Linux › Module 1 › Lesson 1
What is Linux & Why Hackers Use It
Learn what Linux is and why cybersecurity pros live in the terminal
Visual · linux_terminal
A glowing command-line terminal—the tool hackers and defenders use to control systems at full speed.
Opening
Windows is a house. Linux is the workshop.
Most people click icons on Windows or macOS. That is fine for email and streaming. It is not how the internet is actually run. Cloud servers, containers, routers, Android phones, and almost every professional security toolkit speak Linux. If you cannot tell the kernel from the distro from the shell, you will misread logs, copy the wrong commands, and accidentally treat a lab VM like a toy. This lesson is the map: three layers, one ethical line, and a safe way onto the machine.
1. Kernel vs distro vs shell — three layers, not one product
People say "Linux" as if it were one app. It is a stack. Confusing the layers is how beginners install the wrong thing, blame "Linux" for a shell typo, or think Kali is the kernel.
The kernel is the core program that talks to CPU, memory, disks, and network cards. It schedules processes, enforces (or fails to enforce) permissions, and exposes devices as files. You almost never "open the kernel." You live above it. Android phones, Ubuntu servers, and Kali VMs can all share a Linux kernel family while looking nothing alike on the desktop.
A distribution (distro) is a complete operating system built around that kernel: installer, package manager, default userland tools, maybe a desktop, maybe a wall of pentest programs. Ubuntu, Kali, and Parrot are distros. They are recipes. The kernel is the stove.
The shell is the text program that reads what you type and starts other programs. Bash and Zsh are shells. The terminal window is just the glass; the shell is the waiter taking orders. When a tutorial says "open a terminal," it means: get a shell so you can talk to the kernel through ordinary commands like pwd and ls.
Keep this triangle in your head every time someone says "just use Linux":
Kernel
Hardware + process + permission engine. Invisible until a driver, a crash, or a privilege check fails.
Distro
The packaged OS you install (Ubuntu, Kali, Parrot). Same kernel idea, different defaults and software.
Shell
The command interpreter (often bash). This is where defenders type, script, and investigate.
2. Why servers and security tools live on Linux
Linux won the server room because it is stable under load, cheap to clone, scriptable, and inspectable. A cloud VM is usually a Linux userspace talking to a Linux kernel. Logs land in predictable paths. Services are packages you can query. There is no mandatory GUI between you and the machine.
Security tooling followed the servers. Packet capture, port scanning, log parsing, and exploit frameworks were written first for Unix-like shells because that is where the targets and the automation already lived. A GUI can wrap those tools later. The native language is still the command line. Blue teams hunt on Linux because the evidence is on Linux. Red teams (with permission) use Linux because the same evidence, services, and toolchains are there.
Transparency
Open source means configs and many tools can be read, hashed, and audited. "Security through obscurity" is not a plan when the attacker already has the same kernel docs you do.
Repeatability
One command becomes a script. A script becomes an investigation playbook. Mice do not scale; shells do.
Permission is not optional
The same power that lets you read /var/log on your VM lets a criminal wreck a box they do not own. Skill without authorization is still unauthorized access. Practice on machines you own, a lab VM, or written-permission ranges — never a neighbor, school, or random website.
3. Wrong vs right: how you actually start Linux
Failure mode — first week of "I want to be a hacker." Two paths, same curiosity:
Wrong
Wipe your only Windows install to dual-boot Kali as a daily driver, then scan the school Wi-Fi "for practice." You mix untrusted pentest defaults with banking tabs, and you have no legal permission. One bad rm or one angry network admin and the lab is over — or worse, you have committed a crime.
Right
Keep your daily OS. Install Ubuntu or Kali inside VirtualBox/VMware, or enable Windows Subsystem for Linux (WSL). Practice whoami and pwd only on that guest. Treat every command as if it were reversible only if you designed it that way. Never rm -rf / and never chmod 777 /. Written permission or your own VM — those are the only playgrounds.
4. Practical: prove you have a Linux shell
Run these on YOUR Linux VM, YOUR WSL distro, or YOUR spare machine only — never someone else's account. The goal is identity + location + distro name. If a command is missing, you are not in a Linux shell yet (PowerShell is not bash).
Command guide
Safe identity and distro check (your VM / WSL only)
Your machine / VM / WSL only — never someone else's box
Command — copy this
whoami pwd ls
Confirm this is actually a Linux userspace
Command — copy this
cat /etc/os-release
NEVER run these — they can destroy or wide-open a system:
Optional command
rm -rf / chmod 777 /
Mission: name the three layers out loud
1) On your own VM or WSL, run whoami, pwd, and cat /etc/os-release. Write down the username, the current path, and the PRETTY_NAME of the distro. 2) Say this sentence once: "The kernel talks to hardware, the distro is the packaged OS, the shell is where I type." 3) Confirm your practice box is isolated (VM snapshot or WSL) — not the only copy of family photos.
Stuck? Ask Cyberlium AI Mentor
If kernel vs distro vs shell still blurs, ask Cyberlium AI Mentor for a hint — not a lecture. Try: "Hint only: is Kali the kernel or a distro, and where does bash sit?" No spoilers; you should still explain the triangle in your own words.
You now have the three-layer model, the reason servers and tools live here, a legal practice path (VM/WSL), and a hard ethics line. Next up — Linux Distributions (Kali, Ubuntu, Parrot) — we pick which recipe belongs on a beginner disk and which belongs in a disposable lab.
Knowledge Check
APPLY: A classmate says "I installed the Linux kernel" after downloading Kali. They now have a desktop, apt, and hundreds of pentest tools. What did they actually install?
Multiple choice
Knowledge Check
APPLY: You need to practice ls and pwd. Your only PC is a Windows laptop with family photos and banking. Best first move?
Multiple choice
Knowledge Check
APPLY: True or False: Learning bash on your own Ubuntu VM gives you legal permission to run the same recon tools against your city's public website.
True or False