Linux commands, explained

Print the directory your shell is currently using.

pwd

Relative paths start here.

Move into an example website directory.

cd /srv/www/example.com

Replace the path with an existing directory.

Return to the directory used before the last cd.

cd -

Requires a previous directory in this shell.

Check how the shell resolves the PHP command.

command -v php

A missing command returns a nonzero status.

Show matching aliases, functions and executables.

type -a ls

Useful when an alias changes command behavior.

Open the installed chmod documentation.

man chmod

Press q to exit; manuals match installed versions.

Read Bash help for its cd built-in.

help cd

Bash-specific; cd is not an external executable.

Display the status of the immediately preceding command.

printf "Exit status: %s\n" "$?"

Run immediately after the command you are checking.

List the last 25 Bash history entries.

history 25

History may contain secrets; do not publish it.

Show hidden entries, permissions, owners and sizes.

ls -lah -- /srv/www/example.com

The path must exist and be readable.

Create a project directory and missing parents.

mkdir -p -- ./project/config

Creates directories in your current location.

Create a file or update an existing file timestamp.

touch -- ./notes.txt

An existing file keeps its contents.

Copy a configuration, asking before an overwrite.

cp -i -- ./config.conf ./config.conf.backup

Use a private destination if the source contains secrets.

Preserve file attributes while copying a directory.

cp -a -i -- ./site ./site-backup

An existing destination changes where the copy lands; inspect it first.

Rename a file, asking before replacing a destination.

mv -i -- ./old-name.txt ./new-name.txt

Moves affect the original path.

Ask before permanently removing one named file.

rm -i -- ./unneeded-file.txt

Deletion has no automatic undo; verify the exact file.

Remove a directory only if it is empty.

rmdir -- ./empty-directory

Fails rather than deleting directory contents.

Print an absolute resolved path.

realpath -- ./config.conf

Symlinks can point somewhere other than expected.

Print the operating system release information.

cat -- /etc/os-release

Avoid dumping huge files or secrets to shared terminals.

Browse a log without printing it all at once.

less -- /var/log/nginx/access.log

Read permission required; q exits and / searches.

Print the first 30 lines of a text file.

head -n 30 -- ./config.conf

Replace the example filename.

Print the latest 50 log lines.

tail -n 50 -- /var/log/nginx/error.log

The path and log permissions vary by server.

Follow updates and retry if log rotation replaces the file.

tail -F -- /var/log/nginx/error.log

Press Ctrl+C to stop following.

Print text with line numbers, including blank lines.

nl -ba -- ./config.conf

Output is a display, not a file modification.

Count lines, words and bytes.

wc -l -w -c -- ./access.log

Byte count is not necessarily character count.

Show a unified text diff.

diff -u -- ./before.conf ./after.conf

Exit status 1 means differences, not an execution failure.

Inspect file signatures and report a likely type.

file -- ./download.bin

A type guess does not prove a file is safe.

Find matching filenames beneath the website parent.

find /srv/www -type f -name "wp-config.php" -print

Traversal requires permissions and may take time.

List directories named cache.

find ./project -type d -name "cache" -print

This only lists matches; it does not remove anything.

List files modified within roughly the last hour.

find ./project -type f -mmin -60 -print

Modification time is not a complete audit trail.

List files larger than 100 MiB within this filesystem.

find /var/log -xdev -type f -size +100M -print

Some log directories require additional read access.

Find a literal string and show matching line numbers.

grep -nF -- "DB_HOST" ./wp-config.php

Matching lines may contain credentials.

Search text configuration files recursively.

grep -RIn --include="*.conf" -- "server_name" ./config

Symlinks are followed by -R; limit the starting directory.

Match either error or warning.

grep -nE -- "error|warning" ./app.log

Patterns are case-sensitive unless -i is added.

Count lines containing an example status marker.

grep -cF -- " 404 " ./access.log

Confirm the actual log format before interpreting counts.

Count lines safely when filenames contain spaces.

find ./project -type f -name "*.txt" -print0 | xargs -0 -r wc -l --

GNU xargs -r skips execution when no files match.

