Command reference

Debian's wrapper around useradd: creates the home directory, copies /etc/skel, asks for a password, and with --system produces a service account with no login. The one to use by hand.

3 options explained · 4 lessons

Reads and changes a password's lifetime and an account's expiry date. chage -l answers "is this account about to expire?", a question behind a fair number of logins refused on a Monday morning.

3 options explained · 1 lesson

Removes an account. Without --remove-home its files stay, now owned by a UID with no name; with it, they are gone. A service still running as that account is not stopped for you.

1 option explained · 1 lesson

Prints a file's full access control list, what the + in ls -l announces without detailing. Keep one next to a backup: rsync -a and tar without options do not copy ACLs.

1 option explained · 2 lessons

Creates a group, and nothing more. The right it stands for is built afterwards: a directory it owns, a chmod g+s, accounts added with usermod -aG.

1 option explained · 1 lesson

Changes a password, or locks an account with -l without deleting it. Locking closes neither the open sessions nor SSH key access: those are two other decisions.

2 options explained · 1 lesson

Adds rights to a file that the usual nine characters cannot express: one specific account for reading, one more group for writing. ls -l then shows only a +; the rest is read with getfacl.

1 option explained · no lesson

Opens a shell as another identity, asking for that account's password — not yours. On a server where root has no password, su fails and sudo -i is the intended route.

2 options explained · 1 lesson

Runs one command with another account's rights, root by default, and logs who asked for it. It is not "becoming root": each command is allowed or refused by /etc/sudoers, and that file is where what an account can really do is read.

6 options explained · 77 lessons

Shows or sets the mask taken off the permissions of every file created in this shell. It is why a new file is 644 rather than 666: the command did not decide that, the mask did.

1 option explained · 2 lessons

Creates an account with exactly what you specify and nothing more: without -m no home directory, without -s the shell is /bin/sh. It is the low-level tool scripts call; for a person, adduser asks the right questions.

1 option explained · no lesson

Changes an existing account: its groups, its shell, its expiry, its lock. The options look alike and do not do the same thing — -G replaces the group list, -aG adds to it.

5 options explained · 3 lessons

Edits /etc/sudoers and checks the syntax before saving. A typo in that file takes sudo away from everyone, including whoever could fix it; this is the only reasonable way to change it.

2 options explained · 2 lessons

Copies files over SSH, with cp's syntax. Enough for one file; for a tree to keep in sync, rsync copies only what changed.

4 options explained · 1 lesson

Opens a session or runs a command on a remote machine, in an encrypted, authenticated channel. The first connection asks you to check the server's fingerprint; it is the only moment when that check means anything.

7 options explained · 6 lessons

Loads a private key into the agent for the session, which saves retyping the passphrase — and which lends the key to everything that talks to the agent, including a remote host when -A is on.

4 options explained · 1 lesson

Holds decrypted private keys in memory and signs on ssh's behalf. It does nothing until ssh-add hands it something, and eval "$(ssh-agent -s)" is what makes the shell aware of it.

1 option explained · 1 lesson

Creates a key pair, changes its passphrase, or prints a fingerprint. The private key never leaves the machine it was made on; the public one is copied wherever you want to log in.

7 options explained · 4 lessons

The SSH server itself. sshd -t validates the configuration before a restart and sshd -T prints what actually applies, first obtained value per keyword — which the file does not show.

4 options explained · 5 lessons

The space on each filesystem, in blocks or with -i in inodes. A "full" disk while df -h shows room is almost always a df -i at 100%.

3 options explained · 9 lessons

The kernel's message buffer: disks detected, hardware errors, processes killed by the OOM killer. When a service dies without writing anything to its own log, this is where the reason is.

1 option explained · no lesson

The space a directory and its contents actually take. df says how much is missing; du -sh /* | sort -h says where it went.

3 options explained · 5 lessons

RAM and swap: used, free, and above all available, which counts reclaimable cache. A machine whose free column is near zero is fine; available is the one to read.

1 option explained · 3 lessons

Measures disk activity: throughput, requests, wait time, utilisation. A %util near 100 with low throughput points at a disk saturated by small writes, not a full disk.

5 options explained · 1 lesson

Recent logins and reboots, read from wtmp. It dates a reboot without a trawl through the journal, and shows who was logged in when an incident happened.

