Linux › Module 1 › Lesson 3
Linux File System Structure
Understand /home, /etc, /var, and the Linux directory tree
Visual · linux_filesystem
A branching directory tree rooted at / — every file on a Linux system lives somewhere in this hierarchy.
Opening
There is no C: drive. There is a tree — and evidence lives on it.
You can now name kernel, distro, and shell, and you know Ubuntu is for learning while Kali stays in a VM. None of that helps if you cannot find a file. Windows splits disks into letters. Linux hangs everything under one root: /. Configs, logs, user files, and temp droppings all have conventional addresses (the Filesystem Hierarchy Standard, FHS). Defenders do not "search the computer." They walk /etc and /var/log on purpose.
1. One tree: / and the FHS map
The forward slash / is the top of the filesystem — not to be confused with /root, which is the root user's home directory. Read a path left to right: /home/sam/notes.txt means start at root, enter home, enter sam, open notes.txt. Extra disks are mounted as folders somewhere on this same tree (for example /mnt or /media), not as a new "D:".
The FHS is the social contract: programs expect binaries in /bin or /usr/bin, configs in /etc, variable data in /var. Distros (Ubuntu, Kali, Parrot) argue about desktops; they mostly agree on this map. Learn it once and every lab VM stops feeling random.
2. Directories you will actually touch
You do not memorize every folder. You memorize the ones that hold identity, configuration, evidence, and your own work. The rest you can look up. Depth beats a poster on the wall.
FHS stops you should be able to explain in one sentence each:
/
The root of the tree. Everything hangs here. Destroying it (rm -rf /) is how people joke about ending a VM.
/home
Normal users' personal directories. Your notes belong in /home/you — not scattered in /. This is the safe playground.
/etc
System configuration: network, SSH, services, scheduled jobs. Attackers persist here; defenders audit here.
/var
Variable data that grows: logs, caches, spools. /var/log is the diary of what the machine thinks happened.
/tmp
Temporary files, often world-writable, often wiped on reboot. Convenient for labs; popular for dropped malware.
/usr
User-space programs and libraries (historical name — not "your files"). Most commands live under /usr/bin.
/bin
Essential command binaries (ls, pwd). On modern distros this is often a symlink into /usr/bin. Same idea: "the tools."
/opt
Optional add-on software that is not part of the base distro — vendor agents, extra tool suites, lab packages.
3. Absolute vs relative paths — how the shell aims
An absolute path starts with / and does not care where you currently stand: /etc/os-release is always that file. A relative path is interpreted from the current working directory (what pwd prints). If you are in /home/you, then notes.txt means /home/you/notes.txt. The tokens . (this directory) and .. (parent) are relative navigation. Mix them up and you edit the wrong file — or worse, you delete from the wrong place.
Hidden files start with a dot: .bashrc, .ssh. ls hides them unless you ask (ls -a). That is convention, not encryption. Attackers hide persistence in dotfiles; defenders remember to list them. You will practice ls -la in the next module. For now, know that "I don't see it" is not the same as "it is not there."
4. Wrong vs right: where defenders look first
Worked failure mode — "the login page looks weird" on a lab VM you own. Two investigation habits:
Wrong
Wander randomly with the file manager, cat mystery binaries in /tmp as root, chmod 777 / "so I can see everything," and ignore /etc and /var/log. You destroy forensic value, widen permissions, and still cannot say whether SSH or a cron job changed.
Right
Stay in your home for practice files. Use pwd so you know where you are. List / to see the map. Read what you are allowed to read: /etc/os-release, listing /etc names, listing /var/log names. Config changes leave fingerprints in /etc; actions leave stories in /var/log. Never chmod 777 / and never rm -rf / — even "just to see."
5. Practical: walk the tree without breaking it
On YOUR VM or WSL only. You will list directories and create a folder under your home. You will not edit /etc, not touch other users, and not run anything with recursive delete on /.
Command guide
Safe FHS walk (your Linux / WSL / VM only)
Always know where you are
Command — copy this
whoami pwd
Look at the tree — listing is not deleting
Command — copy this
ls / ls "$HOME"
Create practice space in YOUR home only
Command — copy this
mkdir -p "$HOME/cyberlium-lab" ls "$HOME/cyberlium-lab"
Distro identity lives under /etc
Command — copy this
cat /etc/os-release
NEVER:
Optional command
rm -rf / chmod 777 /
Mission: map seven stops
On your own Linux shell: run ls / and write what you see for /home, /etc, /var, /tmp, /usr, /bin, /opt (if a name is missing, note that — some minimal systems fold paths together). Then mkdir -p "$HOME/cyberlium-lab" and confirm with ls that the folder exists in your home, not in /. Say once: "Absolute paths start with /; relative paths start from pwd."
Stuck? Ask Cyberlium AI Mentor
If / vs /root vs /home still collides, ask Cyberlium AI Mentor for a hint — not a directory dump. Try: "Hint only: why is /root not the same as /, and where should my lab notes live?"
You connected distro choice to the shared map underneath: FHS paths, absolute vs relative, and why /etc (how the box is configured) and /var/log (what the box recorded) are defender landmarks. Next up — Quiz — Linux Intro — ten APPLY scenarios that mix kernel/distro/shell, Ubuntu vs Kali, and this tree.
Knowledge Check
APPLY: An analyst on a company Linux server needs yesterday's SSH login failures and whether sshd settings were changed. Which pair should they think of first?
Multiple choice
Knowledge Check
APPLY: You are in /home/alex/projects. You want the same file no matter which folder you cd into later. Which path style?
Multiple choice
Knowledge Check
APPLY: True or False: Running chmod 777 / is a reasonable way to "see hidden defender files" on a lab VM.
True or False