Linux Introduction

1. Introduction to Linux

Linux is an open-source operating system kernel that forms the
core of many operating systems used on servers, computers, cloud platforms,
network devices, embedded systems and cybersecurity environments.

In everyday conversation, the word “Linux” is commonly used to describe a
complete operating system built around the Linux kernel.

Technically, the Linux kernel is only one major component of
a complete Linux operating system.

2. What Is an Operating System?

An operating system is software that manages computer hardware and provides
services that applications use to perform tasks.

Examples of operating systems include:

• Linux
• Microsoft Windows
• macOS
• Android
• Other Unix-like operating systems

The operating system manages resources such as memory, processors, storage,
devices, processes and user access.

3. What Is the Linux Kernel?

The Linux kernel is the central component of a Linux-based
operating system.

It communicates between software and hardware and manages important system
resources.

The kernel is responsible for areas such as:

• Process management
• Memory management
• Device management
• Networking
• Filesystem operations
• Security-related access controls

4. Linux Kernel vs Linux Distribution

A Linux distribution, often called a distro, combines the
Linux kernel with additional software required to create a usable operating
system.

A typical distribution may include:

• Linux kernel
• System libraries
• Command-line utilities
• Package manager
• Desktop environment
• System services
• Configuration tools
• Applications

5. Popular Linux Distributions

Many Linux distributions are available for different purposes.

Examples include:

• Ubuntu
• Debian
• Fedora
• Red Hat Enterprise Linux
• Rocky Linux
• AlmaLinux
• Arch Linux
• openSUSE

Different distributions may use different package-management systems,
configuration approaches and release models.

6. Linux in Cybersecurity

Linux is highly relevant to cybersecurity because many servers, cloud
platforms, network systems and security tools run on Linux.

Security professionals may use Linux for:

• Security monitoring
• Log analysis
• Network administration
• Digital forensics
• Incident response
• Security testing
• Web-server administration
• Cloud administration
• Security tool development

7. Security-Focused Linux Distributions

Some Linux distributions are designed or configured for security education,
digital forensics, penetration testing and security research.

Examples include:

• Kali Linux
• Parrot Security
• Security Onion

These environments contain collections of security tools, but the tools must
always be used only on systems and networks where the user has authorization.

8. Linux and Open Source

Linux is strongly associated with the open-source software movement.

Open-source software generally makes source code available under license
terms that allow certain forms of inspection, modification and redistribution.

The exact permissions depend on the software’s license.

9. Why Open Source Matters in Security

Open-source software can allow developers and security researchers to inspect
code, identify problems, create improvements and contribute fixes.

However, open source does not automatically mean that software is secure.
Security still depends on development practices, maintenance, configuration,
updates and responsible use.

10. Linux Architecture

A simplified Linux system can be viewed as several layers.

1. Hardware: CPU, memory, storage, network devices and peripherals.
2. Kernel: Manages hardware and core system resources.
3. System libraries: Provide reusable functionality to programs.
4. Shell: Provides a command interface for users and scripts.
5. Applications: Programs used to perform specific tasks.

11. User Space and Kernel Space

Linux separates many normal applications from privileged kernel operations.

Applications generally operate in user space, while the
kernel operates in a privileged environment.

This separation helps protect the operating system from unrestricted access
by ordinary applications.

12. The Shell

A shell is a command interpreter that allows users to
interact with the operating system by entering commands.

Common Linux shells include:

• Bash
• Zsh
• Fish
• Dash

Bash is one of the most widely used shells and is particularly important for
Linux administration and scripting.

13. Terminal vs Shell

A terminal is an interface through which users can interact
with a shell.

The shell interprets commands, while the terminal provides the interface in
which commands and their output are displayed.

14. First Linux Commands

The following commands are safe introductory commands that can be used in a
Linux laboratory or personal Linux system.

pwd
ls
whoami
date
uname
hostname

These commands provide basic information about the current environment.

15. The pwd Command

The pwd command means print working directory.
It displays the directory in which the current shell session is operating.

pwd

Example output:

/home/student

16. The ls Command

The ls command lists files and directories.

ls

A more detailed listing can be requested with:

ls -l

Hidden files can be included with:

ls -la

17. The whoami Command

The whoami command displays the username associated with the
current shell session.

whoami

This is particularly useful when learning about Linux permissions and
privileged accounts.

