I still find that the old "how do I safely and portably delete a file named 'dash-eff-arr' (-fr)?" to be a reasonably good predictor of how well someone will fare for more advanced questions. I routinely recommend it as a screening question.
People who flounder around with suggestions about globbing, quoting and escaping are, in my opinion, potentially dangerous at a root shell on a production system. Those who blithely suggest
rm -- -fr are only marginally better. Those who demonstrate a real understanding of how the shell parses a command line ... about the difference between what the shell parsed and what a command (such as
rm) received on its argument vector usually have a pretty good understanding of other systems administration material as well.
A much more interesting and involved question:
Given a tape backup, a boot/root or rescue disc of your choice, and
a system with a freshly replace, blank, hard drive ... how would you get
that system back into production? What other information do you need
before you can proceed?
(I will usually provide a specific
tar command and a date as the label on the tape's case; and print out with the
fdisk -l and
df -k output; and I generally will permit them to change the
tar to any similar
afio, or even
pax command; the details of the archiving utility are not the focus of my question).
This question is not suitable for screening ... the interviewer has to have a solid understanding of the answer and should be able to check off about ten steps in the process. I'm very forgiving of minor sequence issues, especially if the respondent catches them --- for example realizing they he or she would have had to run
fdisk before that series of
I'd say this is, in spirit, the closest to a fizzbuzz scenario.
You have just been given responsibility for a departmental server running Linux.
The former admin has been "hit by a bus" and no one knows the root password for
this system. How do you proceed?
This one is intended to be a dialog. At the core I want them to demonstrate an understanding of how to boot a system into single user mode and force a password change and how to boot from a rescue disc and accomplish the same task. (So I reveal, by turns, that the system is configured with
sulogin and that there's a bootloader (GRUB or LILO) password to prevent an easy
init=/bin/sh). That's the purely technical part of the desired answer.
However, I usually also care about the broader considerations that they should raise. Do they ask whether anyone has
sudo access sufficient to the task? How do they anticipate arranging for the service disruption? Do they ask about the possibility that the former administrator was hostile or that the system may have been compromised? Do they volunteer some opinions or make suggestions about how passwords should be escrowed by management?