Linux Labs

A

aa-complain log only Security
aa-enforce block again Security
aa-status profiles and modes Security
acl Flexible rights beyond rwx — getfacl/setfacl, per-user and per-group grants. Users and permissions
add-apt-repository Installing, upgrading, and removing packages on Debian/Ubuntu; apt and dpkg. Packages
adduser interactive (Debian/Ubuntu) Users and permissions
alias create Basic commands
ambientcapabilities Unit settings that strip a service of root, system writes and new privileges; systemd-analyze security rates them. Security
anacron Running tasks on a schedule: crontab syntax, classic cron and modern systemd timers. Services and systemd
ansible reach all machines Automation
ansible-galaxy Configures servers over SSH: from an inventory and playbooks it brings machines to a described state, no agent needed. Automation
ansible-inventory groups and machines Automation
ansible-playbook run Automation
ansible-vault Configures servers over SSH: from an inventory and playbooks it brings machines to a described state, no agent needed. Automation
apparmor Mandatory access control on Ubuntu — service profiles, enforce/complain modes. Security
apropos How to quickly find a command's options: man, --help, apropos and tldr; how to read a man page. Basic commands
apt refresh the index, then install upgrades Packages
apt-cache package versions and which repo they come from Packages
apt-daily-upgrade Ubuntu's service that installs updates from allowed origins once a day on an apt timer; by default only security ones. Security
apt-get Installing, upgrading, and removing packages on Debian/Ubuntu; apt and dpkg. Packages
at in 30 minutes Basic commands
atq show the job queue Basic commands
atrm remove job #5 Basic commands
auditctl watch a file Security
auditd Kernel-level auditing — who did what and when; watch rules and event search. Security
aureport Kernel-level auditing — who did what and when; watch rules and event search. Security
ausearch by key, readable Security
awk the first field of every line Text and search

B

basename c.txt Files and directories
bash shell version Basic commands
batch Run a command once at a given time — unlike cron's recurring schedule. Basic commands
bg resume job 1 in the background Processes
bind9 Running your own DNS — zones, records, config checks, resolving debug. Services and systemd
blkid every device with a filesystem Storage and file systems
bond Logical networks over a cable and combining NICs into one interface; the bond mode must match the switch's config. Network
bonding Logical networks over a cable and combining NICs into one interface; the bond mode must match the switch's config. Network

C

cap_net_bind_service Parts of root's rights: a process or a file gets only the one it needs, e.g. CAP_NET_BIND_SERVICE for a low port. Security
capability Parts of root's rights: a process or a file gets only the one it needs, e.g. CAP_NET_BIND_SERVICE for a low port. Security
capabilityboundingset Unit settings that strip a service of root, system writes and new privileges; systemd-analyze security rates them. Security
capsh mask → names Security
cat print a file Text and search
cd go into a directory Basic commands
certbot A TLS certificate binds a server key to a site name; openssl reads its fields, checks the chain and issues a new one. Security
cgroup Isolation (namespaces) and resource limits (cgroups) — the foundation of containers and systemd. Processes
cgroups Isolation (namespaces) and resource limits (cgroups) — the foundation of containers and systemd. Processes
chage inspect your training account Users and permissions
chdir Moving around the filesystem: cd, cd -, cd ~, cd .., pushd/popd, CDPATH. Basic commands
chgrp change only the group Users and permissions
chmod rw-r--r-- Users and permissions
choom score and adjustment of a process Processes
chown owner and group Users and permissions
chpasswd The passwd command changes your own password; as root it sets, locks and shows the passwords of other users. Users and permissions
chronyc is the clock in sync, and how close Services and systemd
chronyd An NTP client and server: keeps the system clock in step with time servers and can serve time to your machines. Services and systemd
cifs An SMB server for Windows-compatible shares; the SMB password is separate from the system one, easy to forget to set. Services and systemd
clear Navigation and files — ls, cd, cp, mv, rm, cat, less, head, tail, terminal copy-paste. Files and directories
cmp Comparing files and applying patches: diff two configs, see what changed, apply a patch. Text and search
colordiff Comparing files and applying patches: diff two configs, see what changed, apply a patch. Text and search
column align into a table Text and search
comm the intersection of two files Text and search
command a path or nothing (for scripts) Basic commands
compose docker compose describes a container stack with network, volumes and variables in compose.yaml and starts it at once. Containers
compose.yaml docker compose describes a container stack with network, volumes and variables in compose.yaml and starts it at once. Containers
conntrack connections Network
cp a copy next to it, another name Files and directories
createdb PostgreSQL is a relational DBMS: roles and databases, pg_hba.conf access rules, pg_dump dumps and pg_restore restores. Services and systemd
cron Running tasks on a schedule: crontab syntax, classic cron and modern systemd timers. Services and systemd
crontab edit your own crontab Services and systemd
curl code, headers, body Network
cut first field, ":" delimiter Text and search

