This Linux commands cheat sheet is built for the moment you’re staring at a terminal and need the right command now. Every command is grouped by task, explained in one plain-English line, and paired with a realistic example you can copy and adapt. It starts with the 20 commands you’ll use every day, then covers files, text, searching, permissions, processes, disks, networking, packages, and users, plus the two things most cheat sheets skip: how pipes and redirection actually work, and a calm danger zone for commands that can wipe data.
It’s written for students, people moving over from Windows (maybe you just set up a dual boot), junior admins, and anyone running a homelab. If you want a slower, step-by-step introduction first, start with our basic Linux commands walkthrough and come back here as your reference.
How to use this cheat sheet
Each table row follows the same format:
- Command (with key flags): what you type. Flags are the letters after a dash, like
-lor-h. - What it does: one line, no jargon.
- Example: a realistic command. Swap in your own file names, users, and IP addresses.
What does a flag do? Flags change a command’s behavior. Most can be combined: ls -l -a -h and ls -lah do the same thing. Long flags use two dashes, like --help.
How to get help on any command
| Command | What it does | Example |
man command | Opens the full manual page. Press / to search, q to quit. | man tar |
command --help | Prints a shorter usage summary for most programs. | ls --help |
help builtin | Help for shell built-ins like cd, which have no man page of their own in bash. | help cd |
man -k keyword | Searches manual page descriptions when you don’t know the command name. | man -k compress |
type command | Tells you whether something is a built-in, alias, or program file. | type ll |
tldr command | Community-written, example-first summaries. Not installed by default; install a tldr client from your distro’s packages first. | tldr tar |
Which Linux does this cover?
The commands target bash, standard core utilities, and systemd on Ubuntu/Debian-family systems, which is what most beginners and homelab servers run. Most of them work the same on Fedora, Rocky Linux, Arch, Raspberry Pi OS, and WSL. Where a distro does things differently (package managers, the admin group, service names), the table says so.
One 2026-specific note: Ubuntu 25.10 and Ubuntu 26.04 LTS ship Rust reimplementations by default, uutils coreutils and sudo-rs. They’re designed to be compatible, and this sheet sticks to common, long-standing options, so the commands below behave as described for everyday use.
Windows switchers: In a Linux terminal,
Ctrl+Cstops the running command. It does not copy. UseCtrl+Shift+CandCtrl+Shift+Vto copy and paste in most terminal apps.
Start here: the 20 commands you’ll use daily
If you learn nothing else, learn these.
| Command | What it does | Example |
pwd | Shows which folder you’re in right now. | pwd |
ls -lah | Lists files with details, hidden files, and readable sizes. | ls -lah ~/Downloads |
cd | Changes folder. cd .. goes up one level, cd ~ goes home, cd - goes back. | cd /etc |
mkdir -p | Creates a folder, including any missing parent folders. | mkdir -p projects/site/images |
cp -r | Copies files, or whole folders with -r. | cp -r photos/ photos-backup/ |
mv | Moves or renames a file or folder. | mv draft.txt final.txt |
rm | Deletes files permanently. There is no recycle bin. | rm old-notes.txt |
cat | Prints a whole file to the screen. Best for short files. | cat /etc/os-release |
less | Scrolls through a long file. / searches, q quits. | less ~/.bashrc |
tail -f | Shows the end of a file and keeps watching for new lines. | tail -f app.log |
grep -i | Finds lines containing text, ignoring upper/lower case. | grep -i "error" app.log |
find | Finds files by name, size, type, or age. | find ~ -name "*.pdf" |
nano | Opens a beginner-friendly text editor. Ctrl+O saves, Ctrl+X exits. | nano notes.txt |
sudo | Runs one command with administrator (root) rights. | sudo nano /etc/hosts |
