Linux for Networking and Security Beginners

Getting started safely

Install a mainstream distribution such as Ubuntu Server or Debian in a virtual machine using VirtualBox, VMware or Windows Subsystem for Linux. A VM lets you experiment, take snapshots and roll back mistakes without risking your main computer.

Log in as a normal user and use sudo only for commands that need administrator rights. Working as root all the time is a habit that causes accidents and breaks the principle of least privilege.

Navigating the filesystem

pwd                    # where am I?
ls -la /etc            # list files, including hidden ones
cd /var/log            # change directory
less syslog            # read a file page by page
grep -i error syslog   # search for lines containing error

Essential networking commands

These commands replace older tools such as ifconfig and netstat, which many distributions no longer install by default.

ip a                       # interfaces, MAC and IP addresses
ip route                   # routing table and default gateway
ss -tulpn                  # listening TCP/UDP ports and owning process
ping -c 4 192.168.1.1      # test reachability with four echo requests
traceroute example.com     # list routers along the path
dig example.com A +short   # look up an address record

• ip a shows whether an interface is UP and which address and prefix it holds, such as 192.168.1.20/24.
• ss -tulpn lists services listening for connections. Seeing 0.0.0.0:22 means SSH accepts connections on every interface, whereas 127.0.0.1:3306 means MySQL listens only locally.
• ping and traceroute help you find where connectivity stops; the theory behind them is in our TCP/IP walkthrough.
• dig shows exactly what a DNS server returns, which settles many "the site is down" debates.

File permissions and chmod

Every file has an owner, a group and permissions for three classes: user, group and others. Each class can have read (r), write (w) and execute (x) rights, shown by ls -l as a string such as -rw-r-----.

chmod 640 app.conf          # owner rw, group r, others none
chmod 700 ~/scripts         # only the owner can enter the directory
chmod u+x backup.sh         # add execute for the owner
chown admin:ops app.conf    # change owner and group
chmod 600 ~/.ssh/id_ed25519 # private keys must be owner-only

Users, sudo, updates and logs

Good Linux administration is mostly good security hygiene. Give each person their own account, grant sudo only to those who need it, use SSH keys instead of passwords, and keep the system patched.

sudo apt update && sudo apt upgrade   # patch Debian and Ubuntu systems
sudo journalctl -u ssh --since today  # SSH service logs for today
sudo tail -f /var/log/auth.log        # watch login and sudo events live
last -n 10                            # recent logins

Reading auth.log regularly teaches you what normal looks like, so failed login floods or unexpected sudo use stand out. These habits underpin the controls described in our cybersecurity basics guide.

A troubleshooting walk-through

Imagine a colleague reports that an internal web application on a Linux server has stopped responding. A calm, ordered check with the commands above usually finds the cause within minutes.

1. Run ip a on the server to confirm the interface is UP and still holds the expected address.
2. Run ip route to check the default gateway, then ping -c 4 the gateway to prove local connectivity.
3. Run ss -tulpn to see whether the web server is still listening on port 80 or 443. If it is missing, check the service with systemctl status nginx or the equivalent.
4. Read the service logs with journalctl -u nginx to find the error, such as a full disk or a bad configuration change.
5. From a client, use dig to confirm the application name still resolves to the right IP address.

Writing down what you checked and what you found builds a record that helps the next person, and it is exactly the kind of evidence a security or operations team expects during an incident review.

Building a practice routine

Spend a little time in the shell every day. Set up two VMs on an isolated virtual network, give them static addresses, run a web server on one and reach it from the other, then capture the traffic with Wireshark or tcpdump. Each exercise links commands to concepts. SkillNewton's online networking and security training uses project work of this kind, done on your own machine or virtual lab tools.

Common mistakes

• Running everything as root instead of using a normal account with sudo.
• Fixing permission errors with chmod 777, which gives every user full access.
• Copying commands from forums without understanding what each option does.
• Postponing updates on test machines and carrying the same habit into production.
• Learning only a desktop environment and avoiding the command line.

Frequently asked questions