1. Learning Objectives

By the end of this lesson, you will be able to:

• Explain why Linux dominates servers, cloud, and security labs.
• Navigate a terminal shell and run basic commands safely.
• Describe users, groups, and the Linux permission model (rwx).
• Use chmod and chown to inspect and adjust access (on systems you own).
• List and manage processes; understand why long-running services matter for security.
• Install and update software with package managers responsibly.
• Read system logs with journalctl and classic log files.
• Connect with SSH using keys instead of passwords where possible.
• Use sudo with least privilege instead of daily root login.
• Inspect network listeners with ss and addresses/routes with ip.

2. Why Linux Matters for Cybersecurity

Linux is an open-source family of operating systems built around a kernel (core) and user space (apps, shells, services). Most of the internet runs on Linux: web servers, databases, containers, Android’s kernel lineage, and countless IoT devices.

For defenders and ethical hackers, Linux skills are not optional:

Security mindset: On Linux, misconfiguration (world-writable files, passwordless sudo, exposed SSH) often beats “exotic exploits.” Least privilege and patching are daily work.

3. The Shell: Your Text Interface

A shell interprets commands you type. Common shells:

3.1 Essential navigation

pwd          # print working directory
ls -la       # list files including hidden (.) entries
cd /var/log  # change directory
cd ..        # parent directory
whoami       # current username
uname -a     # kernel and architecture

3.2 Getting help

man ls       # manual page for ls
ls --help    # short help for many GNU tools

Tip: Read --help before guessing flags. Destructive commands (rm -rf) deserve double-checking the path.

3.3 Pipes and redirection

• | sends stdout of one command into another: cat access.log | grep "404".
• > overwrites a file; >> appends.
• 2> redirects errors; &> redirects both (bash).

These patterns appear constantly in log analysis and scripting.

4. Users and Groups

Linux is multi-user. Every file is owned by a user and a group.

4.1 Inspecting accounts

id
id alice
getent passwd | tail
getent group sudo

/etc/passwd lists users (historically included password hashes; modern systems use shadow in /etc/shadow, readable only by root).

4.4 Security practices

• Do not share the root password; use named accounts + sudo.
• Disable unused accounts; remove ex-employees promptly.
• Service accounts get only the permissions their daemon needs.

5. File Permissions: `rwx`

Each file has three permission triples:

Letters: r read, w write, x execute (for directories, x means “enter/list if you know names”).

Example: -rw-r----- 1 alice dev 4096 Mar 1 10:00 report.txt

• Owner alice: read + write
• Group dev: read only
• Others: nothing

5.1 Numeric (octal) mode

Each letter is a bit: r=4, w=2, x=1. Sum per triple:

5.2 chmod and chown

chmod 600 ~/.ssh/id_ed25519
chmod u+x script.sh
chown alice:dev shared.txt    # requires root or ownership rules

Defender note: World-writable web directories (chmod 777) enabled countless website defacements. Upload folders need tight ownership and separate app users.

5.3 Special bits (awareness)

• setuid on executables: runs with owner’s privileges (scrutinize any setuid root binary).
• sticky bit on dirs like /tmp: users can only delete their own files.

Find setuid binaries (authorized lab only):

find / -perm -4000 -type f 2>/dev/null | head

6. Processes

A process is a running program instance with a PID (process ID).

ps aux | head
ps -ef | grep nginx
top          # interactive; q to quit
htop         # if installed
kill PID     # send SIGTERM
kill -9 PID  # force kill — last resort

6.1 Services and systemd

Most modern distros use systemd to start services at boot:

systemctl status ssh
systemctl list-units --type=service --state=running

Security: Unexpected listening services or rogue processes may indicate compromise — correlate with ss (below) and logs.

7. Package Management

Packages install vetted software and track dependencies.

# Debian/Ubuntu examples
sudo apt update
sudo apt upgrade
apt search nginx
sudo apt install curl

Patching closes known CVEs. Unpatched Linux servers appear in breach reports year after year (including container hosts).

Verify package signatures and use official repositories — avoid random .deb downloads from untrusted sites.

8. Logs: journalctl and Classic Files

Logs are CCTV for systems — authentication failures, sudo use, service crashes.

8.1 systemd journal

journalctl -xe                    # recent errors, end at bottom
journalctl -u ssh -n 50           # last 50 lines for ssh unit
journalctl --since "1 hour ago"
journalctl -f                     # follow (like tail -f)

8.2 Traditional log files (paths vary by distro)

sudo tail -n 100 /var/log/auth.log
sudo grep "Failed password" /var/log/auth.log | tail

Protect logs from tampering (centralized logging, immutability where supported).

9. SSH: Secure Remote Administration

SSH (Secure Shell) encrypts remote terminal and file copy (SCP/SFTP).

Default server port: 22 (change only with care and firewall rules).

9.1 Client connection

ssh user@203.0.113.10
ssh -p 2222 user@host

First connect shows host key fingerprint — verify out-of-band in production to prevent MITM.

9.2 Key-based authentication (preferred)

ssh-keygen -t ed25519 -C "alice@laptop"
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
ssh-copy-id user@server

Disable password authentication on servers after confirming keys work (PasswordAuthentication no in sshd_config — test in a second session first).

