Linux Shell and Shell Prompt

Fundamentals · All about Linux · Reading time: ~12 min

The shell is one of the most crucial components in the Linux operating system. It acts as a bridge between the user and the system's core (the kernel), giving you full control over the OS.

If you truly want to learn Linux, you must understand the shell — it's where real power lies.

Try it as you read

This page includes a live, in-browser practice shell near the end. You don't need a real Linux box to follow along — feel free to jump down and try whoami, pwd, ls, and hostname right now.

What Is a Shell?

A Linux terminal, often referred to as the shell or command line interface (CLI), provides a text-based input/output interface that allows users to interact directly with the system.

Through commands typed into the shell, users can:

Execute programs
Manage files
Monitor processes
Configure system settings
Manage users and permissions
Work with networks
Automate tasks
Write shell scripts
Perform system administration

All of this can be done without relying on a graphical interface.

:::info Important Distinction

The terms terminal, shell, CLI, and prompt are often used interchangeably in casual conversation, but they technically describe different things.

Terminal vs Shell vs CLI

Term	Description
Terminal	The application or interface through which you interact with the system
Shell	The program that interprets and executes commands
CLI	The text-based method of interacting with a system
Prompt	The text displayed by the shell indicating that it is ready to accept input

A simplified representation is:

User
  |
  v
Terminal
  |
  v
Shell
  |
  v
Kernel
  |
  v
Hardware / System Resources

For example, when you open a terminal application and see:

user@hostname:~$

the terminal provides the interface, while the shell is responsible for interpreting the command you type.

Popular Linux Shells

Linux supports multiple shells, each with different features and capabilities.

Some commonly encountered shells include:

bash (Bourne Again Shell) – widely used and the default shell in many Linux environments
zsh – provides additional customization and interactive features
fish – designed to provide a user-friendly interactive shell
ksh – KornShell
sh – traditional Unix shell interface

The shell used by a user can vary depending on the Linux distribution, system configuration, and personal preference.

Check Your Current Shell

You can determine your configured login shell with:

echo $SHELL

Example:

/bin/bash

You can also inspect the shell process currently running:

echo $0

or:

ps -p $$ -o comm=

Example:

bash

What does $$ mean?

$$ is a special shell variable that contains the process ID (PID) of the current shell.

Therefore:

ps -p $$ -o comm=

asks the operating system to display information about the current shell process.

Why the Shell Matters in Cybersecurity

Mastering the shell is essential for cybersecurity professionals, system administrators, and developers, as it enables deep interaction, automation, scripting, and system-level control.

For cybersecurity professionals, the shell is particularly important because many security activities are performed through command-line tools.

For example:

nmap
tcpdump
curl
wget
ssh
netstat
ss
ps
grep
awk
sed
find

A security analyst or penetration tester may use the shell to:

Enumerate systems
Inspect network connections
Analyze logs
Search files
Investigate processes
Connect to remote systems
Automate repetitive tasks
Execute security tools
Write scripts for reconnaissance and analysis

The command line therefore becomes an important interface for interacting with Linux systems during security assessments.

Shell Prompts

The shell prompt is a simple yet powerful indicator that gives you important context about your current session.

It appears whenever the terminal is ready to accept a command.

By looking at the prompt, you can quickly understand key information such as:

User Privilege — Admin or non-admin
Username
Hostname — Computer name
Current Working Directory
Optional Information — Time, Git branch, or custom information in advanced prompts

A typical prompt might look like:

user@hostname:~/current-directory$

Let's break it down:

user        @ hostname : ~/current-directory $
  |              |              |             |
Username      Hostname       Directory      Prompt

The exact appearance of a prompt depends on the shell configuration.

Unprivileged User Shell Prompt

A typical unprivileged user prompt ends with:

For example:

user@hostname:~$

The $ convention commonly indicates that the current shell is operating as a regular user.

However, this is only a convention. Shell prompts are configurable, so you should never rely solely on the visible prompt to determine privilege.

Privileged Root Shell Prompt

A typical root shell prompt ends with:

For example:

root@hostname:~#

The # convention commonly indicates a root shell.

However, just like $, the prompt can be customized.

