Linux commands cheat sheet: files, processes, networking and more

First published on the VMHeaven blog: Linux commands cheat sheet: files, processes, networking and more

Short answer: the tables below group the Linux commands a Linux VPS admin actually reaches for (files, processes, networking, permissions, packages), with the one-line version of what each does. Where a command has its own in-depth article, the text links to it.

Files and directories

Command	What it does
ls -la	List files, including hidden ones, with permissions and sizes
cd path	Change directory
pwd	Print the current directory
cp -r src dst	Copy, recursively for a directory
mv src dst	Move or rename
rm -rf path	Delete, recursively and without confirmation; there is no undo
mkdir -p a/b/c	Create a directory, and any missing parent directories
touch file	Create an empty file, or update its modified time
ln -s target link	Create a symbolic link
find /path -name '*.log'	Search for files by name, recursively
df -h	Disk space free, per mounted filesystem, in human-readable units
du -sh path	Total size of a directory

For finding what is filling a disk rather than just how full it is, see checking disk usage on Linux.

Permissions and ownership

Command	What it does
chmod 755 file	Set exact permissions by octal mode
chmod +x file	Add execute, leaving read/write as they were
chown user:group file	Change the owning user and group
ls -l file	Show a file's current mode and owner

Processes

Command	What it does
ps aux	List every running process
top / htop	Live, updating view of CPU and memory per process
kill PID	Ask a process to stop (SIGTERM)
kill -9 PID	Force-kill a process (SIGKILL, no cleanup)
pkill name	Kill by process name instead of PID
nohup cmd &	Run a command that survives the terminal closing

For anything that needs to keep running after you disconnect and that you want to come back to (not just survive, but reattach to), tmux does that better than nohup, which only keeps the process alive, not your terminal session with it.

Networking

Command	What it does
ip -4 addr show	Show IPv4 addresses on every interface
ip route	Show the routing table
ss -tlnp	List listening TCP ports and the process on each
ping host	Test reachability and round-trip time
curl -I url	Fetch just the HTTP headers of a URL
dig domain	Query DNS records for a domain
nc -zv host port	Test whether a single TCP port is open

More on ss, lsof and the other ways to check what is listening in checking open ports on Linux.

Setting an address so it stops changing on reboot is covered in static IP addresses, and clearing a stale DNS answer in flushing the DNS cache.

Services and logs (systemd)

Command	What it does
systemctl status name	Is a service running, and its recent log lines
systemctl restart name	Restart a service
systemctl enable name	Start a service automatically on boot
journalctl -u name -f	Follow a service's logs live
journalctl -xe	Jump to the end of the system log with extra context

Installing software

Distribution	Install	Update everything
Debian, Ubuntu	sudo apt install name	sudo apt update && sudo apt upgrade
RHEL, Rocky, Alma	sudo dnf install name	sudo dnf upgrade
Alpine	sudo apk add name	sudo apk update && sudo apk upgrade

A command not found right after installing often means the shell has not reloaded its command path yet (hash -r fixes that), or the package installs under a different binary name than expected.

Text processing

Command	What it does
cat file	Print a file's contents
less file	Page through a file (q to quit)
grep text file	Search for text inside a file
grep -r text dir	Search recursively through a directory
tail -f file	Follow a file as new lines are written to it
wc -l file	Count lines in a file
sed 's/old/new/g' file	Replace text (stream editor)

Archives and transfers

Command	What it does
tar -czvf out.tar.gz dir/	Create a compressed archive
tar -xzvf out.tar.gz	Extract one
scp file user@host:/path	Copy a file to a remote server over SSH
rsync -av src/ user@host:/path/	Sync a directory, only transferring what changed

More tar flags and what each one does in extracting tar.gz files on Linux.

The one command that stops everyone

Sooner or later something opens vim (a git commit, crontab -e, a minimal server image with no nano installed), and the hardest part is getting back out:

Esc then :wq saves and quits; :q! quits and discards changes. The full table of exit commands, and why vim gets stuck in the first place, is in how to exit vim.

SSH, the entry point to all of the above

Every command on this page assumes you can already get into the server. For the order to run these in on a brand-new server (create a user, lock down SSH, set up a firewall), see initial server setup.

Frequently asked

What is the most important Linux command for a beginner to learn first?

cd and ls (moving around and seeing what is there), followed by cat or less to read a file and sudo for anything that needs elevated permissions. Everything else builds on being able to navigate and read first.

How do I see what is using CPU or memory on a Linux server?

top or htop for a live, updating view; ps aux for a one-time snapshot. htop is easier to read but is not always preinstalled; apt install htop or dnf install htop adds it.

How do I find a file when I don't know which directory it's in?

find / -name 'filename' searches recursively from the root; locate filename is faster if the locate database is installed and up to date (updatedb refreshes it), but will not find anything created since the last update.

What is the difference between kill and kill -9?

kill PID sends SIGTERM, asking the process to shut down cleanly and save its state. kill -9 PID sends SIGKILL, which the process cannot ignore or clean up after; use it only once a plain kill has failed.