The SecureByDefault Brief #009: The 5 Linux Commands to Learn First (and the 1 to Learn Last)

While Pixar was making Toy Story 2, files started vanishing.

Oren Jacob, then an associate technical director, and a colleague were working on Woody's hat when they noticed something off. A folder that had held about 40 files now held about 4.

A delete command had gone through the studio's files and kept going. And when the team turned to their backups, they found the backups had not been working for a month.

The film survived because Galyn Susman, a technical director who had been working from home after having a baby, had a copy on her home computer. Jacob has described bringing it back to the studio this way: "I hugged it with seatbelts, across the backseat."

Here is what I take from that story, and it is not "stay away from the command line."

The command did exactly what it was told. Commands always do. Linux never asks "are you sure?" It assumes you are an adult with a plan. This is flattering and terrifying.

The real lesson: know where you are, and what is around you, before you act. That is what the first five commands are for, taught in the order that keeps you out of trouble.

pwd prints the folder you are currently in.

Everything you type runs from wherever you are standing. Think of pwd as the "you are here" dot on a mall map. When you feel lost, run it.

ls lists the files and folders in your current location.

Add -l for more detail, or -a to include hidden files. Running ls is looking around the room before you start moving furniture.

cd moves you into another folder.

The first goes to a specific place. The second goes up one level. The third, on its own, takes you home. Good habit: after you cd somewhere, run pwd to confirm you landed where you meant to.

cat prints a file on your screen. It is great for small files.

For a longer file, use less, which lets you scroll with the arrow keys and quit by pressing q.

Nothing to do with cats. Everything to do with reading configs and, soon, logs.

grep searches a file and prints only the lines that match what you asked for.

Think of it as Ctrl+F for people who own a server. It is the reason long, scary-looking files become readable. The name comes from an old editor command, g/re/p, which tells you naming was not the priority.

Learning Linux from scratch?

I put the commands, practice plan, log examples, and beginner server checklist into a free Linux Starter Kit.

You will see sudo in front of many commands.

Normal accounts are limited on purpose. They cannot change the whole system. sudo is a deliberate step up: you are asking to run one command with administrator power.

That is a security idea worth learning early, not just a Linux quirk: give yourself the access you need for the task, not more, and think before you type. Use it like a company card. Powerful, useful, and someone will eventually ask what you spent it on.

rm removes files. It is not scary by itself.

What is risky is using a destructive command without knowing where you are. The Toy Story 2 deletion is widely reported to have been an rm command, though the exact command comes from secondary retellings.

Before deleting anything, answer two questions:

That is why those two come first.

There is a safety net, and it is narrower than people think. GNU rm refuses to delete the root of the entire system by default. It does not protect you from deleting the wrong folder, or the right folder on the wrong machine. The safety net covers one specific mistake, and it is not yours.

A second example, told fairly. In 2017, a GitLab engineer was working late at night trying to fix database replication. They deleted a database data directory believing they were on the secondary server. It was the primary. Around 300 GB was removed before the command was stopped, and GitLab's backup and replication options had all quietly failed too.

GitLab's own postmortem takeaway is about systems, not about one person: build an environment where a mistake is easy to recover from. Both stories share one more detail: the backups people were counting on were not working. Restore from yours once, on purpose, and you are ahead of most of us.

Open a Linux terminal and run:

Here is what you just did, in plain English:

You looked around, moved, read, and searched. That is most of what working at a Linux prompt is.

Don't have Linux installed yet? The free Linux Starter Kit shows you the safest ways to start.

Manual pages are thorough and can be a lot. tldr is a free, community-maintained set of cheat sheets that shows practical examples for common commands, so you can see how something is used without digging through a long manual.

If you want a stretch goal later, OverTheWire's Bandit is a free game built for absolute beginners. Its own advice is "Don't panic," which seems right for this series.

Want a structured path instead of random Linux tutorials?

Start with the free Linux Starter Kit.

Next week we point grep at the logs of a real server to see who has been knocking.

Talk soon,

Ron
Cloud and Cybersecurity Engineer, SecureByDefault