Linux Commands Cheat Sheet

Grouped by what you're actually doing — with the flags that matter, and the one that bites.

You don't need 400 commands. You need about fifty, and you need to know which flag turns each one from "prints something" into "does the thing you meant." Here they are by task.

Getting around

Command	What it does
pwd	Where am I
ls -lah	List everything — long, all (incl. hidden), human-readable sizes. The only `ls` you need.
cd -	Jump back to the previous directory. Underrated.
find . -name "*.log"	Find files by name from here down
which / command -v	Where does this binary live

Files

Command	What it does
cp -r src/ dst/	Copy a directory (recursive)
mv old new	Move or rename — same command
mkdir -p a/b/c	Make nested dirs, no error if they exist
ln -s target link	Symlink
rsync -av src/ dst/	Better copy — resumable, shows progress, works over SSH

The one that bites: rm -rf has no undo and no confirmation. Before you run it, run the same path with ls first. A space in the wrong place (rm -rf / home/user) has ended careers.

Reading files and logs

Command	What it does
less file	Page through. `/` to search, `q` to quit, `G` for end.
tail -f app.log	Follow a log live. The command you'll use most in an outage.
tail -n 100 file	Last 100 lines
grep -ri "error" .	Search recursively, case-insensitive
grep -C 3 "error" file	Show 3 lines of context around each hit — the flag that makes grep useful
journalctl -u nginx -f	Follow a systemd service's logs

Permissions

Command	What it does
chmod 644 file	Owner read/write, everyone else read — normal file
chmod 755 dir	Owner full, others read/execute — normal directory or script
chmod 600 ~/.ssh/id_rsa	Owner only. SSH refuses keys that are more open than this.
chown user:group file	Change ownership

The numbers are just read=4, write=2, execute=1, added together, for owner/group/other. 7 = all three, 6 = read+write, 5 = read+execute.

Processes

Command	What it does
ps aux \| grep nginx	Is it running, and as what PID
top	Live CPU/memory. `htop` if installed — much nicer.
kill PID	Ask a process to stop politely (SIGTERM)
kill -9 PID	Force it. Last resort — no cleanup, no saved state.
systemctl status\|restart svc	Check or bounce a service

Disk and memory

Command	What it does
df -h	Free space per filesystem. First thing to check when things break oddly.
du -sh *	What's eating the space in this directory
free -h	Memory in human units
lsblk	Disks and partitions

Troubleshooting tell: when a server starts behaving strangely for no clear reason, run df -h first. A full disk breaks logging, databases, and sessions in ways that look like ten unrelated bugs.

Network

Command	What it does
ip a	Interfaces and IP addresses (replaces `ifconfig`)
ss -tulpn	What's listening on what port, and which process. Replaces `netstat`.
ping -c 4 host	Basic reachability
dig name +short	DNS lookup, just the answer
curl -I url	Headers only — quick "is it up and what's it returning"
traceroute host	Where the path dies

Command	What it does
tar -czf out.tar.gz dir/	Create a gzipped archive
tar -xzf in.tar.gz	Extract one