D

date 2026-06-30 (=%Y-%m-%d) Basic commands
declare A script is a text file of shell commands: the #! line picks the interpreter, arguments arrive in $1, $2 and "$@". Basic commands
default.target A target is a group of units systemd brings the boot up to; rescue and emergency are the targets for repairs. Boot
depmod Kernel modules: loading and unloading with modprobe, kernel messages in dmesg, module parameters. Boot
df free space per partition Storage and file systems
dhcp Handing out addresses on a network — pool, reservations, leases, diagnostics. Services and systemd
dhcpd check the config Services and systemd
diff readable differences Text and search
dig a quick answer (IP only) Network
dir The ls command lists files and directories with permissions, owner, size and modification time, hidden ones too. Files and directories
dirname /a/b Files and directories
disown Running things in the background, shell job control, surviving logout. Processes
dmesg latest messages, with time Boot
docker background Containers
docker-build A Dockerfile is an image recipe: base, files, build and start commands; docker build turns it into an image. Containers
docker-compose docker compose describes a container stack with network, volumes and variables in compose.yaml and starts it at once. Containers
docker-compose.yml docker compose describes a container stack with network, volumes and variables in compose.yaml and starts it at once. Containers
docker-history An image is a read-only stack of layers with files and run settings; Docker creates containers from it. Containers
docker-image An image is a read-only stack of layers with files and run settings; Docker creates containers from it. Containers
docker-images An image is a read-only stack of layers with files and run settings; Docker creates containers from it. Containers
docker-inspect Docker runs programs in isolated containers started from images and manages their ports, volumes and networks. Containers
docker-load An image is a read-only stack of layers with files and run settings; Docker creates containers from it. Containers
docker-network Docker runs programs in isolated containers started from images and manages their ports, volumes and networks. Containers
docker-rmi An image is a read-only stack of layers with files and run settings; Docker creates containers from it. Containers
docker-save An image is a read-only stack of layers with files and run settings; Docker creates containers from it. Containers
dockerd Docker runs programs in isolated containers started from images and manages their ports, volumes and networks. Containers
dockerfile A Dockerfile is an image recipe: base, files, build and start commands; docker build turns it into an image. Containers
dockerignore A Dockerfile is an image recipe: base, files, build and start commands; docker build turns it into an image. Containers
dpkg which files a package brought in Packages
du top directories (within one filesystem) Storage and file systems
dynamicuser Unit settings that strip a service of root, system writes and new privileges; systemd-analyze security rates them. Security

E

e2fsck Filesystems: creating one with mkfs, labels and UUIDs, fsck checks, choosing between ext4 and xfs. Storage and file systems
echo with variable expansion Basic commands
edquota interactively, in an editor Storage and file systems
emergency.target A target is a group of units systemd brings the boot up to; rescue and emergency are the targets for repairs. Boot
env all environment variables Basic commands
ethtool Speed/Duplex/Link Network
exit leave a script with code 1 Basic commands
export for the current session + children Basic commands
exportfs Network directories over NFS — exporting on the server, mounting on the client, permissions. Storage and file systems

