Free reference
Linux command cheat sheet
The commands that actually get typed when a Linux box misbehaves, grouped by job rather than alphabetically. The notes at the bottom are the part worth reading: they settle the things people get wrong under pressure.
PERMISSIONS
| OCT | BITS | MEANS |
|---|---|---|
7 | rwx | read write exec |
6 | rw- | read write |
5 | r-x | read exec |
4 | r-- | read only |
0 | --- | nothing |
MODES YOU ACTUALLY USE
644 | regular files |
755 | directories, scripts |
600 | private keys, .ssh |
400 | read-only secrets |
1777 | /tmp, sticky bit |
CHANGING THEM
chmod 755 file | |
chmod -R u+rwX,go+rX dir/ | |
chown user:group file | |
umask 022 new files 644, dirs 755 |
SYSTEMD
systemctl status svc | |
systemctl start|stop svc | |
systemctl restart svc | |
systemctl reload svc | |
systemctl enable --now svc | |
systemctl daemon-reload | |
systemctl list-units --failed | |
systemctl cat svc |
THE LOGS
journalctl -u svc -f | |
journalctl -u svc --since '10 min ago' | |
journalctl -p err -b |
SSH
ssh -i key.pem user@host | |
ssh -vvv user@host why it refused you | |
chmod 600 ~/.ssh/id_ed25519 |
WHEN THE BOX IS SICK
DISK
df -h space | |
df -i inodes | |
du -xh --max-depth=1 | sort -h | |
lsof +L1 deleted but still open |
MEMORY AND CPU
free -h | |
ps aux --sort=-%mem | head | |
uptime load average, per core |
PORTS AND PROCESSES
ss -tulpn what is listening | |
lsof -i :8080 who owns the port | |
kill -TERM pid ask nicely | |
kill -KILL pid last resort | |
pkill -f pattern |
KERNEL
dmesg -T | tail -40 |
The parts people get wrong
These are the distinctions that cost real time. They are the reason this sheet exists rather than another list of commands.
df says the disk is full but du says it is empty
A deleted file is still held open by a running process. Run lsof +L1, then restart whatever is holding it.
Writes fail but df shows free space
You are out of inodes, not bytes. Check df -i.
What the execute bit does on a directory
Execute on a directory means you can enter it, not run it. Dropping x on a directory hides everything inside.
Why chmod -R 755 is usually wrong
chmod -R 755 makes every file executable too. Use find dir -type f -exec chmod 644 {} + for the files.
systemctl enable vs start
enable does not start the service. start does not survive a reboot. enable --now does both.
Edited a systemd unit file and nothing changed
Edited a unit file and nothing changed? daemon-reload first, then restart.
systemctl restart vs reload
restart drops every connection. reload does not, if the unit actually supports it. systemctl cat tells you.
Is a load average of 4.00 bad?
Load average is per core. 4.00 on four cores is busy. 4.00 on one core is drowning.
ss vs netstat
ss replaced netstat years ago and is already installed. Same job, better output.