Learn › Linux Foundations › Navigation
You just landed on a real Linux machine. Callsign: outpost. In your home directory sits a folder called recon-base, and your mission brief says it contains a classified wing.
There is no mouse here. No icons. Just a blinking cursor, and a folder that is about to lie to your face.
The dark boxes in this lesson are a practice terminal: a safe simulation that checks one command per step. You cannot break anything here. At the end, you launch a real Linux machine and run the full operation for a score.
Your only tool right now is ls, two letters that mean "list." Type this exact command and press Enter:
prompt: student@outpost:~$ answer: ls recon-base ||| ls recon-base/ ||| ls ~/recon-base ||| ls ~/recon-base/ output: barracks documents intel 'motor pool' broken-link field-ops latest-briefing ops comms headquarters logs supply-depot hint: Type ls, then a space, then recon-base. Then press Enter.
Twelve names. Count them: twelve.
But the mission brief says this folder holds a classified wing, and nothing in that list looks classified. The folder is hiding something from you.
In a few minutes you will catch it red-handed. First, you need to know what you are actually looking at.
ls shows you the names of everything in a folder. On Linux, a folder is called a directory. The two words mean the same thing.
The part after the command, recon-base, is a path: the address of a directory. Your terminal is always standing inside some directory, and it cannot see anything until you look. ls is how you look.
One entry in that list already deserves suspicion: 'motor pool' came back wearing quotes. Linux is telling you that name contains a space. Remember that. It becomes important when you try to walk in there.
Your progress in this lesson saves automatically, to your account. Leave and come back on any device, and you continue exactly where you stopped.
ls is one of the oldest commands that exists. It shipped with the very first Unix in 1971, written at Bell Labs by Ken Thompson and Dennis Ritchie. It has been the most-typed command on the planet ever since.
Engineers reach for it dozens of times a day, the way you check your mirrors while driving. By the end of this lesson it will be a reflex for you too.
The name is short on purpose. On a 1971 teletype, every character you typed was printed by a hammer striking paper. Two letters was a kindness.
Time to catch the lie. On Linux, any file or directory whose name starts with a dot (.) is hidden: ls skips it by default.
The -a flag (short for *all*) shows everything, dots included.
Before you run it, commit to a guess: how many NEW names will appear that the first listing hid?
prompt: student@outpost:~$ answer: ls -a recon-base ||| ls -a recon-base/ ||| ls -a ~/recon-base ||| ls -a ~/recon-base/ ||| ls recon-base -a output: . barracks field-ops logs .. broken-link headquarters 'motor pool' .classified comms intel ops .hidden-bunker documents latest-briefing supply-depot hint: Same command as before, but add the -a flag: ls -a recon-base
Four new entries stepped out of the dark: .classified, .hidden-bunker, and two strange ones, . and ...
.classified is the wing your brief promised. It was there the whole time. Not locked, not protected. Just unlisted, because its name starts with a dot.
As for . and ..: those two live inside every directory on every Linux machine on Earth. . means "this directory." .. means "the one above it." Hold that thought. They become your fastest way to move around.
You know the wing exists. Look inside it. And since dot-names hide from a bare ls, go in with -a from the start, in case the classified wing keeps secrets of its own.
prompt: student@outpost:~$ answer: ls -a recon-base/.classified ||| ls -a recon-base/.classified/ ||| ls -a ~/recon-base/.classified output: . .. .hidden-orders agent-list.txt top-secret.txt hint: The path is recon-base/.classified and the flag is -a.
A hidden directory, holding a hidden file: .hidden-orders. Secrets stacked inside secrets, and you found both with one flag.
Notice the path you just typed: recon-base/.classified. The / glues directory names together into an address. That is how every path on Linux is built.
Names are only the surface. The -l flag (short for *long*) turns a listing into a table: permissions, owner, size, and the date each file last changed.