1 option explained · no lesson

Rotates, compresses and removes log files according to /etc/logrotate.d/. It runs once a day from a timer; logrotate -d replays the configuration without touching anything.

1 option explained · 1 lesson

The distribution's name and version, also held in /etc/os-release. The answer to the first question of every fix: "which release are you on?"

1 option explained · 1 lesson

Breaks a path down component by component, with each one's permissions. A "Permission denied" on a readable file comes from a parent directory without x, and this is the command that shows it.

1 option explained · 2 lessons

The same readings as sar, per process: which PID burns the CPU, writes to disk, or switches context too often. The link between "the machine is slow" and "it is this program".

1 option explained · 1 lesson

Resolves a symbolic link, and with -f the whole chain to the real file. It is what says which release a current really points at after a deploy.

1 option explained · 6 lessons

The quota report of a filesystem: who uses what, who is over their soft limit and since when. Read it before chasing a mysterious fault on an account that "cannot write any more".

1 option explained · 1 lesson

Reads back the load history sysstat collects every ten minutes: CPU, memory, disk, network, by time slot. It answers "what was the machine doing at 3 a.m." when nobody was watching.

5 options explained · 1 lesson

Sets an account's or a group's disk quotas on a filesystem mounted with the quota options. Without those mount options the command succeeds and limits nothing.

3 options explained · no lesson

The live state of processes, refreshed. Useful for what is consuming now; useless for what was consuming an hour ago, which only sar kept.

4 options explained · 2 lessons

The running kernel, with -r its exact version. Compare it with what dpkg installed: if they differ, the machine is waiting for a reboot.

1 option explained · 1 lesson

Chooses which of several installed programs answers a generic name — which editor, which java. It is not a version manager: all it does is move a symbolic link.

1 option explained · 1 lesson

Sends a signal to a PID: TERM by default, which asks the process to stop, KILL which asks nothing. The -9 in this site's name is the second: it lets the process neither close its files nor write anything.

2 options explained · 2 lessons

Finds PIDs by name or pattern, without the grep that matches itself. pgrep -a shows the command too, which saves killing the wrong process at the next step.

3 options explained · 4 lessons

Sends a signal to every process whose name matches the pattern. The pattern is a regular expression matching part of the name: pkill node reaches node_exporter too.

1 option explained · 1 lesson

The list of processes at this instant, with PID, owner and command. ps aux shows everything; ps -o pid,ppid,cmd picks the columns, which makes the output readable by a script.

5 options explained · 5 lessons

Processes as a tree, each child under its parent. It is how you see that an orphan node is the grandchild of a bash somebody closed, and not a service.

1 option explained · 1 lesson

Changes permissions. chmod 777 makes the error message go away, and the problem with it — the problem being that anyone can now write that file.

2 options explained · 4 lessons

Changes a file's owner and group. A service that "cannot write" to its own directory has almost always a missing chown after a copy made by root.

2 options explained · 2 lessons

Copies files. Without -a the copy loses owner, timestamps and symbolic links; fine for a working file, wrong for a configuration or a backup.

4 options explained · 2 lessons

Walks a tree and selects files by their properties: name, size, date, owner, permissions. Each test is an option, and -exec or -delete acts on what is left; run it without the action first.

17 options explained · 8 lessons

Copies a file while setting owner, group and mode in one command — install -o root -g root -m 0644. It is cp then chown then chmod, without the window where the file has the wrong rights.

4 options explained · 3 lessons

Creates a link: hard by default, symbolic with -s. ln -sfn replaces an existing link in one operation, which deployment through current requires.

3 options explained · 6 lessons

Lists a directory's contents. ls -l shows the nine permission characters, the owner and the group — the three things to read before concluding a refused access is a bug.

5 options explained · 14 lessons

Creates a directory. mkdir -p also creates missing parents and does not complain if the directory exists — which makes the command rerunnable, but it still fails if a file has that name.

1 option explained · 2 lessons

Moves or renames. On the same filesystem it is an instant rename, which is what makes switching a current link atomic; across two disks it is a copy followed by a delete.

4 options explained · 3 lessons

Deletes files, with no bin and no confirmation. What rm -rf removes is gone; the only protection is what you typed before Enter, and an empty variable turns /var/www/$app into /var/www/ there.