chmod | Changes who can read, write, or run a file. | chmod +x backup.sh |
df -h | Shows free space on every mounted drive. | df -h |
du -sh | Shows how much space a folder uses. | du -sh ~/Videos |
top | Live view of running programs, CPU, and memory. q quits. | top |
systemctl status | Shows whether a service is running and its latest log lines. | systemctl status ssh |
man | Opens the manual for any command. | man grep |
Navigation and files
| Command | What it does | Example |
pwd | Prints the full path of the current folder. | pwd |
ls | Lists files in a folder. | ls /var/log |
ls -l | Long list: permissions, owner, size, date. | ls -l ~/Documents |
ls -a | Includes hidden files (names starting with a dot). | ls -a ~ |
ls -lh | Long list with sizes in K, M, G. | ls -lh ~/Downloads |
ls -lt | Long list sorted by newest first. | ls -lt ~/Downloads |
cd folder | Moves into a folder. | cd ~/projects |
cd .. | Moves up one level. | cd .. |
cd ~ or cd | Goes to your home folder. | cd ~ |
cd - | Jumps back to the previous folder. | cd - |
mkdir | Creates a folder. | mkdir reports |
mkdir -p | Creates nested folders in one go. | mkdir -p 2026/q4/invoices |
touch | Creates an empty file, or updates a file’s timestamp. | touch todo.txt |
cp source dest | Copies a file. | cp config.yml config.yml.bak |
cp -r | Copies a folder and everything in it. | cp -r website/ website-old/ |
cp -i | Asks before overwriting an existing file. | cp -i report.pdf ~/Desktop/ |
cp -a | Copies a folder while keeping permissions and timestamps (good for backups). | cp -a ~/docs /mnt/backup/ |
mv source dest | Moves or renames. | mv IMG_1001.jpg beach.jpg |
mv -i | Asks before overwriting. | mv -i notes.txt ~/Documents/ |
rm file | Deletes a file permanently. | rm temp.log |
rm -i | Asks for confirmation on each file. | rm -i *.log |
rm -r folder | Deletes a folder and its contents. | rm -r old-project/ |
rm -I | Asks once before deleting more than three files or deleting recursively. | rm -rI old-project/ |
rmdir | Deletes a folder only if it’s empty (a safe option). | rmdir empty-folder |
ln -s target link | Creates a shortcut (symbolic link). | ln -s /mnt/nas/media ~/media |
file | Tells you what kind of file something really is. | file download.bin |
stat | Shows detailed info: size, permissions, timestamps. | stat report.pdf |
Paths in one line: / is the root of the whole system, ~ is your home folder, . is the current folder, and .. is the folder above. A path starting with / is absolute; anything else is relative to where you are.
Viewing and editing text
| Command | What it does | Example |
cat file | Prints a file. | cat /etc/hostname |
cat -n file | Prints a file with line numbers. | cat -n script.sh |
less file | Scrolls a long file. /word searches, n finds next, g top, G bottom, q quits. | less /etc/ssh/sshd_config |
head -n 20 | Shows the first 20 lines. | head -n 20 data.csv |
tail -n 50 | Shows the last 50 lines. | tail -n 50 app.log |
tail -f | Follows a file as new lines are added. Ctrl+C stops. | tail -f /var/log/nginx/access.log |
wc -l | Counts lines in a file. | wc -l users.csv |
nano file | Simple editor. Ctrl+O save, Ctrl+X exit, Ctrl+W search. | nano ~/.bashrc |
vim file | Powerful editor. Press i to type, Esc then :wq to save and quit, :q! to quit without saving. | vim config.yml |
diff -u old new | Shows line-by-line differences between two files. | diff -u config.bak config |
sort | Sorts lines alphabetically. Add -n for numbers, -r to reverse. | sort names.txt |
uniq -c | Collapses repeated adjacent lines and counts them (sort first). | uniq -c sorted-ips.txt |
cut -d, -f2 | Pulls out one column from delimited text. | cut -d, -f2 data.csv |
echo | Prints text, or writes it to a file with >. | echo "hello" > greeting.txt |
Which editor should you use? Start with nano: the shortcuts are printed at the bottom of the screen (^ means Ctrl). Learn enough vim to exit it, because it’s the editor you’ll find on almost every server.