F

faillock alice's failed logins Security
false 1 0 — code of every stage Basic commands
fdisk the disk's partition table Storage and file systems
fg bring job 1 to the foreground Processes
file type by content Files and directories
find exact name, search from /etc Files and directories
findfs The blkid command prints the UUID, label and type of the filesystem on a device — what goes into /etc/fstab. Storage and file systems
findmnt the mount tree Storage and file systems
firewall The Linux firewall: filtering traffic with simple ufw and low-level nftables, checking the rules. Security
flock busy — exit with code 1 Basic commands
fold Small pipeline utilities; uniq only removes adjacent duplicates, so it almost always needs sort before it. Text and search
free memory and swap; the reserve is available Processes
fsck Filesystems: creating one with mkfs, labels and UUIDs, fsck checks, choosing between ext4 and xfs. Storage and file systems
fuser lsof shows which process holds a file, a port, or a deleted file that is still open. Processes

G

gawk sed edits and deletes lines by pattern, awk splits lines into fields and computes over them, line by line. Text and search
getcap files with capabilities Security
getent how the system actually resolves it (for apps) Network
getfacl show ACL (+ in ls -l) Users and permissions
getopts A script is a text file of shell commands: the #! line picks the interpreter, arguments arrive in $1, $2 and "$@". Basic commands
getpcaps capabilities of a process by PID Security
git what changed, which branch Files and directories
glob Shell substitutions — * ? [] {} — and how they differ from regular expressions. Basic commands
globbing Shell substitutions — * ? [] {} — and how they differ from regular expressions. Basic commands
gpasswd The usermod command changes an existing account — groups, login shell, home directory, name and locking. Users and permissions
gpg encrypt symmetrically (with a passphrase) Security
gpg2 GnuPG: GPG keys, encrypting files, signing and verifying, symmetric mode with a passphrase. Security
grep case-insensitive Text and search
groupadd Linux accounts and groups; usermod -G without -a replaces all of a user's supplementary groups instead of adding one. Users and permissions
groups Linux accounts and groups; usermod -G without -a replaces all of a user's supplementary groups instead of adding one. Users and permissions
grub How Linux boots: firmware, the GRUB bootloader, the kernel, systemd targets and emergency mode. Boot
grub-install reinstall the bootloader Boot
grub-mkconfig How Linux boots: firmware, the GRUB bootloader, the kernel, systemd targets and emergency mode. Boot
gunzip Packs files into a compressed archive; an archive with no top directory dumps its files into the current directory. Files and directories
gzip Packs files into a compressed archive; an archive with no top directory dumps its files into the current directory. Files and directories

H

hardening Unit settings that strip a service of root, system writes and new privileges; systemd-analyze security rates them. Security
hash display remembered paths Text and search
head the first 10 lines Text and search
help help for a bash builtin Basic commands
history Navigation and files — ls, cd, cp, mv, rm, cat, less, head, tail, terminal copy-paste. Files and directories
host How a name becomes an IP — resolv.conf, systemd-resolved, /etc/hosts, dig. Network
hostname current name Basic commands
hostnamectl name + machine info Services and systemd
htop The top program refreshes the process list, CPU load, memory and load average every few seconds. Processes
hwclock Manages system time and NTP; set-time requires turning off set-ntp first, or the time reverts. Services and systemd

I

id uid/gid/groups Users and permissions
ifconfig Manage interfaces, addresses and routes (iproute2) — the replacement for ifconfig/route. Network
image-digest An image is a read-only stack of layers with files and run settings; Docker creates containers from it. Containers
info How to quickly find a command's options: man, --help, apropos and tldr; how to read a man page. Basic commands
insmod Kernel modules: loading and unloading with modprobe, kernel messages in dmesg, module parameters. Boot
ionice Viewing processes, signals and priorities; finding the processes that hog CPU or memory. Processes
iostat disks: tps, kB/s, await, aqu-sz, %util Processes
ip addresses, brief Network
iptables read the rules Security
iptables-restore The classic Linux firewall — chains, rules, NAT, and why nftables replaced it. Security
iptables-save The classic Linux firewall — chains, rules, NAT, and why nftables replaced it. Security
isc-dhcp-server Handing out addresses on a network — pool, reservations, leases, diagnostics. Services and systemd