Print lines in sorted order.

sort -- ./names.txt

Locale affects ordering; the source file is unchanged.

Count duplicates and put frequent values first.

sort -- ./names.txt | uniq -c | sort -nr

uniq needs equal lines grouped together.

Print fields one and three from simple delimiter-separated data.

cut -d "," -f 1,3 -- ./simple.csv

Not suitable for quoted CSV containing embedded commas.

Print lines 10 through 25.

sed -n "10,25p" ./config.conf

No in-place editing flag is used.

Print a replacement preview to standard output.

sed "s/old.example/new.example/g" ./config.conf

This example does not modify the source.

Add values in the first whitespace-separated column.

awk '{total += $1} END {print total}' ./numbers.txt

Assumes numeric input in column one.

Print a lowercase version of the input.

printf "%s\n" "Example" | tr "[:upper:]" "[:lower:]"

Text is piped directly; no file is written.

Parse and pretty-print JSON.

python3 -m json.tool ./data.json

Requires Python 3; avoid printing private JSON publicly.

Display matches and save them to a review file.

grep -nF -- "ERROR" ./app.log | tee ./errors-review.txt

tee overwrites its destination unless -a is used.

Show owner, permission bits, size and timestamps.

stat -- ./config.conf

Timestamps do not prove who changed a file.

Show permissions and owners along a path.

namei -l /srv/www/example.com/public/index.html

Requires namei, commonly supplied by util-linux.

Allow only the owner to read and write this file.

chmod 600 -- ./private.conf

Verify the service user can still access what it needs.

Add execute permission for the file owner.

chmod u+x -- ./maintenance.sh

Review script contents before executing it.

Change owner and group on one configuration file.

sudo chown deploy:www-data -- ./config.conf

Replace both accounts; do not assume these match your host.

Show the current shell file-creation mask.

umask

This affects new files, not existing permissions.

Restrict newly created files in the current shell.

umask 077

Some programs choose additional permissions explicitly.

Show extended access-control entries.

getfacl -- ./shared-directory

Requires the acl package; filesystem support varies.

Create a link to an example relative target.

ln -s -- ./releases/current ./current-release

Relative targets are resolved from the link location.

Print your effective username.

whoami

sudo can change the effective account.

Show your user ID and group memberships.

id

Useful when troubleshooting file access.

Show groups for an example account.

groups deploy

Replace deploy with a real account.

Read an account entry from configured identity sources.

getent passwd deploy

An empty result may mean the account does not exist.

List current login sessions.

who

Results depend on session accounting.

List commands your account is permitted to run through sudo.

sudo -l

May ask for your password.

Interactively create an Ubuntu/Debian user.

sudo adduser deploy

Review account policy and use a unique username.

Append one group without replacing other memberships.

sudo usermod -aG www-data deploy

New sessions may be needed; verify the group is appropriate.

Interactively change your account password.

passwd

Type passwords at the prompt, never as shell arguments.

Read the distribution name and release fields.

cat /etc/os-release

Distribution version differs from kernel version.

Show kernel and machine information.

uname -a

May expose host details in shared output.

Show hostname and system information on systemd hosts.

hostnamectl

Some containers do not run systemd.

Show uptime and recent system load averages.

uptime

Load includes runnable and certain blocked tasks.

Show memory and swap with readable units.

free -h

Available memory is more informative than unused memory alone.

Show CPU architecture and topology.

lscpu

Virtual machines may expose only virtual CPU details.

Show processing units available to the current process.

nproc

Container limits can differ from physical host capacity.

Print local time and UTC.

date --iso-8601=seconds
date -u --iso-8601=seconds

Both lines inspect time; neither changes the clock.

Inspect timezone and synchronization state.

timedatectl status

Requires a compatible systemd environment.

Watch process CPU and memory use.

top

Press q to exit; this monitor is interactive.

Show processes ranked by memory percentage.

ps aux --sort=-%mem | head -n 15

A snapshot does not measure sustained pressure.

Show processes ranked by reported CPU usage.

ps aux --sort=-%cpu | head -n 15

ps CPU values are not the same as an instant sampling monitor.