When privilege matters, verify it explicitly.

whoami

Example:

root

You can also use:

id

Example:

uid=0(root) gid=0(root) groups=0(root)

The important part here is:

uid=0(root)

UID 0 represents the root account.

:::warning Do Not Trust the Prompt Alone

A $ or # at the end of a prompt is only a visual convention.

A user can customize PS1 and make a prompt look like:

root@server:~#

even when the user is not actually root.

When performing security testing or system administration, verify privileges using commands such as:

whoami
id

Understanding a Shell Prompt

Consider the following prompt:

alice@web-server:/var/www/html$

It can be interpreted as:

Component	Value	Meaning
Username	`alice`	Current user
Hostname	`web-server`	Current machine
Directory	`/var/www/html`	Current working directory
`$`	`$`	Conventional indicator of an unprivileged shell

Now compare it with:

root@web-server:/var/www/html#

The visible difference is the final character:

versus:

But remember that the actual privilege should be verified rather than assumed.

Useful Commands for Understanding Your Shell

Before learning how to customize the prompt, it is useful to understand some commands that reveal information about your current session.

Identity
Location
Hostname
Terminal

Identify the Current User

whoami

Example:

alice

To retrieve more detailed identity and group information:

id

Example:

uid=1000(alice) gid=1000(alice) groups=1000(alice),27(sudo)

Identify the Current Directory

pwd

Example:

/home/alice

pwd means print working directory.

Identify the Host

hostname

Example:

web-server

For additional system information:

hostnamectl

Identify the Terminal Device

tty

Example:

/dev/pts/0

This identifies the terminal device associated with the current shell session.

PS1 Variable in Linux

In Linux, the PS1 variable (Prompt String 1) defines how your command prompt looks in the terminal.

It controls the text, symbols, colors, and structure of the prompt you see every time you're ready to type a command.

For Bash, PS1 is the primary interactive prompt variable.

Bash also provides other prompt variables such as PS2, PS3, and PS4.

Why Is PS1 Important?

The prompt can provide useful context about your current session.

It can show:

Current user
Hostname
Current directory
Time
Git branch
Privilege level
Other custom information

It can also be customized for clarity, productivity, or aesthetics.

View Your Current PS1

You can inspect the current value using:

echo "$PS1"

Depending on your configuration, you may see something similar to:

\u@\h:\w\$

A Basic PS1 Example

For a normal user, your shell prompt might look like:

user@host:~/folder$

Behind the scenes, this can be generated by a PS1 value such as:

PS1='\u@\h:\w\$ '

The escape sequences are interpreted by Bash when the prompt is displayed.

Common Escape Sequences in PS1

Sequence	Meaning
`\u`	Username
`\h`	Hostname up to the first `.`
`\H`	Full hostname
`\w`	Current working directory
`\W`	Basename of the current working directory
`\t`	Current time in `HH:MM:SS` format
`\d`	Current date
`\#`	Command number
`\$`	`#` for root and `$` for other users

Building a Custom Prompt

Suppose you want the prompt to display:

username@hostname:/current/path$

You can use:

PS1='\u@\h:\w\$ '

This maps to:

\u  → username
\h  → hostname
\w  → current directory
\$  → # for root, $ for normal users

Therefore:

\u@\h:\w\$

becomes something like:

alice@web-server:/home/alice$

Customizing the Prompt with Colors

Bash also allows ANSI escape sequences to be used to add colors to the prompt.

For example:

PS1='\[\e[1;32m\]\u@\h:\w\$ \[\e[0m\]'

This creates a prompt with colored text.

The important parts are:

\e[1;32m

which enables the color, and:

\e[0m

which resets the terminal formatting.

Common ANSI Color Codes

Code	Color	Code	Color
`\e[0;30m`	Black	`\e[1;30m`	Bright Black (Gray)
`\e[0;31m`	Red	`\e[1;31m`	Bright Red
`\e[0;32m`	Green	`\e[1;32m`	Bright Green
`\e[0;33m`	Yellow	`\e[1;33m`	Bright Yellow
`\e[0;34m`	Blue	`\e[1;34m`	Bright Blue
`\e[0;35m`	Magenta	`\e[1;35m`	Bright Magenta
`\e[0;36m`	Cyan	`\e[1;36m`	Bright Cyan
`\e[0m`	Reset — always end your `PS1` with this

:::note Why Are \[ and \] Used?