J

jobs list background jobs + PID Processes
journalctl tail a service's logs Logs and audit
jq pretty-print Text and search

K

kill SIGTERM: ask it to exit Processes
killall The kill command sends a signal to a PID — ask it to exit (TERM), reload settings (HUP), or end it at once (KILL). Processes
kvm Virtual machines on Linux — managed with virsh, networks, storage, console. Services and systemd

L

last the last 20 logins Basic commands
less open a file; q to quit Text and search
libvirt Virtual machines on Linux — managed with virsh, networks, storage, console. Services and systemd
ll The ls command lists files and directories with permissions, owner, size and modification time, hidden ones too. Files and directories
ln symlink (order like cp) Files and directories
loadavg The average number of tasks running or waiting for a CPU (R) or for the kernel (D) over 1, 5 and 15 minutes. Processes
locale current settings Basic commands
locale-gen generate one Basic commands
localectl the systemd view Basic commands
logger write a test entry to syslog Logs and audit
losetup attach it: /dev/loop0 Storage and file systems
ls contents of the current directory Files and directories
lsblk tree: disks → partitions → LVM/RAID Storage and file systems
lslocks who holds which locks Basic commands
lsmod loaded modules Boot
lsof who's on this port Processes
ltrace strace shows the system calls of a program and their results: a file that did not open, a failed connect, a wait. Processes
lvcreate a snapshot Storage and file systems
lvextend extend the LV+fs onto all free space Storage and file systems
lvm LVM: physical volumes, volume groups and logical volumes (PV → VG → LV), extending and snapshots. Storage and file systems
lvresize LVM: physical volumes, volume groups and logical volumes (PV → VG → LV), extending and snapshots. Storage and file systems
lvs logical volumes Storage and file systems

M

mailq what's in the queue Services and systemd
man the full manual Basic commands
mc A two-panel file manager for the terminal: navigation, copying, an editor, SFTP. Basic commands
mcedit A two-panel file manager for the terminal: navigation, copying, an editor, SFTP. Basic commands
mcview A two-panel file manager for the terminal: navigation, copying, an editor, SFTP. Basic commands
md Creating directories: -p (with parents), -m (permissions right away), brace expansion, rmdir. Files and directories
mkdir a chain of directories Files and directories
mke2fs The mkfs command creates an empty ext4 or xfs filesystem on a partition; the old data on it becomes unreachable. Storage and file systems
mkfs the same through mkfs -t Storage and file systems
mkfs.ext4 ext4 on a partition Storage and file systems
mkfs.xfs xfs with a label Storage and file systems
mkswap How to read free: used and free memory, the page cache and available; swap, a swap file and vm.swappiness. Processes
modinfo info about a module Boot
modprobe load a module Boot
more The less pager shows a long file or command output screen by screen — scroll, search by word, follow the end. Text and search
mount apply fstab without a reboot (a check!) Storage and file systems
mpstat load of each CPU Processes
mtr path + loss (a report) Network
multi-user.target A target is a group of units systemd brings the boot up to; rescue and emergency are the targets for repairs. Boot
mv rename Files and directories

