Linux commands cheat sheet for server admins, with real examples

Everything you do on a Linux server, from reading a simple log to rescuing a site whose disk has filled up, comes down in the end to a few commands in the terminal. This Linux commands cheat sheet groups about 40 everyday commands by the job you want to get done, with a one-line explanation and a real example for each, so you can use them on your own server today instead of just memorizing them. If you only need the short version, jump to the quick-reference table of 20 everyday commands near the end.

Before you start: how the terminal thinks

Almost every Linux command has the same structure: command [options] [target]. In ls -lh /var/log, for example, the command is ls, the option is -lh and the target is the /var/log folder. Three habits, picked up on day one, will make you several times faster:

• Press Tab. Type the first part of a file or folder name and press Tab to have it completed for you. It is faster, and it prevents typos.
• Press the up arrow. Your previous commands come back; history shows the whole list.
• Know the built-in help. man ls shows the full manual and ls --help a summary of the options. There is no need to memorize anything that is always one command away.

If you haven't connected to your server yet, read our guide to connecting over SSH first and then come back: every example in this article runs in that same terminal.

Moving around and working with files

This is the most heavily used group of Linux commands; you will reach for them dozens of times a day.

pwd, cd and ls: where am I, and what is here?

pwd shows the current path, cd moves you around and ls lists the contents:

cd /var/www        # go to a specific path
cd ..              # one folder up
cd ~               # the current user's home folder
ls -lh             # detailed list with human-readable sizes
ls -lah            # the same, plus hidden files (names starting with a dot)

In the output of ls -lh, the first column shows the permissions, the third and fourth the owner and group, and the fifth the size. We decode these columns a little further on, in the permissions section.

mkdir, cp and mv: create, copy, move

mkdir -p /var/www/site/logs   # create a folder, nested ones included
cp config.php config.php.bak  # copy (the best insurance before any edit!)
cp -r /var/www/site /root/    # copy a whole folder with its contents
mv old-name.txt new-name.txt  # rename
mv report.pdf /root/docs/     # move

rm: delete, with no recycle bin

There is no "Undo" on a Linux server: rm file.txt deletes a file and rm -r folder/ deletes a folder, permanently. The -f switch means "don't ask". Only type the combination rm -rf once you have read the path twice (we come back to it in the section on dangerous mistakes).

find: a needle in a haystack

find /var/www -name "*.log"            # every .log file
find /var/log -size +100M              # files larger than 100 MB
find /var/www -mtime -1                # changed in the last 24 hours

Viewing and editing files

cat, less, head and tail: reading without an editor

cat /etc/hostname              # print the whole file (for short files)
less /var/log/syslog           # page through a large file; q quits, / searches
head -n 20 access.log          # the first twenty lines
tail -n 50 error.log           # the last fifty lines

The star of this group is tail -f, which follows a file "live". Leave the site's error log open and you see each error at the very moment you refresh the page:

tail -f /var/log/nginx/error.log

nano: an editor that won't give you a hard time

nano /etc/nginx/nginx.conf opens the file; save with Ctrl+O and Enter, and exit with Ctrl+X. The vim editor is more powerful, but nano is all you need to start with, and you never get stuck inside it.

grep: search for text inside files

grep "error" /var/log/nginx/error.log      # lines that contain error
grep -i "timeout" error.log                # case-insensitive
grep -rn "db_password" /var/www/           # search a whole folder, with line numbers
grep -c "Failed password" /var/log/auth.log  # only count the matches

The last command counts failed login attempts on the server. Run it on a server you have only just received to see how quickly the bots find you, and then take our Linux server security checklist seriously.

Resources and processes: how is the server doing right now?

top and htop: the server's live dashboard

top shows the CPU and RAM usage of every process, live (press q to quit). Its friendlier cousin is htop, which you install with sudo apt install htop: it is in color, sorts with a click and draws a usage bar for each core.

ps and kill: find a process and stop it

ps aux | grep nginx    # every nginx process, with its ID (PID)
kill 1234              # politely ask process 1234 to exit
kill -9 1234           # force it to exit; only when a plain kill didn't work

free, df and du: RAM and disk in plain language

free -h
#                total   used   free   buff/cache   available
# Mem:           3.8Gi   1.2Gi  0.3Gi  2.3Gi        2.4Gi

The number that matters is in the available column, not free. Linux deliberately spends empty RAM on cache and hands it back as soon as a program needs it. A low free figure is nothing to worry about; a low available figure is.

df -h                      # free space on each partition
du -sh /var/www/*          # size of each folder; shows what filled the disk
du -sh /var/log/* | sort -h  # the same, sorted from smallest to largest

uptime: a one-line pulse check

uptime shows how long the server has been running and gives three load average figures. A rule of thumb: if the load is higher than the number of CPU cores, the server is under pressure.

