Linux Commands
Linux commands are the 300-plus text-based instructions that let a practitioner manage a Linux system entirely from a terminal, covering file operations, process control, network diagnostics, and system configuration.
The set spans utilities from the core userland, tools that ship with the Linux Kernel, and packages layered on top, and a working command-line session on a Debian 12 or Ubuntu 22.04 box typically touches 40 to 60 distinct commands in the first year of daily use. This page organises those commands by category, adds a printable cheat sheet up front, and walks through the patterns that turn a memorised list into fluid muscle memory.
The cheat sheet below assumes a standard install: Bash as the shell, GNU coreutils, and the typical admin packages (curl, iptables, or nftables, and a package manager such as apt or dnf). Every entry is the bare command with its one-phrase purpose; the sections after the sheet explain the reasoning behind each group and the edge cases that trip up newcomers. For the deeper layer beneath these commands, the Linux Kernel exposes the syscalls that every tool ultimately wraps, so understanding which syscall a command calls clarifies why a flag exists. Tasks like Find Files on Linux or auditing Linux User Accounts map directly onto specific command families, and the same patterns apply when you run Linux for the LAMP stack and need to inspect Apache or MySQL processes from the shell.
Cheat Sheet: Commands by Category
The cheat sheet groups the 85 most frequently used commands into 7 categories. Print it, tape it beside your monitor, and drill one category per day until the muscle memory holds.
| Category | Command | Purpose |
|---|---|---|
| File navigation | cd, ls, pwd, mkdir, rm, cp, mv | Move through, create, copy, delete files and directories |
| File inspection | cat, head, tail, grep, wc, file | Read contents, filter lines, count words, identify file types |
| Process control | ps, top, htop, kill, killall, nohup | List, monitor, and terminate running processes |
| Permissions | chmod, chown, id, sudo | Change read/write/execute bits, ownership, and privilege escalation |
| Network | ifconfig, ip, ping, curl, netstat, ss | Configure interfaces, test reachability, inspect sockets |
| Package management | apt, dnf, pacman, dpkg, rpm | Install, update, remove software packages |
| System info | uname, df, du, free, uptime, whoami | Report kernel version, disk usage, memory, and active sessions |
Reading the Man Page and Getting Context
Reading the man page for any Linux command unlocks options that a cheat sheet cannot capture, because each utility documents 15 to 40 flags and their interaction rules. The man page lives at a predictable path, and the command man <command> opens it in the pager. To navigate inside the pager, press / and type a string to search, then n for the next match and q to quit. Three companion commands extend the same idea: info <command> opens the GNU info node, which supports hypertext cross-references; <command> --help prints a short summary without the pager; and apropos <keyword> searches the one-line descriptions across all man pages. For a sysadmin who works across RHEL, Debian, and Alpine, the man-pages package on each distro guarantees the same 1,200-plus pages are present.
File and Directory Commands in Practice
File and directory commands form the 12-command subset that a practitioner runs dozens of times a shift. The navigation trio is cd (change directory), ls (list contents), and pwd (print working directory). Modification commands split into create (mkdir with the -p flag to build nested paths in one call), copy (cp -r for recursive directory trees), move (mv, which renames when source and target share a filesystem), and delete (rm -rf, which the manual warns "will not ask for confirmation"). Inspection commands such as grep -r to search recursively, wc -l to count lines, and file to identify the binary type round out the set. A pattern that saves time: combine ls with a wildcard and sort, as in ls -la | sort -k5 -n, to list files by size in bytes. The same directory-walking logic underpins Find Files on Linux, where the find command with -name, -size, and -mtime predicates locates files that no GUI browser surfaces.
Process, User, and Permission Commands
Process, user, and permission commands let a Linux admin see what is running, who is logged in, and what each user may touch. The process trio is ps aux (list all processes with owner, CPU, and memory), top or htop (live, sortable process table), and kill -9 <PID> (force-terminate a stuck process). For user management, the commands useradd, usermod, userdel, and groupadd create and modify the entries in /etc/passwd and /etc/group, which is where Linux User Accounts are actually stored as UID, GID, shell, and home-path fields. Permission commands chmod (octal notation: 755 gives the owner read/write/execute and the group and others read/execute) and chown (change owner and group) control access at the filesystem level. A practical sequence for hardening a web server: run ps aux | grep apache to confirm the service runs as the www-data user, then chmod 640 /etc/apache2/apache2.conf so that only the root and apache groups can read the main config file.
Network and Diagnostic Commands
Network and diagnostic commands are the 8 tools a sysadmin reaches for the moment a service stops responding. Start with ping <host> to confirm reachability and measure round-trip time in milliseconds. The ip command (part of iproute2, which replaced ifconfig in most modern distros) shows interfaces with ip a, routes with ip r, and lets you add an address with ip addr add 192.168.1.5/24 dev eth0. For socket-level detail, ss -tulpn lists every listening TCP and UDP port with the owning process name and PID. curl -I <url> sends a single HTTP HEAD request and prints the status code and headers, which is enough to confirm whether Apache or Nginx is answering on port 80. When a LAMP deployment misbehaves, the chain is: ss -tlnp to verify MySQL listens on 127.0.0.1:3306, then curl -v http://localhost to see whether the web server proxies correctly, then tail -f /var/log/apache2/error.log to read the stack trace. The Linux for the LAMP stack context makes this diagnostic loop a daily routine for any web-facing sysadmin.
Package Management and System Updates
Package management and system update commands keep a Linux server current, patched, and free of orphaned dependencies. On Debian and Ubuntu, apt is the front-end: apt update refreshes the package index, apt upgrade applies security and feature patches to installed packages, and apt full-upgrade also removes packages that are no longer needed. The dpkg tool operates one layer below, on the .deb archive itself, and dpkg -l lists every installed package with its version string. On RHEL, CentOS, and Fedora, the equivalent chain is dnf update, dnf install <pkg>, and rpm -qa for a full inventory. Arch Linux uses pacman -Syu for a single-command full-system upgrade. A production discipline: schedule apt upgrade or dnf update on a Tuesday window, read the change log before rebooting, and keep a 7-day apt cache (the default in /var/cache/apt/archives) so that a rollback is one apt install --reinstall away.
Building a Personal Command Drillsheet
Building a personal command drillsheet turns a static cheat sheet into a living reference that matches the 5 to 8 servers a sysadmin actually manages. Start with the 20 commands you used in the last 30 days and write each one with the exact flags you use, not the man-page default. For example, if you always check disk with df -hT (human-readable sizes plus filesystem type), record that form, not bare df. Add a second column for the "why": df -hT catches a full /var partition that would otherwise fill /var/log and crash syslog. Review the drillsheet monthly, drop commands you no longer run, and add the 2 or 3 new tools the current incident taught you. The result is a one-page document that compresses the 85-command reference into the 25 commands that cover 90 percent of a working day.