When Bash prompt escape sequences contain non-printing characters (like color codes), wrapping them with:

\[
\]

tells Bash "don't count these characters toward the visible prompt width."

Without this, Bash miscalculates where the prompt text actually starts, which causes visual glitches when you use line editing, command history recall (arrow keys), or terminal line-wrapping.

:::

Temporary vs Permanent Changes

When you modify PS1 directly from the terminal:

PS1='\u@\h:\w\$ '

the change normally applies to the current shell session.

If you close the terminal and start a new shell, the change may disappear.

To make the configuration persistent for Bash interactive shells, you will commonly place the configuration in:

~/.bashrc

For example:

nano ~/.bashrc

Add:

PS1='\u@\h:\w\$ '

Then reload the configuration:

source ~/.bashrc

You can verify the result by checking:

echo "$PS1"

:::warning Be Careful When Editing .bashrc

A mistake in .bashrc can affect every new interactive Bash session.

If you are experimenting, keep a backup:

cp ~/.bashrc ~/.bashrc.backup

Then make your changes.

:::

PS1 Is Not the Only Prompt Variable

Bash provides several prompt variables.

Variable	Purpose
`PS1`	Primary interactive prompt
`PS2`	Secondary prompt
`PS3`	Prompt used by the `select` construct
`PS4`	Prefix used when tracing commands with `set -x`

For example, if Bash expects additional input, you may see the secondary prompt:

This can happen when a command has not been completed.

Example:

echo "Hello

Bash may wait for the closing quote and display:

You can cancel the incomplete command with:

Ctrl+C

Shell Prompt in Security Operations

Understanding the shell prompt is especially important during penetration testing and system administration.

Imagine you connect to a remote system:

ssh analyst@server

You receive:

analyst@server:~$

You should immediately establish basic context:

whoami
id
hostname
pwd

This gives you:

Current user
Current privileges
Target hostname
Current directory

A simple workflow is:

Connect
  |
  v
whoami
  |
  v
id
  |
  v
hostname
  |
  v
pwd
  |
  v
Continue enumeration

This habit is useful because commands executed on the wrong host, wrong directory, or wrong privilege level can have unintended consequences.

Shell and Command Execution

One of the most important concepts for cybersecurity professionals is understanding how the shell interprets commands.

Consider:

echo "Hello"

The shell parses the command and invokes the appropriate program or shell builtin.

More complex commands can contain:

Pipes
Redirection
Variables
Command substitution
Wildcards
Quoting
Command chaining

For example:

cat access.log | grep "401"

Here:

cat access.log
      |
      v
   Output
      |
      v
     grep
      |
      v
Matching lines

The | character creates a pipe, connecting the output of one command to the input of another.

Shell Metacharacters

The shell recognizes a number of special characters that can change how commands are interpreted.

Common examples include:

|
>
>>
<
;
&&
||
$
*
?

For example:

cat file.txt | grep "password"

uses:

to pipe output from one command into another.

Similarly:

echo "hello" > output.txt

uses:

to redirect output into a file.

Understanding these characters becomes particularly important when studying command injection vulnerabilities.

Why This Matters for Web Security

Many applications have functionality that interacts with operating-system commands.

For example, an application might internally execute something conceptually similar to:

command + user_input

If untrusted input is incorporated into shell commands without appropriate protections, an attacker may be able to alter the intended command execution.

This class of vulnerability is known as OS Command Injection.

OWASP recommends avoiding direct OS command execution where possible and, when it cannot be avoided, using appropriate parameterization and input validation.

:::info Security Connection

Understanding how the shell interprets:

;
&&
||
|
>
<
$

is useful when learning how command injection works.

The same knowledge is also important for defending applications that interact with operating-system commands.

:::

Practical Exercise

No Linux box handy? Use the sandbox below — it's a small in-browser practice shell (not a real system, nothing you type here can break anything). Try the steps that follow directly in it.

practice-shell

Practice shell — type "help" to get started. Nothing here is real.

learner@onlysecurity:~$

What can this practice shell do?

