$ Linux One Liners
Back to cert prep

Unofficial practice

Find Which RPM Owns a File

A binary or file needs an owner. Ask the package database first so you know whether the file is managed, missing, or from the wrong package family.

Linux One Liners is an independent study and practice resource. It is not affiliated with, endorsed by, or approved by LPI, The Linux Foundation, CompTIA, or any certification provider. This site does not provide exam dumps or real exam questions.

Try first

rpm -qf /usr/bin/ssh

Troubleshooting ladder

  1. Name the symptom.
  2. Inspect read-only state.
  3. Find the owner, service, file, device, mount, or route.
  4. Read the decisive output field.
  5. Choose the next narrow command.
  6. Avoid broad or destructive changes.
  7. Make the smallest justified change if required.
  8. Verify and record what changed.

drill evidence

Sample output and answer key

Command anatomy

rpm -qf /usr/bin/ssh
dpkg -S / rpm -qf
find the package that owns a file
path
the installed file being checked
package
the owning package returned by the database

Annotated output

openssh-clients-9.3p1-10.el9.x86_64

What to notice

name
the owning RPM package
version/release
the installed build
arch
the package architecture

Safe vs unsafe move

Common wrong move

Mixing Debian dpkg checks with RPM-family hosts.

Next safe command

rpm -qi openssh-clients

Goal

Prove the condition with command output before changing the system.

Safe first command

rpm -qf /usr/bin/ssh

Correct interpretation

The decisive fields are `name`, `version/release`, `arch`. The affected object is the exact target named in the output, not the broad subsystem around it. The next safe command is `rpm -qi openssh-clients` because it narrows the evidence without jumping to a broad fix. Watch out for this wrong move: Mixing Debian dpkg checks with RPM-family hosts.

Next safe command

rpm -qi openssh-clients

Common wrong move

Mixing Debian dpkg checks with RPM-family hosts.

Self-check

Which package owns the file, and what package-detail command would you run next?

source and objective

Related cert objective

Source status: LPI LPIC-1 overview verified July 3, 2026. Current version 5.0; exams 101-500 and 102-500.

Open related practice area

Related command pages

Why this matters

The point is not to memorize a flag. It is to read the evidence, name the next safe check, and avoid the tempting broad fix.