List process IDs and full commands matching Nginx.

pgrep -af nginx

Command lines can contain sensitive arguments.

Show parent and child processes with IDs.

pstree -p

May require the psmisc package.

Collect five samples at one-second intervals.

vmstat 1 5

The first row reports averages since boot.

Show extended device statistics over three reports.

iostat -xz 1 3

Requires sysstat; the initial report is since boot.

Inspect one example process before acting on it.

ps -p 12345 -o pid,ppid,user,stat,etime,args

Replace 12345 with a verified current process ID.

Ask a known process to terminate gracefully.

kill -TERM 12345

Recheck PID and ownership; prefer systemctl for managed services.

Show mounted filesystem types and space use.

df -hT

Filesystem space and directory totals measure different things.

Show inode use on mounted filesystems.

df -i

A filesystem can run out of inodes before bytes.

Estimate disk use beneath one directory.

du -sh -- /srv/www/example.com

Traversal may be slow and permissions may hide files.

Compare immediate subdirectories without crossing filesystems.

du -xhd1 -- /var | sort -h

GNU du options; unreadable directories produce errors.

List block devices and mount locations.

lsblk -o NAME,SIZE,FSTYPE,MOUNTPOINTS

Read-only inventory; it does not mount or format devices.

Show mounted filesystems as a tree.

findmnt

Available fields vary by util-linux version.

Find the filesystem covering a directory.

findmnt -T /srv/www

Useful before assuming which device is full.

List open files whose directory links were removed.

sudo lsof +L1

Requires lsof; do not restart services without assessing impact.

Inspect filesystem UUIDs and type signatures.

sudo blkid

Read-only probing may require administrator access.

List the archive members without extracting them.

tar -tzf ./site-backup.tar.gz

Inspect unexpected paths before extracting untrusted archives.

Archive an example website directory.

tar -czf ./site-backup.tar.gz -C /srv/www example.com

Writes an archive; coordinate consistency for live data.

Extract into a review directory without restoring original ownership.

mkdir -p ./restore-review && tar -xzf ./site-backup.tar.gz -C ./restore-review --no-same-owner

Use only a trusted archive; extraction can overwrite files.

Inspect names and sizes in a ZIP file.

unzip -l ./plugin.zip

Requires unzip; listing does not prove the archive is safe.

Extract into a review directory, preserving existing files.

unzip -n ./plugin.zip -d ./plugin-review

Review names and trust the source before extraction.

Package a project directory as ZIP.

zip -r ./project.zip ./project

Requires zip; avoid accidentally including credentials.

Calculate the file checksum.

sha256sum -- ./download.tar.gz

Compare against a trusted independent published digest.

Check files against a trusted digest list.

sha256sum -c ./SHA256SUMS

The checksum list itself must be authentic.

Check gzip stream integrity without extraction.

gzip -t ./site-backup.tar.gz

This does not validate the backup contents or application consistency.

Dry-run a directory-content synchronization.

rsync -avhn -- ./site/ ./backup/

The trailing slash copies contents rather than the directory itself.

Copy local contents and preserve supported archive attributes.

rsync -avh -- ./site/ ./backup/

Can replace destination files; review a dry run first.

Preview an upload over SSH.

rsync -avhn -e "ssh -p 22" -- ./site/ deploy@example.com:/srv/www/example.com/

Replace the host, user, port and path; requires remote rsync.

Upload a site directory over SSH.

rsync -avh -e "ssh -p 22" -- ./site/ deploy@example.com:/srv/www/example.com/

Can overwrite remote files; verify host identity and preview first.

Copy a local file to an example remote location.

scp -P 22 ./config.conf deploy@example.com:/srv/config-review.conf

May overwrite a remote file; confirm destination and permissions.

Copy a remote report to your machine.

scp -P 22 deploy@example.com:/srv/report.txt ./report.txt

May overwrite the local destination; verify the source host.

Open an encrypted file-transfer session.

sftp -P 22 deploy@example.com

Commands such as put and rm inside the session change files.

Compare contents by checksum during a dry run.

rsync -avhnc -- ./site/ ./backup/

Reads file contents on both sides and can be slower.

