Linux System Configuration Files

If Linux were a living organism, its configuration files would be its DNA — small text files scattered across the filesystem that determine exactly how the system behaves: which services start, how the network is configured, who can log in, what the shell looks like, and much more. Understanding these files is one of the most important skills a Linux system administrator can have, because nearly every administrative task — from configuring a web server to fixing a broken network — eventually comes down to editing a configuration file correctly.

This article explains, from first principles, what configuration files are, where they live, how they’re structured, and how to work with the most important ones safely.

What Is a Configuration File?

A configuration file is simply a plain text file that a program reads when it starts (or sometimes continuously) to determine its settings and behavior. Instead of hard-coding behavior into a program’s binary code, Linux software is designed around the Unix philosophy: keep code and configuration separate, so administrators can change behavior without recompiling or modifying the program itself.

flowchart LR
    A[System Boots] --> B[Program Starts]
    B --> C{Reads Config File?}
    C -->|Yes| D[Applies Settings from File]
    C -->|No config found| E[Uses Built-in Defaults]
    D --> F[Program Runs With Custom Behavior]
    E --> F

Where Configuration Files Live

Linux follows the Filesystem Hierarchy Standard (FHS), which defines standard locations for different types of files. Configuration files overwhelmingly live under /etc.

Key System Configuration Files Every Admin Should Know

/etc/passwd — User Accounts

This file lists every user account on the system, one per line, in a colon-separated format:

username:x:1001:1001:Full Name:/home/username:/bin/bash

username:x:1001:1001:Full Name:/home/username:/bin/bash

Fields, in order: username, password placeholder (x means the real hash is in /etc/shadow), UID, GID, comment/full name, home directory, login shell.

/etc/shadow — Encrypted Passwords

Stores hashed passwords and password aging policy. It is readable only by root for security reasons:

sudo cat /etc/shadow

sudo cat /etc/shadow

/etc/group — Group Definitions

developers:x:1002:alice,bob,carol

developers:x:1002:alice,bob,carol

/etc/hosts — Static Hostname Resolution

Maps hostnames to IP addresses without needing DNS:

127.0.0.1   localhost
192.168.1.10 fileserver.local fileserver

127.0.0.1   localhost
192.168.1.10 fileserver.local fileserver

/etc/fstab — Filesystem Mount Table

Defines which filesystems are automatically mounted at boot:

UUID=1234-5678  /data   ext4    defaults        0 2

UUID=1234-5678  /data   ext4    defaults        0 2

Fields: device (or UUID), mount point, filesystem type, mount options, dump flag, fsck order.

/etc/resolv.conf — DNS Resolver Configuration

nameserver 8.8.8.8
nameserver 1.1.1.1

nameserver 8.8.8.8
nameserver 1.1.1.1

Note: on modern systems using systemd-resolved or NetworkManager, this file is often auto-generated and should not be manually edited — changes get overwritten.

/etc/network/interfaces (Debian/Ubuntu, legacy) or Netplan YAML (modern Ubuntu)

Legacy Debian-style static IP configuration:

auto eth0
iface eth0 inet static
    address 192.168.1.50
    netmask 255.255.255.0
    gateway 192.168.1.1

auto eth0
iface eth0 inet static
    address 192.168.1.50
    netmask 255.255.255.0
    gateway 192.168.1.1

/etc/ssh/sshd_config — SSH Server Configuration

Port 22
PermitRootLogin no
PasswordAuthentication no

Port 22
PermitRootLogin no
PasswordAuthentication no

/etc/sudoers — Sudo Privilege Rules

Never edit this file directly with a normal text editor — always use visudo, which validates syntax before saving and prevents you from locking yourself out:

sudo visudo

sudo visudo

Configuration File Formats

Linux configuration files come in several common formats:

Editing Configuration Files Safely

Step 1: Always Back Up Before Editing

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak-$(date +%F)

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak-$(date +%F)

Step 2: Use a Text Editor You’re Comfortable With

sudo nano /etc/ssh/sshd_config
# or
sudo vim /etc/ssh/sshd_config

sudo nano /etc/ssh/sshd_config
# or
sudo vim /etc/ssh/sshd_config

Step 3: Validate Syntax Before Applying (When Possible)