Networking: from IP addresses to connection tests

ip a                       # IP addresses and network interface status
ping -c 4 mehranhost.cloud # reachability and latency test (4 packets, then stop)
ss -tlnp                   # which service is listening on which port?

The output of ss -tlnp answers the eternal question "why won't my site come up?". If Nginx is not in the list, it isn't running at all, and if another process has taken port 80, you will see that right here:

State   Local Address:Port   Process
LISTEN  0.0.0.0:22           users:(("sshd",pid=812,fd=3))
LISTEN  0.0.0.0:80           users:(("nginx",pid=1420,fd=6))

curl and wget: the terminal's browser

curl -I https://example.com    # response headers only: a 200? a redirect? which server?
wget https://example.com/backup.tar.gz   # download a file

curl -I is gold for troubleshooting. A 301 means a redirect; 502 Bad Gateway means the web server is up but PHP is not answering (we cover the full diagnosis in our guide to fixing a 502 error); and curl: (7) Failed to connect means nothing is listening on that port at all, or a firewall is blocking it.

scp and rsync: moving files between two machines

scp backup.tar.gz root@203.0.113.10:/root/       # a simple copy over SSH
rsync -avz --progress /var/www/ root@203.0.113.10:/var/www/

The key difference: scp always sends everything from scratch, while rsync transfers only what has changed, which makes it the clear winner for moving a site or for repeated backups. We walk through a complete rsync backup setup in our guide to backing up a Linux server.

Users and permissions

Creating a user, and sudo

adduser mehran             # create a new user (asks a few interactive questions)
usermod -aG sudo mehran    # grant sudo rights (on AlmaLinux: the wheel group)
passwd mehran              # change the password

sudo means "run this one command with administrator rights". Working day to day as a regular user plus sudo is far safer than working as root all the time: one typo as root can take down the whole server.

chmod and chown: who can do what

Every file has three permission levels (owner, group, others), and each level has three rights (read r=4, write w=2, execute x=1). Adding these numbers up gives you the familiar permission codes:

chmod 644 index.html   # owner: read+write, others: read only; the standard for web files
chmod 755 script.sh    # owner: everything, others: read+execute; the standard for folders and scripts
chmod 600 id_ed25519   # owner only; required for SSH keys
chown -R www-data:www-data /var/www/site   # change the owner of a whole folder

The infamous Permission denied error almost always comes back to these two commands: either the file's permissions are wrong, or its owner is not the user the program runs as (for example, the web server runs as www-data but the files belong to root).

Services and logs: systemctl and journalctl

Every piece of software that runs permanently on a server (the web server, the database, your bot) is a systemd "service", and you manage it with a pair of commands:

systemctl status nginx     # status: active or failed? plus the latest log lines
systemctl restart nginx    # restart
systemctl reload nginx     # reload the config without downtime
systemctl enable nginx     # start automatically after every reboot
systemctl disable --now apache2   # disable it and stop it right now

And to see that service's log:

journalctl -u nginx -n 50        # the last fifty lines of the service's log
journalctl -u nginx -f           # follow it live (like tail -f)
journalctl -u nginx --since "10 min ago"

Installing and updating packages

On Ubuntu and Debian you use apt; on AlmaLinux and Rocky, dnf:

# Ubuntu / Debian
apt update                 # refresh the package lists (always run this first!)
apt install htop           # install
apt upgrade                # upgrade every installed package
apt remove apache2         # remove

# AlmaLinux / Rocky
dnf install htop
dnf update

If you get E: Unable to locate package, it usually means you forgot apt update, or the package has a different name on that distribution. We explain the differences between the Debian and Red Hat families in the best operating system for a VPS.