N

named Running your own DNS — zones, records, config checks, resolving debug. Services and systemd
named-checkconf check named.conf syntax Services and systemd
namei type, mode, owner of each part Users and permissions
namespaces Isolation (namespaces) and resource limits (cgroups) — the foundation of containers and systemd. Processes
nano open/create a file Basic commands
nc is the port open? (refused vs timed out) Network
ncat Checking whether ports are reachable, simple data transfer over TCP/UDP. Network
ncdu interactive overview Storage and file systems
needrestart who needs a restart Security
netcat Checking whether ports are reachable, simple data transfer over TCP/UDP. Network
netstat Shows who is listening on ports and which connections are open; a netstat replacement, faster with many connections. Network
network-online.target A target is a group of units systemd brings the boot up to; rescue and emergency are the targets for repairs. Boot
newgrp Linux accounts and groups; usermod -G without -a replaces all of a user's supplementary groups instead of adding one. Users and permissions
nfs Network directories over NFS — exporting on the server, mounting on the client, permissions. Storage and file systems
nft low level Security
nftables The Linux firewall: filtering traffic with simple ufw and low-level nftables, checking the rules. Security
nice Viewing processes, signals and priorities; finding the processes that hog CPU or memory. Processes
nl Small pipeline utilities; uniq only removes adjacent duplicates, so it almost always needs sort before it. Text and search
node_exporter Collecting metrics with a pull model — targets, PromQL, exporters, alerts. Services and systemd
nohup survive logout Processes
nologin A login-shell replacement that reports refusal and exits instead of opening an interactive shell. Users and permissions
nonewprivileges Unit settings that strip a service of root, system writes and new privileges; systemd-analyze security rates them. Security
nproc CPU count to compare with Processes
nsenter enter all namespaces of a process Processes
nslookup How a name becomes an IP — resolv.conf, systemd-resolved, /etc/hosts, dig. Network
ntp An NTP client and server: keeps the system clock in step with time servers and can serve time to your machines. Services and systemd

O

oom A kernel mechanism: when memory runs out on the machine or in a cgroup with a limit, it kills a process with SIGKILL. Processes
oom_score_adj A kernel mechanism: when memory runs out on the machine or in a cgroup with a limit, it kills a process with SIGKILL. Processes
oomkilled A kernel mechanism: when memory runs out on the machine or in a cgroup with a limit, it kills a process with SIGKILL. Processes
openssl names Security

P

pam-auth-update turn on pwquality Security
pam.d The module stack in /etc/pam.d decides whether to let a user in, which password to accept and when to lock them out. Security
pam_faillock The module stack in /etc/pam.d decides whether to let a user in, which password to accept and when to lock them out. Security
pam_pwquality The module stack in /etc/pam.d decides whether to let a user in, which password to accept and when to lock them out. Security
parted the same with parted Storage and file systems
partprobe kernel re-reads the table Storage and file systems
passwd change your own password Users and permissions
paste Small pipeline utilities; uniq only removes adjacent duplicates, so it almost always needs sort before it. Text and search
patch apply the patch Text and search
path Environment variables: env, export, $PATH, ~/.bashrc and profiles; where "command not found" comes from. Basic commands
permissions The Unix permission model — read/write/execute, owner/group/other, special bits. Users and permissions
pg_dump PostgreSQL is a relational DBMS: roles and databases, pg_hba.conf access rules, pg_dump dumps and pg_restore restores. Services and systemd
pg_lsclusters version, port, status Services and systemd
pg_restore PostgreSQL is a relational DBMS: roles and databases, pg_hba.conf access rules, pg_dump dumps and pg_restore restores. Services and systemd
pgrep PIDs of processes with nginx in the name Processes
pidof PIDs by exact program name Processes
pidstat who reads and writes, full command Processes
ping three requests and a summary; else Ctrl+C Network
ping6 The ping command sends ICMP echo requests to a host and prints replies, latency and loss — the first network check. Network
pkill by a command-line pattern Processes
popd go back to the previous one from the stack Basic commands
port-scan A port scanner: shows which ports of a machine are open, closed or filtered, as another machine sees them. Network
postconf the effective config Services and systemd
postfix Sending and receiving mail — config, the queue, logs, typical delivery debugging. Services and systemd
postgres PostgreSQL is a relational DBMS: roles and databases, pg_hba.conf access rules, pg_dump dumps and pg_restore restores. Services and systemd
postgresql PostgreSQL is a relational DBMS: roles and databases, pg_hba.conf access rules, pg_dump dumps and pg_restore restores. Services and systemd
postqueue force the queue to flush Services and systemd
printenv a single variable Basic commands
printf a reliable way to print a string Basic commands
prlimit change on the fly Processes
proc /proc is a filesystem where the kernel shows processes (/proc/<pid>) and its own state: memory, load, parameters. Processes
procfs /proc is a filesystem where the kernel shows processes (/proc/<pid>) and its own state: memory, load, parameters. Processes
prometheus Collecting metrics with a pull model — targets, PromQL, exporters, alerts. Services and systemd
promtool check the config Services and systemd
protectsystem Unit settings that strip a service of root, system writes and new privileges; systemd-analyze security rates them. Security
ps processes of this terminal Processes
psql TCP login with a password Services and systemd
pushd go there, remembering the old directory on a stack Basic commands
pvcreate LVM: physical volumes, volume groups and logical volumes (PV → VG → LV), extending and snapshots. Storage and file systems
pvs physical volumes Storage and file systems
pwd current path Basic commands
pwquality The module stack in /etc/pam.d decides whether to let a user in, which password to accept and when to lock them out. Security
pwscore The module stack in /etc/pam.d decides whether to let a user in, which password to accept and when to lock them out. Security