Searching: grep and find
grep searches inside files. find searches for files themselves.
| Command | What it does | Example |
grep "text" file | Shows lines containing the text. | grep "Listen" /etc/apache2/ports.conf |
grep -i | Ignores upper/lower case. | grep -i "warning" app.log |
grep -n | Shows line numbers. | grep -n "TODO" main.py |
grep -r | Searches every file in a folder, recursively. | grep -r "192.168.1.50" /etc |
grep -rn | Recursive search with line numbers (the combo you’ll use most). | grep -rn "api_key" ~/projects |
grep -v | Shows lines that do NOT match. | grep -v "^#" /etc/fstab |
grep -w | Matches whole words only. | grep -w "root" /etc/passwd |
grep -c | Counts matching lines. | grep -c "Failed password" auth.log |
grep -l | Lists only the names of files that match. | grep -rl "localhost" ~/projects |
grep -C 3 | Shows 3 lines of context before and after each match. | grep -C 3 "panic" app.log |
grep -E | Extended patterns, such as “this OR that”. | grep -E "error|fail" app.log |
find path -name | Finds files by exact name pattern (case-sensitive). | find ~ -name "*.mp4" |
find path -iname | Same, ignoring case. | find ~/Pictures -iname "*.jpg" |
find -type f / -type d | Limits results to files or to directories. | find ~/projects -type d -name "node_modules" |
find -size +100M | Finds files bigger than 100 MB. | find ~ -type f -size +100M |
find -mtime -1 | Finds files modified in the last 24 hours. | find /var/log -type f -mtime -1 |
find -mmin -30 | Finds files modified in the last 30 minutes. | find ~/projects -type f -mmin -30 |
find -empty | Finds empty files or folders. | find ~/Downloads -type d -empty |
which | Shows the full path of a program you can run. | which python3 |
Note on
grep -E: in the table the pipe is shown escaped. In your terminal type it plainly:grep -E "error|fail" app.log
Tip: when find searches system folders as a normal user, it prints lots of “Permission denied” lines. Hide them with 2>/dev/null (explained in the pipes section below), or run it with sudo.
Permissions and ownership
Every file has an owner, a group, and three sets of permissions: for the owner (u), the group (g), and everyone else (o). Each set can include r (read), w (write), and x (execute, or “enter” for folders).
How do you read ls -l permissions? An example line looks like this:
-rwxr-xr-- 1 alice devs 2048 Oct 14 09:12 deploy.shThe first character is the type (- file, d directory, l link). Then three groups of three: rwx for the owner (alice), r-x for the group (devs), and r-- for everyone else.
| Command | What it does | Example |
ls -l | Shows permissions, owner, and group. | ls -l deploy.sh |
chmod +x | Makes a file executable (a script you can run). | chmod +x deploy.sh |
chmod u+x | Adds execute for the owner only. | chmod u+x deploy.sh |
chmod go-w | Removes write permission from group and others. | chmod go-w shared.txt |
chmod o-rwx | Removes all access for “others”. | chmod o-rwx payroll.csv |
chmod 755 | Owner: everything. Everyone else: read and run. | chmod 755 deploy.sh |
chmod 644 | Owner: read/write. Everyone else: read only. | chmod 644 index.html |
chmod 600 | Owner only: read/write. Nobody else. | chmod 600 ~/.ssh/id_ed25519 |
chmod -R u=rwX,go=rX | Fixes a whole folder safely: capital X adds execute only to folders and files that are already executable. | chmod -R u=rwX,go=rX ~/shared |
chown user:group | Changes owner and group (usually needs sudo). | sudo chown alice:alice report.pdf |
chown -R | Changes ownership of a folder and everything inside it. | sudo chown -R www-data:www-data /var/www/mysite |
chgrp | Changes just the group. | sudo chgrp devs project.md |
umask | Shows the default permission mask applied to new files. | umask |
(www-data is the web server user on Debian and Ubuntu. Other distros use different names, such as nginx or apache.)
chmod numbers explained: 755, 644, 600
Each digit is the sum of read = 4, write = 2, execute = 1. The three digits are owner, group, others.
| Number | Letters | Who can do what | Use it for |
755 | rwxr-xr-x | Owner can do everything; everyone else can read and run/enter. | Scripts, programs, and most folders |
644 | rw-r--r-- | Owner can read and write; everyone else can only read. | Regular files: web pages, configs, documents |
600 | rw------- | Only the owner can read and write. | Private files: SSH private keys, files with passwords |
700 | rwx------ | Only the owner can do anything. | Private folders such as ~/.ssh |
Why is chmod 777 a bad idea? It lets every user on the system change or replace the file. It’s almost never the right fix for a “permission denied” error. See the danger zone below.
