🐧 Module 03 · Linux Fundamentals

What Linux actually is

Design principles — these explain almost everything else

Distribution families

The command line

Getting help — teach this first

man ls            # full manual: arrows to scroll, / to search, q to quit
ls --help         # quick summary
apropos copy      # search manuals by keyword
type cd           # builtin, alias or program?
which python3     # where is the executable?

Navigation and listing

pwd               # where am I?
cd /var/log       # absolute path
cd ..             # up one level
cd ~              # home directory
cd -              # back to the previous directory

ls -l             # long format: permissions, owner, size, date
ls -a             # include hidden files (those starting with .)
ls -lh            # human-readable sizes
ls -ltr           # oldest first — best for log directories
ls -ld /etc       # the directory itself, not its contents

Files and directories

touch notes.txt          mkdir -p a/b/c
cp file.txt backup.txt   cp -r dir1/ dir2/
mv old.txt new.txt       mv file.txt /tmp/
rm file.txt              rm -r directory/

Viewing, searching, processes

cat file.txt      less file.txt     head -n 20 file.txt
tail -n 50 f.log  tail -f app.log   # follow a live log

find /home -name "*.txt"      find . -mtime -7
find /var -size +100M         locate report.pdf

ps aux | grep nginx           top
kill 1234                     kill -9 1234   # last resort
df -h     du -sh /var/log     free -h     uptime

The file system

Windows gives each disk a letter. Linux has a single tree starting at /, and extra disks are mounted at a directory inside that tree.

The layout is standardised by the Filesystem Hierarchy Standard (FHS), which is why these directories mean the same thing on every distribution.

Links

ln  original.txt hardlink.txt      # second name for the same inode
ln -s /var/log/app.log ~/applog    # symbolic link — a file holding a path

A hard link is an equal second name; delete one and the data survives until the last name goes. It cannot cross filesystems. A symbolic link is a small file containing a path; it can cross filesystems and point at directories, but it breaks if the target disappears. In practice you will use symbolic links almost every time.

Editors, redirection, pipes and filters

Surviving vim

Vim is on every Unix system, including minimal containers and rescue shells. Even learners who prefer nano need enough vim to escape it.

The three standard streams

ls > files.txt          # stdout to a file, OVERWRITING it
ls >> files.txt         # append instead
command 2> errors.txt   # stderr only
command > out.txt 2>&1  # both to the same file
command 2> /dev/null    # discard errors

Pipes — the payoff of the design principles

cat access.log | grep "404" | sort | uniq -c | sort -rn | head

Read it as: take the log, keep the 404 lines, sort them, count duplicates, sort by count descending, show the top ten. Five single-purpose tools composed into a report.

The filters worth memorising

grep -i "error" app.log     # case-insensitive
grep -v "debug" app.log     # invert: lines NOT matching
grep -rn "TODO" ./src       # recurse, with line numbers

cut -d: -f1 /etc/passwd     # field 1, colon-delimited → usernames
sort -n numbers.txt         # numeric — "10" after "9", not before
sort file.txt | uniq -c     # counts (uniq needs sorted input)
wc -l file.txt              # count lines

sed 's/old/new/g' file.txt  # replace every match
sed -i.bak 's/a/b/g' f.txt  # edit in place, keeping a backup

awk '{print $1}' file       # first field of every line
awk -F: '{print $1}' /etc/passwd
awk '{sum+=$2} END {print sum}' data.txt

# Top 10 IP addresses in a web log
awk '{print $1}' access.log | sort | uniq -c | sort -rn | head

# Filesystems above 80% full
df -h | awk '$5+0 > 80 {print $6, $5}'

# Largest five files under /var
du -ah /var 2>/dev/null | sort -rh | head -5

Users, groups and permissions

Every process runs as some user, and every file belongs to a user and a group. Almost every real security incident on a Linux server traces back to something in this section being wrong.

chmod 755 script.sh        chmod u+x script.sh
chmod go-w file.txt        chmod -R 755 /var/www
chown priya:developers file.txt

useradd -m -s /bin/bash priya      passwd priya
usermod -aG developers priya       # -aG APPENDS
groupadd developers                id priya

Special permissions

su versus sudo

Servers prefer sudo because nobody needs the root password and every action is attributable to a person. Edit the rules with visudo, never a plain editor — it validates the syntax before saving.

Key takeaways

• ✅Kernel ≠ operating system ≠ distribution.
• ✅Everything is a file; small tools; text as the universal interface — these explain the rest.
• ✅/etc is configuration, /var/log is logs, /proc is the live kernel, /root is a home directory.
• ✅rm is permanent and > destroys a file. Prefer >> and check with ls first.
• ✅Pipes compose single-purpose tools into reports: grep | sort | uniq -c | sort -rn | head.
• ✅755 for scripts and directories, 644 for files, 600 for keys. 777 is almost always a mistake.
• ✅usermod -aG appends; usermod -G wipes. Always include the a.

Quiz