Linux Basics for Cybersecurity

Why Linux?

Linux is the backbone of cybersecurity for several reasons:

• Most servers run Linux
• Superior command-line tools
• Open-source transparency
• Powerful scripting capabilities
• Preferred OS for security tools

File System Structure

/               Root directory
├── bin         Essential command binaries
├── boot        Boot loader files
├── dev         Device files
├── etc         System configuration files
├── home        User home directories
├── lib         Shared libraries
├── opt         Optional software
├── root        Root user home directory
├── sbin        System binaries
├── tmp         Temporary files
├── usr         User programs
└── var         Variable data (logs, etc.)

Essential Commands

Navigation

pwd                 # Print working directory
ls                  # List files
ls -la              # List all files with details
cd /path/to/dir     # Change directory
cd ..               # Go up one directory
cd ~                # Go to home directory

File Operations

cat file.txt        # Display file contents
less file.txt       # View file with pagination
head -n 10 file.txt # Show first 10 lines
tail -f log.txt     # Follow log file in real-time
cp source dest      # Copy file
mv old new          # Move/rename file
rm file.txt         # Delete file
mkdir dirname       # Create directory
rmdir dirname       # Remove empty directory
rm -rf dirname      # Remove directory recursively

File Permissions

Linux uses a permission system with three levels:

• Owner (u): The file's owner
• Group (g): Users in the file's group
• Others (o): Everyone else

Three permission types:

• Read (r): View file contents
• Write (w): Modify file
• Execute (x): Run file as program

# View permissions
ls -l file.txt
# Output: -rw-r--r-- 1 user group 1234 Jan 1 12:00 file.txt

# Change permissions
chmod 755 script.sh     # rwxr-xr-x
chmod u+x script.sh     # Add execute for owner
chmod go-w file.txt     # Remove write for group/others

# Change ownership
chown user:group file.txt

Process Management

ps aux              # List all processes
top                 # Interactive process viewer
htop                # Enhanced process viewer
kill PID            # Terminate process
killall name        # Kill all processes by name
bg                  # Send process to background
fg                  # Bring process to foreground
jobs                # List background jobs

Searching and Finding

find / -name "*.txt"        # Find files by name
find / -type f -size +100M  # Find files larger than 100MB
grep "pattern" file.txt     # Search for pattern in file
grep -r "pattern" /path/    # Recursive search
locate filename             # Quick file search
which command               # Find command location

Network Commands

ifconfig                # Network interface configuration
ip addr show            # Show IP addresses
ping host.com           # Test connectivity
netstat -tulpn          # Show listening ports
ss -tulpn               # Modern netstat alternative
nmap target.com         # Network scanning
curl https://api.com    # Make HTTP requests
wget https://file.com   # Download files

Package Management

Debian/Ubuntu (APT)

sudo apt update         # Update package lists
sudo apt upgrade        # Upgrade packages
sudo apt install pkg    # Install package
sudo apt remove pkg     # Remove package
apt search keyword      # Search for packages

Red Hat/CentOS (YUM/DNF)

sudo yum update
sudo yum install pkg
sudo dnf install pkg

Text Processing

cat file.txt | grep "error"     # Filter lines
cat file.txt | sort | uniq      # Sort and remove duplicates
awk '{print $1}' file.txt       # Print first column
sed 's/old/new/g' file.txt      # Replace text
cut -d',' -f1 data.csv          # Extract CSV column

Bash Scripting Basics

#!/bin/bash

# Variables
NAME="John"
echo "Hello, $NAME"

# Conditionals
if [ -f "/etc/passwd" ]; then
    echo "File exists"
fi

# Loops
for i in {1..5}; do
    echo "Number: $i"
done

# Functions
function greet() {
    echo "Hello, $1"
}
greet "World"

Security Best Practices

1. Keep system updated: sudo apt update && sudo apt upgrade
2. Use strong passwords: Consider password managers
3. Limit sudo access: Only give necessary privileges
4. Monitor logs: Check /var/log/ regularly
5. Disable unnecessary services: systemctl disable service
6. Use SSH keys: Instead of passwords
7. Configure firewall: ufw enable

Practice Exercises

1. Create a directory structure for organizing penetration testing results
2. Write a script to backup important files
3. Find all SUID binaries on the system
4. Monitor network connections in real-time
5. Parse log files to find failed login attempts

Next Module

Ready for Networking Fundamentals!