ALA-R1: Cell Navigation

ALA-R1

Cell Navigation

Adv Linux / ALA-R1
< Course Index

Operational Briefing

Mission Context:

"Every cell runs the same directory skeleton. An operator who does not know the filesystem hierarchy before touching a live cell is a liability. This module re-establishes that foundation. Read it fast if it feels familiar. Read it carefully if anything is unclear."

The Filesystem Hierarchy Standard

The FHS defines where everything lives on a Linux system. Every Ubuntu 22.04 cell uses the same top-level structure. Operators who internalize this navigate incident response without hesitation.

# Inspect the root hierarchy ls -la / # Read the official hierarchy man page man hier # Tree view of /etc, two levels deep (requires tree package) tree /etc --max-depth=2

Key directories to know: /bin and /sbin (user/system binaries, now symlinks to /usr/bin on Ubuntu 22.04), /etc (configuration), /var (variable data including logs), /proc and /sys (virtual kernel interfaces), /home (user home directories), /tmp (ephemeral), /opt (third-party software).

Operational Context:

Every cell runs the same directory skeleton. Knowing the FHS is knowing the cell's anatomy before you touch anything.

Navigation and Inspection

Efficient navigation is a speed multiplier in every operational scenario. These commands build the habits that make directory movement automatic.

# Print working directory pwd # Jump to previous directory (toggle between two locations) cd - # Push to a directory, return to origin with popd pushd /var/log popd # List with human sizes, sorted by size descending, then by time ls -lhSt # Full metadata for a single file stat /etc/passwd

On modern Ubuntu, ls -la /bin shows a symlink pointing to /usr/bin. Absolute paths start with / and never depend on your current position. Relative paths do. Always prefer absolute paths in scripts to avoid context-dependent failures.

Operational Context:

In an incident response scenario, speed of navigation is speed of recovery. Operators who hesitate on paths cost the grid downtime.

The find Command

find performs a real-time walk of the filesystem. It is the primary sweep tool for locating files by name, age, size, permission, or ownership. Learn its flags before you need them under pressure.

# All .conf files under /etc modified in the last 7 days find /etc -name "*.conf" -mtime -7 # All SUID binaries on the system (suppress permission errors) find / -perm /4000 -type f 2>/dev/null # Log files larger than 10 MB find /var/log -size +10M # Files owned by a specific user, run a command on each find /home -user operator -type f -exec ls -la {} \;

Core flags: -name / -iname (case-insensitive), -type f (file) / d (directory), -mtime (modification days), -size, -perm, -user, -exec. The 2>/dev/null suffix suppresses "Permission denied" noise on system directories.

Operational Context:

When an anomaly is reported, find is your first sweep tool. Learn its flags before you need them under pressure.

locate, which, and whereis

locate queries a pre-built index rather than walking the live filesystem. It is fast but potentially stale. which and whereis find executable locations in $PATH and standard system directories respectively.

# Fast index-based search (may be out of date) locate sshd_config # Rebuild the locate database (run as root) sudo updatedb # Find the exact path of an executable in $PATH which bash # Find binary, source, and man page locations whereis curl

find is authoritative: it reads the live filesystem. locate is fast but reads an index that was last built when updatedb ran (typically via cron). On a compromised cell, locate may report a file that has already been deleted or miss a file that was just planted.

Operational Context:

On a compromised cell, the locate index may lie. Know when to trust it and when to use find instead.

File Type Identification

Linux files are not identified by extension. The file command reads the file's actual content (magic bytes) and reports its true type. This is critical when investigating suspicious files on a tampered cell.

# Report the type of any file file /bin/ls file /etc/passwd file /dev/sda # Inspect raw hex to see magic bytes directly xxd /bin/ls | head -5

Special file types you will encounter: block devices (b), character devices (c), named pipes (p), sockets (s), and symbolic links (l). All are visible in the first character of ls -la output. A regular file shows -.

Operational Context:

Not every file is what its extension claims. On a cell that has been tampered with, file tells the truth when names do not.

File Descriptors and Redirection

Every process inherits three standard file descriptors: stdin (0), stdout (1), stderr (2). Redirection operators control where each stream goes. Understanding this is prerequisite to writing bash scripts and understanding pipes.

# See the open file descriptors of the current shell ls /proc/$$/fd # Open a custom file descriptor (fd 3) pointing to a log file exec 3>/tmp/debug.log # Redirect stdout to a file ls /etc > /tmp/etc-list.txt # Append stdout to a file ls /var >> /tmp/etc-list.txt # Redirect stderr only find / -name "secret" 2> /tmp/errors.txt # Merge stderr into stdout, pipe both to tee command 2>&1 | tee /tmp/output.txt

The operator &> is shorthand for redirecting both stdout and stderr to the same destination. Piping to tee writes to a file while still printing to the terminal, which is essential when you need a live view and a saved record simultaneously.

Operational Context:

Understanding file descriptors is prerequisite to understanding pipes and process communication, which underpin everything in Week 1.

Self-Check

  1. What is the FHS, and why does it matter that all cells follow the same directory structure?
  2. What is the difference between find and locate? When would you distrust locate on a compromised cell?
  3. What does find / -user root -perm /4000 -type f 2>/dev/null find, and why are those results security-relevant?
  4. What are stdin, stdout, and stderr, and how do you redirect each one independently?

If you are comfortable with all of these, proceed to ALA-R2: Access Control.