hidden files
ls -lh                # Human-readable sizes (K, M, G)
ls -lt                # Sort by modification time
ls -ltr               # Sort by time, reversed (oldest first)
ls -R                 # Recursive listing
ls -d */              # List only directories

# Output example
ls -lh /etc/passwd
-rw-r--r--. 1 root root 2.3K Dec  1 10:30 /etc/passwd

The ls command lists directory contents and is probably the most frequently used command. Without arguments, it lists the current directory. You can specify a directory to list, or multiple directories, or patterns with wildcards. The -l option gives long format output showing permissions, owner, group, size, modification time, and name. This is essential for understanding file properties. The -a option shows hidden files - in Linux, files starting with a dot are hidden by default. Your home directory has many hidden configuration files like .bashrc that only appear with -a. Combining options is common: -la shows long format including hidden files, -lh adds human-readable sizes (4.0K instead of 4096), -lt sorts by modification time with newest first. The -r option reverses sort order, so -ltr shows oldest files first - useful for finding recent changes when combined with -lt. The -R option lists recursively, descending into subdirectories. Use with caution on large directories. For listing only directories, ls -d */ works well. Understanding ls options helps you quickly find the information you need about files.

Understanding ls -l Output


            -rw-r--r--. 1 root root 2.3K Dec  1 10:30 /etc/passwd

Field	Example	Meaning
File type + permissions	`-rw-r--r--`	Regular file, owner read/write, others read
Link count	`1`	Number of hard links
Owner	`root`	User who owns the file
Group	`root`	Group that owns the file
Size	`2.3K`	File size (with -h)
Modified	`Dec 1 10:30`	Last modification date/time

Understanding ls -l output is crucial for system administration. Each field tells you something important about the file. The first character indicates file type: dash for regular file, d for directory, l for symbolic link, b for block device, c for character device. The next nine characters are permissions in three groups of three: owner, group, others - we'll cover these in depth in the permissions module. The dot after permissions indicates SELinux context exists. The link count shows hard links - for directories, this includes the . and .. entries. Owner and group show who owns the file and can be changed with chown and chgrp. Size shows bytes by default, or human-readable with -h. The timestamp shows when the file was last modified. Understanding these fields helps you answer questions like: Who owns this file? When was it last changed? Can I read it? Is it a regular file or something special? This information guides your troubleshooting and administration decisions.

Visualizing with tree

# Install tree (if not present)
sudo dnf install tree

# Basic tree view
tree /etc/ssh
/etc/ssh
├── moduli
├── ssh_config
├── ssh_config.d
│   └── 50-redhat.conf
├── sshd_config
└── sshd_config.d
    └── 50-redhat.conf

# Useful options
tree -L 2             # Limit depth to 2 levels
tree -d               # Directories only
tree -a               # Show hidden files
tree -h               # Show file sizes
tree -p               # Show permissions
tree --dirsfirst      # List directories before files

The tree command provides a visual representation of directory structures that's much easier to understand than repeated ls commands. It's not installed by default on RHEL but is available in the base repositories. Tree recursively lists directories and files in a hierarchical format with connecting lines showing the structure. This is invaluable for understanding how files are organized, documenting directory layouts, and exploring unfamiliar software installations. The -L option limits depth - tree -L 2 shows only two levels, preventing overwhelming output on large directories. The -d option shows only directories, useful for understanding structure without the clutter of files. The -a option includes hidden files. The -h option shows file sizes, -p shows permissions. The --dirsfirst option lists directories before files at each level, making structure clearer. Tree output is also useful in documentation and reports. You can redirect it to a file with tree > structure.txt. For very large directories, combine -L to limit depth with other options to get manageable output.

Special Directories

/proc

Virtual filesystem for process and kernel information. /proc/cpuinfo, /proc/meminfo, /proc/[pid]/

/sys

Virtual filesystem for device and driver information. Used for hardware configuration.

/run

Runtime data since boot. PID files, sockets, tmpfs mounted. Cleared on reboot.

/mnt

Temporary mount point for manual mounts. Convention for admin-mounted filesystems.

/media

Mount point for removable media. USB drives, DVDs auto-mount here.

/opt

Optional software packages. Third-party applications often install here.

