This reference covers Ubuntu and Debian-based distributions and is aimed at server administrators and home lab builders running systems such as Ubuntu Server, Proxmox, Docker hosts, and NAS platforms. Commands are intended for use in a standard bash terminal. Where a command requires elevated privileges, sudo is noted or implied.
Navigation and File Operations
| Command |
What it does |
Example / Notes |
pwd |
Print working directory |
Shows your current full path |
ls |
List directory contents |
ls /etc |
ls -la |
List all files including hidden, with permissions and ownership |
Use this to inspect dotfiles and symlinks |
ls -lh |
List with human-readable file sizes |
Shows KB, MB, GB instead of byte counts |
cd |
Change directory |
cd /var/log |
cd ~ |
Change to home directory |
Equivalent to cd /home/username |
cd - |
Return to previous directory |
Toggles between two locations |
mkdir dirname |
Create a directory |
mkdir backups |
mkdir -p |
Create nested directories, no error if they exist |
mkdir -p /opt/myapp/config |
rm file |
Remove a file |
No recycle bin — deletion is permanent |
rm -rf /path |
Recursively force-delete a directory and all contents |
Use with extreme caution. No confirmation prompt. |
cp source dest |
Copy a file |
cp config.yml config.yml.bak |
cp -r src/ dest/ |
Recursively copy a directory |
cp -r /etc/nginx /etc/nginx.bak |
mv source dest |
Move or rename a file or directory |
mv old.conf new.conf |
touch filename |
Create an empty file or update timestamps |
touch deploy.log |
find /path -name "*.conf" |
Find files by name pattern |
find /etc -name "*.conf" -type f |
locate filename |
Fast filename search using a pre-built index |
Run sudo updatedb first to refresh the index |
which command |
Show the path of an executable |
which python3 |
whereis command |
Show binary, source, and man page locations |
whereis nginx |
tree |
Display directory structure as a tree |
Install with apt install tree; use tree -L 2 to limit depth |
Viewing and Editing Files
| Command |
What it does |
Example / Notes |
cat file |
Print entire file contents to terminal |
cat /etc/hosts |
less file |
Page through a file interactively |
Arrow keys to scroll, q to quit, /term to search |
more file |
Page through a file (forward only) |
Older alternative to less |
head -n 20 file |
Show the first 20 lines of a file |
head -n 50 /var/log/syslog |
tail -n 20 file |
Show the last 20 lines of a file |
tail -n 100 /var/log/nginx/error.log |
tail -f file |
Follow a log file in real time |
tail -f /var/log/syslog — Ctrl+C to stop |
grep "pattern" file |
Search for a pattern in a file |
grep "error" /var/log/nginx/error.log |
grep -r "pattern" /path |
Recursive search across all files in a directory |
grep -r "listen 80" /etc/nginx/ |
grep -i "pattern" file |
Case-insensitive search |
grep -i "failed" /var/log/auth.log |
grep -v "pattern" file |
Show lines that do not match |
grep -v "^#" /etc/ssh/sshd_config — strip comments |
wc -l file |
Count the number of lines in a file |
wc -l /etc/passwd |
diff file1 file2 |
Show differences between two files |
diff nginx.conf nginx.conf.bak |
nano file |
Open a file in the nano text editor |
Ctrl+O to save, Ctrl+X to exit |
vim file |
Open a file in the vim text editor |
i to insert; Esc then :wq to save and quit; :q! to quit without saving |
Permissions and Ownership
Understanding ls -la output
-rwxr-xr-x 1 ubuntu www-data 4096 May 10 09:00 script.sh\\n ||||||||| | |\\n ||||||||+-- other: r-x (read, execute)\\n |||||+++--- group: r-x (read, execute)\\n ||+++------ owner: rwx (read, write, execute)\\n |+--------- file type: - file, d directory, l symlink
Numeric permission reference
| Mode |
Meaning |
Common use |
755 |
Owner: rwx | Group: r-x | Other: r-x |
Directories, public scripts |
644 |
Owner: rw- | Group: r– | Other: r– |