It supports a small, safe subset of real Bash behavior so you can build muscle memory: whoami, id-style identity checks via whoami, pwd, hostname, ls, cd, cat, mkdir, touch, rm, cp, mv, grep, find, echo, clear, and history. Use the ↑ / ↓ arrows to recall previous commands and Tab to autocomplete.

If you have access to a real Linux system, try the following commands one by one there as well — the practice shell above is a good warm-up, but nothing beats the real thing.

Step 1 — Identify Yourself

whoami

Step 2 — Check Your Privileges

id

Step 3 — Identify the Host

hostname

Step 4 — Identify Your Current Directory

pwd

Step 5 — Identify Your Shell

echo "$SHELL"

Step 6 — Inspect the Prompt Configuration

echo "$PS1"

Step 7 — Temporarily Change the Prompt

PS1='\u@\h:\w\$ '

Step 8 — Restore Your Shell Configuration

If you modified .bashrc, reload it:

source ~/.bashrc

Useful References

The following resources are useful when learning Linux shells and Bash:

Key Takeaways

By the end of this section, you should understand:

What a shell is
The difference between a terminal, shell, CLI, and prompt
Common Linux shells such as bash, zsh, fish, and ksh
How to identify your current shell
How to identify your current user and privileges
How to interpret a shell prompt
What the PS1 variable does
Common Bash prompt escape sequences
How to customize PS1
How .bashrc is used for interactive Bash configuration
What PS2, PS3, and PS4 are used for
Why shell syntax matters in cybersecurity
Why understanding shell metacharacters is important when studying command injection

Now that you understand the Linux shell and shell prompt, the next step is to learn the commands you will use every day.

The natural progression is:

Linux Shell
     |
     v
Basic Commands
     |
     v
File & Directory Management
     |
     v
Users & Permissions
     |
     v
Processes
     |
     v
Networking
     |
     v
Shell Scripting
     |
     v
Linux Security & Privilege Escalation

Recap

New here? Start with Linux: The Penguin in the Room for the history and use cases, then come back to this page for the shell fundamentals.

What Is a Shell?​

Terminal vs Shell vs CLI​

Popular Linux Shells​

Check Your Current Shell​

Why the Shell Matters in Cybersecurity​

Shell Prompts

Unprivileged User Shell Prompt​

Privileged Root Shell Prompt​

Understanding a Shell Prompt

Useful Commands for Understanding Your Shell

Identify the Current User​

Identify the Current Directory​

Identify the Host​

Identify the Terminal Device​

PS1 Variable in Linux

Why Is PS1 Important?​

View Your Current PS1​

A Basic PS1 Example​

Common Escape Sequences in PS1

Building a Custom Prompt

Customizing the Prompt with Colors

Common ANSI Color Codes​

Temporary vs Permanent Changes

PS1 Is Not the Only Prompt Variable

Shell Prompt in Security Operations

Shell and Command Execution

Shell Metacharacters

Why This Matters for Web Security

Practical Exercise

Step 1 — Identify Yourself​

Step 2 — Check Your Privileges​

Step 3 — Identify the Host​

Step 4 — Identify Your Current Directory​

Step 5 — Identify Your Shell​

Step 6 — Inspect the Prompt Configuration​

Step 7 — Temporarily Change the Prompt​

Step 8 — Restore Your Shell Configuration​

Useful References

Key Takeaways

Next

What Is a Shell?

Terminal vs Shell vs CLI

Popular Linux Shells

Check Your Current Shell

Why the Shell Matters in Cybersecurity

Unprivileged User Shell Prompt

Privileged Root Shell Prompt

Identify the Current User

Identify the Current Directory

Identify the Host

Identify the Terminal Device

Why Is PS1 Important?

View Your Current PS1

A Basic PS1 Example

Common ANSI Color Codes

Step 1 — Identify Yourself

Step 2 — Check Your Privileges

Step 3 — Identify the Host

Step 4 — Identify Your Current Directory

Step 5 — Identify Your Shell

Step 6 — Inspect the Prompt Configuration

Step 7 — Temporarily Change the Prompt

Step 8 — Restore Your Shell Configuration