Unix Network Admin - Glossary

Address (A) record

An A record maps a DNS host name to an IPv4 address. Reverse mapping from an IPv4 address to a host name uses a PTR record in the in-addr.arpa namespace.

Address (AAAA) record

An AAAA record maps a DNS host name to an IPv6 address. The four-letter name reflects that an IPv6 address is four times the size of an IPv4 address.

authentication

Authentication verifies the identity of a user, service, process, or host before access is granted. Unix and Linux systems commonly use local credentials, SSH keys, certificates, Kerberos, LDAP-backed identity stores, and multifactor authentication.

authorization

Authorization determines what an authenticated identity is permitted to do. Unix and Linux systems enforce authorization through file permissions, groups, access control lists, sudo policy, service configuration, firewall rules, and application-specific controls.

authoritative name server

An authoritative name server provides definitive DNS data for one or more zones. It answers from locally maintained zone data or from data transferred from another authoritative server rather than performing recursive resolution for the requested name.

autofs

autofs is an automounting service that mounts file systems on demand and unmounts them after inactivity. It is commonly used with NFS and can obtain automount maps from local files, LDAP, or SSSD-supported identity services.

BIND

BIND, the Berkeley Internet Name Domain software, is a widely deployed implementation of DNS. Its named daemon can provide authoritative DNS, recursive resolution, caching, DNSSEC validation, dynamic updates, and zone transfers.

caching resolver

A caching resolver performs DNS resolution for clients and stores responses for the duration of each record's time to live. It reduces repeated external queries and improves response time. A caching resolver should normally be accessible only to authorized clients.

Certification Authority Authorization (CAA) record

A CAA record identifies which certificate authorities are permitted to issue TLS certificates for a DNS domain. It supports certificate-governance and mis-issuance reduction but does not replace certificate monitoring.

Canonical Name (CNAME) record

A CNAME record makes one DNS name an alias of another canonical DNS name. The alias inherits the target's address resolution and must not coexist with other record types at the same owner name.

chrony

chrony is a modern implementation of the Network Time Protocol. The chronyd daemon synchronizes the system clock, while chronyc displays status and changes runtime settings. Accurate time is essential for Kerberos, certificates, logs, and distributed systems.

Dynamic Host Configuration Protocol (DHCP)

DHCP automatically supplies network configuration such as IP addresses, subnet prefixes, default gateways, DNS servers, and lease duration. DHCPv4 and DHCPv6 are separate protocols and may be used alongside IPv6 router advertisements.

dig

dig is a DNS query and troubleshooting utility distributed with BIND. It displays DNS response sections, flags, record types, response codes, authoritative data, and DNSSEC information, making it preferable to older interactive tools for detailed analysis.

Domain Name System (DNS)

DNS is a distributed hierarchical naming system that maps domain names to resource records such as IPv4 and IPv6 addresses, mail exchangers, service locations, certificate policies, and reverse-lookup names.

Domain Name System Security Extensions (DNSSEC)

DNSSEC uses digital signatures to authenticate DNS data and detect modification between an authoritative zone and a validating resolver. DNSSEC provides data-origin authentication and integrity; it does not encrypt DNS queries or responses.

domain

A domain is a node and the namespace beneath it in the DNS hierarchy. Administrative responsibility may be delegated at domain boundaries, while a DNS zone contains the portion of that namespace served by a particular authoritative data set.

email alias

An email alias is an alternate recipient address that redirects mail to another mailbox, local account, distribution list, or external address. Aliases are commonly managed by the mail-transfer system or a directory service.

email masquerading

Email masquerading rewrites locally generated sender addresses so that messages appear to originate from a consistent organizational domain rather than from individual host names or internal subdomains.

encryption

Encryption transforms readable data into ciphertext using a cryptographic algorithm and key. Modern network administration uses encryption for data in transit, stored credentials, backup media, management channels, and protected application data.

firewall

A firewall enforces policy by permitting, rejecting, or logging network traffic according to addresses, ports, protocols, connection state, interfaces, zones, and other criteria. On modern Linux systems, firewalld and nftables are commonly used to manage packet filtering.

firewalld

firewalld is a dynamic firewall-management service that organizes policy into zones, services, ports, and rich rules. On current enterprise Linux distributions, it commonly uses the nftables framework as its packet-filtering backend.