Config files, web assets |
600 |
Owner: rw- | Group: — | Other: — |
SSH private keys, secrets |
700 |
Owner: rwx | Group: — | Other: — |
Private scripts, ~/.ssh directory |
777 |
Everyone: rwx |
Avoid on servers — full access for all users |
Permission and ownership commands
| Command |
What it does |
Example / Notes |
chmod 755 file |
Set permissions numerically |
chmod 644 /etc/nginx/nginx.conf |
chmod +x file |
Make a file executable |
chmod +x deploy.sh |
chmod -R 755 /path |
Recursively set permissions on a directory |
chmod -R 755 /var/www/html |
chown user:group file |
Change owner and group of a file |
chown ubuntu:ubuntu app.conf |
chown -R www-data:www-data /var/www |
Recursively assign web server ownership |
Standard for Nginx/Apache web roots |
chgrp groupname file |
Change only the group of a file |
chgrp docker /var/run/docker.sock |
sudo command |
Run a command as root |
sudo systemctl restart nginx |
su - |
Switch to the root user (full login shell) |
Requires root password; not available on Ubuntu by default |
whoami |
Print the current user |
Useful inside scripts to confirm execution context |
id |
Show UID, GID, and group memberships |
id ubuntu |
groups |
List groups the current user belongs to |
groups username |
User and Group Management
| Command |
What it does |
Example / Notes |
useradd username |
Create a new user (low-level, minimal) |
Does not create home directory by default; use -m flag to create one |
adduser username |
Create a new user interactively (Debian/Ubuntu) |
Preferred on Ubuntu — prompts for password and details, creates home directory |
usermod -aG group username |
Add a user to a supplementary group |
usermod -aG sudo username — grant sudo access; usermod -aG docker username |
usermod -l newname oldname |
Rename a user account |
Does not rename home directory — do that separately |
userdel username |
Delete a user account |
Add -r to also remove the home directory |
passwd username |
Set or change a user’s password |
sudo passwd ubuntu |
groupadd groupname |
Create a new group |
groupadd developers |
groupdel groupname |
Delete a group |
Users are not deleted when a group is removed |
cat /etc/passwd |
List all user accounts |
Format: username:x:UID:GID:info:home:shell |
cat /etc/group |
List all groups and their members |
Format: groupname:x:GID:members |
Process Management
| Command |
What it does |
Example / Notes |
ps aux |
List all running processes with resource usage |
Columns: USER, PID, %CPU, %MEM, COMMAND |
ps aux | grep nginx |
Filter process list by name |
Pipe with grep -v grep to exclude the grep process itself |
top |
Real-time process monitor |
q to quit; k to kill a process by PID |
htop |
Interactive process viewer with colour output |
Install with apt install htop; F9 to kill, F6 to sort |
kill PID |
Send SIGTERM (graceful stop) to a process |
kill 3421 |
kill -9 PID |
Send SIGKILL (force-terminate) to a process |
Use when a graceful kill does not work |
killall processname |
Kill all processes matching a name |
killall nginx |
pkill processname |
Send a signal to processes matching a name pattern |
pkill -HUP nginx — send reload signal |
pgrep processname |
Return PIDs of matching processes |
pgrep nginx |
nohup command & |
Run a command that persists after logout |
nohup ./backup.sh & — output goes to nohup.out |
jobs |
List background and suspended jobs in the current shell |
Shows job numbers used with fg and bg |
fg %1 |
Bring a background job to the foreground |
Use job number from jobs |
bg %1 |
Resume a suspended job in the background |
Use after Ctrl+Z to suspend |
command & |
Run a command immediately in the background |
./long-script.sh & |
| Ctrl+C |
Interrupt (terminate) the current foreground process |
Sends SIGINT |
| Ctrl+Z |
Suspend the current foreground process |
