Linux on AWS EC2

About this part

Most servers on the internet run Linux, and most security tools run on Linux too. In this part you launch your own Linux server on Amazon EC2 and learn to work on it the way professionals do.

You start by launching an instance, choosing a key pair and a security group, and logging in safely over SSH. Then you learn the everyday commands: moving around the file system, reading and editing files, and managing users and permissions. Finally you learn the advanced commands defenders use daily: ps, ss, grep, find, journalctl and file permissions in depth.

Why this matters for security: when a server is attacked, the evidence is in Linux logs, running processes and file permissions. If you can read /var/log and spot a strange process, you can catch problems early.

An everyday comparison: learning Linux is like learning to drive before you learn to repair a car. Every later part of this book, from web servers to Kali Linux, assumes you are comfortable at the Linux prompt. Keep your EC2 instance in the free tier, and stop it when you are not practising.

Examples you will meet in this part. You will read /var/log/secure on Amazon Linux to see SSH login attempts, use ss -tlnp to see which programs (nginx, Tomcat, MySQL, Node.js, Gunicorn) are listening, and use chmod and chown so that web files are not world-writable. The same commands work on servers running Java, Python, Node.js, PHP or .NET apps.

After this part you will be able to

1. Launch an EC2 instance with a key pair and a security group that allows SSH only from your IP.
2. Move around Linux confidently and read logs with tail, less and grep.
3. Explain file permissions like -rw-r----- and fix them safely.
4. Find which process listens on a port with ss -tlnp.

A real-world picture

Suppose we are a junior cloud engineer at Infosys supporting a client's Linux servers. A ticket says "the server is slow". With this part you run top, df -h and journalctl -p err, and you find a full disk in two minutes. Globally, most cloud workloads on AWS, Azure and Google Cloud run Linux, so these skills carry over everywhere. Everyday analogy: learning the switches and the meter board in your own house before calling an electrician.

Key terms

• AMI: Amazon Machine Image, the template a new EC2 instance starts from.
• Key pair: A public key on the server and a private .pem file on your laptop, used for SSH login.
• Security group: A stateful firewall attached to an instance.
• sudo: Run one command as root, and it is logged.
• chmod 640: Owner can read and write, group can read, others get nothing.
• journalctl: Reads systemd logs, for example journalctl -u sshd.

Mini case study

Suppose we are a junior analyst at Tata Consultancy Services, asked to review a new web server on AWS before launch (with the client's written approval). The checklist from this part becomes a short report: what you checked, what you found (for example "port 22 open to 0.0.0.0/0" or "directory listing on"), the evidence (a command and its output), and the fix. Clear, evidence-based reports like this are how defenders work every day.