Fully Qualified Domain Name (FQDN)

An FQDN identifies a host or domain by its complete position in the DNS hierarchy, such as server1.example.com. The final dot explicitly represents the DNS root and is often omitted in user-facing notation.

Group ID (GID)

A GID is the numeric identifier associated with a Unix or Linux group. File ownership and access checks use numeric IDs internally even when commands display group names.

Host Information (HINFO) record

Limited or historical use: An HINFO record can describe a host's CPU and operating-system type. It is rarely published because the information is usually unnecessary and may disclose details useful to an attacker.

ip command

The ip utility from the iproute2 suite displays and configures addresses, interfaces, routes, neighbors, tunnels, and policy-routing rules. It is the modern replacement for many uses of ifconfig, route, and arp.

IP address

An IP address identifies a network interface or endpoint within an Internet Protocol network. IPv4 uses 32-bit addresses, while IPv6 uses 128-bit addresses and supports a much larger address space.

IPv4

Internet Protocol version 4 uses 32-bit addresses commonly written in dotted-decimal notation, such as 192.0.2.10. IPv4 remains widely used and frequently relies on private addressing and Network Address Translation.

IPv6

Internet Protocol version 6 uses 128-bit addresses written in hexadecimal notation, such as 2001:db8::10. IPv6 supports stateless address autoconfiguration, neighbor discovery, multicast, and end-to-end addressing without requiring NAT as a normal design assumption.

Kerberos

Kerberos is a ticket-based network authentication protocol that allows users and services to prove their identities without repeatedly transmitting passwords. It supports single sign-on and depends on accurate time synchronization and trusted key distribution centers.

Lightweight Directory Access Protocol (LDAP)

LDAP is a protocol for accessing and managing directory information such as users, groups, hosts, policies, and application data. LDAP should be protected with TLS and is commonly integrated with SSSD, Kerberos, identity-management platforms, or Active Directory.

Mail Delivery Agent (MDA)

An MDA delivers a message from the mail-transfer system into a user's mailbox, mail store, or delivery pipeline. Examples include local delivery agents and server-side filtering systems.

Mail Exchange (MX) record

An MX record identifies the mail servers responsible for accepting email for a DNS domain. Lower preference values are attempted before higher values, and each MX target must resolve to an address record rather than a CNAME.

Mail Transfer Agent (MTA)

An MTA accepts, routes, relays, and transfers email using SMTP. Common Unix and Linux MTAs include Postfix, Exim, and sendmail.

Mail User Agent (MUA)

An MUA is the client software through which a user composes, sends, reads, searches, and organizes email. It communicates with mail systems through protocols such as SMTP submission, IMAP, or web APIs.

name server

A name server is software that answers DNS queries. Depending on its configuration, it may serve authoritative zone data, perform recursive resolution, cache answers, or combine several of these roles with carefully restricted access.

Name Server (NS) record

An NS record identifies an authoritative name server for a DNS zone or delegated child domain. The referenced server name must resolve to an address, and delegations may require glue records in the parent zone.

named

named is the BIND name-server daemon. Modern BIND configurations use named.conf and included configuration files rather than the obsolete /etc/named.boot format.

Network Address Translation (NAT)

NAT rewrites IP addresses, ports, or both as packets cross a network boundary. It is commonly used for IPv4 address conservation and policy enforcement, but it is not a substitute for firewalling or end-to-end security.

NetworkManager

NetworkManager is a service and API for configuring and monitoring network interfaces, connections, routing, DNS, VPNs, bridges, bonds, VLANs, and other network functions on many Linux distributions.

Network File System (NFS)

NFS allows a client to mount directories exported by a remote server and use them as part of the local file-system hierarchy. Current deployments should use supported NFS versions, controlled exports, appropriate identity mapping, and strong authentication where required.

