← All lessons
Foundations · Beginner · 5 min
Linux command line
Most servers and most security tools live here.
What it is
Most of the internet runs on Linux, and most security tools are built for it. Core commands to know: ls (list files), cd (move), cat and less (read files), grep (search text), find (search files), ps and top (running processes), ss or netstat (network connections), chmod and chown (permissions), sudo (run as admin). Logs live in /var/log. Pipes (|) chain commands together, and that's where the real power is.
Real case · Everyday
Log triage
A SOC analyst can find brute-force attempts in seconds: grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr lists the IPs with the most failed SSH logins.
How defenders stop it
- Disable SSH password logins; use keys
- Run services as unprivileged users
- Keep packages updated
- Ship logs somewhere attackers can't delete them
Check yourself
1. Which command searches inside files for text?
- find
- grep
- chmod
- ps
Show answer
grep. find searches for files by name; grep searches their contents.
2. Where do most Linux logs live?
- /var/log
- /etc/passwd
- /home
- /tmp
Show answer
/var/log. System and security logs, such as auth.log for logins, are kept under /var/log.
3. What does a pipe (|) do?
- Deletes a file
- Runs a command as admin
- Lists hidden files
- Sends one command's output into the next command
Show answer
Sends one command's output into the next command. Pipes chain commands together, for example grep Failed auth.log | wc -l counts failed logins.
Answer them in the app to earn XP.
Next: The SOC, SIEM & logs →