18. The uname Command

The uname command displays information about the operating system
and kernel.

uname

For more detailed system information:

uname -a

19. The Linux Filesystem

Linux uses a hierarchical filesystem.

The top of the hierarchy is represented by the root directory:

/

Important directories commonly include:

• /home — user home directories
• /etc — system configuration files
• /var — variable data such as logs
• /tmp — temporary files
• /usr — many user-space programs and resources
• /bin — essential command binaries on systems that use this layout
• /sbin — system administration binaries on systems that use this layout
• /dev — device interfaces
• /proc — process and kernel information interface

20. Linux Is Case-Sensitive

Linux filenames and many commands are case-sensitive.

For example:

Report.txt
report.txt
REPORT.txt

These may represent three different filenames.

21. Users in Linux

Linux is designed as a multi-user operating system.

Different users can have different identities, permissions and access levels.

This is important for security because users should normally receive only the
permissions required for their responsibilities.

22. The Root User

The root account is a highly privileged account in Linux.

Root can perform administrative operations that ordinary users cannot.

Because actions performed with root privileges can significantly affect a
system, administrative privileges should be used carefully.

23. sudo

The sudo command allows an authorized user to execute selected
commands with elevated privileges.

sudo command

For example, an administrator might use:

sudo apt update

The exact command available depends on the Linux distribution and the user’s
permissions.

24. Linux Permissions

Linux uses permissions to control access to files and directories.

The traditional permission categories are:

• Owner
• Group
• Others

Common permissions include:

• r — read
• w — write
• x — execute

25. Why Permissions Matter in Cybersecurity

Poor permissions can expose sensitive information or allow unauthorized
changes.

For example, a configuration file containing sensitive information should not
normally be writable by every user on a system.

Understanding permissions is therefore essential for Linux security.

26. Linux Processes

A process is a running instance of a program.

Linux assigns each process a Process ID, commonly called a
PID.

Processes are important for security monitoring because unusual or unexpected
processes may require investigation.

27. Basic Process Commands

Common commands include:

ps
ps aux
top

These commands can provide information about running processes.

28. Linux Networking

Linux contains extensive networking capabilities.

Basic networking commands include:

ip addr
ip route
ping
ss

These commands can help administrators understand interfaces, routes and
network connections.

29. Linux Package Management

Linux distributions use package-management systems to install, update and
remove software.

For Debian-based distributions, a common package manager is
APT.

sudo apt update
sudo apt upgrade

Other distributions use different package-management tools.

30. Security and Package Updates

Keeping software updated is an important security practice because updates
can contain security fixes.

However, organizations should follow approved testing and change-management
procedures, especially on production systems.

31. Linux Logs

Linux systems commonly record important system events in logs.

Depending on the distribution and configuration, logs may be available under:

/var/log/

Modern Linux systems may also use systemd-journald, which can be
queried using journalctl.

journalctl

32. Linux in Servers

Linux is widely used for server workloads such as:

• Web servers
• Database servers
• DNS servers
• File servers
• Application servers
• Cloud workloads
• Container platforms

33. Linux in Cloud Computing

Many cloud environments provide Linux-based virtual machines and containers.

Linux knowledge therefore helps cybersecurity professionals understand cloud
infrastructure, system configuration, identity, networking and logging.

34. Linux and Web Servers

Linux is frequently used to host websites and web applications.

Common server software includes:

• Apache HTTP Server
• Nginx
• PHP runtime environments
• Database systems

A cybersecurity professional may need to understand how these services are
configured and protected.

35. Linux Security Fundamentals

A basic Linux security strategy includes:

• Strong authentication
• Least privilege
• Secure permissions
• Regular updates
• Firewall configuration
• Log monitoring
• Service minimization
• Secure backups
• Access control
• Security monitoring

36. Principle of Least Privilege in Linux

Linux provides multiple mechanisms that allow administrators to limit user
access.

A good security practice is to avoid giving ordinary users unnecessary
administrative privileges.

37. Linux Command-Line Skills

Cybersecurity professionals often work with the command line because it is
efficient for administration, troubleshooting, automation and investigation.

