Linux Commands cheat sheet

Linux commands are the small programs you run from a terminal to move around, find things, read and edit text, and look after a machine. The reference below is grouped by what you are trying to do, and the filter box searches all of it at once. Type port to see everything about ports, or macos to see where the Mac's versions differ.

Every command was run on Ubuntu 24.04 LTS, with GNU coreutils 9.4, grep 3.11, sed 4.9, findutils 4.9.0, tar 1.35, util-linux 2.39.3, procps-ng 4.0.4, iproute2 6.1.0, OpenSSH 9.6 and curl 8.5. The permission and user commands were also run on Debian 13, and the package rows say which distributions they were checked on. The shell language itself, meaning quoting, variables, loops and redirection, is on the Bash cheat sheet.

Reading ls -l and permission numbers

ls -l starts every line with ten characters. Take -rwxr-xr--:

Each of the three sets is one digit in a chmod number: read is 4, write is 2 and execute is 1, added together. So rwx is 7, r-x is 5, r-- is 4, and the line above is chmod 754.

On a folder, the letters mean something slightly different. r lets you list the names inside, w lets you create, rename and delete files in it, and x lets you go into it and reach the files at all. A folder with r but no x shows you names you cannot open. And deleting a file is controlled by the folder's w, not the file's own permissions, which is why /tmp sets the sticky bit.

Pipelines worth knowing

Most real jobs are two to five of these commands joined with |, each doing one small thing. How pipes and redirection work is on the Bash cheat sheet; these are the combinations that come up again and again, every one run on the versions above.

# The five IP addresses that sent the most requests (nginx or Apache access log)
awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -n 5
 
# How many responses of each status code
awk '{print $9}' access.log | sort | uniq -c
 
# Rename a function across a whole project, safely with spaces in file names
grep -rlZ 'old_name' src | xargs -0 sed -i 's/old_name/new_name/g'
 
# Stop whatever is listening on port 3000, and do nothing if nothing is
lsof -ti :3000 | xargs -r kill
 
# Compress logs older than a week
find /var/log/myapp -name '*.log' -mtime +7 -exec gzip {} +
 
# The ten biggest folders under /var, and the ten biggest files on this disk
sudo du -h -d 1 /var | sort -rh | head -n 10
sudo find / -xdev -type f -size +100M -exec du -h {} + 2>/dev/null | sort -rh | head -n 10
 
# Watch a log for errors as they happen
tail -F app.log | grep --line-buffered -i error

$ awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -n 5
      3 203.0.113.7
      2 198.51.100.2
      1 192.0.2.10

sort | uniq -c | sort -rn is the one to remember: sort so duplicates sit together, count each run, then sort the counts biggest first. GNU sort uses a merge sort, which is why it copes with files bigger than your memory. --line-buffered in the last one makes grep pass each match on straight away instead of saving them up. When the logic outgrows a one-liner, a short script in the Python cheat sheet is usually easier to read than a longer pipe. For data you want to query rather than scan, loading it into SQLite and using the SQL cheat sheet is often quicker than any of these.

SSH keys and a config file

Logging in with a key instead of a password is safer and saves typing. Three steps, on your own machine:

# 1. Make a key pair. Press Enter for the default location, then pick a passphrase.
ssh-keygen -t ed25519 -C "ada@laptop"
 
# 2. Copy the public half to the server. This is the last time it asks for the password.
ssh-copy-id -p 2222 ada@203.0.113.10
 
# 3. Log in with the key
ssh -p 2222 ada@203.0.113.10

Then give each server a short name in ~/.ssh/config, so every ssh, scp and rsync command can use it:

Host web1
    HostName 203.0.113.10
    User ada
    Port 2222
    IdentityFile ~/.ssh/id_ed25519
 
Host db1
    HostName 10.0.0.5
    User ada
    ProxyJump web1

ssh web1                              # logs in with the right user, port and key
scp report.pdf web1:/tmp/
rsync -avz site/ web1:/var/www/site/
ssh db1                               # goes through web1 to reach a private address

chmod 600 ~/.ssh/config if SSH complains about its permissions, and the same for the private key. SSH refuses a private key that other users can read, with a WARNING: UNPROTECTED PRIVATE KEY FILE! banner. The same key works for pushing to GitHub or GitLab over SSH; add the .pub file in their settings, and the Git cheat sheet takes it from there.

Linux and macOS: GNU and BSD tools

The commands on a Mac come from BSD, not GNU. They agree on the basics and differ at the edges. Alpine Linux, common in Docker images, uses BusyBox instead, which is smaller again: grep -P, find -printf, ps --sort and tar --zstd all fail there. apk add coreutils grep findutils procps tar installs the GNU versions.

If a script has to run on both, stick to the options in the portable rows, or install the GNU tools on the Mac with brew install coreutils gnu-sed grep findutils and call them as gsed, ggrep and gfind.

Gotchas

The mistakes almost everyone makes once. Each row was reproduced on the versions above.

Common questions