4 options explained · 3 lessons

Everything the system knows about a file: inode, permissions in octal, modification and change times, link count. It is ls -l with nothing rounded or left out.

2 options explained · 6 lessons

Creates an empty file, or updates an existing file's timestamp. The empty file that says "this script has run" or switches a rule on (/etc/cron.allow) is often made this way.

1 option explained · 2 lessons

Prints an indented tree, what ls -R does less legibly. tree -L 2 caps the depth, which makes a deployment directory fit on one screen.

1 option explained · 1 lesson

Sets a file's size, cutting it or extending it with zeros. truncate -s 0 empties a log without deleting it, so without breaking the descriptor a process keeps open on it.

1 option explained · no lesson

Processes text field by field and line by line, with a small language. awk '{print $2}' is enough to pull out a space-separated column, which cut does badly.

1 option explained · 2 lessons

Extracts columns from text, by character or by field with -d and -f. Enough for /etc/passwd; awk takes over when the separator is a variable run of spaces.

2 options explained · no lesson

The differences between two files, line by line. diff -u produces the format git and patch read, and it is what goes into a report to show what changed in a configuration.

1 option explained · 1 lesson

Searches for a pattern in files or in what is piped to it, and returns the line — or with -q only an exit status, which makes it a test in a script. The pattern is a regular expression unless -F.

9 options explained · 17 lessons

The first lines of a file or a stream. head -1 on a command's output keeps its first line, which is often all a script needs.

1 option explained · 3 lessons

Joins files line by line, side by side. With -sd+ it turns a column of numbers into 1+2+3, which bc can add up.

2 options explained · no lesson

Sorts lines. sort -h understands du -h sizes, sort -n numbers, and with no option the sort is alphabetical — where 10 comes before 9.

3 options explained · 2 lessons

The last lines of a file, and with -f the ones arriving as they come. For a systemd service, journalctl -f is the same thing without having to know the file's path.

2 options explained · 10 lessons

Writes what it receives both to a file and to standard output. sudo tee is how you write a root-owned file from a pipe, where sudo echo > file fails.

1 option explained · 1 lesson

Replaces or deletes characters in a stream: tr -d '\r' strips the Windows line endings that make a script "not found" while it is right there.

2 options explained · no lesson

Removes adjacent repeated lines, or with -c counts them. It sees only neighbours: sort | uniq -c is the pair, and uniq alone on an unsorted file removes nothing.

1 option explained · 1 lesson

Counts lines, words and bytes. wc -l on the output of a grep or an ls turns a list into a number — the shape a check takes in a script.

2 options explained · 1 lesson

Builds and runs a command from what it reads on standard input. With find -print0 | xargs -0, file names containing spaces stop being split in two.

2 options explained · 1 lesson

The default interactive shell of human accounts on Ubuntu, and the interpreter of most administration scripts. bash -n checks a script's syntax without running it; bash -x shows each command as it runs.

2 options explained · 1 lesson

Edits an account's table of scheduled jobs. On a systemd machine a timer does the same with a log, a status and catch-up of missed runs — crontab is what you will find on existing machines.

2 options explained · 2 lessons

The date and time, in the format you ask for. date -u +%Y%m%dT%H%M%SZ names a backup or a release so it sorts; date -d @1700000000 translates a Unix timestamp.

4 options explained · 2 lessons

Detaches a job from the shell that started it, so it survives the terminal closing. A rescue, not a method: a service that has to run needs a systemd unit.

1 option explained · 1 lesson

Prints the environment, or runs a command in a modified one. On a script's first line, #!/usr/bin/env bash finds bash wherever it is installed.

1 option explained · 1 lesson

Takes a lock on a file for the duration of a command, so a second instance waits or gives up. It is what keeps a timer-launched backup from overlapping the previous one.

5 options explained · 1 lesson

The processes started from this shell and still attached to it, with their job numbers. What is listed here dies with the terminal; disown or tmux are the ways to avoid that.

2 options explained · 1 lesson

Sets the shell's behaviour. set -euo pipefail at the top of a script stops it at the first failing command, the first undefined variable, and an error in the middle of a pipe — instead of carrying on as if nothing happened.