Q

qemu-img an overlay Storage and file systems
quota a user's quota and usage Storage and file systems

R

read A script is a text file of shell commands: the #! line picks the interpreter, arguments arrive in $1, $2 and "$@". Basic commands
readlink the real path Files and directories
realpath an absolute path Files and directories
reboot-required Ubuntu's service that installs updates from allowed origins once a day on an apt timer; by default only security ones. Security
redis Cache, queues, and sessions in RAM; KEYS * blocks the server on large databases — use --scan instead. Services and systemd
redis-cli check the server is alive (expect PONG) Services and systemd
redis-server Cache, queues, and sessions in RAM; KEYS * blocks the server on large databases — use --scan instead. Services and systemd
regex A regular expression is a pattern that many strings match; grep searches by it, sed replaces by it, awk selects lines. Text and search
regexp A regular expression is a pattern that many strings match; grep searches by it, sed replaces by it, awk selects lines. Text and search
renice a running process's priority Processes
repquota a report for the filesystem Storage and file systems
rescue.target A target is a group of units systemd brings the boot up to; rescue and emergency are the targets for repairs. Boot
resize2fs ext4: fill all free space in the volume Storage and file systems
resolvectl DNS servers and search domains Network
restic create the repository, once Files and directories
rm delete a file Files and directories
rmdir remove an empty one Files and directories
rmmod Kernel modules: loading and unloading with modprobe, kernel messages in dmesg, module parameters. Boot
rndc apply (or systemctl reload named) Services and systemd
route Manage interfaces, addresses and routes (iproute2) — the replacement for ifconfig/route. Network
rsync sync (changes only, with progress) Files and directories
rsyslog Writes text logs to /var/log and forwards them over the network; it does not rotate them itself, that's logrotate's job. Logs and audit
rwx The Unix permission model — read/write/execute, owner/group/other, special bits. Users and permissions