Resume with fg or bg |
Disk and Storage
| Command |
What it does |
Example / Notes |
df -h |
Show disk space usage for all mounted filesystems |
Human-readable sizes; check Use% column |
du -sh /path |
Show total size of a directory |
du -sh /var/log |
du -sh * |
Show size of each item in the current directory |
Run from / or /var to identify large directories |
lsblk |
List block devices and their mount points |
Shows disks, partitions, and LVM volumes in a tree layout |
fdisk -l |
List partition tables for all disks |
Requires root; use sudo fdisk -l |
mount /dev/sdb1 /mnt/data |
Mount a partition to a directory |
Directory must exist first; use mkdir -p /mnt/data |
umount /mnt/data |
Unmount a filesystem |
Ensure no processes are using the mount point first |
blkid |
Show UUIDs and filesystem types of block devices |
Use UUIDs in /etc/fstab for reliable mounting |
free -h |
Show RAM and swap usage |
Monitor available column for actual free memory |
vmstat |
Show virtual memory, CPU, and I/O statistics |
vmstat 2 5 — sample every 2 seconds, 5 times |
iostat |
Show CPU and disk I/O statistics |
Install with apt install sysstat; use iostat -x 1 for extended stats |
ncdu |
Interactive disk usage browser |
Install with apt install ncdu; navigate with arrow keys, d to delete |
Network Commands
| Command |
What it does |
Example / Notes |
ip a |
Show all network interfaces and IP addresses |
Modern replacement for ifconfig |
ip addr show eth0 |
Show details for a specific interface |
Replace eth0 with your interface name (e.g., ens3, enp3s0) |
ip route |
Show the routing table |
Check default gateway with ip route | grep default |
ifconfig |
Legacy network interface configuration tool |
Install with apt install net-tools; use ip a instead where possible |
ping host |
Test connectivity to a host |
ping -c 4 8.8.8.8 — send 4 packets then stop |
curl URL |
Transfer data from a URL |
curl -I https://example.com — fetch headers only; curl -o file URL to download |
wget URL |
Download a file from a URL |
wget -O filename.tar.gz URL |
netstat -tulpn |
Show listening ports and associated processes |
Requires net-tools; use ss -tulpn instead on modern systems |
ss -tulpn |
Show listening TCP/UDP ports and the processes using them |
Faster and more accurate than netstat |
nmap host |
Scan open ports on a host |
nmap -sV 192.168.1.1 — detect service versions; install with apt install nmap |
traceroute host |
Trace the network path to a host |
traceroute 8.8.8.8; install with apt install traceroute |
dig domain |
Perform a DNS lookup with detailed output |
dig serverman.co.uk A; dig @8.8.8.8 domain to query a specific resolver |
nslookup domain |
Simple DNS query tool |
nslookup serverman.co.uk |
host domain |
Brief DNS lookup output |
host serverman.co.uk |
arp -a |
Show ARP cache (IP to MAC address mappings) |
Useful for finding devices on the local network |
ip neigh |
Show neighbour (ARP) table |
Modern equivalent of arp -a |
hostname |
Print the system hostname |
Change permanently with hostnamectl set-hostname newname |
hostname -I |
Print all local IP addresses |
Quick way to find your server’s IP |
ufw status |
Show UFW firewall status and rules |
sudo ufw status verbose for full output |
ufw allow 22 |
Allow inbound traffic on a port |
sudo ufw allow 22/tcp; also ufw allow 'Nginx Full' |
ufw enable |
Enable the UFW firewall |
Ensure SSH is allowed before enabling: sudo ufw allow ssh |
| Command |
What it does |
Example / Notes |
uname -a |
Show all system information (kernel, hostname, architecture) |
Full system summary in one line |
uname -r |
Show the running kernel version |
Useful before and after kernel upgrades |
hostnamectl |
Show detailed system identity and OS information |
Includes hostname, machine ID, OS, kernel, and architecture |
lscpu |