Aim it at the documents office:
prompt: student@outpost:~$ answer: ls -l recon-base/documents ||| ls -l recon-base/documents/ ||| ls -l ~/recon-base/documents output: total 20 -rw-r--r-- 1 student student 463 Nov 5 2024 after-action-report.txt -rw-r--r-- 1 student student 207 Nov 5 2024 equipment-list.txt -rw-r--r-- 1 student student 487 Nov 5 2024 mission-brief.txt -rw-r--r-- 2 student student 223 Nov 5 2024 roster-backup.txt -rw-r--r-- 2 student student 223 Nov 5 2024 roster.txt hint: The flag is a lowercase L, not the number one: ls -l
Read one line left to right. -rw-r--r-- is who may read or change the file; permissions get their own lesson later. Then an owner, a size in bytes, a date, and the name.
Now look closer. Two files at the bottom are identical: roster.txt and roster-backup.txt, both exactly 223 bytes, and both showing a 2 in the second column where every other file shows 1.
That 2 is a clue to something strange: those two names might not be two files at all. You will prove it shortly.
Flags stack. -l and -a together give you the long table AND the hidden entries: ls -la. Ask any Linux engineer which form they type most, and this is it.
Aim it at the ops room:
prompt: student@outpost:~$ answer: ls -la recon-base/ops ||| ls -la recon-base/ops/ ||| ls -al recon-base/ops ||| ls -la ~/recon-base/ops output: total 24 drwxr-xr-x 5 student student 4096 Nov 5 2024 . drwxr-xr-x 14 student student 4096 Nov 5 2024 .. drwxr-xr-x 2 student student 4096 Nov 5 2024 plan-alpha drwxr-xr-x 2 student student 4096 Nov 5 2024 plan-bravo drwxr-xr-x 2 student student 4096 Nov 5 2024 plan-charlie -rwxr-xr-x 1 student student 59 Nov 5 2024 run-scan.sh hint: Combine the two flags you know: ls -la, then the path to ops.
Two new details. Lines that start with d are directories: the three plans are rooms, run-scan.sh is a file. And there are . and .. again, at the top of every -a listing, patient as furniture.
Byte counts get silly fast. Is 751921 big? The -h flag (*human-readable*) converts sizes to K, M and G.
The logs room is where the big files live. Before you look: one log in there is more than ten times the size of every other. Commit to a guess about which.
prompt: student@outpost:~$ answer: ls -lh recon-base/logs ||| ls -lh recon-base/logs/ ||| ls -hl recon-base/logs ||| ls -lh ~/recon-base/logs output: total 804K -rw-r--r-- 1 student student 735K Nov 5 2024 access.log -rw-r--r-- 1 student student 15K Nov 5 2024 audit.log -rw-r--r-- 1 student student 42K Nov 5 2024 auth.log -rw-r--r-- 1 student student 7.3K Nov 5 2024 system.log hint: Add h to the long flag: ls -lh
access.log at 735K. On a real server this is the everyday shape of trouble: one log quietly eating the disk. -lh is how you spot it in one glance.
Reading sizes is good. Sorting by them is better. The -S flag (capital S, for *size*) sorts the listing largest first.
prompt: student@outpost:~$ answer: ls -lS recon-base/logs ||| ls -lS recon-base/logs/ ||| ls -Sl recon-base/logs ||| ls -lS ~/recon-base/logs output: total 804 -rw-r--r-- 1 student student 751921 Nov 5 2024 access.log -rw-r--r-- 1 student student 42196 Nov 5 2024 auth.log -rw-r--r-- 1 student student 14904 Nov 5 2024 audit.log -rw-r--r-- 1 student student 7453 Nov 5 2024 system.log hint: Capital S: ls -lS
Biggest first, every time. "The disk is full, what is eating it" is one of the most common real tickets in the field, and ls -lS is the first move.
Notice the same files now show exact byte counts: 751921 instead of 735K, because you dropped the -h. Same truth, two dialects.
So far you look into one room at a time. The -R flag (*recursive*) walks into every subdirectory and lists those too.
prompt: student@outpost:~$ answer: ls -R recon-base/ops ||| ls -R recon-base/ops/ ||| ls -R ~/recon-base/ops output: recon-base/ops: plan-alpha plan-bravo plan-charlie run-scan.sh
recon-base/ops/plan-alpha: 'mission log.txt' objectives.txt timeline.txt
recon-base/ops/plan-bravo: objectives.txt resources.txt
recon-base/ops/plan-charlie: contingency.txt objectives.txt hint: Capital R: ls -R, then the path to ops.
Every plan folder, opened in one command. Each block starts with the directory's path and a colon, then its contents.