S

samba An SMB server for Windows-compatible shares; the SMB password is separate from the system one, easy to forget to set. Services and systemd
sar The order of checks for "the server is slow": CPU, memory, disk, kernel and network — what shows each resource. Processes
scp copy a file to the server Network
screen new named session Basic commands
sed preview the changed lines Text and search
setcap give a file Security
setfacl grant a user Users and permissions
setgid Special permission bits: setuid and setgid run a program as its owner; setgid and sticky shape shared directories. Users and permissions
setquota soft/hard limits on space Storage and file systems
setsid Running things in the background, shell job control, surviving logout. Processes
setuid Special permission bits: setuid and setgid run a program as its owner; setgid and sticky shape shared directories. Users and permissions
sfdisk fdisk and parted write a partition table (GPT or MBR) and partitions to a disk; parted -s runs without prompts. Storage and file systems
sftp A client for logging in and copying files over SSH; host aliases in ~/.ssh/config remove repeated connection parameters. Network
sgid Special permission bits: setuid and setgid run a program as its owner; setgid and sticky shape shared directories. Users and permissions
sh A script is a text file of shell commands: the #! line picks the interpreter, arguments arrive in $1, $2 and "$@". Basic commands
shellcheck check a script Basic commands
showmount Network directories over NFS — exporting on the server, mounting on the client, permissions. Storage and file systems
sleep pause for one second Processes
smb An SMB server for Windows-compatible shares; the SMB password is separate from the system one, easy to forget to set. Services and systemd
smbclient list shares Services and systemd
smbpasswd set an SMB password (separate from the system one!) Services and systemd
snap installed packages Packages
snapd Ubuntu's second package format with auto-update; snap revert rolls back to the previous version, kept by snap itself. Packages
sort alphabetical order Text and search
source reload without a new login Basic commands
ss listening ports + who Network
ssh connect Network
ssh-add load into the agent Network
ssh-agent Key pairs for passwordless login; sshd rejects ~/.ssh if it is writable by the group or by others. Network
ssh-copy-id install it on the server Network
ssh-keygen generate a pair Network
ssh-keyscan the host's public keys (to stdout) Network
sshd check config syntax Security
sshd_config The OpenSSH server; edit the config with a second session open — a mistake in PermitRootLogin locks you out immediately. Security
ssl A TLS certificate binds a server key to a site name; openssl reads its fields, checks the chain and issues a new one. Security
stat everything Files and directories
sticky Special permission bits: setuid and setgid run a program as its owner; setgid and sticky shape shared directories. Users and permissions
strace all calls of a command Processes
stress stress-ng puts load on the CPU, memory and disk for a set time — for experiments with load, OOM and disk I/O. Processes
stress-ng 2 processes load the CPU Processes
su Linux accounts and groups; usermod -G without -a replaces all of a user's supplementary groups instead of adding one. Users and permissions
sudo Grants temporary root rights via sudoers; edit the file only through visudo, or a mistake locks everyone out of sudo. Security
sudoers Grants temporary root rights via sudoers; edit the file only through visudo, or a mistake locks everyone out of sudo. Security
suid Special permission bits: setuid and setgid run a program as its owner; setgid and sticky shape shared directories. Users and permissions
swapfile How to read free: used and free memory, the page cache and available; swap, a swap file and vm.swappiness. Processes
swapoff How to read free: used and free memory, the page cache and available; swap, a swap file and vm.swappiness. Processes
swapon active swap; empty means no swap Processes
symlink Symlinks (ln -s) and hard links: how they differ, when to use which, common mistakes with relative paths. Files and directories
sysctl read a parameter Boot
syslog Writes text logs to /var/log and forwards them over the network; it does not rotate them itself, that's logrotate's job. Logs and audit
sysstat iostat shows disk load — requests, latency, %util; pidstat shows CPU, memory and disk usage per process. Processes
systemctl state, no pager Services and systemd
systemd-analyze how long the boot took Boot