Show CPU architecture details |
Cores, threads, cache, virtualisation support |
lsmem |
Show memory range and size information |
Use free -h for a simpler usage summary |
lspci |
List PCI devices |
lspci | grep -i vga — identify GPU |
lsusb |
List USB devices |
Useful for identifying connected hardware in a home lab |
dmidecode |
Read hardware information from DMI/SMBIOS tables |
sudo dmidecode -t memory — show RAM module details |
cat /etc/os-release |
Show OS name and version |
Reliable way to identify the distribution and version |
uptime |
Show how long the system has been running and load averages |
Load average values: 1min, 5min, 15min |
who |
Show currently logged-in users |
Includes terminal and login time |
last |
Show history of user logins and system reboots |
last reboot — list reboot history only |
history |
Show command history for the current user |
history | grep apt — search history; !123 to re-run command 123 |
dmesg |
Print the kernel ring buffer (boot and hardware messages) |
Use sudo dmesg for full output |
dmesg | tail -20 |
Show the last 20 kernel messages |
Useful for diagnosing hardware errors and USB events |
Package Management (apt — Ubuntu/Debian)
| Command |
What it does |
Example / Notes |
apt update |
Refresh the package index from repositories |
Always run before installing or upgrading packages |
apt upgrade |
Upgrade installed packages without removing any |
Safe for routine updates; will not install new dependencies that require package removal |
apt full-upgrade |
Upgrade packages, adding or removing dependencies as needed |
Use for distribution upgrades or when apt upgrade holds packages back |
apt install package |
Install a package |
apt install nginx curl git — multiple packages in one command |
apt remove package |
Remove a package, keeping configuration files |
apt remove nginx |
apt purge package |
Remove a package and its configuration files |
Use this for a clean removal |
apt autoremove |
Remove orphaned packages no longer needed as dependencies |
Run periodically after upgrades to free disk space |
apt search term |
Search for packages by keyword |
apt search "web server" |
apt show package |
Display detailed information about a package |
Shows version, dependencies, description |
apt list --installed |
List all installed packages |
Pipe to grep package to check if something is installed |
dpkg -l |
List all installed packages (low-level) |
Status codes: ii = installed, rc = removed but config remains |
dpkg -l | grep package |
Check if a specific package is installed |
dpkg -l | grep nginx |
add-apt-repository ppa:name |
Add a PPA (Personal Package Archive) |
add-apt-repository ppa:ondrej/php; run apt update afterwards |
apt-cache policy package |
Show installed version, candidate version, and repository priority |
Useful for pinning or debugging version conflicts |
systemd Service Management
| Command |
What it does |
Example / Notes |
systemctl status service |
Show the current status and recent logs for a service |
systemctl status nginx |
systemctl start service |
Start a service immediately |
sudo systemctl start docker |
systemctl stop service |
Stop a service immediately |
sudo systemctl stop apache2 |
systemctl restart service |
Stop and start a service |
Causes a brief interruption; use reload where supported |
systemctl reload service |
Reload configuration without stopping the service |
sudo systemctl reload nginx — no downtime |
systemctl enable service |
Enable a service to start automatically at boot |
Creates symlinks in the appropriate systemd target directory |
systemctl disable service |
Prevent a service from starting at boot |
Does not stop the currently running service |
systemctl is-active service |
Return whether a service is currently active |
Returns active or inactive — useful in scripts |