3 options explained · 2 lessons

On Debian and Ubuntu, /bin/sh is dash, not bash. A script that starts with #!/bin/sh and uses [[, arrays or source fails — in production, not in the terminal you tested it in.

1 option explained · 1 lesson

Reads the systemd journal, by unit (-u), by period (--since), by boot (-b), live (-f). It is where a service's output went when it writes to no file.

19 options explained · 25 lessons

Halts or reboots the machine, now or at a stated time, warning open sessions. shutdown -c cancels what is scheduled.

2 options explained · 1 lesson

Drives systemd units: start, stop, enable at boot, read the state. status says what is happening now, is-enabled what will happen at the next boot; those are two different questions.

19 options explained · 47 lessons

Lists the unit files you have overridden or replaced, and how they differ from the package's. It answers "what was changed on this machine" without a trawl through /etc/systemd.

1 option explained · 1 lesson

Runs a command as a transient unit, with a journal and limits, without writing a unit file. --on-active=10m schedules it once, what at used to do.

2 options explained · 1 lesson

Obtains and renews Let's Encrypt certificates by proving control of the domain, and installs a timer for renewal. certbot renew --dry-run rehearses the procedure without issuing anything.

5 options explained · 2 lessons

Sends an HTTP (or other) request and shows the response. curl -I reads only the headers, -v shows the whole exchange, TLS included — that is how you tell "the server answers badly" from "the server does not answer".

12 options explained · 17 lessons

Queries the DNS and shows the raw answer, with the TTL and the server that answered. dig +short for the value; dig @1.1.1.1 to ask a specific resolver rather than the local cache.

1 option explained · 11 lessons

Linux's historical rule-based firewall; on recent Ubuntu, a compatibility layer over nftables. Rules live in memory: what you add is gone at reboot unless something saves it.

4 options explained · 1 lesson

A minimal SMTP client that hands a machine's mail to an authenticated relay, without running a mail server. It is what lets cron and scripts send an alert.

1 option explained · 1 lesson

Opens a raw TCP or UDP connection to a port, or listens on one. nc -zv host 5432 says whether the port is open before the database gets blamed.

3 options explained · 4 lessons

The nftables firewall tool, which replaces iptables. nft list ruleset shows the whole set of rules actually loaded, whichever tool put them there — ufw included.

1 option explained · 1 lesson

The web server and reverse proxy of the hosting courses. The command itself is mostly for nginx -t, which validates the configuration before a reload: an invalid configuration reloaded leaves the old one running, without saying so loudly.

3 options explained · 11 lessons

Scans a machine's ports from outside and shows what an attacker would see. Run it on your own servers after every firewall change — and only on your own.

3 options explained · 1 lesson

The TLS toolbox: openssl s_client connects and shows the certificate the server actually presents, openssl x509 reads a certificate on disk. The first is what you need when the browser says "not secure" without saying why.

6 options explained · 3 lessons

Sends ICMP packets and times the reply. It proves a machine is reachable at the IP level; it says nothing about port 443, and a firewall dropping ICMP makes it fail on a perfectly healthy server.

1 option explained · 2 lessons

Reads and changes Postfix's configuration. postconf -n prints only what differs from the defaults — the view you need when working out why mail is not leaving.

1 option explained · 1 lesson

The open sockets: who listens on which port, which connections are established, and with -p which process. ss -tlnp is the command that answers "is something already listening on 80?"

4 options explained · 14 lessons

Captures the packets crossing an interface and prints them, filtered by host, port or protocol. The final arbiter: when two machines disagree about what was sent, tcpdump shows what actually went over the wire.

5 options explained · 1 lesson

Downloads a file from a URL to disk, resuming where it stopped with -c. Where curl is for examining a response, wget is for keeping it.

1 option explained · 1 lesson

Fingerprint-based intrusion detection: a baseline of the files, then a report of what changed. Worth only as much as a baseline taken on a clean machine and kept off it.

1 option explained · 1 lesson

Loads, reloads or removes an AppArmor profile. apparmor_parser -r reloads a changed profile without restarting the service it confines — the command you want when a service is allowed to write a file and AppArmor refuses it.

1 option explained · 1 lesson

Compares installed files with their package's checksums. A binary changed without dpkg knowing is either an intrusion or a forgotten emergency cp; either way it is what you needed to know.

