Getting Oriented in the Shell

Before you start: getting a terminal

Lesson 1 was mostly reading. This lesson is the first one where you actually sit at a keyboard and type, so you need a terminal open and a shell waiting for you.

If you are on macOS or native Linux, you already have one: open Terminal (macOS) or whatever terminal application your distro ships with. Nothing else to install.

If you are on Windows, install the Windows Subsystem for Linux (WSL), which gives you a real Linux environment running alongside Windows rather than an imitation of one. Open PowerShell as Administrator (right-click it, “Run as administrator”) and run:

wsl --install

Follow the prompts, restart if asked, and you will end up with a Ubuntu terminal you can open like any other application. Full details and troubleshooting live at Microsoft’s WSL install docs.

This is the only time this track will stop to explain the Windows path. From here on, whenever a lesson says “open your terminal” or “in your terminal,” it means macOS Terminal, native Linux, or WSL. One detail worth knowing upfront: macOS has defaulted to zsh rather than bash since macOS Catalina (2019), while native Linux and WSL default to bash. Every command taught in this track works identically in either shell, so this will not trip you up hands-on, but it does change one thing you are about to learn: the prompt symbol.

What a shell actually is

A shell is a program whose entire job is to sit between you and the operating system: it reads the line of text you type, figures out what you mean, and asks the kernel to do it. When people say “the command line” or “the terminal,” they usually mean this same thing: a shell, waiting for input, inside a terminal window. The shell you will use throughout this track is called bash, the most common default on Linux and the one WSL gives you. If you are on macOS, your default shell is zsh instead; everything below reads the same way, with one small difference in the prompt symbol noted below.

The line where you type is called the prompt, and it is worth learning to read instead of skimming past. A typical prompt looks something like this:

alex@webserver01:~/linux-essentials$

Break it into pieces:

• alex is the username you are logged in as.
• webserver01 is the hostname, the name of the machine you are on. This matters a lot once you are routinely connected to several servers at once; it is easy to run a command on the wrong one if you stop checking this.
• ~/linux-essentials is your current directory (more on that word in a moment), with ~ as shorthand for your home directory.
• The final symbol is the one habit worth building immediately: in bash, a $ means you are an ordinary user, and a # means you are logged in as root, the Linux superuser who can do absolutely anything on the system, including destroy it. In zsh, macOS’s default shell, the ordinary-user symbol is % instead of $, but it means exactly the same thing, and # still means root in both shells. Some distros also color the root prompt red for the same reason. Get used to glancing at that one character before you hit enter on anything.

Creating your practice space

Rather than running commands wherever your terminal happens to open, this track gives you one dedicated folder to work in. Create it now and move into it:

mkdir -p ~/linux-essentials && cd ~/linux-essentials

mkdir makes a new directory (folder); -p tells it not to complain if the folder already exists, and to create any missing parent folders along the way. The && just means “and then do this next, but only if the first part succeeded.”

Every hands-on exercise from here through the rest of this track happens inside ~/linux-essentials. That gives you a sandbox you can fill with test files, break, and clean up without any risk of touching something that actually matters on your system. Whenever a later lesson tells you to run a command, assume it means “from inside ~/linux-essentials” unless it says otherwise.

Finding out where you are: pwd

The first question to answer on any unfamiliar system is simply “where am I right now?” The answer comes from:

pwd

pwd stands for print working directory, and that is exactly what it does: it prints the full path of the directory your shell is currently sitting in. Right now, having just run the cd above, it should print something ending in /linux-essentials.

Seeing what is there: ls

Once you know where you are, the next question is “what is actually in here?” That is ls (list):

ls

Your linux-essentials folder is empty right now, so this prints nothing. Add the -la flags to get a much richer view:

ls -la

-l switches to the “long” format: one entry per line, with permissions, owner, size, and modification date instead of just a bare name. -a tells ls to also show hidden entries, files and folders whose name starts with a dot, which plain ls leaves out by default. You should see at least two entries you did not create: . (this directory itself) and .. (its parent). That permissions column at the start of each line, a string like drwxr-xr-x, is something you will learn to read properly in a later lesson on permissions; for now, just notice that it is there and that it carries real information about who can do what to each file.

Moving around: cd

cd (change directory) is how you move between folders, and it is worth knowing a few shortcuts beyond the plain cd ~/linux-essentials you already used above.

mkdir notes
cd notes      # relative path: move into "notes", found inside the current directory
pwd

cd /tmp       # absolute path: starts with "/", so it always means the same place
pwd           # regardless of where you started from

cd ~/linux-essentials   # absolute again, using the ~ shortcut for your home directory
pwd

cd notes
cd ..         # ".." always means "one level up", so this goes back up to linux-essentials
pwd

cd -          # the dash jumps you back to whichever directory you were just in
pwd

The distinction between the two kinds of path matters: a relative path (notes, ../notes, ./notes) is interpreted starting from wherever you currently are, so the same command can land you somewhere completely different depending on your starting point. An absolute path (anything starting with /, or with ~ which the shell expands to your home directory) always means the same location no matter where you ran it from. When precision matters, prefer absolute paths; when you are just hopping around nearby folders, relative paths save typing.

Why this is worth drilling into muscle memory

pwd, ls, and cd look almost too simple to spend a whole lesson on, but they are, without exaggeration, the first three commands nearly every security analyst runs after landing a shell on an unfamiliar server. Whether that shell arrives through a planned SSH login or through a foothold gained mid-incident on a compromised box, the very first questions are always the same ones you just practiced answering: where am I, what is here, and how do I get to where I actually need to look. An analyst who has to stop and think about basic navigation is burning attention that should be going toward the actual investigation, the suspicious process, the strange file, the log entry that does not add up. Fluency here is not a side skill; it is what frees up your focus for the part of the job that actually requires thinking.

What to notice

• The $ versus # prompt distinction is not cosmetic. Running the wrong command as root, on the wrong machine, is one of the most common ways incidents get worse rather than better.
• ls -la just gave you a first glimpse of file permissions. You will come back to read that permissions column properly, and the . and .. entries, in a later lesson.
• You now have a standing ~/linux-essentials folder. You do not need to clean it up between lessons; later lessons will tell you when to add to it or remove something specific.