Linux learning
Linux learning is a structured path from the command line to working system administration, and most learners reach a comfortable baseline after 4 weeks of daily practice.
The path runs in two layers: the basics first (the shell, files, processes and the network), then the hacker track that builds directly on those basics. The central entity here is the Linux command line, because both layers run on it. A beginner who types 3 commands a day typically reads a manual page unaided by week 2 and installs a package from source by week 4. That pace is realistic, and the rest of this page is the sequence that produces it.
What Linux learning actually is
Linux learning is a skill set, not a certification, and it is built the same way on every machine, desktop or server. The learner earns a position by reading, writing, debugging and recovering real state. The history runs back through Unix culture, which taught generations of engineers that a program should do one thing well and hand off through text. That tradition is why a Linux shell can chain 8 small utilities into one pipeline. The project began when Linus and Linux first shipped a working kernel in 1991, and the community that grew around it kept the learning curve steep but honest. The Linux Foundation now stewards much of that core, and its public materials are a sound reference when a manual page is unclear. None of that history is optional reading, though; the basics below are what you actually do.
The basics, in the right order
The basics follow a fixed order, because each topic assumes the one before it. Work through these 6 areas in sequence, and keep a lab machine (a virtual machine is fine) for every step.
- Learn the shell: bash or zsh, and the 40 commands that cover most daily work, such as ls, grep, and man.
- Master the file system: paths, permissions, the 64 kilobyte block size that most filesystems use, and the 4 permission bits that decide who reads and writes.
- Understand processes: the 3 states of running, sleeping and zombie, and how to stop a runaway one with kill.
- Learn packages: the 2 main families, RPM and DEB, and how they install 1000s of programs in one step.
- Work the network: the 7 layers of the OSI model, and the 3 ports that matter most, 22, 80 and 443.
- Read logs: the 3 files in /var/log, and how to tail the live one while you reproduce the fault.
Each area takes a few days at 1 hour a day. The network area is where Linux Network Basics matters most, because the rest of the stack, web server, database and firewall, all speak the same protocol. Get the 3 ports right and the later topics fall into place.
How the hacker track builds on the basics
The hacker track builds directly on the 6 basics above, and it adds the adversarial view that a normal administrator never needs. A hacker asks the opposite question of an administrator: not how to run a service, but how to take it down or read its secrets. That single inversion turns the same command line into a set of tools. The track starts the moment the basics are solid, and it adds 5 new competencies in this order.
- Enumerate: find every open port on a target, using nmap to scan the 1024 common ones in minutes.
- Exploit: take one known service and try the 3 most common misconfigurations, an unpatched version, an open write, and a default password.
- Privilege escalate: move from a low user to root using a 2 digit SUID bit or a world-writable cron file.
- Move laterally: read the hosts file and the 4 lines that map the internal network, then try the next box.
- Cover tracks: understand what the 3 audit logs record, so you know what to clean and what you cannot.
None of this requires new hardware. A hacker uses the same 4 week baseline, only pointed at a target. The skills map one to one onto the basics, which is why the track is a continuation and not a restart.
What a real lab looks like
A real lab is 3 machines in a virtual network, and it is cheap enough to run on a single laptop with 16 gigabytes of memory. Machine 1 is the attacker, a minimal Linux install with nmap and metasploit. Machine 2 is the target, a deliberately vulnerable image. Machine 3 is the watcher, which only records. You spend 2 sessions a week on the lab, 90 minutes each, and you log every command in a plain text file. That log becomes your notes, your study aid, and eventually your proof of work.
Tools and the versions that matter
The tools are few, and the versions decide what you can do. A 2026 starter kit is small enough to list. The 3 core tools and the versions that make them current are shown below, along with the 1 job each does in the track.
| Tool | Current version | Role |
|---|---|---|
| nmap | 7.95 | Enumerate open ports and guess services |
| tcpdump | 4.99 | Read the live packets on the 3 main ports |
| Wireshark | 4.4 | Decode those packets visually and filter by 2 fields |
The 3 ports from the basics section are the ports you will watch most, and the 64 kilobyte block size from the file system section is why large scans read fast. The tool list never grows much, because the basics do most of the work. Update the 3 tools once a year, and pin the versions in a file so a reinstall is a 2 minute task.
Where learners stall, and the 2 habits that clear it
Learners stall at the same 2 points, and 2 habits clear both. The first stall is reading, where a learner reads a page for 3 hours and keeps nothing. The clearing habit is to type every example, because the muscle memory holds what the page forgets. The second stall is panic, where a learner breaks the lab and gives up. The clearing habit is a snapshot, a saved copy of the lab taken before every risky step, which resets the machine in under 1 minute. Both habits cost almost nothing, and both move the 4 week baseline forward instead of sideways.
Keep the central entity, the Linux command line, in every session, and the track stays connected to the basics that started it. That connection is the whole of Linux learning: a steady 4 week foundation, a 5 step adversarial track, and 2 habits that keep both moving.