A practical Linux command reference — what you actually run from a terminal. Works on most Linuxes and macOS (BSD sed/find have minor quirks; flagged where it matters).
Files & directories
| Command | What it does |
pwd | Print working directory |
ls -lah | List with sizes, permissions, hidden files |
cd ~ | Go home |
cd - | Go to previous directory |
mkdir -p a/b/c | Create nested directories |
cp file dest / cp -r dir dest | Copy file / directory |
mv old new | Move or rename |
rm file | Delete file |
rm -rf dir | Delete directory recursively (DESTRUCTIVE) |
ln -s target link | Symbolic link |
touch file | Create empty file / update timestamp |
du -sh * | Size of each item in current dir, human-readable |
du -sh * | sort -h | Sorted by size |
df -h | Disk space free per filesystem |
tree -L 2 | Visual directory tree, 2 levels deep |
Search & find
| Command | What it does |
find . -name "*.log" | Files matching name |
find . -type d -name node_modules | Directories named node_modules |
find . -mtime -7 | Modified in last 7 days |
find . -size +100M | Larger than 100 MB |
find . -name "*.tmp" -delete | Find and delete |
find . -name "*.js" -exec grep "TODO" {} + | Run command on each match |
grep "pattern" file | Lines matching pattern |
grep -r "pattern" . | Recursive grep |
grep -rni "todo" --include="*.js" | Recursive, case-insensitive, line numbers, only .js |
rg "pattern" | ripgrep — much faster than grep |
locate filename | Find file by name (uses index) |
which python | Path to executable in $PATH |
Viewing files
| Command | What it does |
cat file | Print whole file |
less file | Page through file (q to quit, / to search) |
head -20 file | First 20 lines |
tail -20 file | Last 20 lines |
tail -f file | Follow new lines as they arrive (logs) |
wc -l file | Count lines |
Text processing
| Command | What it does |
sort file | Sort lines |
sort -u file | Sort + remove duplicates |
sort -hr | Sort by human-readable numbers, reverse |
uniq file | Remove consecutive duplicates (sort first!) |
uniq -c | Count occurrences |
cut -d',' -f1,3 file.csv | Columns 1 and 3 by comma |
awk '{print $1}' | First whitespace-separated field |
awk -F',' '{sum += $2} END {print sum}' | Sum column 2 |
sed 's/old/new/g' file | Substitute (print to stdout) |
sed -i 's/old/new/g' file | Substitute in-place |
tr 'a-z' 'A-Z' | Translate (e.g., upper case) |
jq '.users[].email' data.json | Extract from JSON (separate install) |
Pipes & redirection
cmd1 | cmd2 # pipe stdout of cmd1 to stdin of cmd2
cmd > file # write stdout to file (overwrite)
cmd >> file # append stdout to file
cmd 2> errors.log # redirect stderr
cmd > out 2> err # split stdout and stderr
cmd &> combined.log # both to one file
cmd < input.txt # read stdin from file
echo "hi" | tee file # write to file AND stdout
Permissions
| Command | What it does |
chmod 644 file | rw for owner, r for group/others |
chmod 755 file | rwx owner, rx group/others (typical executable) |
chmod +x script.sh | Add execute bit |
chmod -R 755 dir | Recursive |
chown user:group file | Change owner + group |
sudo command | Run as root (or another user with -u) |
Permission notation: 4=read, 2=write, 1=execute. Add to combine. 755 = 7 (4+2+1) for owner, 5 (4+1) for group + others.
Processes
| Command | What it does |
ps aux | All running processes |
ps aux | grep nginx | Filter for a process |
top / htop | Live process viewer (htop is friendlier) |
kill <pid> | Send SIGTERM (graceful) |
kill -9 <pid> | SIGKILL (force, no cleanup) |
killall nginx | Kill all processes by name |
cmd & | Run in background |
nohup cmd & | Background + survive logout |
jobs | List jobs in current shell |
fg %1 | Bring job 1 to foreground |
bg %1 | Resume job 1 in background |
Networking
| Command | What it does |
curl -I url | HEAD request — show headers |
curl -L url | Follow redirects |
curl -X POST -H "Content-Type: application/json" -d '{"a":1}' url | POST JSON |
wget url | Download file |
ping host | ICMP echo |
dig example.com | DNS lookup |
nslookup example.com | DNS lookup (older alternative) |
ss -tulpn | Open TCP/UDP ports + processes (modern) |
netstat -tulpn | Same (legacy) |
traceroute host | Path to a host |
ip a | Network interfaces |
Compression / archives
| Command | What it does |
tar -czvf out.tar.gz dir/ | Create gzipped tar |
tar -xzvf in.tar.gz | Extract gzipped tar |
tar -xzvf file.tar.gz -C /target/ | Extract to specific directory |
zip -r out.zip dir/ | Create zip |
unzip file.zip | Extract zip |
gzip file / gunzip file.gz | Single-file compress / decompress |
Variables & scripting
# Variable
NAME="Alice"
echo "Hello $NAME"
# Command substitution
TODAY=$(date +%Y-%m-%d)
echo "Today is $TODAY"
# Conditionals
if [ -f "file.txt" ]; then echo "exists"; fi
if [[ "$1" == "deploy" ]]; then ./deploy.sh; fi
# Loops
for f in *.log; do gzip "$f"; done
for i in {1..5}; do echo $i; done
# Functions
greet() { echo "Hello, $1"; }
greet Alice
# Exit on first error (recommended at top of scripts)
set -euo pipefail
SSH
| Command | What it does |
ssh user@host | Connect |
ssh -p 2222 user@host | Custom port |
ssh-keygen -t ed25519 | Generate keypair |
ssh-copy-id user@host | Install your public key on server |
scp file user@host:/path/ | Copy file to server |
rsync -avz dir/ user@host:/path/ | Smart sync (resumable, only deltas) |
ssh -L 8080:localhost:80 user@host | Tunnel local 8080 to host's 80 |
Related tools
Test regex patterns before sed/grep: regex tester. Compute or verify file SHA hashes: hash generator. Decode Base64-encoded payloads (e.g., from environment files): Base64 encoder/decoder.