Skip to main content

Linux Fundamentals

Introduction​

Linux is an open-source operating system based on Unix. Understanding Linux is essential in cybersecurity because:

  • The majority of web servers use Linux
  • Security tools are often developed for Linux
  • WSL allows using Linux under Windows

Comparison Windows vs Linux​

File System Structure​

AspectWindowsLinux
RootC:\/
Separator\/
Case sensitivityNoYes
UsersC:\Users\name/home/name
ProgramsC:\Program Files/usr/bin, /opt
ConfigurationRegistryText files (/etc)

Linux Directory Tree​

/
├── bin/          # Essential binaries
├── boot/         # Boot files
├── dev/          # Devices
├── etc/          # System configuration
├── home/         # User directories
├── lib/          # Libraries
├── media/        # Media mount points
├── mnt/          # Temporary mount points
├── opt/          # Optional software
├── proc/         # Processes (virtual)
├── root/         # Root's home
├── sbin/         # System binaries
├── tmp/          # Temporary files
├── usr/          # User programs
└── var/          # Variable data (logs, mail)

Essential Commands​

# Current directory
pwd

# List files
ls
ls -la          # Details + hidden files
ls -lh          # Human-readable sizes

# Change directory
cd /path
cd ~            # Home
cd -            # Previous
cd ..           # Parent

Files and Folders​

# Create
mkdir folder
touch file

# Copy
cp source destination
cp -r folder/ destination/

# Move/Rename
mv source destination

# Delete
rm file
rm -r folder/
rm -rf folder/   # Force (DANGER!)

# Display content
cat file
less file        # Pagination
head -n 10 file
tail -n 10 file
tail -f file     # Real-time follow
# Find files
find /path -name "*.txt"
find / -type f -name "password*"
find / -perm -4000   # SUID

# Search within files
grep "pattern" file
grep -r "pattern" /path/
grep -i "pattern" file   # Case insensitive

Permissions​

# View permissions
ls -l file

# Format: -rwxrwxrwx
#         │└┬┘└┬┘└┬┘
#         │ │  │  └── Others (o)
#         │ │  └───── Group (g)
#         │ └──────── Owner (u)
#         └────────── Type (- file, d directory)

# Change permissions
chmod 755 file     # rwxr-xr-x
chmod u+x file     # Add execution for user
chmod go-w file    # Remove write for group/others

# Change owner
chown user:group file

Chmod Values​

ValuePermission
7rwx (read + write + execute)
6rw- (read + write)
5r-x (read + execute)
4r-- (read only)
0--- (none)

Users and Groups​

Important Files​

FileContent
/etc/passwdList of users
/etc/shadowHashed passwords
/etc/groupList of groups
/etc/sudoersSudo configuration

User Commands​

# Current user
whoami
id

# Change user
su - username
su -              # Become root

# Execute as root
sudo command
sudo -i           # Root shell

# Manage users
useradd username
passwd username
userdel username

Processes​

Commands​

# List processes
ps aux
ps -ef

# Tree
pstree

# Real-time
top
htop              # Enhanced version

# Kill a process
kill PID
kill -9 PID       # Force
killall name

# Background
command &
jobs
fg %1
bg %1

Common Signals​

SignalNumberDescription
SIGTERM15Terminate gracefully
SIGKILL9Kill immediately
SIGINT2Interrupt (Ctrl+C)
SIGHUP1Hang up

Network​

Commands​

# IP configuration
ip addr
ifconfig          # Old

# Connections
netstat -tulpn
ss -tulpn         # Modern

# Connectivity test
ping address
traceroute address

# DNS
nslookup domain
dig domain

# Transfer
wget url
curl url
curl -o file url

# Remote connection
ssh user@server
scp file user@server:/path/

Services and Daemons​

systemd (modern)​

# Status
systemctl status service

# Start/Stop
systemctl start service
systemctl stop service
systemctl restart service

# Enable/Disable at boot
systemctl enable service
systemctl disable service

# List services
systemctl list-units --type=service

SysVinit (old)​

service name start
service name stop
service name status

Important Files for Security​

Configuration​

FileDescription
/etc/passwdUser accounts
/etc/shadowPassword hashes
/etc/sudoersSudo privileges
/etc/ssh/sshd_configSSH configuration
/etc/crontabSystem scheduled tasks

Logs​

FileDescription
/var/log/auth.logAuthentication (Debian)
/var/log/secureAuthentication (RedHat)
/var/log/syslogSystem logs
/var/log/messagesGeneral messages
/var/log/apache2/Apache logs

View Logs​

# Journalctl (systemd)
journalctl
journalctl -u service
journalctl -f            # Real-time
journalctl --since today

# Files
tail -f /var/log/auth.log
grep "Failed" /var/log/auth.log

Special Bits (Security)​

SUID (Set User ID)​

Allows a program to be executed with the privileges of the owner.

# Find SUID files
find / -perm -4000 2>/dev/null

# Example: passwd has SUID root to modify /etc/shadow
ls -l /usr/bin/passwd
# -rwsr-xr-x 1 root root ... /usr/bin/passwd

SGID (Set Group ID)​

Similar but for the group.

find / -perm -2000 2>/dev/null

Sticky Bit​

Prevents file deletion by non-owners.

ls -ld /tmp
# drwxrwxrwt ... /tmp
# The 't' indicates the sticky bit

Basic Bash Scripting​

First Script​

#!/bin/bash
# My first script

echo "Hello, $USER!"
echo "Today is $(date)"
echo "You are in $(pwd)"

Variables and Conditions​

#!/bin/bash

# Variables
name="Linux"
version=5

# Condition
if [ $version -gt 4 ]; then
    echo "$name version $version is recent"
else
    echo "Old version"
fi

# Loop
for i in 1 2 3 4 5; do
    echo "Iteration $i"
done

Useful Script - Basic Enumeration​

#!/bin/bash
# Basic system enumeration

echo "=== SYSTEM INFORMATION ==="
echo "Hostname: $(hostname)"
echo "Kernel: $(uname -a)"
echo "User: $(whoami)"
echo "ID: $(id)"

echo -e "\n=== USERS ==="
cat /etc/passwd | cut -d: -f1

echo -e "\n=== SUID FILES ==="
find / -perm -4000 2>/dev/null

echo -e "\n=== CRON JOBS ==="
cat /etc/crontab

echo -e "\n=== NETWORK CONNECTIONS ==="
ss -tulpn

WSL (Windows Subsystem for Linux)​

Installation​

# PowerShell (Admin)
wsl --install

# Choose a distribution
wsl --install -d Ubuntu

WSL Commands​

# List distributions
wsl --list --verbose

# Start
wsl

# Access Windows files
cd /mnt/c/Users/

# From Windows, access Linux
\\wsl$\Ubuntu\home\user\

Exercises​

  1. Navigate the file system and list the files in /etc
  2. Create a file, change its permissions to 644
  3. Find all SUID files on the system
  4. Write a script that displays system information
  5. View authentication logs

References​