And there is another quoted name: 'mission log.txt' inside plan-alpha. Spaces in filenames keep turning up. Soon you will learn to walk into them without tripping.
One more way to see: the -F flag (*classify*) tags every name with what it is. A trailing / is a directory. @ is a symlink, a shortcut that points at another file. * is an executable program.
prompt: student@outpost:~$ answer: ls -F recon-base ||| ls -F recon-base/ ||| ls -F ~/recon-base output: barracks/ documents/ intel/ 'motor pool'/ broken-link@ field-ops/ latest-briefing@ ops/ comms/ headquarters/ logs/ supply-depot/ hint: Capital F: ls -F recon-base
Ten directories, and two @ shortcuts. latest-briefing points at the real mission brief in documents. broken-link points at a file that no longer exists: symlinks can outlive their targets, and -F spots both kinds without opening anything.
Back to the mystery from the documents office: two names, identical sizes, and that 2 in the link column.
Every file on Linux has an ID number called an inode. The name you see is just a label pointing at that number. The -i flag shows the number next to each name.
If roster.txt and roster-backup.txt are truly one file wearing two names, they will show the SAME number.
prompt: student@outpost:~$ answer: ls -i recon-base/documents ||| ls -i recon-base/documents/ ||| ls -i ~/recon-base/documents output: 131307 after-action-report.txt 131304 mission-brief.txt 131305 roster.txt 131306 equipment-list.txt 131305 roster-backup.txt hint: Lowercase i: ls -i, then the path to documents.
There it is: roster.txt and roster-backup.txt share one inode. One file, two names. That is called a hard link, and that shared number is the proof.
One honest warning: inode numbers are assigned per machine, per boot. On the real VM you are about to earn a score on, the numbers will be different from these. The twins sharing ONE number is the part that never changes, and it is the part that matters.
Pause and take stock. Ten minutes ago ls gave you names. Now you can reveal hidden files, read sizes and dates, sort by size, walk whole subtrees, tag types, and prove two names are one file.
One command. Seven flags. And they stack into a single sweep:
prompt: student@outpost:~$ answer: ls -lahR recon-base/supply-depot ||| ls -lahR recon-base/supply-depot/ ||| ls -laRh recon-base/supply-depot ||| ls -ahlR recon-base/supply-depot output: recon-base/supply-depot: total 20K drwxr-xr-x 5 student student 4.0K Nov 5 2024 . drwxr-xr-x 14 student student 4.0K Nov 5 2024 .. drwxr-xr-x 2 student student 4.0K Nov 5 2024 comms-equipment drwxr-xr-x 2 student student 4.0K Nov 5 2024 medical drwxr-xr-x 2 student student 4.0K Nov 5 2024 rations
recon-base/supply-depot/comms-equipment: total 12K drwxr-xr-x 2 student student 4.0K Nov 5 2024 . drwxr-xr-x 5 student student 4.0K Nov 5 2024 .. -rw-r--r-- 1 student student 475 Nov 5 2024 serial-numbers.txt
recon-base/supply-depot/medical: total 12K drwxr-xr-x 2 student student 4.0K Nov 5 2024 . drwxr-xr-x 5 student student 4.0K Nov 5 2024 .. -rw-r--r-- 1 student student 410 Nov 5 2024 inventory.txt
recon-base/supply-depot/rations: total 12K drwxr-xr-x 2 student student 4.0K Nov 5 2024 . drwxr-xr-x 5 student student 4.0K Nov 5 2024 .. -rw-r--r-- 1 student student 383 Nov 5 2024 menu.txt hint: All four flags in one bundle: ls -lahR
Long, all, human sizes, recursive: one command, the entire depot inventoried. This is what fluency looks like, and you just typed it.
Seeing is half the mission. Now you learn to MOVE.
Your terminal always stands in exactly one directory. Right now, that is your home directory: the one place on the machine that belongs to you.
The command pwd (*print working directory*) tells you where you stand. It answers with a full address:
prompt: student@outpost:~$ answer: pwd output: /home/student hint: Three letters: pwd
/home/student. Read it right to left: a directory called student, inside a directory called home, inside /, the root, the top of everything.
Every file on a Linux machine has exactly one such address. Addresses that start with / are called absolute paths, and they work from anywhere, the way a full street address works from any mailbox in the country.
