Basic Linux commands fall into groups: navigation (pwd, ls, cd), file work (cp, mv, rm, mkdir), permissions (chmod, chown), packages (apt), processes (ps, top, kill), search and text processing (find, grep, sed, awk), networking (ip, ss, curl) and services (systemctl, journalctl). Below are tables with commands and examples that cover most daily work in the terminal.
This Linux command cheat sheet is organized by tasks: find a file, install a package, kill a frozen process, pull a line out of a log, check a port. The commands are tested on Ubuntu and Debian; almost everything also works on other distributions, where the main difference is the package manager.
Help and hints
| Command | What it does |
|---|
man ls | full manual for a command; quit with q, search with /word |
ls --help | short summary of the flags |
type cd | what it is: a built-in command, an alias or a file |
which python3 | path to the executable file |
history | command history; !123 repeats command number 123 |
Ctrl+R | search the history |
Ctrl+C / Ctrl+D | interrupt a command / close the shell |
Navigating the file system
| Command | What it does |
|---|
pwd | current directory |
ls -la | all files, including hidden ones, with permissions and sizes |
ls -lh | sizes in human-readable form (K, M, G) |
ls -lt | sort by modification time |
cd /var/log | go to an absolute path |
cd .. / cd ~ / cd - | one level up / home / previous directory |
tree -L 2 | directory tree, two levels deep (package tree) |
Working with files and directories
| Command | What it does |
|---|
touch file.txt | create an empty file or update its modification time |
mkdir -p a/b/c | create directories together with their parents |
cp file.txt backup.txt | copy a file |
cp -r src/ dst/ | copy a directory recursively |
mv old.txt new.txt | rename or move |
rm file.txt | delete a file (no trash bin) |
rm -r dir/ | delete a directory with its contents; -f — without prompts, be careful |
rmdir dir | delete an empty directory |
ln -s /opt/app/current app | symbolic link |
stat file.txt | details: size, permissions, inode, dates |
file image.bin | determine the file type from its content |
Viewing contents
| Command | What it does |
|---|
cat file | print the whole file |
less file | page-by-page view, search with /, quit with q |
head -n 20 file | first 20 lines |
tail -n 50 file | last 50 lines |
tail -f /var/log/syslog | follow a file in real time |
wc -l file | number of lines |
diff a.conf b.conf | differences between files |
Permissions and owners
| Command | What it does |
|---|
chmod +x script.sh | allow execution |
chmod 644 file | rw-r--r--: the owner writes, others read |
chmod 755 dir | rwxr-xr-x: typical for directories and scripts |
chmod 600 ~/.ssh/id_ed25519 | owner only: for private keys |
sudo chown www-data:www-data file | change owner and group |
sudo chown -R alice /srv/app | change owner recursively |
id | your UID, GID and groups |
sudo -i | root shell |
sudo usermod -aG docker alice | add a user to a group |
Packages (apt, Debian and Ubuntu)
| Command | What it does |
|---|
sudo apt update | refresh the package lists from the repositories |
sudo apt upgrade | upgrade installed packages |
sudo apt install nginx | install a package |
sudo apt remove nginx | remove, keeping configuration files; purge — together with configs |
sudo apt autoremove | remove unneeded dependencies |
apt search htop | search for a package |
apt show nginx | description and version |
dpkg -l | grep nginx | check whether a package is installed |
dpkg -L nginx | which files the package installed |
On RHEL, Fedora and Rocky Linux the equivalents are dnf install, dnf remove, dnf upgrade and rpm -qa.