9.3 Hardening checklist (your lab VM)

10. sudo: Controlled Elevation

sudo runs one command as root (or another user) with audit trail.

sudo apt update
sudo -l                 # list what you may run
sudo -u www-data id

/etc/sudoers is edited with visudo — syntax errors can lock you out.

Bad patterns: ALL=(ALL) NOPASSWD: ALL for every developer. Better: role-based sudo for specific commands (package install, service restart).

Every sudo invocation should appear in auth logs — monitor for abuse.

11. Network Inspection: `ip` and `ss`

Replace legacy ifconfig / netstat with:

ip addr show
ip route show
ip link show
ss -tulpn                 # TCP/UDP listening sockets with processes (needs root for all PIDs)
ss -tan state established

Unexpected :445 or :3389 on a Linux web box warrants investigation.

12. Everyday Parallels (Memory Hooks)

13. Case Study: Cloud and Container Misconfiguration (Industry Pattern)

Public breach post-mortems repeatedly cite:

• Secrets in environment variables on shared hosts
• Containers running as root
• SSH keys copied everywhere without rotation
• Default credentials on appliances

Lesson: Linux fundamentals — users, permissions, logs, patching — directly reduce blast radius when one app is compromised.

14. Case Study: Mirai and IoT Defaults

The Mirai botnet exploited weak default passwords on Linux-based IoT devices. Devices were enrolled into DDoS armies.

Lesson: Change defaults, segment IoT networks, disable Telnet, patch firmware.

15. Practical Lab: Your Own Linux VM or WSL

Objective: Build muscle memory on a system you own (local VM, WSL2, Raspberry Pi, or cloud free tier in your account).

Part A — Identity and permissions

1. Create user labuser and group labgroup.
2. Create /home/labuser/projects/notes.txt with mode 640.
3. Verify with ls -l and id labuser.

Part B — Processes and services

4. List running services: systemctl list-units --type=service --state=running | head -20.
5. Find which process listens on port 22: ss -tulpn | grep :22.

Part C — Logs

6. Trigger a failed SSH login (wrong password once) to your own VM, then find the failure in journalctl or auth.log.

Part D — Network

7. Record your IPv4 address, default gateway, and DNS from ip addr and resolvectl status or /etc/resolv.conf.

Part E — sudo

8. Run sudo -l and explain each allowed command in one sentence.

Do not scan or attack systems you do not own. Do not publish private keys or real production IPs unnecessarily.

16. Knowledge Check

Q1. What does the x permission mean on a directory?

A. Encrypt the directory
B. Allow entering/listing when combined with other rules
C. Delete all files automatically
D. Share over NFS only

Q2. Which command shows listening TCP/UDP ports with associated processes (when permitted)?

A. ss -tulpn
B. chmod -R 777
C. useradd
D. journalctl --vacuum

Q3. Why is SSH key authentication generally preferred over password-only login?

A. Keys are shorter to type
B. Keys resist offline guessing and enable easier rotation per device
C. Keys disable encryption
D. Keys work without a private key file

Q4. What UID does the root account use?

A. 1000
B. 0
C. 65535
D. -1

Q5. Which file mode is appropriate for a private SSH key?

A. 777
B. 644
C. 600
D. 755

Q6. What does sudo primarily provide?

A. Unlimited anonymous access
B. Audited, granular elevation for authorized users
C. A replacement for firewalls
D. Automatic malware removal

Q7. Where do modern systemd-based distros often store unified logs?

A. Only /tmp
B. The systemd journal (queried with journalctl)
C. Inside /dev/null
D. Browser cookies

Q8. What is a safe first step before disabling SSH password authentication?

A. Delete all user accounts
B. Confirm key-based login works in a separate session
C. Open port 22 to 0.0.0.0/0 without firewall
D. Set permissions on /etc/shadow to 777

Q9. Which command updates package index metadata on Debian/Ubuntu?

A. apt update
B. apt upgrade only
C. rpm -e
D. fdisk

Q10. Why should web upload directories rarely be mode 777?

A. It improves SEO
B. Any local user or compromised account may modify content
C. It disables HTTPS
D. It prevents logging

Answer Key

1. B
2. A
3. B
4. B
5. C
6. B
7. B
8. B
9. A
10. B

17. Lesson Summary

You learned that Linux powers most servers and labs, that the shell is your daily interface, and that users, groups, and rwx enforce least privilege. You practiced thinking about processes, packages, and logs as defender tools, and about SSH, sudo, ip, and ss as safe administration habits on machines you control.

Remember: Strong Linux hygiene — patching, non-root services, key-based SSH, sensible chmod, and log review — prevents many real-world incidents without waiting for a “zero-day.”

18. Coming Next: Windows Fundamentals

In the next lesson, you will learn how Windows organizes accounts and groups, how Event Viewer records logon success (4624) and failure (4625), how services and updates affect security, how Microsoft Defender fits endpoint protection, and how PowerShell helps administrators and defenders inspect systems you are authorized to manage.

CYNARKS Academy – Learn to Understand. Practice to Defend.

Practice only on systems and networks you own or have explicit authorization to test.