T

tac lines in reverse order Text and search
tail the last 10 lines Text and search
tar create (gzip) Files and directories
tcpdump port 80, no resolving Network
tee Splits a stream: writes to a file AND shows it on screen; sudo tee to write into protected files. Text and search
test test and [ ] check a file, a string or a number and answer with a code: 0 is yes, 1 is no; [[ ]] is the bash version. Basic commands
timedatectl time, time zone, sync status Services and systemd
tldr examples, if available Basic commands
tls A TLS certificate binds a server key to a site name; openssl reads its fields, checks the chain and issues a new one. Security
tmux new named session Basic commands
top a live process list; q to quit Processes
touch create an empty file / update its time Files and directories
tr case conversion Text and search
tracepath A ladder of connectivity checks — from the gateway to DNS and the destination port. Network
traceroute trace over a TCP port (when ICMP is blocked) Network
trap A script is a text file of shell commands: the #! line picks the interpreter, arguments arrive in $1, $2 and "$@". Basic commands
tree Navigation and files — ls, cd, cp, mv, rm, cat, less, head, tail, terminal copy-paste. Files and directories
true An exit code is a number from 0 to 255 that a command reports: 0 means success, anything else a failure or a "no". Basic commands
tty Compare load average to the core count (nproc), not an absolute threshold — the three numbers mean nothing without it. Basic commands
tune2fs shrink the root reserve to 1% Storage and file systems
type alias/builtin/function/file — every match Basic commands

U

ufw SSH FIRST Security
ulimit all limits of the shell Processes
umask the current mask: 0002 or 0022 Users and permissions
umount Mounting filesystems: the mount command, persistent mounts in /etc/fstab, UUIDs and options. Storage and file systems
unalias remove Basic commands
uname kernel name Basic commands
unattended-upgrade what it would install Security
uniq The uniq command collapses adjacent identical lines and counts them with -c; sort almost always comes before it. Text and search
unlink The rm command deletes files and directories at once, with no trash; -i and -I ask first, -r removes a tree. Files and directories
unset Environment variables: env, export, $PATH, ~/.bashrc and profiles; where "command not found" comes from. Basic commands
unshare Isolation (namespaces) and resource limits (cgroups) — the foundation of containers and systemd. Processes
untar Packs files into a compressed archive; an archive with no top directory dumps its files into the current directory. Files and directories
update-ca-certificates trust the CA Security
update-grub after editing /etc/default/grub Boot
uptime uptime and load average Basic commands
useradd with a home directory and bash Users and permissions
userdel Linux accounts and groups; usermod -G without -a replaces all of a user's supplementary groups instead of adding one. Users and permissions
usermod add a user to a group, keep others Users and permissions
users Compare load average to the core count (nproc), not an absolute threshold — the three numbers mean nothing without it. Basic commands

V

vgcreate LVM: physical volumes, volume groups and logical volumes (PV → VG → LV), extending and snapshots. Storage and file systems
vgs volume groups Storage and file systems
vi The bare minimum for editing configs; Esc always returns to Normal mode, where letters are commands, not text. Basic commands
vim The bare minimum for editing configs; Esc always returns to Normal mode, where letters are commands, not text. Basic commands
virsh all VMs Services and systemd
virt-install Virtual machines on Linux — managed with virsh, networks, storage, console. Services and systemd
visudo the main /etc/sudoers Security
vlan Logical networks over a cable and combining NICs into one interface; the bond mode must match the switch's config. Network
vmstat queue, memory, swap, disk, CPU Processes

W

w who's on the system and what they're doing now Basic commands
wait wait for its result Processes
watch every second, highlight changes Basic commands
wc lines, words, bytes and the name Text and search
wg generate keys Security
wg-quick bring the tunnel up Security
wget download it Network
whatis How to quickly find a command's options: man, --help, apropos and tldr; how to read a man page. Basic commands
whereis binary + man page + sources Basic commands
which just the path to the file Basic commands
who who's logged in, in detail Basic commands
whoami effective user Basic commands
whois a domain (registrar, expiry, NS) Network
wildcard Shell substitutions — * ? [] {} — and how they differ from regular expressions. Basic commands
wireguard A fast VPN on a key pair instead of passwords; the private key in wg0.conf needs permissions, like an SSH key. Security

X

xargs Turns stdin lines into a command's arguments; without -0, file names with spaces and newlines break the parsing. Basic commands
xfs_growfs xfs: mountpoint, not the device! Storage and file systems
xfs_repair check xfs Storage and file systems