Environment and profile
| Command | What it does |
|---|
echo $PATH | where the shell looks for programs |
env | all environment variables |
export APP_ENV=prod | set a variable for the current session and child processes |
alias ll='ls -la' | a shortcut for a command |
source ~/.bashrc | reload the profile without logging out |
crontab -e / crontab -l | edit / show cron jobs |
Processes
| Command | What it does |
|---|
ps aux | all processes with user, CPU and memory |
ps aux | grep nginx | find a process |
pgrep -a nginx | PID and command line by name |
top / htop | load in real time |
kill 1234 | ask a process to terminate (SIGTERM) |
kill -9 1234 | force-kill (SIGKILL) — last resort |
pkill -f "python app.py" | terminate by a match in the command line |
command &, jobs, fg | run in the background and manage jobs |
nohup ./job.sh & | the process survives closing the terminal |
free -h | memory and swap |
uptime | uptime and average load |
strace -p 1234 | system calls of a process |
Services and logs (systemd)
| Command | What it does |
|---|
systemctl status nginx | service state and the last lines of its log |
sudo systemctl start|stop|restart nginx | start, stop, restart |
sudo systemctl reload nginx | re-read the configuration without stopping |
sudo systemctl enable --now nginx | enable autostart and start now |
systemctl --failed | failed units |
journalctl -u nginx -f | service log in real time |
journalctl -u nginx --since "1 hour ago" | log for the last hour |
journalctl -p err -b | errors since the last boot |
Finding files
| Command | What it does |
|---|
find /var/log -name "*.log" | find by name |
find . -type f -mtime -1 | files changed in the last day |
find / -size +500M 2>/dev/null | large files, access errors hidden |
find . -name "*.tmp" -delete | find and delete |
du -sh * | size of each item in a directory |
df -h | free space on file systems |
Searching and processing text: grep, sed, awk, jq
| Command | What it does |
|---|
grep "error" app.log | lines containing the word |
grep -i -n "error" app.log | case-insensitive, with line numbers |
grep -r "listen" /etc/nginx/ | recursively through a directory |
grep -v "DEBUG" app.log | lines where the word is absent |
grep -c "500" access.log | number of matches |
grep -E "warn|error" app.log | extended regular expressions |
sed 's/old/new/g' file | replace and print the result |
sed -i 's/8080/9090/' app.conf | replace directly in the file |
sed -n '10,20p' file | print lines 10–20 |
awk '{print $1}' access.log | the first field of each line |
awk -F: '{print $1}' /etc/passwd | user names (separator :) |
awk '$9 == 500' access.log | lines where the ninth field equals 500 |
sort | uniq -c | sort -rn | count repeats and sort by frequency |
cut -d, -f2 data.csv | the second column of a CSV |
jq '.items[].name' data.json | extract fields from JSON |
Pipeline example: the ten IP addresses that sent the most requests to nginx.
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10
Redirection and pipelines
| Construct | What it does |
|---|
cmd > out.txt | write the output to a file (overwrite) |
cmd >> out.txt | append to the end of the file |
cmd 2> err.txt | redirect errors |
cmd > all.log 2>&1 | output and errors into one file |
cmd1 | cmd2 | pass the output of one command to the input of another |
cmd | tee out.txt | show on screen and save |
cmd1 && cmd2 | run the second only if the first succeeds |
cmd1 || cmd2 | run the second if the first fails |
Archives
| Command | What it does |
|---|
tar -czf backup.tar.gz dir/ | pack and compress with gzip |
tar -xzf backup.tar.gz | extract |
tar -tzf backup.tar.gz | list the contents |
zip -r site.zip site/ / unzip site.zip | zip archives |
Networking
| Command | What it does |
|---|
ip a | interfaces and IP addresses |
ip r | routing table |
ping -c 4 8.8.8.8 | host availability |
ss -tulpn | open ports and the processes using them |
dig example.com / nslookup example.com | DNS query |
curl -I https://example.com | response headers only |
curl -s https://api.example.com | jq | API request with pretty-printed JSON |
wget URL | download a file |
traceroute example.com | the path packets take to a host |
ssh user@host | connect to a server |
ssh-keygen -t ed25519 | create an SSH key pair |
scp file user@host:/tmp/ | copy a file to a server |
rsync -avz dir/ user@host:/srv/dir/ | synchronize a directory |
sudo ufw status | firewall rules |
System and disks
| Command | What it does |
|---|
uname -a | kernel and architecture |
cat /etc/os-release | distribution and version |
hostnamectl | host name and system information |
lsblk | disks and partitions |
sudo mount /dev/sdb1 /mnt | mount a partition |
who / w | who is logged in right now |
sudo reboot / sudo shutdown -h now | reboot / power off |
Summary
A couple of dozen commands cover everyday work: ls, cd, cp, mv, rm, chmod, sudo, apt, ps, kill, systemctl, journalctl, grep, find, ss, curl and ssh. Keep this Linux command cheat sheet at hand and check it until the commands become second nature. Every group of commands is covered step by step in our Linux course.
How do I exit man or less?
Press q. To search inside, type a slash and the word; n jumps to the next match.
How do I exit the vim editor?
Press Esc, then type :q! and Enter to quit without saving, or :wq to save and quit. Beginners may find nano easier for editing files.
Why is rm -rf dangerous?
The command deletes without confirmation and without a trash bin, and a mistake in the path (for example, an extra space before the asterisk) can wipe the wrong directory. Check the path with ls before running it.
How do I repeat the last command with sudo?
Type sudo !! — the shell substitutes the previous command in full.
How do I stop a frozen command in the terminal?
Ctrl+C sends an interrupt signal. If the command does not respond, find its PID with ps or pgrep in another terminal and end it with kill.