Linux Fundamentals for Security Learners

Why Linux matters

Most servers, containers and security tools (including Nmap and Wireshark) run on Linux. Being comfortable in a terminal makes every later topic easier.

The file system layout

Essential commands

pwd                 # where am I?
ls -la              # list files with permissions
cd /var/log         # change directory
cat file.txt        # print a file
grep -i "failed" auth.log   # search text
ps aux              # running processes
ss -tulpn           # listening network sockets
id                  # your user and groups

Users and permissions

Every file has an owner, a group and permission bits for read (r), write (w), execute (x). ls -l shows them, for example -rw-r----- 1 alice staff means: the owner can read and write, the group can read, others have no access.

Numeric form: r=4, w=2, x=1. So chmod 640 secret.txt gives the owner 6 (rw-), the group 4 (r--) and others 0.

Security-relevant ideas:

• Run as a normal user and use sudo only when needed (least privilege).
• A script that is writable by everyone but executed by root is a privilege-escalation risk — try our Permission Audit challenge.

Pipes and redirection

grep "Failed password" /var/log/auth.log | wc -l     # count failures
sudo ss -tulpn > listening.txt                        # save output

Practice plan

Install a Linux VM in your lab, then repeat the commands above until they feel natural.