Linux commands

Command-first reference for the Linux shell (bash and zsh), for someone at a terminal who needs the exact command and flags: files, text, pipes, permissions, processes, networking, archives and packages, starting with a lookup table. Flags are the GNU versions on Ubuntu, Debian and Fedora; macOS ships BSD tools, and differences are noted where they bite. Administration in depth is in Linux sysadmin, SSH in SSH, keys & certificates.

Quick lookup

Shell basics

The shell reads what you type and runs it: bash on most Linux servers, zsh on macOS and many desktops. The terminal is the window the shell runs in.

alice@web1:~/src$ ls -la --color=auto /etc

-- ends the options, so rm -- -weird-name treats -weird-name as a file. Every command returns an exit status: 0 is success, anything else is failure; echo $? prints the last one. a && b runs b only if a succeeded, a || b only if it failed, a; b runs both.

Getting help

Tab completion

Press Tab to complete a command, path or option. Press it twice to list candidates (bash) or open a menu you can cycle through (zsh). Completion of subcommands and flags (git che, systemctl res then Tab) comes from the bash-completion package on bash; zsh needs autoload -Uz compinit && compinit in ~/.zshrc, which frameworks such as Oh My Zsh add for you.

Keyboard shortcuts

These are the default emacs-style bindings in bash and zsh.

History

bash keeps history in ~/.bash_history, written when the shell exits. With HISTCONTROL=ignoreboth (Ubuntu's default .bashrc), a command that starts with a space is not saved, which is handy for one-off secrets; zsh needs setopt HIST_IGNORE_SPACE.

Navigating and files

pwd                 # print working directory
cd /var/log         # absolute path: starts with /
cd src              # relative to where you are
cd ..               # up one level
cd                  # home (same as cd ~)
cd -                # back to the previous directory
pushd /etc; popd    # visit, then return

Path shortcuts: ~ home, . this directory, .. the parent, / the root of the filesystem.

Create, copy, move, delete

If dst is an existing directory, cp -r src dst and mv src dst put src inside it (dst/src).

Viewing files

less -R keeps colors, less -N numbers lines, less +F app.log starts in follow mode. man pages open in less, so the same keys work there.

Finding files

find walks a directory tree: find WHERE TESTS ACTION.

# stop a script early if a tool is missing
command -v jq >/dev/null || { echo "need jq" >&2; exit 1; }

Searching text

grep prints the lines that match a regular expression (regex), a pattern language.

Exit status: 0 found, 1 not found, 2 error.

grep -rniE 'timeout|refused' /var/log/nginx/
grep -rl 'TODO' src/ --include='*.ts'
grep -v '^#' app.conf | grep -v '^$'  # no comments/blanks
grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' access.log \
  | sort | uniq -c | sort -rn | head    # top IPs
ps aux | grep '[n]ginx'   # [n] keeps grep out of the result

ripgrep

ripgrep (rg) searches recursively by default, skips .gitignored, hidden and binary files, and is much faster on big trees.

Text processing

Small tools that each read lines on stdin and write lines on stdout, chained with |.

cut, sort, uniq, tr

# frequency count: the most common lines first
sort access.log | uniq -c | sort -rn | head

sed

sed (stream editor) applies edits to each line and prints the result.

awk

awk splits each line into fields: $1, $2 and so on, $NF is the last, $0 the whole line, and NR the line number. A program is pattern { action } pairs; END { … } runs after the last line.

xargs

xargs turns lines of input into arguments for another command, for tools that don't read stdin (rm, mv, chmod).

Without -0, xargs splits on spaces and treats quotes specially, so my file.txt becomes two arguments.

tee, paste, column, diff

jq

jq filters and reshapes JSON; install it with your package manager.

Pipes and redirection

Every process has three streams: stdin (0, input), stdout (1, output) and stderr (2, errors). By default all three are your terminal.

Redirections apply left to right: 2>&1 points stderr at wherever stdout points at that moment.

make > build.log 2>&1      # both streams into the file
make 2>&1 > build.log      # errors still on screen
# here-doc into a file
cat > app.ini <<'EOF'
[server]
port = 8080
EOF
diff <(ls dir1) <(ls dir2)   # compare two listings
echo 'vm.swappiness=10' \
  | sudo tee /etc/sysctl.d/99-swap.conf

Globbing and quoting

The shell expands globs (wildcards) into matching file names before the command runs; the command never sees the *.

ls *.log                 # every .log file here
cp config.yml{,.bak}     # cp config.yml config.yml.bak
mkdir -p app/{src,test,docs}
mv report.{txt,md}       # change the extension
echo file{1..3}.txt      # file1.txt file2.txt file3.txt

When nothing matches, bash passes the pattern through unchanged and zsh stops with no matches found. Quote patterns meant for the command, not the shell: find . -name '*.log', curl 'https://x.dev/?q=1'.