Processes and services
Processes: see and stop running programs
| Command | What it does | Example |
ps aux | Lists every running process with its owner, CPU, and memory use. | ps aux |
pgrep -a name | Finds processes by name and shows their PID and full command. | pgrep -a python3 |
top | Live process view. Shift+P sorts by CPU, Shift+M by memory, q quits. | top |
htop | A friendlier top with colors and mouse support. May need installing. | htop |
kill PID | Asks a process to stop politely (SIGTERM). | kill 4821 |
kill -9 PID | Forces a process to stop immediately (SIGKILL). Last resort; it can’t save its work. | kill -9 4821 |
pkill name | Stops processes by name. | pkill firefox |
pkill -f "text" | Stops processes whose full command line matches. | pkill -f "python3 app.py" |
command & | Runs a command in the background. | ./long-job.sh & |
jobs | Lists background jobs in this terminal. | jobs |
fg %1 | Brings job 1 back to the foreground. | fg %1 |
bg %1 | Resumes a paused job in the background. | bg %1 |
Ctrl+Z | Pauses the current foreground program. | (press while a program runs) |
nohup command & | Keeps a command running after you log out; output goes to nohup.out. | nohup ./backup.sh & |
Services and logs: systemctl and journalctl
Most modern distros manage background services with systemd. systemctl controls services; journalctl reads their logs.
| Command | What it does | Example |
systemctl status name | Shows if a service is running, plus recent log lines. | systemctl status ssh |
sudo systemctl start name | Starts a service now. | sudo systemctl start ssh |
sudo systemctl stop name | Stops a service now. | sudo systemctl stop ssh |
sudo systemctl restart name | Stops and starts a service (apply config changes). | sudo systemctl restart ssh |
sudo systemctl reload name | Reloads config without a full restart (if the service supports it). | sudo systemctl reload nginx |
sudo systemctl enable --now name | Starts a service and sets it to start at every boot. | sudo systemctl enable --now ssh |
sudo systemctl disable name | Stops a service from starting at boot. | sudo systemctl disable bluetooth |
systemctl is-active name | Prints just “active” or “inactive”. | systemctl is-active ssh |
systemctl --failed | Lists services that failed. | systemctl --failed |
systemctl list-units --type=service --state=running | Lists all running services. | systemctl list-units --type=service --state=running |
sudo systemctl daemon-reload | Reloads unit files after you edit or add one. | sudo systemctl daemon-reload |
journalctl -u name | Shows logs for one service. | sudo journalctl -u ssh |
journalctl -f | Follows the system log live. | sudo journalctl -f |
journalctl -u name -f | Follows one service’s log live. | sudo journalctl -u ssh -f |
journalctl -b | Shows logs from the current boot only. | sudo journalctl -b |
journalctl -b -1 | Shows logs from the previous boot (needs persistent journaling, the default on Ubuntu and Fedora). | sudo journalctl -b -1 |
journalctl -p err -b | Shows only errors from this boot. | sudo journalctl -p err -b |
journalctl --since | Shows logs from a time window. | sudo journalctl --since "1 hour ago" |
journalctl -n 100 | Shows the last 100 log lines. | sudo journalctl -u ssh -n 100 |
(The SSH service is called ssh on Ubuntu/Debian and sshd on Fedora and RHEL.)
