12.1 Linux Fundamentals & Commands

Linux is the operating system you will meet most often in cyber operations labs, servers, and many Air Force cyber training environments. The Cyber Test does not require you to be a full-time Linux administrator, but it does expect you to understand the shell as a control surface: navigate the file tree, inspect files, adjust permissions, and see what processes are running. This section builds those fundamentals with the commands that appear most often on aptitude-style cyber exams.

The Shell as Your Interface

A shell is a program that accepts typed commands and asks the kernel to carry them out. Common shells include bash and zsh. When you open a terminal, you land in a working directory — the folder the shell treats as "here" until you change it. Almost every path-related mistake on exams comes from forgetting where "here" is.

Navigation: pwd, cd, and ls

Three commands form the navigation loop you should be able to explain without hesitation:

pwd (print working directory) outputs the absolute path of your current location — for example /home/airman/ops. If a question walks you through cd commands and asks where you end up, track the path carefully, then confirm with the mental equivalent of pwd.

cd (change directory) moves you. Useful forms:

• cd /etc — jump to an absolute location
• cd reports — enter a subdirectory of the current folder
• cd .. — move up one level to the parent directory
• cd ~ or cd — go to the home directory
• cd - — return to the previous directory (handy, less often tested)

ls lists what is in a directory. Without options it shows names. With -l you get a long listing that includes permissions, owner, size, and timestamp — the same permission string you will decode in section 12.3. With -a you also see hidden entries whose names start with a dot (.bashrc, .ssh).

Absolute vs Relative Paths

A path tells the OS how to find a file or directory.

• An absolute path starts at the filesystem root / and does not depend on your current directory. Example: /var/log/syslog always means the same place.
• A relative path is interpreted from the current working directory. Example: if you are in /home/airman, then docs/notes.txt means /home/airman/docs/notes.txt.

Special relative tokens:

• . means the current directory
• .. means the parent directory

Exam tip: If a question says you are in /opt/tools and you run cd ../data, you move to /opt/data, not /data. Count each .. as one level up from where you are now.

Why this matters in cyber: scripts, malware droppers, and log analysis all resolve paths the same way. Misreading a relative path is how analysts open the wrong file — or how attackers hide payloads in unexpected folders.

Reading Content: cat and grep

cat concatenates and prints file contents to the terminal. For small config files it is the fastest way to see everything at once:

cat /etc/hostname
cat notes.txt

For very large files, operators often prefer pagers (less, more), but aptitude questions usually stick with cat as "display the file."

grep searches for lines matching a pattern. Classic uses:

grep "Failed password" /var/log/auth.log
grep -i error app.log
grep -r "API_KEY" /home/airman/project

• -i ignores case
• -r (or -R) searches recursively through directories
• Patterns can be literal strings or regular expressions on harder items

On the Cyber Test, treat grep as the tool that answers: "Which lines in this file contain X?" Combined with cat, it is how you inspect configurations, scripts, and logs without a graphical editor.

Ownership and Permissions Tools: chmod and chown

Linux files have an owner (user), a group, and permission bits for owner/group/others. Two commands change those controls:

chown changes ownership:

chown airman report.txt
chown airman:cyberteam report.txt

The second form sets both user and group. Changing ownership usually requires elevated privileges when you do not already own the file.

chmod changes the permission mode. You will see both symbolic and octal forms in the wild:

chmod u+x script.sh
chmod 755 script.sh
chmod 600 secrets.env

755 is a common executable-script mode (owner read/write/execute; group/others read/execute). 600 is a common private-file mode (owner read/write only). Section 12.3 goes deeper on rwx and octal math; here, remember the job of each tool: chmod = permission bits, chown = who owns the file.

From a security viewpoint, overly permissive modes (777) and wrong ownership are classic findings. Overly restrictive modes can break services that need to read a config. The Cyber Test cares that you know which command fixes which problem.

Processes: ps and top

A process is a running instance of a program. When something feels "stuck," consumes CPU, or looks suspicious, you inspect processes.

ps prints a snapshot of processes. Common forms:

ps
ps aux
ps -ef

You typically look for a PID (process ID), the commanding user, CPU/memory hints (depending on options), and the command name. Once you know a PID, administrative actions (outside pure fundamentals) can target that process specifically.

top is an interactive, refreshing view of process activity. It repeatedly updates so you can watch which processes burn CPU or RAM in near real time. For exam purposes:

• ps = point-in-time list
• top = live monitor of resource use

Cyber relevance: malware, runaway scripts, and misbehaving services all show up as processes. Being able to name the right inspection tool is the first step before kill signals, service restarts, or deeper forensics.

Putting the Workflow Together

A realistic analyst loop looks like this:

1. pwd / ls — orient yourself
2. cd into the directory of interest (absolute if you know it; relative if you are exploring)
3. cat or grep to read evidence in files
4. ls -l / chmod / chown when permissions or ownership block access or look wrong
5. ps / top when the question shifts from files to running programs

Memorize command jobs, not every flag. If you can map "list," "move," "show path," "print file," "search lines," "change mode," "change owner," and "show processes" to the right tools, you will clear most Linux fundamentals items on the Cyber Test.