Show network interfaces and IP addresses concisely.

ip -br address

Requires the iproute2 utilities.

Show IPv4 routes and the default gateway.

ip route show

Use ip -6 route show for IPv6 routes.

Ask the kernel which route it would use.

ip route get 1.1.1.1

A route lookup does not prove end-to-end connectivity.

Show listening sockets and available process information.

sudo ss -lntup

Administrator access exposes other users’ process details.

List established TCP sockets numerically.

ss -tn state established

Connection lists can contain private peer addresses.

Show aggregate socket statistics.

ss -s

Counts are a snapshot, not a traffic history.

Send four ICMP echo requests.

ping -c 4 example.com

ICMP may be filtered even when a website works.

Estimate the route and path MTU.

tracepath example.com

Requires tracepath; devices may suppress replies.

Show per-interface packet and error counters.

ip -s link show

Counters need interval comparisons to diagnose a trend.

Query IPv4 address records using the configured resolver.

dig +short example.com A

Requires dnsutils on Ubuntu.

Inspect mail-exchanger answers and DNS response metadata.

dig example.com MX

A DNS answer is not a mail delivery test.

Read public TXT records such as SPF and verification tokens.

dig example.com TXT

Large answers may include unrelated TXT values.

List nameserver answers.

dig +short example.com NS

Cached responses can differ during a DNS change.

Ask a specific resolver for IPv6 address records.

dig @1.1.1.1 example.com AAAA

This sends the queried name to that resolver.

Inspect systemd-resolved links and DNS settings.

resolvectl status

Applies only when systemd-resolved is in use.

Issue a bounded HEAD request and show headers.

curl -sS -I --connect-timeout 5 --max-time 15 https://example.com/

HEAD behavior can differ from GET responses.

Follow up to five redirects while inspecting headers.

curl -sS -I -L --max-redirs 5 --connect-timeout 5 --max-time 20 https://example.com/

Review redirect targets; this sends requests to them.

Inspect a TLS handshake with hostname verification.

timeout 15s openssl s_client -connect example.com:443 -servername example.com -verify_hostname example.com -verify_return_error </dev/null

Requires GNU timeout, OpenSSL and a configured trust store; not a full TLS audit.

Open a remote shell as an example account.

ssh -p 22 deploy@example.com

Verify the fingerprint through a trusted channel before accepting it.

Connect using a specific existing key.

ssh -i ~/.ssh/id_ed25519 -p 22 deploy@example.com

Never upload or disclose the private key.

Generate a separate SSH keypair interactively.

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_example -C "example-server"

Choose a passphrase and do not overwrite an existing key.

Show the fingerprint of a public key.

ssh-keygen -lf ~/.ssh/id_ed25519_example.pub

A public fingerprint is not the private key.

Append your public key to a remote account.

ssh-copy-id -i ~/.ssh/id_ed25519_example.pub deploy@example.com

Verify the remote host first; requires an existing access method.

Connect with verbose diagnostics.

ssh -vv -o ConnectTimeout=10 deploy@example.com

Logs can reveal usernames, paths and server details.

Print evaluated client configuration without connecting.

ssh -G example.com

This is client configuration, not the server sshd configuration.

Check sshd configuration syntax and key availability.

sudo sshd -t

Do this before any reload; keep a working access session.

Show fingerprints available from your running SSH agent.

ssh-add -l

Requires a reachable agent; it does not show private key material.

Refresh repository package metadata.

sudo apt update

Changes local package indexes; does not upgrade packages.

Show installed packages with candidate upgrades.

apt list --upgradable

Refresh indexes first for current repository information.

Find repository packages matching a search term.

apt search nginx

Search results depend on enabled repositories.

Read package metadata and dependencies.

apt show nginx

Does not prove which variant your host should install.

Preview package actions without installing Nginx.

apt-get -s install nginx

Simulation is not an availability or deployment guarantee.

Install Nginx and required dependencies after review.

sudo apt install nginx

Package hooks may start services or alter configuration.

Preview upgrade actions.

apt-get -s upgrade

Actual transactions can change after metadata or package state changes.

