Linux Commands Cheatsheet

Navigation & paths

Command	Description
pwd	Print working directory
cd ~ / cd	Home directory
cd -	Previous directory (OLDPWD)
cd ..	Parent directory
ls	List files
ls -la	All files, long format, human sizes often ls -lah
ls -lt	Sort by time, newest first
tree -L 2	Directory tree (install tree if missing)
realpath file	Canonical absolute path
basename /path/to/file.txt	Filename only
dirname /path/to/file.txt	Directory portion

File operations

Command	Description
touch file	Create empty file or update mtime
cp src dst	Copy file
cp -r src/ dst/	Copy directory recursively
cp -a src/ dst/	Archive mode: preserve perms, links, times
mv old new	Move or rename
rm file	Remove file
rm -r dir/	Remove directory
rm -rf dir/	Force recursive (dangerous)
ln -s target linkname	Symbolic link
ln target linkname	Hard link
mkdir -p a/b/c	Create parents as needed
rmdir dir	Remove empty directory
install -m 755 src dst	Copy with mode (common in scripts)

Viewing & editing

Command	Description
cat file	Print entire file
tac file	Print lines reversed order
less file	Pager (scroll, search with /)
head -n 20 file	First 20 lines
tail -f file	Follow log file live
tail -n 100 file	Last 100 lines
wc -l file	Line count
file /bin/sh	Guess file type
stat file	Inode metadata, timestamps
vim / nano	Editors

Find & locate

Command	Description
find . -name "*.log"	By name pattern
find /var -type f -mtime -1	Files modified in last day
find . -maxdepth 2 -type d	Directories, depth limit
find . -size +100M	Files larger than 100MB
find . -exec grep -l foo {} \;	Run command per file
find . -print0 | xargs -0 rm	Safe with spaces in names
locate passwd	Fast DB search (updatedb)
which python3	Executable on PATH
whereis ls	Binary, man, source

Permissions & ownership

Command	Description
chmod 755 script.sh	rwxr-xr-x
chmod u+x file	Add execute for owner
chmod -R g+w dir/	Recursive group write
chown user:group file	Change owner and group
chown -R www-data: dir/	Recursive
umask 022	Default file mode mask (shell)
getfacl file	POSIX ACLs
setfacl -m u:bob:rwx file	Set ACL entry
sudo chown root file	Elevated ownership change

Text processing

Command	Description
grep pattern file	Search lines
grep -r "term" .	Recursive
grep -n	Line numbers
grep -E	Extended regex
grep -i	Case insensitive
sed -n '5,10p' file	Print lines 5–10
sed -i 's/old/new/g' file	In-place replace (GNU sed)
awk '{print $1}' file	First column (whitespace)
awk -F: '{print $1}' /etc/passwd	Field separator
cut -d: -f1 /etc/passwd	Cut fields
sort file	Sort lines
sort -u	Unique lines
uniq	Adjacent duplicate collapse (often after sort)
sort | uniq -c | sort -rn	Count occurrences
tr 'a-z' 'A-Z'	Translate characters
paste f1 f2	Merge lines side by side
diff -u a b	Unified diff

Processes & jobs

Command	Description
ps aux	All processes (BSD style)
ps -ef	Full listing (POSIX)
pgrep -af nginx	Find PIDs by name
pkill nginx	Signal by name
kill PID	SIGTERM
kill -9 PID	SIGKILL (last resort)
kill -l	List signal names
top / htop	Interactive monitors
nice -n 10 cmd	Lower CPU priority
renice +5 -p PID	Change running process nice
jobs	Shell background jobs
fg / bg	Foreground / background
nohup cmd &	Survive terminal close
lsof -i :3000	Process using port
lsof -p PID	Open files for process

systemd & services

Command	Description
systemctl status nginx	Service status
systemctl start|stop|restart nginx	Control service
systemctl enable nginx	Start at boot
systemctl disable nginx	Disable at boot
systemctl daemon-reload	After unit file edits
journalctl -u nginx -f	Follow unit logs
journalctl --since "1 hour ago"	Time window
journalctl -b	Current boot only