Archiving and compression with tar

The standard format for moving folders around on Linux is tar.gz, and two commands are all you need:

tar czf site-backup.tar.gz /var/www/site    # create a compressed archive
tar xzf site-backup.tar.gz                  # extract into the current path
tar tzf site-backup.tar.gz | less           # just list the contents, without extracting

A trick to remember the letters: create to build an archive, extract to unpack one, z means gzip, and f means the file name comes next.

Power combos: pipes and redirection

This is where the real power of the Linux terminal lies: the output of any command can become the input of the next one.

• | (the pipe) hands the output to the next command: ps aux | grep php
• > writes the output to a file (wiping whatever was in it!): df -h > disk-report.txt
• >> appends to the end of a file: echo "test" >> notes.txt
• && runs the second command only if the first one succeeded: apt update && apt upgrade -y

A few combinations worth saving:

# the ten IPs with the most requests in the web server log
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10

# the biggest folders on the whole server
du -h / --max-depth=2 2>/dev/null | sort -rh | head -15

# only today's errors from one service
journalctl -u nginx --since today | grep -i error

Five dangerous mistakes that can wreck a server

1. rm -rf with the wrong path. The classic disaster: rm -rf /var/www /site (one stray space!) deletes all of /var/www and then goes after /site. Before any rm -rf, look at the same path with ls first.
2. chmod -R 777 to "fix" a permissions problem. It lets every user and every script write to everything: an open invitation to malware. Fix permission problems with the right chown and the standard 644/755 numbers.
3. Locking yourself out with the firewall. If you are logged in over SSH and writing firewall rules, first make sure the SSH port is allowed (ufw allow 22 before ufw enable). And if you do lock yourself out, the web console in the Mehran Host panel reaches the server from your browser and is always there as a way back in.
4. Editing a config without a backup copy. A cp nginx.conf nginx.conf.bak takes two seconds; bringing back a service that won't start because of a broken config takes two hours. Run the config test tools (such as nginx -t) before you restart, too.
5. Running unknown scripts as root. Use the curl … | bash pattern only with sources you fully trust. Download anything else first, read it with less, and only then run it.

Linux commands cheat sheet: 20 commands to know by heart

Next step

These commands are your toolbox; real skill comes from using them on a real project. Our suggestion: set up a website with Nginx (in those ten minutes you will use half the commands in this article), and right after that, put the ten server security steps in place. Don't have a server to practice on yet? Creating one takes less than a minute.

Frequently asked questions

Which Linux commands should I learn first?

Start with ten commands, ls, cd, cp, mv, rm, nano, tail, grep, df and systemctl: they cover a large share of day-to-day server administration, and the rest sink in through repetition. There is no need to memorize a long list: man shows the full manual for any command, and the --help switch prints a summary of its options right there in the terminal. The most effective way to learn is to do a real task, not to reread a list.

How different are Linux commands on Ubuntu and AlmaLinux?

About 95 percent of the basic commands are identical on both families, because both are built on the same GNU coreutils and the same systemd; ls, grep, tar, systemctl and journalctl work unchanged. The main difference is the package manager: apt on Ubuntu and Debian versus dnf on AlmaLinux and Rocky. A few other details differ too: on Red Hat-based systems the admin group is wheel, not sudo, the web server user is nginx, not www-data, and some package names are different.

What does a "Permission denied" error mean when I run a command?

It means the user running the command lacks the required rights on that file or path. There are three common causes: the command needs administrator rights and you left out sudo; the file belongs to another user, for example the site's files belong to root while the web server runs as its own user; or the script's execute bit is not set. Check the owner and permissions with ls -l, fix ownership with chown and use the standard 644 and 755. Never paper over it with chmod -R 777.

How do I stop a running command or get out of a terminal screen?

Press Ctrl+C to interrupt a running command; in most cases that is all you need. If you are stuck inside less, man or any other paged output, q gets you out, and q also quits top and htop. If you landed in the vim editor by accident, type :q! and press Enter to leave without saving; in nano it is Ctrl+X. If the whole SSH session has frozen and no key responds, press Enter and then ~. to close the connection itself.

How do I find out what is filling up my server's disk?

You find what is filling the disk with three commands, run in this order: df -h to see which partition is full, then du -sh /* and du -sh /var/* to drill down layer by layer to the folder at fault, and finally find /var/log -size +100M to hunt down oversized files. On most servers the culprit is logs; shrink the systemd journal with journalctl --vacuum-size=200M. If deleting a file frees no space, a process still holds it open, and restarting that service gets the space back.