Disk and system info
| Command | What it does | Example |
df -h | Free and used space on every mounted filesystem. | df -h |
df -h / | Free space on the drive holding a given path. | df -h /home |
df -i | Shows inode use (a disk can be “full” of tiny files even with free space). | df -i |
du -sh folder | Total size of one folder. | du -sh /var/log |
du -h --max-depth=1 | Size of each subfolder, one level deep. | sudo du -h --max-depth=1 /var |
free -h | RAM and swap: total, used, available. | free -h |
uname -r | Kernel version. | uname -r |
uname -a | Kernel version, hostname, and architecture. | uname -a |
cat /etc/os-release | Which distro and version you’re running. | cat /etc/os-release |
hostnamectl | Hostname, OS, kernel, and hardware summary. | hostnamectl |
uptime | How long the system has been up, plus load averages. | uptime |
lsblk | Lists disks and partitions as a tree. | lsblk |
lsblk -f | Adds filesystem type, label, and UUID. | lsblk -f |
lscpu | CPU model, cores, and threads. | lscpu |
nproc | Number of CPU threads available. | nproc |
date | Current date and time. | date |
timedatectl | Time zone and clock sync status. | timedatectl |
sudo dmesg | Kernel messages (useful after plugging in hardware). | sudo dmesg |
Networking
| Command | What it does | Example |
ip a | Shows network interfaces and their IP addresses. | ip a |
ip -br a | Same, in a compact one-line-per-interface view. | ip -br a |
ip route | Shows the routing table, including your default gateway. | ip route |
hostname -I | Prints just this machine’s IP addresses. | hostname -I |
ping -c 4 host | Sends 4 test packets. Without -c, Linux pings forever (Ctrl+C stops). | ping -c 4 1.1.1.1 |
ss -tulpn | Lists listening ports: TCP, UDP, with process names (needs sudo to see all processes). | sudo ss -tulpn |
curl -I URL | Fetches only a website’s HTTP headers (quick “is it up?” check). | curl -I https://example.com |
curl -L URL | Fetches a page and follows redirects. | curl -L https://example.com |
curl -O URL | Downloads a file, keeping its original name. | curl -O https://example.com/file.iso |
curl -o name URL | Downloads a file under a name you choose. | curl -o ubuntu.iso https://example.com/file.iso |
dig domain | Looks up DNS records in detail. | dig example.com |
dig +short domain | Prints just the IP address answer. | dig +short example.com |
dig @server domain | Asks a specific DNS server. | dig @1.1.1.1 example.com |
nslookup domain | Simpler DNS lookup, familiar from Windows. | nslookup example.com |
ssh user@host | Logs in to another machine securely. | ssh [email protected] |
ssh -p port user@host | SSH on a non-standard port. | ssh -p 2222 [email protected] |
scp file user@host:path | Copies a file to another machine over SSH. | scp backup.tar.gz [email protected]:/home/alice/ |
rsync -avh src/ dest/ | Copies or syncs folders efficiently; re-runs only copy what changed. | rsync -avh ~/photos/ [email protected]:/srv/photos/ |
(dig and nslookup come from a DNS utilities package that minimal installs may not include. On Ubuntu/Debian it’s bind9-dnsutils; on Fedora it’s bind-utils.)
What happened to ifconfig and netstat? They come from the old net-tools package, which many distros no longer install by default. ip and ss are the modern replacements. Running a homelab? sudo ss -tulpn is the fastest way to audit which services are exposed, and it’s a good first step in securing your homelab network.
Archives and packages
tar, zip, and gzip
tar flags decoded: c = create, x = extract, t = list, z = gzip, J = xz, v = verbose, f = the archive file name comes next.
| Command | What it does | Example |
tar -czf name.tar.gz folder | Creates a gzip-compressed archive. | tar -czf docs-backup.tar.gz ~/Documents |
tar -xzf name.tar.gz | Extracts a .tar.gz into the current folder. | tar -xzf docs-backup.tar.gz |
tar -xzf file -C folder | Extracts into a specific (existing) folder. | tar -xzf site.tar.gz -C /tmp/restore |
tar -tzf name.tar.gz | Lists what’s inside without extracting. | tar -tzf docs-backup.tar.gz |
tar -xf archive | Extracts most tar formats; compression is detected automatically. | tar -xf node-v22.tar.xz |
tar -cJf name.tar.xz folder | Creates a smaller (slower) xz-compressed archive. | tar -cJf logs.tar.xz logs/ |
zip -r name.zip folder | Creates a .zip (handy for sharing with Windows users). | zip -r photos.zip photos/ |
unzip file.zip | Extracts a .zip. | unzip photos.zip |
unzip -l file.zip | Lists a .zip’s contents. | unzip -l photos.zip |
gzip file | Compresses one file (replaces it with file.gz). | gzip big.log |
gunzip file.gz | Decompresses a .gz file. | gunzip big.log.gz |
(zip and unzip may need installing on minimal systems.)