Many services provide a built-in config test:

sudo nginx -t          # test Nginx config
sudo sshd -t           # test SSH config
sudo apachectl configtest   # test Apache config

sudo nginx -t          # test Nginx config
sudo sshd -t           # test SSH config
sudo apachectl configtest   # test Apache config

Step 4: Reload or Restart the Service

sudo systemctl restart sshd
sudo systemctl reload nginx

sudo systemctl restart sshd
sudo systemctl reload nginx

A Practical Example: Changing the SSH Port

Step 1: Back up the config

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

Step 2: Edit the file

sudo sed -i 's/^#Port 22/Port 2222/' /etc/ssh/sshd_config

sudo sed -i 's/^#Port 22/Port 2222/' /etc/ssh/sshd_config

Step 3: Test and restart

sudo sshd -t && sudo systemctl restart sshd

sudo sshd -t && sudo systemctl restart sshd

Step 4: Update the firewall

sudo ufw allow 2222/tcp

sudo ufw allow 2222/tcp

Python Example: Parsing a Simple Config File

Many admins write small Python scripts to read or validate configuration files. Here’s an example that parses a key-value style config:

def parse_config(path):
    config = {}
    with open(path) as f:
        for line in f:
            line = line.strip()
            if not line or line.startswith('#'):
                continue
            if '=' in line:
                key, value = line.split('=', 1)
                config[key.strip()] = value.strip()
    return config

settings = parse_config('/etc/myapp/myapp.conf')
print(settings.get('LogLevel', 'INFO'))

def parse_config(path):
    config = {}
    with open(path) as f:
        for line in f:
            line = line.strip()
            if not line or line.startswith('#'):
                continue
            if '=' in line:
                key, value = line.split('=', 1)
                config[key.strip()] = value.strip()
    return config

settings = parse_config('/etc/myapp/myapp.conf')
print(settings.get('LogLevel', 'INFO'))

This kind of script is useful for validating configuration before deploying it, or for building configuration management tooling.

Comparison: Debian/Ubuntu vs. RHEL/CentOS Configuration Conventions

Best Practices

• Always back up before editing — a single typo in a critical config file can prevent a service (or the whole system) from starting.
• Use version control for configs. Tools like etckeeper automatically commit /etc to a Git repository, giving you full history and easy rollback.
• Validate syntax before restarting services, especially for anything network-facing like SSH or firewalls, where a mistake could lock you out.
• Prefer override/drop-in directories over editing vendor-provided files directly (e.g., use /etc/systemd/system/service.d/override.conf instead of editing the main unit file).
• Comment your changes so future administrators (including future you) understand why a setting was changed.
• Keep a change log of configuration modifications, especially in production environments.

Troubleshooting

Problem: Service won’t start after editing its config

Check the service’s status and logs immediately:

sudo systemctl status servicename
sudo journalctl -u servicename -n 50

sudo systemctl status servicename
sudo journalctl -u servicename -n 50

Problem: Locked out of SSH after changing sshd_config

Always test the config before restarting, and keep an existing SSH session open while testing changes, so you have a fallback session to fix mistakes:

sudo sshd -t

sudo sshd -t

Problem: Changes to /etc/resolv.conf keep disappearing

This file is often managed automatically by systemd-resolved or NetworkManager. Edit the underlying source instead (e.g., Netplan YAML or NetworkManager connection profiles), not /etc/resolv.conf directly.

Problem: visudo reports a syntax error

Do not force-save with a syntax error — this can leave the system with no valid sudo rules. Fix the reported line number, or exit without saving and try again.

Conclusion

Configuration files are the control panel of a Linux system. Mastering where they live, how they’re formatted, and how to edit them safely — with backups, validation, and careful restarts — is foundational to reliable system administration. Whether you’re managing user accounts in /etc/passwd, tuning /etc/fstab for storage, or hardening SSH through /etc/ssh/sshd_config, the same disciplined workflow applies: back up, edit, validate, and restart.

Further Reading

• Filesystem Hierarchy Standard
• man 5 passwd
• man 5 fstab
• sshd_config man page
• Arch Wiki: Configuration files
• etckeeper project