Short answer: the tables below group the Linux commands a server admin actually reaches for — files, processes, networking, permissions, packages — with the one-line version of what each does. Where a command has its own in-depth article (a full cheat sheet, or a specific error it throws), the table links to it.
Files and directories
| Command | What it does |
|---|---|
| ls -la | List files, including hidden ones, with permissions and sizes |
| cd path | Change directory |
| pwd | Print the current directory |
| cp -r src dst | Copy, recursively for a directory |
| mv src dst | Move or rename |
| rm -rf path | Delete, recursively and without confirmation — no undo |
| mkdir -p a/b/c | Create a directory, and any missing parent directories |
| touch file | Create an empty file, or update its modified time |
| ln -s target link | Create a symbolic link |
| find /path -name '*.log' | Search for files by name, recursively |
| df -h | Disk space free, per mounted filesystem, in human-readable units |
| du -sh path | Total size of a directory |
For finding what is filling a disk rather than just how full it is, see checking disk usage on Linux.
Permissions and ownership
| Command | What it does |
|---|---|
| chmod 755 file | Set exact permissions by octal mode |
| chmod +x file | Add execute, leaving read/write as they were |
| chown user:group file | Change the owning user and group |
| ls -l file | Show a file's current mode and owner |
The full reference — octal vs symbolic mode, recursive chmod without breaking directories, and why 777 is almost never the fix — is in the chmod command guide.
Processes
| Command | What it does |
|---|---|
| ps aux | List every running process |
| top / htop | Live, updating view of CPU and memory per process |
| kill PID | Ask a process to stop (SIGTERM) |
| kill -9 PID | Force-kill a process (SIGKILL, no cleanup) |
| pkill name | Kill by process name instead of PID |
| nohup cmd & | Run a command that survives the terminal closing |
What every column in ps aux actually means is in ps aux explained.
Networking
| Command | What it does |
|---|---|
| ip -4 addr show | Show IPv4 addresses on every interface |
| ip route | Show the routing table |
| ss -tlnp | List listening TCP ports and the process on each |
| ping host | Test reachability and round-trip time |
| curl -I url | Fetch just the HTTP headers of a URL |
| dig domain | Query DNS records for a domain |
| nc -zv host port | Test whether a single TCP port is open |
More on ss, lsof and the other ways to check what is listening in checking open ports on Linux.
Setting an address so it stops changing on reboot is covered in static IP addresses, and clearing a stale DNS answer in flushing the DNS cache.
Services and logs (systemd)
| Command | What it does |
|---|---|
| systemctl status name | Is a service running, and its recent log lines |
| systemctl restart name | Restart a service |
| systemctl enable name | Start a service automatically on boot |
| journalctl -u name -f | Follow a service's logs live |
| journalctl -xe | Jump to the end of the system log with extra context |
Installing software
| Distribution | Install | Update everything |
|---|---|---|
| Debian · Ubuntu | sudo apt install name | sudo apt update && sudo apt upgrade |
| RHEL · Rocky · Alma | sudo dnf install name | sudo dnf upgrade |
| Alpine | sudo apk add name | sudo apk update && sudo apk upgrade |
A command not found right after installing often means the shell has not reloaded its command path yet (hash -r fixes that), or the package installs under a different binary name than expected:
| Command missing | Guide |
|---|---|
| curl | curl-command-not-found |
| wget | wget-command-not-found |
| git | git-command-not-found |
| python3 / pip | pip-command-not-found |
| docker | docker-command-not-found |
| npx | npx-command-not-found |
| sudo | sudo-command-not-found |
| systemctl | systemctl-command-not-found |
Text processing
| Command | What it does |
|---|---|
| cat file | Print a file's contents |
| less file | Page through a file (q to quit) |
| grep text file | Search for text inside a file |
| grep -r text dir | Search recursively through a directory |
| tail -f file | Follow a file as new lines are written to it |
| wc -l file | Count lines in a file |
| sed 's/old/new/g' file | Replace text (stream editor) |
Archives and transfers
| Command | What it does |
|---|---|
| tar -czvf out.tar.gz dir/ | Create a compressed archive |
| tar -xzvf out.tar.gz | Extract one |
| scp file user@host:/path | Copy a file to a remote server over SSH |
| rsync -av src/ user@host:/path/ | Sync a directory, only transferring what changed |
For an interactive session instead of a one-shot copy, see the sftp command.
More tar flags and what each one does in extracting tar.gz files on Linux.
Docker
Containers, images, Compose and cleanup have grown into their own reference: the Docker commands cheat sheet.
The one command that stops everyone
Sooner or later something opens vim — a git commit, crontab -e, a minimal server image with no nano installed — and the hardest part is getting back out:
Esc then :wq saves and quits; :q! quits and discards changes. The full table of exit commands, and why vim gets stuck in the first place, is in how to exit vim.
SSH, the entry point to all of the above
Every command on this page assumes you can already get into the server — start with generating an SSH key if you have not yet.
For the order to run these in on a brand-new server — create a user, lock down SSH, set up a firewall — see initial server setup.
Frequently asked
What is the most important Linux command for a beginner to learn first?
cd and ls — moving around and seeing what is there — followed by cat or less to read a file and sudo for anything that needs elevated permissions. Everything else builds on being able to navigate and read first.
How do I see what is using CPU or memory on a Linux server?
top or htop for a live, updating view; ps aux for a one-time snapshot. htop is easier to read but is not always preinstalled — apt install htop or dnf install htop adds it.
How do I find a file when I don't know which directory it's in?
find / -name 'filename' searches recursively from the root; locate filename is faster if the locate database is installed and up to date (updatedb refreshes it), but will not find anything created since the last update.
What is the difference between kill and kill -9?
kill PID sends SIGTERM, asking the process to shut down cleanly and save its state. kill -9 PID sends SIGKILL, which the process cannot ignore or clean up after — use it only once a plain kill has failed.