Apply available upgrades after confirmation.

sudo apt upgrade

May restart services; review maintenance needs and backups.

List paths installed by an example package.

dpkg -L nginx-common

The package name must be installed.

Show Nginx state and recent journal entries.

systemctl status nginx --no-pager

Nonzero status can indicate an inactive service.

Print whether the unit is active.

systemctl is-active nginx

A running process alone does not prove application health.

List failed systemd units.

systemctl --failed --no-pager

Investigate the journal before restarting repeatedly.

Show unit files and drop-in configuration.

systemctl cat nginx

Check for secrets before sharing the output.

Apply a supported reload only after a successful syntax check.

sudo nginx -t && sudo systemctl reload nginx

Affects live service configuration; confirm the correct host.

Stop and start Nginx.

sudo systemctl restart nginx

Can interrupt active connections; use a maintenance window.

Reread changed systemd unit files and drop-ins.

sudo systemctl daemon-reload

Does not restart affected services by itself.

Show UFW status and numbered rules.

sudo ufw status numbered

UFW may not be the active firewall manager.

Preview allowing inbound TCP port 443.

sudo ufw --dry-run allow 443/tcp

Does not apply the rule; check provider firewalls separately.

Show the latest 100 accessible entries from this boot.

journalctl -b -n 100 --no-pager

System-wide logs may require extra permissions.

Show recent entries for a unit.

journalctl -u nginx -n 100 --no-pager

Some Nginx logs are files rather than journal entries.

Show recent entries at error priority or more severe.

journalctl -p err --since "1 hour ago" --no-pager

Applications must use journal priorities consistently.

Stream new entries for Nginx.

journalctl -fu nginx

Ctrl+C stops the viewer.

Read the previous boot when retained.

journalctl -b -1 -n 100 --no-pager

Requires persistent or otherwise retained previous-boot records.

Show space used by archived and active journal files.

journalctl --disk-usage

This does not remove journal data.

Show the tail of the kernel message buffer.

sudo dmesg --human | tail -n 60

Access may be restricted and messages may reveal host details.

Read rotation configuration and print debug decisions.

sudo logrotate --debug /etc/logrotate.conf

Debug mode does not rotate logs or update its state file.

Show the recorded system boot time.

who -b

Depends on system accounting records.

List the current account cron entries.

crontab -l

A missing crontab may return a nonzero status.

Open the current account crontab in an editor.

crontab -e

Saving changes affects scheduled jobs; review user and timezone.

Inspect system cron locations.

ls -l /etc/cron.d /etc/cron.daily /etc/cron.weekly

File format differs from a user crontab.

Show active and inactive timer schedules.

systemctl list-timers --all --no-pager

Timers are separate from cron jobs.

Parse a Bash script without executing it.

bash -n ./maintenance.sh

A syntax pass does not prove correctness or safety.

Run a script with Bash.

bash ./maintenance.sh

Inspect the script and test on staging first.

Treat text containing spaces as one argument.

printf "%s\n" "a filename with spaces.txt"

Double quotes still expand variables and command substitutions.

Print executable search directories.

printf "%s\n" "$PATH"

Do not add untrusted writable directories to PATH.

Set one variable only for a reviewed child command.

APP_ENV=staging bash ./maintenance.sh

This runs the script; use only non-secret values in shell history.

Check syntax and whether required configuration files can be opened.

sudo nginx -t

No reload is performed.

Validate and dump the loaded Nginx configuration.

sudo nginx -T

Output may contain upstream credentials or other sensitive settings.

Show build configuration and enabled compiled features.

nginx -V

Output is written to standard error.

Show the PHP binary used by your shell.

php -v

CLI and PHP-FPM may use different versions or configuration.

Show loaded CLI ini files.

php --ini

Does not show the PHP-FPM request configuration.

List loaded CLI PHP modules.

php -m

Check the FPM runtime separately for web requests.

Lint one PHP file without running its application code.

php -l ./plugin.php

Lint does not validate WordPress hooks or runtime dependencies.

List matching FPM units.

systemctl list-units --type=service --all "php*-fpm.service" --no-pager

Use the actual unit name rather than guessing a PHP version.

