Whatever brought you to Linux — cloud instances, network OS shells, DevOps tooling, a certification track — the same three foundations carry all of it: where things live in the filesystem, who may touch them, and how running programs are inspected and controlled. These are the literacy layer; every later skill assumes them.
One tree, well-known addresses
There are no drive letters: every filesystem, device and pseudo-file mounts somewhere under /. The Filesystem Hierarchy Standard makes locations predictable across distributions:
- /etc — system configuration, plain text: /etc/ssh/sshd_config, /etc/fstab, /etc/hosts.
- /usr/bin and /usr/sbin — commands; /usr/sbin holds administrative ones. /bin and /sbin are usually symlinks here now.
- /var — data that grows: logs in /var/log (auth.log, messages/syslog — or the systemd journal), spools, databases.
- /home/<user> and /root — home directories; /tmp — world-writable scratch, cleared on schedule.
- /proc and /sys — kernel state impersonating files: /proc/cpuinfo, /proc/net/route; reading them is how most monitoring works.
- /dev — devices as files: /dev/sda, /dev/null, /dev/tty0.
Permissions: three triads and a umask
ls -l prints the contract for each file: type, then three rwx triads for the owning user, the owning group, and everyone else. -rw-r----- 1 alice ops means alice reads and writes, group ops reads, others get nothing. Directories reinterpret the letters: r lists entries, w creates and deletes them, x permits entering and traversal — a directory without x is a wall regardless of r. chmod changes modes (symbolic g+w or octal 640), chown alice:ops file changes ownership, and umask defines what permissions new files are denied by default (umask 022 yields 644 files). Root bypasses all of it, which is exactly why routine work runs as a normal user with sudo for the privileged moments — logged, granular and revocable via /etc/sudoers.
$ ls -l /etc/ssh/sshd_config-rw-r--r-- 1 root root 3253 Mar 4 11:02 /etc/ssh/sshd_config$ sudo chmod 640 secrets.conf && sudo chown root:ops secrets.conf$ umask0022
Processes and services
Every running program is a process with a PID, an owner, and a parent. ps aux answers 'what is running as whom'; top (or htop) answers 'what is eating the box'; kill sends signals by PID — TERM (15) asks politely, KILL (9) does not ask. Long-running services belong to systemd: systemctl status sshd shows state and recent log lines, start/stop/restart control it, enable makes it boot-persistent, and journalctl -u sshd --since today reads its logs. The habit that separates fluency from tourism is chaining these: a service misbehaves → systemctl status → journalctl for its unit → ps/top for its resource footprint → the config file in /etc it started from.
$ systemctl status nginx --no-pager | head -5$ journalctl -u nginx --since "1 hour ago" | tail -20$ ps aux | grep [n]ginx
Practise on a disposable VM until ls -l output reads like a sentence and systemctl is muscle memory. The next chapter takes the same fluency to the network side of the host — addresses, routes, sockets and the order in which to interrogate them.