Students should become comfortable with commands such as:

pwd
ls
cd
cp
mv
mkdir
rm
cat
less
grep
find
whoami
id
ps
top
ip
ss
ping

38. Linux Commands Must Be Used Carefully

Some Linux commands can modify or delete files, change permissions or affect
system services.

Students should therefore practice administrative commands in a laboratory
environment and understand what a command does before executing it.

39. Safe Linux Learning Environment

A Linux virtual machine is an excellent environment for learning.

Students can use platforms such as VirtualBox, VMware or other authorized
virtualization environments to create isolated practice systems.

Security exercises should be performed only against systems the learner owns
or has explicit permission to test.

40. Simple Linux Information Exercise

Run the following commands in your Linux laboratory:

whoami
hostname
pwd
uname -a
ip addr

Record what each command tells you about the system.

41. Basic Linux Information with PHP

PHP can execute operating-system commands in some server environments, but
this capability should be handled carefully.

For a controlled educational environment, the following example demonstrates
how PHP can retrieve a limited system value.

<?php

$hostname = gethostname();

if ( false !== $hostname ) {
	echo 'System hostname: ';
	echo htmlspecialchars(
		$hostname,
		ENT_QUOTES,
		'UTF-8'
	);
} else {
	echo 'Hostname could not be determined.';
}

42. Security Warning About Command Execution

Functions that execute operating-system commands can introduce serious
security risks when user-controlled input is passed into them.

Never concatenate untrusted user input directly into shell commands.

When system commands are genuinely required, applications should use strict
allowlists, safe APIs and appropriate input validation.

43. Linux and Cybersecurity Career Paths

Linux knowledge is useful across many cybersecurity roles, including:

• Security analyst
• Security engineer
• System administrator
• Network administrator
• Cloud security professional
• Incident responder
• Digital forensics analyst
• Penetration tester
• DevSecOps professional

44. Practical Laboratory Exercise

Create a Linux virtual machine or use an authorized Linux laboratory.

Complete the following tasks:

1. Identify your current username.
2. Identify the hostname.
3. Display the current directory.
4. List files in the current directory.
5. Display kernel information.
6. Display network interface information.
7. Display the routing table.
8. View running processes.
9. Identify the Linux distribution.
10. Locate a system log directory.

45. Practical Exercise Commands

whoami
hostname
pwd
ls -la
uname -a
ip addr
ip route
ps aux
cat /etc/os-release
ls -la /var/log

Use these commands only on your own Linux system or an authorized training
environment.

46. Review Questions

1. What is Linux?
2. What is the Linux kernel?
3. What is a Linux distribution?
4. Name three Linux distributions.
5. Why is Linux important in cybersecurity?
6. What is open-source software?
7. What is a shell?
8. What is a terminal?
9. What does the pwd command do?
10. What does ls do?
11. What does whoami display?
12. What is the root user?
13. What is sudo?
14. Why are Linux permissions important?
15. What is a process?
16. What is a PID?
17. What does ip addr help display?
18. Why are software updates important for security?
19. Where are Linux logs commonly stored?
20. Why should security exercises be performed only in authorized environments?

47. Key Takeaways

• Linux is an open-source kernel used by many operating systems.
• A Linux distribution combines the kernel with additional software.
• Linux is widely used in servers, cloud environments and cybersecurity.
• The command line is an important Linux administration interface.
• Linux uses users and permissions to control access.
• The root account has extensive administrative privileges.
• sudo can provide authorized administrative access.
• Processes represent running programs.
• Linux provides powerful networking tools.
• Package managers help maintain installed software.
• Logs provide valuable information for security monitoring.
• Regular updates are an important part of system security.
• Least privilege should be applied to Linux accounts and services.
• Linux commands should be used carefully, especially administrative commands.
• Cybersecurity practice should always occur in authorized environments.

48. Conclusion

Linux is one of the most important operating-system environments for
cybersecurity professionals to understand. Its command-line tools, permission
model, networking capabilities, processes, package-management systems and
logging facilities provide the foundation for many security activities.

The lessons that follow will build practical Linux skills step by step,
starting with the command line and progressing into files, permissions, users,
processes, networking and shell fundamentals.

The next lesson is:
Terminal Fundamentals.