Quote every variable: rm "$f", not rm $f, or a name with a space becomes two arguments. Pass a script's arguments on with "$@". In interactive bash, ! inside double quotes triggers history expansion (echo "hi!there" fails); use single quotes.

f='my report.txt'
rm $f            # tries to delete "my" and "report.txt"
rm "$f"          # deletes "my report.txt"
echo '$HOME'     # prints $HOME
echo "$HOME"     # prints /home/alice
echo "today is $(date +%F)"

Variables and environment

echo "$PATH" | tr ':' '\n'          # one dir per line
export PATH="$HOME/.local/bin:$PATH"  # prepend a dir
hash -r      # bash: forget cached command locations

export EDITOR=vim
export PATH="$HOME/.local/bin:$PATH"
alias ll='ls -lah'
alias gs='git status'
mkcd() { mkdir -p "$1" && cd "$1"; }

Reload with source ~/.bashrc (or . ~/.zshrc), or open a new terminal. macOS has used zsh as the default shell since 10.15 Catalina. Change your login shell with chsh -s "$(command -v zsh)".

Permissions and ownership

Every file has an owner, a group and three sets of permissions.

-rwxr-x---  1 alice devs 4096 Nov 11 09:30 deploy.sh
│└┬┘└┬┘└┬┘    └─┬─┘ └┬─┘
│ │  │  │       │    └ group owner
│ │  │  │       └ user owner
│ │  │  └ others: everyone else
│ │  └ group: members of devs
│ └ user: alice
└ type: - file, d directory, l symlink

Three digits give user, group, others: 750 is rwxr-x---. On a directory, r lists names, w creates and deletes entries, and x lets you enter it.

Setuid, setgid and sticky bits, ACLs and sudo rules are in Linux sysadmin.

Processes and jobs

A process is a running program, numbered by a PID. A job is a process started from your current shell.

ps STAT column: R running, S sleeping, D waiting on I/O (unkillable until it returns), T stopped, Z zombie (exited, not yet collected by its parent).

The full signal table is in Linux sysadmin.

Closing a terminal or an SSH session sends SIGHUP to its jobs, which ends most programs. For long work over SSH, use tmux (or screen): the session keeps running after you disconnect.

Anything that must survive reboots belongs in systemd (Services and logs).

System info

The first minute on a slow machine (vmstat, iostat, sar) is in Linux sysadmin.

Networking

ss -p needs sudo to show processes owned by other users. dig comes from dnsutils (Debian/Ubuntu) or bind-utils (Fedora/RHEL).

curl and wget

Remote shells and copying

With rsync, src/ copies the contents of src and src copies the directory itself. Keys, ~/.ssh/config and tunnels are in SSH, keys & certificates.

Archives and compression

Packages

• RHEL's dnf4 spells the upgradable check dnf check-update, and versionlock needs its plugin.
• apt is meant for people; scripts should call apt-get, whose output is stable.
• On Arch, never refresh with pacman -Sy alone and then install: always upgrade with -Syu.
• Homebrew runs without sudo; desktop apps install with brew install --cask.

Repositories, pinning and reboot checks are in Linux sysadmin.

Services and logs

On systemd distros (all the common ones), long-running programs are units managed by systemctl, and their output goes to the journal, read with journalctl.

Writing unit files, timers and cron jobs is covered in Linux sysadmin and its journalctl and scheduling sections.

Users

Group changes apply at the next login (or newgrp docker in the current shell). The admin group is sudo on Debian and Ubuntu and wheel on Fedora and RHEL. More in Linux sysadmin.

References

• man7.org Linux man pages (opens in a new tab): current man pages for commands, system calls and file formats
• GNU Coreutils manual (opens in a new tab): ls, cp, sort, cut, tr, du and the rest
• Bash Reference Manual (opens in a new tab): expansion, quoting, redirection, history, startup files
• Zsh documentation (opens in a new tab): globbing, options, line editor
• GNU grep manual (opens in a new tab), GNU sed manual (opens in a new tab), GNU Awk User's Guide (opens in a new tab)
• GNU find manual (opens in a new tab) and find(1) (opens in a new tab): every test and action
• jq manual (opens in a new tab): filters, functions, string formats
• ripgrep user guide (opens in a new tab): flags, ignore rules, file types
• curl man page (opens in a new tab): every curl option
• GNU tar manual (opens in a new tab): options, compression, member names
• ip(8) (opens in a new tab) and ss(8) (opens in a new tab): iproute2 networking commands
• ArchWiki: pacman/Rosetta (opens in a new tab): the same package task across pacman, apt, dnf and zypper
• Homebrew documentation (opens in a new tab): formulae, casks, brew commands
• tmux: Getting Started (opens in a new tab): sessions, windows, panes, key bindings
• tldr pages (opens in a new tab): short, example-first help pages
• explainshell (opens in a new tab): paste a command line, see each part explained
• ShellCheck (opens in a new tab) and Bash Pitfalls (opens in a new tab): quoting and scripting mistakes