Disk & filesystem

Command	Description
df -h	Filesystem space human-readable
df -i	Inode usage
du -sh dir/	Total size of directory
du -h --max-depth=1	Per-subdirectory sizes
lsblk	Block devices tree
mount	Show mounts
mount /dev/sdb1 /mnt	Mount device
umount /mnt	Unmount
fdisk -l	Partition tables (needs root)
blkid	UUID / type of block devs

Networking

Command	Description
ip addr	IP addresses (replaces ifconfig)
ip route	Routing table
ip link	Interfaces state
ss -tlnp	TCP listening + process
ss -tulpn	All listening UDP/TCP
netstat -tulpn	Legacy sockets listing
ping -c 4 host	ICMP echo
traceroute host	Path hops
mtr host	Combined ping/trace
dig +short A example.com	DNS lookup
nslookup host	DNS (simple)
curl -I URL	HTTP headers only
curl -v URL	Verbose
wget -O- URL	Download to stdout
nc -zv host 443	Port check (netcat)
tcpdump -i eth0 port 80	Packet capture (root)

Users & sudo

Command	Description
whoami	Current user
id	UID, GID, groups
su - user	Switch user (login shell)
sudo -i	Root login shell
sudo -u www-data cmd	Run as specific user
sudo -l	List allowed sudo commands
passwd	Change password
getent passwd user	Lookup user (NSS)
groups user	Group membership

Package managers

Command	Description
apt update && apt upgrade	Debian/Ubuntu refresh & upgrade
apt install pkg	Install
apt remove pkg	Remove
apt search term	Search packages
dpkg -l | grep foo	Installed .deb packages
yum install pkg / dnf install	RHEL/Fedora family
rpm -qa	List installed RPMs

Archives & compression

Command	Description
tar czf archive.tar.gz dir/	Create gzip tarball
tar xzf archive.tar.gz	Extract
tar cjf archive.tar.bz2 dir/	bzip2
zip -r out.zip dir/	Zip recursive
unzip file.zip	Extract zip
gzip -k file	Compress file (keep original with -k GNU)
zcat file.gz	Cat gzipped file

Environment & shell

Command	Description
echo $PATH	Show PATH
export VAR=value	Set env var (bash)
env	Print environment
printenv HOME	Single variable
source script.sh	Run in current shell
. script.sh	Same as source
history	Command history
alias ll='ls -la'	Shell alias
watch -n 2 'df -h'	Re-run every 2s

SSH & remote

# Connect
ssh user@host
ssh -i ~/.ssh/key.pem user@host

# Jump host (ProxyJump)
ssh -J bastion user@internal

# Copy file
scp file.txt user@host:/path/
rsync -avz ./local/ user@host:/remote/

# Local port forward (local 8080 → remote 3000)
ssh -L 8080:localhost:3000 user@host

# Remote forward (remote port → your local)
ssh -R 9090:localhost:9090 user@host

# Copy SSH key to server
ssh-copy-id user@host

# Disable strict host key check (avoid except debug)
ssh -o StrictHostKeyChecking=no user@host

Misc one-liners

Command	Description
curl ifconfig.me	Public IP (third-party service)
timeout 5 cmd	Kill command after 5s
xargs -n1	One argument per invocation
tee file	Write stdin to file and stdout
sudo !!	Re-run last command with sudo (bash)

Keyboard shortcuts (bash)

• Ctrl+A / Ctrl+E — start / end of line
• Ctrl+U / Ctrl+K — delete to start / end of line
• Ctrl+W — delete word backward
• Ctrl+R — reverse search history
• Ctrl+L — clear screen
• Ctrl+Z — suspend; bg / fg
• !! — repeat last command
• !$ — last argument of previous command
• !n — history event number n