4 options explained · 1 lesson

The version control tool, used here for configuration files as much as for code: who changed what, when, and how to go back. git status and git log are the two commands to know before any other.

16 options explained · 9 lessons

Adds a package source (usually a PPA) and its key. Every source added is a third party you trust for everything it publishes; the list should stay short.

1 option explained · no lesson

The package management interface for a human: update, upgrade, install, with a progress bar and output that changes between versions — which makes it unfit for scripts.

2 options explained · 5 lessons

The same as apt, with stable output and options meant for scripts: apt-get install -y in an installation script, apt in a terminal.

1 option explained · no lesson

The low-level package manager: installs a .deb, lists what is installed (dpkg -l), says which package a file belongs to (dpkg -S). It does not resolve dependencies — that is apt's job.

6 options explained · 4 lessons

Asks a package's configuration questions again — the time zone, the locales, the keyboard. The intended way to change what installation asked once.

1 option explained · no lesson

The JavaScript runtime the hosting courses' applications run on. node --version is the first thing to compare between the machine where it works and the one where it does not.

2 options explained · 2 lessons

Node's package manager. npm ci installs exactly what package-lock.json describes, which npm install does not guarantee — and ci is what a deployment should call.

2 options explained · 4 lessons

Installs packages that are confined and auto-updated by Canonical. Updates are deferred more than they are switched off — worth knowing before installing a service this way on a server.

2 options explained · 1 lesson

Decompresses a .gz, replacing the archive with the file. gunzip -c writes to standard output without touching the archive, which lets you read a rotated log without unpacking it to disk.

1 option explained · 1 lesson

Compresses a file, replacing it with its .gz version. gzip -k keeps the original; without it, it disappears, which surprises the first time on a log still open.

2 options explained · 2 lessons

Synchronises two trees by transferring only the differences, locally or over SSH. -a keeps permissions, dates and links; -n rehearses without writing, and that is where to start.

9 options explained · 6 lessons

Computes or checks a file's SHA-256 digest. sha256sum -c compares a download with the published digest — the only proof the file received is the one announced.

1 option explained · 1 lesson

Bundles a tree into one file, and unpacks it. Without --acls --xattrs it loses ACLs; without -p on extraction, permissions follow your umask rather than the archive.

10 options explained · 2 lessons

Encrypts, signs and verifies files with public keys. Here it encrypts backups before they leave the machine and checks package signatures — two uses where the private key must be backed up elsewhere, or the encrypted backup is worth nothing.

19 options explained · 1 lesson

A terminal session that survives disconnection: what runs inside carries on when SSH drops, and is found again with tmux attach. For a long operation started by hand, it is the insurance that a network drop will not kill it.

4 options explained · 1 lesson

Builds and runs containers. docker ps, docker logs and docker exec are the troubleshooting trio; docker compose describes several containers in a file rather than in a two-hundred-character command line.

20 options explained · 7 lessons

Deletes an entire database. --if-exists avoids the error when it does not exist, which makes a script rerunnable — and also makes the command silent.

1 option explained · no lesson

MariaDB's interactive client, the counterpart of psql. mariadb -e runs a query from a script; SHOW DATABASES and SHOW GRANTS are the first two things to look at on an unfamiliar server.

1 option explained · 1 lesson

Exports a MariaDB database as SQL. --single-transaction gets a consistent copy of InnoDB tables without locking them, which a backup on a live service requires.

5 options explained · 1 lesson

Exports one database as SQL or in archive format, consistently, without stopping the service. It is the logical backup; until a restore has been tried, it is only a file.

2 options explained · 2 lessons

Exports every database and what pg_dump leaves out: the roles and their passwords. pg_dumpall --globals-only beside one pg_dump per database is the combination that really restores.

1 option explained · 1 lesson

Says whether a PostgreSQL server accepts connections, through an exit status. The readiness test of a deployment script or a healthcheck, with no password and no query.

1 option explained · no lesson

Restores a pg_dump -Fc archive, wholly or in part (-t one table). -l lists the archive's contents without restoring anything; that is where to start.

1 option explained · 1 lesson

PostgreSQL's interactive client. psql -c runs a query from a script; \l, \dt and \du answer the first three questions — which databases, which tables, which roles.

6 options explained · 12 lessons