There are two ways to write any path.
An absolute path starts at the root: /home/student/recon-base/ops. Unambiguous, works from anywhere, and long.
A relative path starts from where you stand: if you are home, recon-base/ops reaches the same door in a fraction of the typing.
Explore the difference yourself. Click around the map: blue is where you stand, green is the target, and the amber hops ARE the relative path.
{ "caption": "Blue = where you stand. Green = your target. The numbered amber hops ARE the relative path: read them in order.", "home": "/home/student", "current": "/home/student/recon-base/ops/plan-bravo", "target": "/home/student/recon-base/ops/plan-alpha", "tree": { "name": "/", "children": [ { "name": "home", "children": [ { "name": "student", "children": [ { "name": "recon-base", "children": [ { "name": "documents", "children": [ { "name": "mission-brief.txt" }, { "name": "roster.txt" } ] }, { "name": "headquarters", "children": [ { "name": "command-center", "children": [ { "name": "briefing-room" } ] }, { "name": "intel-office", "children": [ { "name": "classified" } ] } ] }, { "name": "logs", "children": [ { "name": "access.log" } ] }, { "name": "ops", "children": [ { "name": "plan-alpha", "children": [ { "name": "objectives.txt" }, { "name": "timeline.txt" } ] }, { "name": "plan-bravo", "children": [ { "name": "objectives.txt" } ] }, { "name": "plan-charlie" } ] } ] } ] } ] } ] } }
Time to move for real. The command is cd (*change directory*): give it a path, and your terminal walks there.
Jump straight to the briefing room, deep inside headquarters, with one absolute path. And know this going in: cd prints nothing when it succeeds. Silence is success. You confirm the move with pwd.
prompt: student@outpost:~$ answer: cd /home/student/recon-base/headquarters/command-center/briefing-room output: hint: cd, a space, then the full path starting with /home/student/
Silence, as promised. Did it work? Ask:
prompt: student@outpost:briefing-room$ answer: pwd output: /home/student/recon-base/headquarters/command-center/briefing-room hint: The same three letters as before.
Five levels deep in one silent hop, and pwd confirms it. That silence trips up everyone at first. No news is good news; errors are loud.
You are deep in the base. Getting home takes three characters: cd with nothing after it goes to your home directory from anywhere on the machine.
prompt: student@outpost:briefing-room$ answer: cd output: hint: Just cd, nothing else, Enter.
Home also has a one-character nickname: ~ (the tilde). The shell swaps it for /home/student before cd even sees it. That makes ~/recon-base/supply-depot/comms-equipment a full address in disguise:
prompt: student@outpost:~$ answer: cd ~/recon-base/supply-depot/comms-equipment output: hint: Start the path with ~/ and spell out the rest.
Notice your prompt has been telling you where you are the whole time: it read ~ at home, then briefing-room, now comms-equipment. The prompt is a compass. Learn to glance at it.
Remember .hidden-bunker from the reveal? Hidden means unlisted, nothing more. If you know the name, you can walk straight in.
prompt: student@outpost:comms-equipment$ answer: cd ~/recon-base/.hidden-bunker ||| cd /home/student/recon-base/.hidden-bunker output: hint: The path is ~/recon-base/.hidden-bunker, dot included.
You are standing inside a directory that a bare ls cannot even see. Hidden files are a convention for tidiness, not a lock. Real security comes from permissions, later in this track.
Now the two strange entries from every -a listing earn their keep.
. is the room you are in. .. is the room above it. They are not decorations: they are real, walkable doors. cd .. climbs up one level from anywhere.
You are about to be dropped at an observation post four levels deep. Climb up one level and see where you surface:
prompt: student@outpost:observation-post$ answer: cd .. output: hint: cd, space, two dots.
One cd .., no path, no fuss. Where did you surface?
prompt: student@outpost:north-sector$ answer: pwd output: /home/student/recon-base/field-ops/north-sector hint: pwd shows the new address.
From observation-post up to north-sector: .. took you to the parent. And it chains: ../.. is two levels up, ../../.. is three. Each .. is one rung of the ladder.
Practice Operation First Recon in a real Linux terminal at The Linux Camp. Progress is verified automatically as you type commands on the machine.