systemctl list-units --type=service |
List all loaded service units and their state |
Add --all to include inactive services |
journalctl -u service |
Show all logs for a specific service |
journalctl -u nginx |
journalctl -u service -f |
Follow live logs for a service |
journalctl -fu nginx |
journalctl -u service --since "1 hour ago" |
Show logs from the last hour for a service |
Also accepts: "2024-01-01 12:00:00", yesterday |
journalctl -xe |
Show recent journal entries with context, jumping to the end |
First place to look after a failed service start |
systemctl daemon-reload |
Reload systemd manager configuration |
Run after creating or editing a .service unit file in /etc/systemd/system/ |
SSH and Remote Access
| Command |
What it does |
Example / Notes |
ssh user@host |
Connect to a remote host over SSH |
ssh ubuntu@192.168.1.100 |
ssh -p 2222 user@host |
Connect using a non-standard SSH port |
Common when port 22 is remapped for security |
ssh -i ~/.ssh/key user@host |
Connect using a specific private key |
Key must have permissions 600 |
ssh-keygen -t ed25519 |
Generate a new ED25519 key pair |
Preferred over RSA for new keys; saves to ~/.ssh/ by default |
ssh-copy-id user@host |
Copy your public key to a remote host’s authorised keys |
Enables passwordless SSH login |
scp file user@host:/path |
Securely copy a file to a remote host |
scp backup.tar.gz ubuntu@nas:/backups/ |
scp -r dir user@host:/path |
Recursively copy a directory to a remote host |
Use rsync for large or resumable transfers |
rsync -avz source/ user@host:/dest/ |
Sync files to a remote host, showing progress |
-a archive, -v verbose, -z compress in transit |
rsync -avz --delete source/ dest/ |
Sync and delete files in destination not present in source |
Useful for backups; test without --delete first |
SSH config shortcut
Create or edit ~/.ssh/config to define aliases for frequently accessed hosts:
Host myserver\\n HostName 192.168.1.100\\n User ubuntu\\n IdentityFile ~/.ssh/id_ed25519\\n Port 22
After saving, connect with simply ssh myserver.
Cron Jobs
Crontab commands
| Command |
What it does |
Example / Notes |
crontab -e |
Edit the current user’s crontab |
Opens in the default editor; set with EDITOR=nano crontab -e |
crontab -l |
List the current user’s scheduled cron jobs |
sudo crontab -l -u username to view another user’s crontab |
crontab -r |
Remove the current user’s crontab entirely |
Irreversible — back up with crontab -l > crontab.bak first |
Cron syntax
# ┌───────────── minute (0–59)\\n# │ ┌─────────── hour (0–23)\\n# │ │ ┌───────── day of month (1–31)\\n# │ │ │ ┌─────── month (1–12)\\n# │ │ │ │ ┌───── day of week (0–7, Sunday = 0 or 7)\\n# │ │ │ │ │\\n# * * * * * command to execute
| Expression |
Meaning |
0 2 * * * |
Every day at 02:00 |
*/15 * * * * |
Every 15 minutes |
0 0 * * 0 |
Every Sunday at midnight |
0 9-17 * * 1-5 |
Every hour from 09:00 to 17:00, Monday to Friday |
30 4 1 * * |
At 04:30 on the first day of every month |
@reboot |
Once when the system boots |
@daily |
Once per day (equivalent to 0 0 * * *) |
@weekly |
Once per week (equivalent to 0 0 * * 0) |
@monthly |
Once per month (equivalent to 0 0 1 * *) |
Text Processing
| Command |
What it does |
Example / Notes |
grep |
Search for lines matching a pattern |
grep -r "error" /var/log/ — search all logs for errors |
sed |
Stream editor for filtering and transforming text |
sed -i 's/old/new/g' file.txt — find and replace in place across entire file |
awk |
Pattern scanning and text processing language |
awk '{print $1}' file — print the first field of each line |
sort |
Sort lines of text |
sort -n file — numeric sort; sort -r — reverse order |
uniq |
Remove consecutive duplicate lines |
sort file | uniq — sort first to ensure duplicates are adjacent |
cut |
Extract sections from each line of a file |