Several directories serve special purposes you should understand. /proc is a virtual filesystem - no actual files exist on disk. Instead, reading files here queries the kernel for information. /proc/cpuinfo shows CPU details, /proc/meminfo shows memory statistics, and /proc/[pid]/ directories contain information about each running process. /sys is another virtual filesystem providing information about devices, drivers, and kernel subsystems. Writing to certain files here can configure hardware settings. /run is a tmpfs - a filesystem in RAM - that holds runtime data created since boot. PID files that track running processes live here, as do socket files for inter-process communication. It's cleared on every reboot. /mnt is the traditional location for manually mounting filesystems. When you attach a disk and mount it temporarily, /mnt is the conventional location. /media is used for automatically mounted removable media. When you insert a USB drive on a desktop system, it typically mounts under /media. /opt is for optional or add-on software packages that don't fit the standard /usr hierarchy. Commercial software and large applications sometimes install here.

Finding Your Way

# Where am I?
pwd

# What's here?
ls -la

# What's in subdirectories?
tree -L 2

# Where is a command?
which python
/usr/bin/python

whereis bash
bash: /usr/bin/bash /usr/share/man/man1/bash.1.gz

# Where is a file?
locate passwd            # Fast (uses database)
find /etc -name "passwd" # Thorough (searches live)

# What type is this?
file /etc/passwd
/etc/passwd: ASCII text

Let's review commands for finding your way around the filesystem. pwd tells you where you are - always helpful when you're unsure. ls -la shows what's in the current directory, including hidden files. tree provides a visual overview of directory structure. For finding commands, which shows the path to an executable that would run if you typed the command. whereis is broader, showing the binary, source, and manual page locations. For finding files, locate is very fast because it searches a pre-built database rather than the filesystem directly. The database updates periodically via updatedb. The find command searches the live filesystem - slower but always current and much more powerful with options for searching by name, size, type, modification time, permissions, and more. The file command tells you what type of content a file contains - useful when extensions are missing or misleading. file /etc/passwd reveals it's ASCII text. These commands together let you efficiently explore and understand any Linux system.

Tab Completion

Tab completion automatically completes commands, paths, and filenames when you press the Tab key - saving time and preventing typos.

# Type partial path, press Tab to complete
cd /etc/sys[TAB]
cd /etc/sysconfig/           # Completed!

# Multiple matches? Press Tab twice to list options
cd /etc/sys[TAB][TAB]
sysconfig/  sysctl.conf  sysctl.d/  systemd/

# Works with commands too
syste[TAB]
systemctl                    # Completed!

# And with options (in bash-completion)
systemctl st[TAB][TAB]
start   status  stop

Pro Tip: Use Tab obsessively - it's faster, avoids typos, and confirms paths exist.

Tab completion is one of the most important productivity features in the shell. Instead of typing long paths character by character, type enough to be unique and press Tab. The shell completes the rest. If multiple completions are possible, pressing Tab twice shows all options. This works for file paths, command names, and with the bash-completion package, even command options. For paths, tab completion has a crucial benefit beyond saving typing: it verifies the path exists. If nothing completes, the path doesn't exist or you've made a typo. This catches errors immediately rather than when the command fails. Get in the habit of using Tab constantly. When typing /etc/sysconfig/network-scripts, you might type /e[Tab]/sysco[Tab]/net[Tab] - just a few characters plus Tab presses. This is much faster than typing the full path and eliminates typos. For commands, Tab completion helps you discover available commands. Type the beginning and double-Tab to see what's available. With bash-completion installed, Tab even completes command-specific options and arguments.

Key Takeaways

The FHS provides a consistent directory structure across Linux systems

Absolute paths start with /, relative paths start from current directory

Key commands: pwd cd ls tree

Know where to find: /etc (config), /var/log (logs), /home (users), /usr (programs)

Let's summarize what we've learned about the Linux filesystem hierarchy. The Filesystem Hierarchy Standard ensures consistency - once you learn where things are on one Linux system, you know where to find them on any Linux system. Key directories include /etc for configuration, /var for variable data like logs, /home for user files, and /usr for programs and libraries. Understanding the difference between absolute and relative paths is fundamental. Absolute paths starting with / work from anywhere; relative paths depend on your current location. The dot and double-dot shortcuts are essential for relative navigation. Your core navigation tools are pwd to know where you are, cd to move around, ls to see what's there, and tree for visual structure. Tab completion accelerates all of this while preventing errors. In your lab exercises, apply these concepts by exploring the actual filesystem. Navigate to /var/log and examine log files. Use tree to understand directory structures. Find files with locate and find. Read virtual files in /proc to see system information. This hands-on exploration builds the intuition you need for system administration. Next module, we'll learn to manage files and directories - creating, copying, moving, and deleting.

Graded Lab

Navigate to /var/log and list files sorted by modification time
Use tree to visualize the /etc/ssh directory structure
Find all files named "passwd" anywhere on the system
Practice using relative paths with .. and . to navigate
Explore /proc/cpuinfo and /proc/meminfo

Next: Managing Files from the Command Line