Stop 03 · Linux & Windows FundamentalsTopics · 1/10

Linux Fundamentals for Security

In short

Most servers on the internet run Linux, and so do most security tools. If you're slow in a Linux terminal, every lab, investigation and interview task will feel twice as hard.

The dominant OS for security tools and servers alike — comfort navigating Linux is assumed for nearly every security role, from running pentesting tools to analyzing a compromised server.

The blob picks a spanner from a pegboard of neatly hung tools.

Think of it like this

A mechanic's tool wall

A good mechanic doesn't own one giant machine. The wall holds many small tools, each doing one job well, and he combines them for each repair. Linux works the same: small commands you chain together to answer any question.

Watch it happen

Where security-relevant things live

/etc

/var/log

/home

/tmp

passwd, shadow

auth.log

1/5Everything in Linux hangs off one root folder, /. There are no C: or D: drives.

The big ideas

What you need to know

Everything is a file

Configs, logs, devices and even running processes (under /proc) show up as files you can read.

root is all-powerful

The root user can do anything. Normal work should happen as a regular user, with sudo when needed.

The shell is your main tool

Navigation, searching, process checks and network checks all happen from the terminal.

Package managers install tools

apt on Ubuntu and Kali, dnf on Fedora and RHEL. Always install from official repos.

See it in code

Walk through the code

bash

1whoami && id            # who am I, and which groups am I in?2sudo -l                 # what am I allowed to run as root?3ps aux --sort=-%cpu | head   # busiest processes4ss -tulpn               # which ports are listening, and by which program5last -n 10              # recent logins6ls -la /tmp             # anything odd dropped here?

1/3Know your identity and privileges before anything else. sudo -l shows what you can run as root.

This is a first-five-minutes check on a Linux box you're investigating. Run it on your own VM first so you know what 'normal' looks like.

Save yourself the pain

Common mistakes

Oops

Doing everything logged in as root.

Do this instead

Use a normal account and sudo for specific commands. One typo as root can wreck a system.

Oops

Copy-pasting commands from random blogs without reading them.

Do this instead

Read every command and check unfamiliar flags with man or --help first. Some 'fixes' are traps.

Your mission

Learn the basics the fun way

~45 min

Quick check

You want to see which programs are listening for network connections on a Linux server. Which command?

Go deeper

1Set up a Linux practice VM (e.g. Kali Linux, commonly used in security work) and explore it hands-on.
2Learn the basics of the file system and package management.
3Practice daily until navigating a terminal feels natural, not intimidating.