Linux for network and security beginners: the 20 commands to learn first

Sooner or later, every network or security role puts you in front of a Linux command line. Many firewalls, routers, cloud servers, monitoring tools and security appliances run Linux underneath. The good news: you don't need hundreds of commands. About twenty cover most of what a beginner does. Practise them in a free virtual machine (see virtualisation basics) where mistakes don't matter.

Finding your way around

• pwd: shows which folder you are in.
• ls -l: lists files with their size, owner and permissions. Add -a to see hidden files.
• cd /var/log: moves into a folder. cd .. goes up one level and cd ~ goes home.
• mkdir labs: creates a folder.

Reading files

• cat file.txt: prints a short file to the screen.
• less file.txt: opens a long file you can scroll through. Press q to quit and /word to search.
• tail -f /var/log/syslog: follows a log file live as new lines arrive. Very useful while you test something.
• grep -i "error" file.log: shows only the lines containing a word. Add -r to search a whole folder.

Copying, moving and deleting

• cp a.conf a.conf.bak: copies a file. Always make a backup before editing a configuration.
• mv old new: moves or renames a file.
• rm file: deletes a file. There is no recycle bin, so read the command twice before pressing Enter.
• nano file: a simple text editor for beginners. Save with Ctrl+O and exit with Ctrl+X.

Users and permissions

• whoami: shows which user you are logged in as.
• sudo command: runs one command with administrator rights. Use it only when needed.
• chmod 600 key.pem: sets permissions so only the owner can read and write a file, which is required for private keys.

Permissions are shown as letters such as rwxr-x---: read, write and execute for the owner, the group and everyone else. Understanding them is a core security skill, because a file that everyone can write to is an open door.

Networking commands

These are the ones you will use most in network and security work. The full list, with Windows equivalents, is on the Linux commands page.

• ip a: shows your interfaces and IP addresses. Check the result with the subnet calculator if you are unsure which network you are on.
• ip route: shows the routing table, including the default gateway.
• ping -c 4 8.8.8.8: tests whether a host replies. -c 4 stops after four tries.
• dig example.com or nslookup example.com: tests DNS lookups. See how DNS works.
• ss -tulpn: lists which ports the machine is listening on and which program owns each one. Look up unfamiliar ports in the port reference.
• traceroute example.com: shows each router on the path to a destination.

Services and processes

• systemctl status ssh: shows whether a service is running and its latest log lines.
• sudo systemctl restart ssh: restarts a service after you change its configuration.
• top or htop: a live view of CPU and memory use, and which process is using them.
• journalctl -u ssh --since "1 hour ago": reads a service's logs for a time window.

Three habits that save you

1. Use Tab. Press Tab to complete file and command names. It saves time and prevents typing mistakes.
2. Read the manual. man ls or ls --help explains every option. Being able to look things up is more important than memorising them.
3. Check before you change. Back up the file, make one change, test it, then move on. The same rule applies on a production firewall.

A small practice lab

Set yourself this exercise in your VM: find your IP address and gateway, check which ports are listening, install a web server package, confirm it is running with systemctl, test it with curl localhost, then find its access log under /var/log and use grep to show only your own requests. If you can do that without notes, you have the basics.

Tip: keep the cheat sheets open while you practise, and add your own notes for the commands you use most.