Installing software: package managers depend on your distro
There is no single universal Linux install command. Use the one your distro ships with. Not sure which you have? Run cat /etc/os-release.
| Task | Debian / Ubuntu / Mint / Pop!_OS (apt) | Fedora / RHEL / Rocky / Alma (dnf) |
| Refresh package lists | sudo apt update | sudo dnf check-update |
| Upgrade everything | sudo apt upgrade | sudo dnf upgrade |
| Install a package | sudo apt install htop | sudo dnf install htop |
| Remove a package | sudo apt remove htop | sudo dnf remove htop |
| Search for a package | apt search htop | dnf search htop |
| Show package details | apt show htop | dnf info htop |
| Remove unused dependencies | sudo apt autoremove | sudo dnf autoremove |
Arch-based distros use pacman, and openSUSE uses zypper. Many distros also support Flatpak or Snap for desktop apps. Stick to one package manager per task rather than mixing them for the same app.
Users and sudo basics
| Command | What it does | Example |
whoami | Prints your username. | whoami |
id | Shows your user ID and every group you belong to. | id |
groups user | Lists a user’s groups. | groups alice |
sudo command | Runs one command as root (asks for your password). | sudo apt update |
sudo !! | Re-runs your previous command with sudo (bash). | sudo !! |
sudo -i | Opens a root shell. Type exit to leave it. | sudo -i |
sudo -l | Lists what you’re allowed to run with sudo. | sudo -l |
su - user | Switches to another user’s login shell. | su - bob |
passwd | Changes your own password. | passwd |
sudo passwd user | Sets another user’s password. | sudo passwd bob |
sudo adduser user | Creates a user interactively (Debian/Ubuntu). | sudo adduser bob |
sudo useradd -m -s /bin/bash user | Creates a user with a home folder (works on all distros). | sudo useradd -m -s /bin/bash bob |
sudo usermod -aG group user | Adds a user to a group. Log out and back in for it to apply. | sudo usermod -aG sudo bob |
sudo userdel -r user | Deletes a user and their home folder. | sudo userdel -r bob |
sudo visudo | Safely edits sudo rules (checks syntax before saving). | sudo visudo |
(The admin group is sudo on Ubuntu/Debian and wheel on Fedora and RHEL.)
Pipes and redirection in plain English
This is the concept beginners miss most, and it’s what makes the command line powerful. Every command has input, normal output (stdout), and error output (stderr). These symbols redirect them:
| Symbol | Plain English |
| (pipe) | “Send this command’s output into the next command.” |
> | “Save the output to a file, replacing whatever was in it.” |
>> | “Add the output to the end of a file.” |
2> | “Send error messages somewhere else.” |
2>&1 | “Send errors to the same place as normal output.” |
< | “Read input from this file.” |
&& | “Run the next command only if this one succeeded.” |
|| | “Run the next command only if this one failed.” |
(In the table the pipe symbols are escaped for formatting. In the terminal you type a single | or ||.)
Real examples you’ll actually use:
# Pipe: find a process, sort folders by size, search your history
ps aux | grep -i firefox
du -sh * | sort -h
history | grep ssh
# Overwrite vs append
ls -l /etc > etc-listing.txt
echo "Backup finished at $(date)" >> ~/backup.log
# Hide "Permission denied" noise by sending errors to /dev/null
find / -name "nginx.conf" 2>/dev/null
# Save both output and errors from a script to one log file
./backup.sh > backup.log 2>&1
# Run the upgrade only if the update succeeded
sudo apt update && sudo apt upgrade
# Write to a root-owned file: "sudo echo ... > file" fails, tee works
echo "192.168.1.50 nas" | sudo tee -a /etc/hostsWhy does sudo echo "x" > /etc/file fail? The > is handled by your own shell before sudo runs, so the file is opened without root rights. Piping into sudo tee -a (append) or sudo tee (overwrite) fixes it.
Small gotcha: ps aux | grep firefox also lists the grep command itself. pgrep -a firefox gives a cleaner answer.
