The Command Line and the File System

Almost every server on the Internet runs Linux, almost every security tool runs well on Linux, and almost every professional in this field spends part of the day in a terminal. The command line looks austere at first, but it is just a conversation: you type a short instruction, the system answers. In this lesson you learn the basic vocabulary and the layout of the Linux file system, using the server VM of your lab.

Chapter 3 left you with a working lab: a Kali VM and a Linux server on an isolated network. From now on, you will use them every day. Open a terminal on the server VM (or on Kali, since the commands are the same) and try each command as you read.

Why the command line?

Graphical tools are friendly, but they are slow for repeated tasks, they hide what is really happening, and they are often absent on servers, which have no screen. The command line is precise, fast, scriptable and available over a network connection. It is also where most security tools live, and where logs and configuration files can be inspected directly.

The program that reads your commands is called the shell. On most Linux systems the default is bash. The line where you type is the prompt, and it typically looks like this:

student@lab-server:~$

It shows the current user (student), the machine name (lab-server), the current directory (~ means your home directory) and the sign $, which indicates a normal user. A # instead of $ indicates the administrator account (root), a reminder to be careful.

Anatomy of a command

A command has three parts: the command name, optional options (often starting with a dash) and arguments, which are what the command acts on.

ls -l /etc

Here ls is the command (list), -l is an option (long format) and /etc is the argument (the directory to list). Options can be combined: ls -la means long format and show hidden files. When you do not know a command, ask for help: man ls opens the manual (press q to quit), and many tools also accept --help. Use the Tab key to autocomplete names and the up arrow to bring back previous commands: they save a great deal of typing.

The layout of the file system

Linux organises everything in a single tree that starts at the root directory, written /. There are no drive letters. A path such as /home/student/notes.txt reads from the root down to the file. A absolute path starts with /; a relative path starts from where you are now. Two special names are useful: . is the current directory and .. is the parent directory.

The standard directories you must recognise:

The phrase "everything is a file" is a famous Linux idea: documents, configuration, devices, even information about processes are exposed as files you can read with the same tools. For a security person, this makes the system remarkably transparent.

Moving around and looking

These commands form your core toolkit:

pwd                 # print the current directory
ls                  # list files
ls -la              # long format, including hidden files (names starting with a dot)
cd /etc             # change directory (absolute path)
cd ..               # go up one level
cd ~                # go home (same as typing cd alone)
cat /etc/hostname   # show the content of a file
less /etc/os-release# page through a file (q to quit)
head -n 5 file      # first 5 lines
tail -n 5 file      # last 5 lines
tail -f file        # follow a file as it grows (Ctrl+C to stop)

Note that Linux is case sensitive: Notes.txt and notes.txt are two different files. Names that contain spaces must be quoted or escaped, which is a good reason to avoid spaces in your own file names.

Creating, copying, moving, deleting

mkdir labnotes          # create a directory
touch labnotes/day1.txt # create an empty file
cp labnotes/day1.txt labnotes/copy.txt
mv labnotes/copy.txt labnotes/day2.txt   # move or rename
rm labnotes/day2.txt    # delete a file
rmdir labnotes          # delete an empty directory
rm -r labnotes          # delete a directory and its contents

Be careful: there is no recycle bin on the command line. rm deletes immediately, and rm -r deletes entire trees. One of the oldest mistakes in the book is running a recursive deletion in the wrong directory, especially as an administrator. This is where snapshots pay off in your lab, and why you should always double-check what you type before pressing Enter.

Searching and filtering

Linux is superb at finding things. Three tools you will use constantly:

• find searches for files by name, type, size or date: find /etc -name "*.conf".
• grep searches inside files for text: grep "error" /var/log/syslog. Useful options: -i ignores case, -n shows line numbers, -r searches directories recursively.
• wc counts lines, words or characters: wc -l file.

The real power comes from pipes. The symbol | sends the output of one command to the input of the next, so that small tools can be combined into powerful ones:

cat /etc/passwd | wc -l
ls /etc | grep ssh
history | grep apt | tail -n 5

You can also redirect output into a file with > (overwrite) or >> (append): ls /etc > list.txt saves the listing in a file. Errors travel on a separate stream, which you can discard with 2>/dev/null, a handy trick when a command prints noisy "permission denied" messages.

Editing a file

Sooner or later you need to edit a configuration file. nano is the friendliest terminal editor: type nano file.txt, edit, press Ctrl+O to save and Ctrl+X to quit (the key names are shown at the bottom of the screen). Another editor, vim, is very powerful but has a learning curve; if you ever end up in it by accident, press Esc, then type :q! and Enter to leave without saving.

Installing software

On Debian-based systems such as Kali, Debian and Ubuntu, the package manager apt installs, updates and removes software from signed repositories. Installing a package requires administrator rights, which we explain in the next lesson:

sudo apt update
sudo apt install tree
tree -L 1 /

The package manager is the right way to add software: it checks signatures and tracks dependencies, in contrast to downloading programs from random websites.

Your turn: explore and annotate the server

On your server VM, do the following and write the results in your lab notebook. First, display your current directory and the content of your home directory with hidden files. Second, create a directory lab, and inside it a file inventory.txt that contains the output of hostname, uname -a and ip addr show (use redirection with >>). Third, find out how many users are defined in /etc/passwd using a pipe. Fourth, list all files under /etc whose name ends in .conf that mention the word ssh in their name.

pwd
ls -la ~
mkdir ~/lab
hostname >> ~/lab/inventory.txt
uname -a >> ~/lab/inventory.txt
ip addr show >> ~/lab/inventory.txt
cat ~/lab/inventory.txt
wc -l /etc/passwd
find /etc -name "*ssh*.conf" 2>/dev/null