NFS version 4 (NFSv4)

NFSv4 integrates locking, state management, compound operations, and stronger security options into the protocol. Kerberos-based modes such as krb5, krb5i, and krb5p can provide authentication, integrity, and privacy.

nftables

nftables is the modern Linux packet-filtering and network-policy framework in the Netfilter subsystem. Administrators use the nft command to manage tables, chains, rules, sets, maps, counters, and stateful filtering.

nmcli

nmcli is the command-line interface for NetworkManager. It creates, modifies, activates, deactivates, and inspects persistent network connection profiles and device state.

nslookup

Legacy troubleshooting interface: nslookup remains available on many systems, but dig or resolvectl generally provides clearer output and better visibility into modern DNS behavior.

Network Information Service (NIS)

Historical technology: NIS distributed user, group, host, and configuration data across Unix networks but lacks modern security controls. New deployments should use LDAP, Kerberos, SSSD, Identity Management, Active Directory integration, or another supported identity platform.

NIS+

Historical technology: NIS+ was a more structured and secure successor to NIS, used mainly on older Solaris systems. It is not an appropriate foundation for a new 2026 identity architecture.

packet capture

Packet capture records network frames or packets for troubleshooting, performance analysis, incident response, and protocol validation. Captures may contain credentials, personal information, or sensitive application data and must be handled accordingly.

Pluggable Authentication Modules (PAM)

PAM is a framework that allows Unix and Linux applications to use configurable authentication, account, password, and session policies without embedding one fixed authentication method in each application.

port

A TCP or UDP port is a 16-bit number used to identify an application endpoint on a host. Server processes listen on selected ports, and clients connect from temporary source ports.

Postfix

Postfix is a widely used Unix and Linux mail-transfer agent designed around modular processes and least-privilege operation. It commonly replaces older sendmail deployments while continuing to use SMTP for message transfer.

Pointer (PTR) record

A PTR record maps an IP address to a domain name in a reverse-DNS zone. IPv4 uses in-addr.arpa, while IPv6 uses ip6.arpa.

primary authoritative server

The primary authoritative server maintains the principal writable copy of a DNS zone. Secondary authoritative servers obtain synchronized copies through full or incremental zone transfer. The term primary replaces the older term master.

recursive resolver

A recursive resolver accepts a client's request for a final DNS answer, queries other DNS servers as necessary, validates applicable DNSSEC data, and returns the result or an error. Access should be limited to authorized clients to prevent abuse as an open resolver.

Resource Record (RR)

A resource record is an individual DNS data item containing an owner name, time to live, class, type, and type-specific value. Common types include A, AAAA, CNAME, MX, NS, PTR, SOA, SRV, TXT, CAA, and DNSSEC records.

reverse DNS

Reverse DNS maps an IP address to a domain name through PTR records. Reverse zones use in-addr.arpa for IPv4 and ip6.arpa for IPv6.

resolv.conf

/etc/resolv.conf provides resolver configuration in a traditional Unix format, including name-server addresses and search domains. On many modern systems it is generated or managed by NetworkManager, systemd-resolved, DHCP clients, or another network-management service.

resolvectl

resolvectl queries and inspects the local resolver managed by systemd-resolved. It can display per-interface DNS servers, search domains, protocol use, DNSSEC validation status, and cached resolution results.

root hints

Root hints are a bootstrap list of DNS root-server names and addresses used by a recursive resolver to begin iterative resolution. They replace older glossary wording such as root cache file.

root server

A root server is authoritative for the DNS root zone and returns referrals to top-level-domain name servers. Root-server service is globally distributed through many anycast instances for resilience and performance.

routing

Routing selects the path packets take between networks. Unix and Linux administrators manage routing tables, default gateways, metrics, source-based rules, and dynamic-routing software with tools such as ip route and routing suites.

Remote Procedure Call (RPC)

RPC allows a program to invoke a procedure provided by another process or host. Unix networking uses several RPC mechanisms, including ONC RPC in traditional NFS-related services.

secondary authoritative server

A secondary authoritative server obtains a read-only copy of a DNS zone from a primary or another secondary server through AXFR or IXFR. It improves availability and distributes authoritative query load. The term secondary replaces the older term slave.