Keyboard shortcuts that save real time
These work in bash, the default shell on most distros.
| Shortcut | What it does |
Tab | Auto-completes commands, file names, and paths. Press it constantly. |
Tab Tab | Shows all possible completions when there’s more than one. |
Up / Down arrows | Scrolls through previous commands. |
Ctrl+R | Searches your command history as you type. Press Ctrl+R again for older matches, Enter to run, Ctrl+G to cancel. |
Ctrl+C | Stops the running command (it does not copy). |
Ctrl+Z | Pauses the running command (fg resumes it). |
Ctrl+D | Logs out of the shell, or ends input. |
Ctrl+L | Clears the screen (same as clear). |
Ctrl+A / Ctrl+E | Jumps to the start / end of the line. |
Ctrl+U | Deletes from the cursor to the start of the line. |
Ctrl+K | Deletes from the cursor to the end of the line. |
Ctrl+W | Deletes the word before the cursor. |
Alt+. | Inserts the last argument of the previous command. |
Ctrl+Shift+C / Ctrl+Shift+V | Copy / paste in most terminal apps. |
History commands:
| Command | What it does | Example |
history | Lists your recent commands with numbers. | history |
!number | Re-runs command number N from history. | !42 |
!! | Re-runs the last command. | !! |
Windows to Linux: quick command translator
Coming from Command Prompt? These are the closest everyday equivalents.
| Windows (cmd) | Linux | Note |
dir | ls -l | |
cd | cd / pwd | Plain cd on Linux goes home; use pwd to see where you are. |
copy / xcopy | cp / cp -r | |
move / ren | mv | One command for both moving and renaming. |
del / rmdir /s | rm / rm -r | No recycle bin. |
type | cat | |
cls | clear | Or Ctrl+L. |
findstr | grep | |
where | which | |
ipconfig | ip a | |
ping | ping -c 4 | Linux keeps pinging until you press Ctrl+C. |
tasklist | ps aux | |
taskkill /PID | kill | |
shutdown /r /t 0 | sudo reboot |
Remember that Linux is case-sensitive: Report.txt and report.txt are two different files.
Danger zone: commands that can destroy data (and the safe habit for each)
Linux assumes you mean exactly what you type. There’s no “Are you sure?” and no recycle bin for terminal deletions. None of this is a reason to fear the terminal; it’s a reason to build a few habits.
| Command or pattern | What can go wrong | Safe habit | |
rm -rf | Deletes folders permanently, with no prompt. A stray space is enough: rm -rf ~ /Downloads/old deletes your entire home folder and then /Downloads/old. | Run ls on the exact path first. Use pwd to confirm where you are. Prefer rm -rI so you get one confirmation. Use tab completion instead of typing paths. | |
rm -rf "$DIR"/* in scripts | If $DIR is empty, this becomes rm -rf /. Modern rm refuses rm -rf / by default, but that protection doesn’t cover /. | Use rm -rf "${DIR:?}"/*, which stops the script with an error if the variable is empty. | |
chmod -R 777 | Makes every file writable by every user. On system paths it can break SSH logins and sudo, which refuse insecure permissions. | Fix the specific file or folder. Use chmod -R u=rwX,go=rX folder, or add the user to the right group. | |
sudo chown -R on the wrong path | Hands system files to the wrong user, breaking services. | Check the path with ls -ld path first. Never run it on /, /etc, or /usr. | |
dd if=... of=/dev/sdX | Overwrites the target disk completely. A wrong letter wipes the wrong drive. | Run lsblk before and after plugging in the USB drive to confirm which device it is. Double-check the of= value. Device names can change between boots. | |
mkfs | Formats a partition, erasing its filesystem. | Confirm the device with lsblk -f (it shows existing filesystems and labels). Unmount it first. | |
> redirect | command > file silently replaces the file’s contents. | Use >> to append. Turn on protection with set -o noclobber (then > refuses to overwrite existing files; `> | ` forces it). |
find ... -delete | Deletes every match instantly. Placed before the filters, it deletes everything under the path. | Run the find without -delete first, check the list, then add -delete as the last option. | |
usermod -G group user | Without -a, it replaces the user’s groups, which can lock them out of sudo. | Always use usermod -aG. | |
crontab -r | Deletes all your scheduled jobs with no prompt. It’s one key away from crontab -e. | Back up first: crontab -l > ~/crontab-backup.txt. | |
curl ... | sudo bash | Runs a script from the internet as root before you’ve seen it. | Download it, read it, then run it. | |
| Firewall changes over SSH | Enabling a firewall before allowing SSH locks you out of a remote server. | On Ubuntu, run sudo ufw allow OpenSSH before sudo ufw enable. More in our homelab network security guide. |
The one habit that matters most: have a backup. Every safe habit above reduces mistakes; only backups undo them.
