Every Linux system uses the same standard layout, called the Filesystem Hierarchy Standard. Once you know it, you can find your way around any Linux machine.
ls /In the terminal
student@vulntech:~$ ls / bin dev home media opt root sbin sys usr boot etc lib mnt proc run srv tmp var
| Directory | What's inside |
|---|---|
/bin, /usr/bin | The programs you run as commands: ls, date, ... |
/sbin, /usr/sbin | System programs, mostly for the administrator |
/etc | System-wide settings, as plain text files |
/home | Users' home directories |
/root | The home directory of the administrator, root |
/var | Data that changes: /var/log has the log files |
/tmp | Temporary files; often wiped when the computer restarts |
/usr | Installed software, libraries and documentation |
/dev | Devices (disks, terminals) shown as files |
/proc | A window into the running system: processes, memory, CPU |
/mnt, /media | Where USB drives and other disks get attached |
/etc: the settings
Settings on Linux are plain text files, and most live in /etc. For example, the machine's name is in /etc/hostname, and the list of users is in /etc/passwd:
ls /etc/hostname /etc/passwd /etc/os-releaseIn the terminal
student@vulntech:~$ ls /etc/hostname /etc/passwd /etc/os-release /etc/hostname /etc/os-release /etc/passwd
Where are the commands?
Commands are just program files. which shows where one lives:
which ls treeIn the terminal
student@vulntech:~$ which ls tree /bin/ls /usr/bin/tree
Everything is a file
Linux shows almost everything as a file, even hardware and running programs. Your terminal itself is a file in /dev:
ttyIn the terminal
student@vulntech:~$ tty /dev/ttyS0
Tip: For security work,
/etc(configuration),/home(user files),/var/log(what happened) and/tmp(anyone can write there) are the first places to look on a machine.
Remember: Programs in
/binand/usr/bin, settings in/etc, users in/home, logs in/var/log, scratch files in/tmp.