Inspect one HTTP response and timing sample.

curl -sS -o /dev/null --connect-timeout 5 --max-time 20 -w 'status=%{http_code} connect=%{time_connect}s first_byte=%{time_starttransfer}s total=%{time_total}s\n' https://example.com/

One request is not a reliable performance benchmark.

Show the installed MariaDB client version.

mariadb --version

Client version is not necessarily the server version.

Connect and query the server version.

mariadb -u app_user -p -e "SELECT VERSION();"

Replace the user; -p prompts rather than exposing a password.

List databases visible to your account.

mariadb -u app_user -p -e "SHOW DATABASES;"

Permissions limit which names are visible.

Inspect visible database sessions.

mariadb -u app_user -p -e "SHOW PROCESSLIST;"

Queries and connection metadata can contain private information.

Write a private logical database backup.

umask 077; mariadb-dump -u backup_user -p --single-transaction --quick --databases wordpress > ./wordpress-backup.sql

Overwrites the destination; consistency assumes transactional tables and no conflicting DDL. The umask 077 also applies to the rest of this shell session. Backups need tested restores.

Ask a local Redis endpoint to reply.

redis-cli -h 127.0.0.1 -p 6379 PING

Unauthenticated example; use your configured socket/TLS/ACL settings.

Inspect memory statistics using an interactive password prompt.

redis-cli --user app_user --askpass -h 127.0.0.1 INFO memory

Requires compatible redis-cli and ACL permissions; no password in arguments.

Inspect a bounded set of recent slow operations.

redis-cli -h 127.0.0.1 SLOWLOG GET 10

Arguments may contain private data; credentials may be required.

Request one incremental batch of matching key names.

redis-cli -h 127.0.0.1 SCAN 0 MATCH "wp:*" COUNT 100

COUNT is a hint; use the returned cursor until zero for a full iteration.

Show branch state and changed paths.

git status --short --branch

Untracked files are not part of commits until added.

Show local unstaged edits in one path.

git diff -- ./config.conf

Does not include staged changes.

Show changes prepared for the next commit.

git diff --cached

Check for accidentally staged secrets.

Show a compact recent history.

git log -n 10 --oneline --decorate

Commit messages are descriptions, not proof of deployment.

List configured fetch and push URLs.

git remote -v

URLs may contain private repository information.

Download remote objects and update tracking references.

git fetch origin

Does not update working-tree files; still changes local Git state.

List fetched commits not in the current HEAD.

git log --oneline HEAD..origin/main

Replace main if your deployment uses a different branch.

Update from main only when a fast-forward is possible.

git pull --ff-only origin main

Review local status and backups first; hooks or deployed code may affect production.

Stage one file and commit the prepared index.

git add -- ./config.conf && git commit -m "Update configuration"

Any other staged files also enter this commit; review git diff --cached first.

Inspect the CLI binary and PHP environment.

wp --info

Requires WP-CLI installed on your command path.

Show the WordPress version in an example installation.

wp --path=/srv/www/example.com/public core version

Replace the path with your actual WordPress root.

List installed plugins and update metadata.

wp --path=/srv/www/example.com/public plugin list

WordPress bootstrap can load application code and contact services.

List installed themes.

wp --path=/srv/www/example.com/public theme list

Requires access to the installation and its database.

Compare core files against official published checksums.

wp --path=/srv/www/example.com/public core verify-checksums

Contacts WordPress.org; not a complete malware or custom-code audit.

Read the stored WordPress site URL.

wp --path=/srv/www/example.com/public option get siteurl

Multisite context may require an explicit --url value.

List WordPress cron events.

wp --path=/srv/www/example.com/public cron event list

WP-Cron is distinct from the host cron scheduler.

Preview a WordPress-aware database replacement.

wp --path=/srv/www/example.com/public search-replace "https://old.example" "https://new.example" --skip-columns=guid --dry-run

Requires a current backup; dry run can still bootstrap plugins and read many tables.

List database tables for this WordPress configuration.

wp --path=/srv/www/example.com/public db tables

Database access and the correct site context are required.