A fast, scannable reference. For explanations and examples behind any of these, see the Linux Commands and Linux Fundamentals sections.
Navigation & Files
| Command | Description |
|---|
pwd | Print current directory |
cd - | Go to previous directory |
ls -la | List all files, long format, including hidden |
mkdir -p a/b/c | Create nested directories |
cp -a src/ dst/ | Copy recursively, preserving everything |
mv old new | Move / rename |
rm -rf dir/ | Remove recursively, forced — no undo |
find . -name "*.log" | Find files by name |
find . -mtime +7 -delete | Delete files older than 7 days |
du -sh dir/ | Total size of a directory |
df -hT | Disk usage by filesystem, with type |
ln -s target link | Create a symbolic link |
readlink -f link | Resolve a symlink’s real target |
basename /path/file.txt | file.txt |
dirname /path/file.txt | /path |
Permissions & Ownership
| Command | Description |
|---|
chmod 644 file | rw-r–r– (standard file) |
chmod 755 file | rwxr-xr-x (standard executable) |
chmod u+x file | Add execute for owner |
chmod -R 755 dir/ | Apply recursively |
chown user:group file | Change owner and group |
chgrp group file | Change group only |
umask | Show default permission mask |
chmod +t dir/ | Sticky bit (only owner can delete own files) |
chmod u+s file | setuid — run as file’s owner |
Users & Groups
| Command | Description |
|---|
id | Show UID, GID, groups |
whoami | Current username |
sudo useradd -m -s /bin/bash user | Create user with home dir |
sudo passwd user | Set/change password |
sudo userdel -r user | Delete user + home directory |
sudo usermod -aG group user | Add to a group (append!) |
groups user | List a user’s groups |
su - user | Full login shell as another user |
sudo -u user command | Run one command as another user |
visudo | Safely edit /etc/sudoers |
Processes & Jobs
| Command | Description |
|---|
ps aux | All processes, BSD-style |
ps -ef --forest | Process tree |
top / htop | Live process monitor |
kill 1234 | SIGTERM — graceful stop |
kill -9 1234 | SIGKILL — force stop, uncatchable |
pkill -f "pattern" | Kill by command-line match |
jobs | List background jobs |
fg %1 / bg %1 | Foreground / background a job |
nohup cmd & | Survive terminal logout |
nice -n 10 cmd | Start with lower priority |
renice -n 5 -p 1234 | Change priority of running process |
Disk & Storage
| Command | Description |
|---|
lsblk -f | Block devices + filesystems |
df -i | Inode usage (can block writes even with free space) |
mount /dev/sdb1 /mnt | Mount a device |
umount /mnt | Unmount |
mkfs.ext4 /dev/sdb1 | Format as ext4 |
lsof +L1 | Deleted files still held open (space not freed) |
free -h | RAM and swap usage |
swapon --show | Active swap devices |
Networking
| Command | Description |
|---|
ip a | Show interfaces + IPs |
ip route show | Routing table |
ss -tulnp | Listening ports + owning process |
dig +short example.com | DNS lookup, short output |
curl -I https://host | HTTP headers only |
curl -o /dev/null -s -w "%{http_code}\n" url | Just the status code |
nc -zv host port | Check if a TCP port is open |
traceroute host | Hop-by-hop path |
mtr host | Continuous traceroute + loss stats |
Text Processing
| Command | Description |
|---|
grep -i "text" file | Case-insensitive search |
grep -r "text" dir/ | Recursive search |
grep -v "text" file | Invert match (exclude) |
sed 's/old/new/g' file | Replace all occurrences (stdout) |
sed -i 's/old/new/g' file | Replace in place |
awk '{print $1}' file | Print first column |
awk -F: '{print $1}' file | Custom field separator |
sort | uniq -c | Count duplicate lines (needs sorted input) |
cut -d, -f1 file | Extract field by delimiter |
wc -l file | Count lines |
Package Management
| Command | Description |
|---|
sudo apt update && sudo apt upgrade | Debian/Ubuntu: refresh index + upgrade |
sudo apt install pkg | Install a package |
sudo dnf install pkg | RHEL/Fedora equivalent |
dpkg -L pkg | Files installed by a .deb package |
rpm -qa | grep pkg | Query installed RPM packages |
Archiving & Compression
| Command | Description |
|---|
tar -czvf archive.tar.gz dir/ | Create gzip-compressed archive |
tar -xzvf archive.tar.gz | Extract |
tar -tvf archive.tar | List contents without extracting |
rsync -avh src/ dst/ | Sync, preserving attributes |
rsync -avh --dry-run --delete src/ dst/ | Preview a mirror sync before running it |
systemd & Logs
| Command | Description |
|---|
systemctl status service | Current state + recent logs |
systemctl restart service | Restart |
systemctl enable --now service | Enable at boot + start now |
systemctl daemon-reload | Reload unit files after editing |
journalctl -u service -f | Follow a service’s logs live |
journalctl -b -1 | Logs from the previous boot |
systemd-analyze blame | Which services slow down boot |
Signals Quick Reference
| Signal | Number | Meaning |
|---|
| SIGHUP | 1 | Hangup / reload config |
| SIGINT | 2 | Ctrl+C |
| SIGTERM | 15 | Graceful stop (default kill) |
| SIGKILL | 9 | Force stop — cannot be caught |
File Permission Numbers
| Octal | Meaning |
|---|
644 | rw-r–r– — standard file |
755 | rwxr-xr-x — standard executable/directory |
600 | rw——- — private file (e.g. SSH keys) |
700 | rwx—— — private directory |
777 | rwxrwxrwx — full access, avoid in production |
Production Considerations
- This cheatsheet trades explanation for speed — if a command’s behavior isn’t obvious from its flags, check the corresponding Linux Commands article before running it against production.
- Anything marked destructive (
rm -rf, --delete) deserves a --dry-run/manual double-check pass in production, cheatsheet or not.
Quick Interview Answer
“A command cheatsheet is meant for fast recall under pressure — permission octals, signal numbers, and the handful of flags you use constantly (-la, -czvf, -tulnp) are worth memorizing outright, while anything unfamiliar is worth pausing on rather than pattern-matching from a sheet, especially for destructive operations.”