When you need to… use…
| When you need to… | Use… |
| See which drive is full | df -h |
| Find which folder is eating the space | sudo du -xh --max-depth=1 / then repeat on the biggest folder |
| Find files over 1 GB | sudo find / -xdev -type f -size +1G |
Fix “disk full” when du doesn’t add up | sudo lsof +L1 (deleted files still held open; restart the program holding them) |
| Check how much space logs use | journalctl --disk-usage |
| Shrink the system journal | sudo journalctl --vacuum-size=500M |
| See what’s listening on a port | sudo ss -tulpn or sudo lsof -i :8080 |
| Watch a log live | sudo journalctl -u ssh -f or tail -f /var/log/nginx/error.log |
| Find out why a service failed | systemctl status name, then sudo journalctl -u name -b |
| See what’s using CPU or RAM | top (Shift+P for CPU, Shift+M for memory) |
| Stop a frozen program | pkill name, and only if that fails, pkill -9 name |
| Find your IP address | ip -br a or hostname -I |
| Tell a network problem from a DNS problem | ping -c 3 1.1.1.1 works but ping -c 3 example.com fails? It’s DNS. |
| Check which distro you’re on | cat /etc/os-release |
| Find a command you ran last week | Ctrl+R, then type part of it |
| Find text inside lots of files | grep -rn "text" folder |
| Find where a program is installed | which program |
| Extract a .tar.gz | tar -xzf file.tar.gz |
(lsof is preinstalled on most desktop and server distros but may be missing from minimal images.)
Frequently asked questions
What are the most important Linux commands for beginners?
Start with pwd, ls, cd, mkdir, cp, mv, rm, cat, less, grep, find, nano, sudo, chmod, df, du, top, systemctl, and man. Those cover moving around, managing files, reading text, fixing permissions, and checking system health. Our basic Linux commands guide walks through them step by step.
Do these commands work on every Linux distro?
Almost all of them do, because they come from standard tools that ship everywhere. The main differences are package managers (apt on Debian/Ubuntu, dnf on Fedora/RHEL, pacman on Arch), the admin group (sudo vs wheel), and some service names (ssh vs sshd). Those differences are flagged in the tables.
Do Linux commands work on macOS or Windows?
On Windows, WSL (Windows Subsystem for Linux) runs a real Linux distribution, so these commands work there. macOS has a similar Unix terminal, but many of its built-in tools are BSD versions with different flags, and it doesn’t use systemctl, apt, or ip.
How do I undo rm in Linux?
Usually you can’t. Terminal deletions skip the trash, so restore from a backup. That’s why the danger zone recommends ls before rm, and rm -i or rm -I for prompts.
What’s the difference between > and >>?
> replaces a file’s contents with the command’s output. >> adds the output to the end of the file and keeps what was already there.
What does sudo do?
It runs a single command with administrator (root) privileges, after asking for your password. Use it only for commands that actually need it, such as installing software or editing system files.
How do I stop a command that’s running?
Press Ctrl+C. If a program is frozen in another window, find it with pgrep -a name and stop it with kill PID, or with kill -9 PID as a last resort.
Are ifconfig and netstat still used?
They still work where the net-tools package is installed, but many distros no longer include it by default. Use ip a instead of ifconfig and ss -tulpn instead of netstat.
How do I remember all these commands?
You don’t need to. Learn the 20 daily commands, lean on Tab completion and Ctrl+R history search, and check man or --help for flags. Keep this page (or the printable PDF) open for everything else.
Next steps
Bookmark this page as your Linux command line cheat sheet, and grab the printable PDF for your desk. If you’re still building the basics, our basic Linux commands walkthrough explains each core command in more depth. Setting up a server at home? Head to our homelab guide, then lock it down with how to secure a homelab network.
