ls
what is in herels lists a directory. On its own it prints names; with -l it prints one line of facts per entry — what kind of thing it is, who may do what to it, who owns it, how big it is and when it last changed. That long line is the most-read output on any Linux system.
The first ten characters of an ls -l line say what the entry is and who may touch it.
At the terminal
Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.
What the numbered lines are telling you
"d" is a directory, "-" a regular file, "l" a symbolic link. The dot is this directory itself, and the two dots below it are its parent.
rwx for the owner, r-x for the group, r-x for everyone else. The x on a file means it may be run as a program.
.env is hidden from a plain ls. Its rw------- mode means only the owner can read or write it — right for a file of secrets.
logs is a pointer to /var/log/app. Its own permissions are always shown as rwxrwxrwx; the target's are what count.
Link count, owner, group, size in bytes, the time the content last changed, and the name.
Switches
A switch changes how the command behaves. These are the ones used day to day; man ls lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.
-l- Long format: permissions, owner, group, size and date, one entry per line.
-a- All: include the hidden entries whose names begin with a dot.
-h- Human-readable sizes — 4.0K, 12M, 1.3G — when used with -l.
-R- Recursive: list every sub-directory beneath as well.
-t- Sort by modification time, newest first.
-r- Reverse the sort order. With -t, oldest first.
-S- Sort by size, largest first.
-d- List the directory itself rather than its contents.
Variations worth knowing
The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.
ls -lh /var/logLong listing of another directory with sizes in K, M and G.
ls -lt | headNewest first — the quickest way to see what just changed.
ls -ld /etc/sshDescribes the directory itself rather than listing what is inside it.
ls -R srcLists every subdirectory beneath src as well.
In cybersecurity
An ls -l line is a permission audit of one file. Reading it properly finds most local misconfigurations before an attacker does.
A "w" in the last group of three lets any user on the system change the file. On a script that root runs, that is a way to become root.
Keys, .env files and backups should show rw------- or stricter. An r in the last group publishes them to every local user.
A leading dot only hides a name from a casual listing. Always look with -a, especially in web roots and home directories.