cut -d',' -f2 file.csv — extract the second column from a CSV |
tr |
Translate or delete characters |
cat file | tr '[:lower:]' '[:upper:]' — convert file contents to uppercase |
wc |
Count lines, words, and characters |
wc -l file — line count; wc -w file — word count |
Practical text processing one-liners
# Find and replace a string across a file\\nsed -i 's/oldstring/newstring/g' config.txt\\n\\n# Print the third column from a space-delimited file\\nawk '{print $3}' access.log\\n\\n# Show unique IP addresses from an Nginx access log\\nawk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn\\n\\n# Remove blank lines from a file\\nsed -i '/^$/d' file.txt\\n\\n# Extract the second field from a colon-delimited file\\ncut -d':' -f2 /etc/passwd\\n\\n# Count how many times each HTTP status code appears in a log\\nawk '{print $9}' /var/log/nginx/access.log | sort | uniq -c | sort -rn
Archives and Compression
| Command |
What it does |
Example / Notes |
tar -czf archive.tar.gz /path |
Create a gzip-compressed tar archive |
tar -czf backup-$(date +%F).tar.gz /etc/nginx |
tar -xzf archive.tar.gz |
Extract a gzip-compressed tar archive |
Add -C /dest/ to extract to a specific directory |
tar -tzf archive.tar.gz |
List the contents of a tar.gz archive without extracting |
Verify contents before extracting |
tar -cjf archive.tar.bz2 /path |
Create a bzip2-compressed tar archive |
Better compression than gzip but slower |
zip -r archive.zip /path |
Create a zip archive recursively |
zip -r configs.zip /etc/nginx /etc/mysql |
unzip archive.zip |
Extract a zip archive |
unzip archive.zip -d /dest/ — extract to a specific directory |
gzip file |
Compress a single file with gzip |
Replaces the original file with file.gz |
gunzip file.gz |
Decompress a gzip file |
Equivalent to gzip -d file.gz |
7z a archive.7z /path |
Create a 7-Zip archive |
Install with apt install p7zip-full; highest compression ratio |
7z x archive.7z |
Extract a 7-Zip archive |
7z x archive.7z -o/dest/ — extract to a specific path |
Useful One-Liners
# Check what's listening on a specific port\\nss -tulpn | grep :80\\n\\n# Find files larger than 1 GB\\nfind / -type f -size +1G 2>/dev/null\\n\\n# Watch a command refresh every 2 seconds\\nwatch -n 2 df -h\\n\\n# Tail multiple log files at once\\ntail -f /var/log/syslog /var/log/auth.log\\n\\n# Count lines in a log file matching a pattern\\ngrep -c "ERROR" /var/log/app.log\\n\\n# Recursively find and delete files by extension\\nfind /path -name "*.tmp" -delete\\n\\n# Show the 10 largest directories\\ndu -h --max-depth=1 / 2>/dev/null | sort -rh | head -10\\n\\n# Check which process is using a specific port\\nlsof -i :8080\\n\\n# Follow systemd logs for the Docker service\\njournalctl -fu docker\\n\\n# Generate a random 32-character password\\nopenssl rand -base64 32\\n\\n# Show failed login attempts\\ngrep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn\\n\\n# Display real-time network interface statistics\\nwatch -n 1 cat /proc/net/dev\\n\\n# Find all SUID files (potential privilege escalation vectors)\\nfind / -perm /4000 -type f 2>/dev/null\\n\\n# Quickly test if a remote port is open (no nmap required)\\ntimeout 3 bash -c 'cat < /dev/null > /dev/tcp/192.168.1.1/22' && echo "Open" || echo "Closed"\\n\\n# Show disk I/O per process\\niotop -o\\n\\n# List the 10 most recently modified files in a directory\\nfind /var/log -type f -printf '%T@ %p\\\\n' | sort -rn | head -10 | awk '{print $2}'\\n\\n# Reload shell configuration without logging out\\nsource ~/.bashrc\\n\\n# Show environment variables sorted alphabetically\\nenv | sort
Related articles: n8n Expressions Cheat Sheet: Variables, Functions and Syntax, Proxmox Cheat Sheet: CLI Commands for VMs, LXC and Storage, Git Cheat Sheet: Every Command You Need, How to Revive an Old PC with Linux