Secure RPC

Historical technology: Secure RPC added authentication to older ONC RPC and NFS environments. Modern deployments should prefer NFSv4 with Kerberos-based security or another currently supported secure file-service design.

sendmail

Historical or existing-system context: sendmail is a long-standing Unix MTA that transfers email using SMTP. It remains present in some environments, but new deployments frequently choose Postfix or another actively maintained MTA with simpler policy management.

sendmail M4 configuration

Historical or existing-system context: sendmail commonly uses M4 macros to generate its operational configuration. Administrators supporting an existing sendmail environment should edit the macro source and regenerate the configuration rather than modifying generated output blindly.

Simple Mail Transfer Protocol (SMTP)

SMTP transfers email between mail systems and submits outgoing mail from clients. Production deployments should use authenticated submission and TLS where appropriate, together with anti-abuse controls and domain-authentication technologies.

Start of Authority (SOA) record

An SOA record identifies core administrative parameters for a DNS zone, including its primary server, responsible contact, serial number, refresh and retry timers, expiration interval, and negative-caching value. Every zone contains one SOA record at its apex.

socket

A socket is an operating-system endpoint used for local or network communication. Internet sockets are commonly identified by protocol, address, and port, while Unix-domain sockets provide local interprocess communication.

Service (SRV) record

An SRV record identifies the host and port that provide a named service for a domain. It includes priority and weight values and is used by technologies such as Kerberos, LDAP, SIP, and Active Directory.

ss command

The ss utility displays socket and connection information, including listening ports, established sessions, protocol state, processes, and network statistics. It is the modern replacement for most uses of netstat.

Secure Shell (SSH)

SSH provides encrypted remote login, command execution, tunneling, and file transfer. Administrators should use current cryptographic algorithms, protect private keys, restrict privileged login, and apply multifactor authentication where required.

System Security Services Daemon (SSSD)

SSSD connects Linux systems to remote identity and authentication providers such as LDAP, Kerberos, Identity Management, and Active Directory. It provides identity lookup, credential caching, access control, and integration with PAM and the Name Service Switch.

systemd-resolved

systemd-resolved is a local name-resolution service that can maintain per-interface DNS configuration, caching, DNSSEC validation, split-DNS routing, and local host-name resolution. Its state is inspected with resolvectl.

Transmission Control Protocol (TCP)

TCP provides connection-oriented, reliable, ordered byte-stream delivery over IP. It uses acknowledgments, retransmission, flow control, and congestion control to support applications such as SSH, HTTPS, SMTP, and many database protocols.

tcpdump

tcpdump is a command-line packet-capture and protocol-analysis utility. It can filter traffic by interface, host, network, port, protocol, and packet attributes and can write captures in formats used by graphical analyzers.

Transport Layer Security (TLS)

TLS protects application traffic through encryption, integrity checking, and certificate-based authentication. It underpins HTTPS, secure mail transport, LDAPS or StartTLS, and many administrative APIs.

Transaction Signature (TSIG)

TSIG authenticates DNS messages between trusted systems using a shared secret and keyed message authentication. It is commonly used to secure zone transfers, dynamic updates, and control operations; it does not encrypt DNS contents.

Text (TXT) record

A TXT record stores text associated with a DNS name. Common uses include domain verification, SPF policy, DKIM public keys, DMARC policy, and application-specific metadata.

User Datagram Protocol (UDP)

UDP provides connectionless datagram delivery over IP without built-in acknowledgment, retransmission, ordering, or congestion recovery. Applications use UDP when low overhead, multicast, real-time behavior, or application-managed reliability is required.

User ID (UID)

A UID is the numeric identifier associated with a Unix or Linux user account. Processes and file systems use UIDs internally to represent ownership and enforce access controls.

Virtual Local Area Network (VLAN)

A VLAN separates Layer 2 broadcast domains on shared switching infrastructure by applying an IEEE 802.1Q tag. Linux systems can create and manage VLAN interfaces with NetworkManager, nmcli, or the ip command.

zone

A DNS zone is the portion of the DNS namespace administered as one data set by a particular authority. A zone may contain an entire domain or exclude delegated child domains.

zone file

A zone file is a text representation of authoritative DNS resource records. BIND can load zones from files, dynamic-update journals, databases, catalog zones, or other supported backends.

zone transfer

A zone transfer synchronizes authoritative DNS data between servers. AXFR transfers the complete zone, while IXFR transfers supported incremental changes. Transfers should be restricted to authorized servers and authenticated with TSIG where appropriate.