Skip to content

Essential Linux Commands

Overview

Every SSH session starts here. Fluent use of these tools is the baseline for automation and incident response.

This is Tutorial 3 in Module 2: Command Line Essentials of the REBASH Academy Linux for Cloud & DevOps Engineers series — written for administrators, DevOps engineers, SREs, and platform engineers operating production Linux.

Prerequisites

  • Boot Process and Filesystem Hierarchy
  • Terminal access with a regular user account (sudo where noted)

Learning Objectives

By the end of this tutorial, you will be able to:

  • Apply the core ideas of “Essential Linux Commands” on a real Linux host
  • Use modern tools (ip/ss, systemctl/journalctl) where they apply
  • Complete the lab under ~/rebash-linux/ with clear outputs
  • Relate this topic to Cloud, DevOps, and production operations
  • Explain the failure modes you would check first in an incident

Architecture

Linux ops work sits between humans/automation and the kernel, services, and network. This topic’s control points are shown below.

Architecture diagram for Essential Linux Commands

Theory

What it is

Essential Linux commands are the everyday Command Line Interface (CLI) tools for navigating the filesystem, creating and moving files, inspecting content, and reading metadata. Navigation (pwd, ls, cd), mutation (mkdir, touch, cp, mv, rm), viewing (cat, less, head, tail), and inspection (stat, file, history) form the baseline every SSH session and shell script builds on. Composition — redirection (>, >>, 2>) and pipes (|) — turns these tools into small pipelines rather than one monolithic programme.

Why it matters

Incident response, configuration checks, and automation all start with fluent navigation and safe file operations. Operators who guess at paths or paste destructive rm patterns cause outages; those who can page logs with less, follow with tail -f, and confirm type and mode with stat/file move faster and with less risk. Cloud and Continuous Integration (CI) environments expose the same commands inside containers and runners, so this fluency transfers across hosts.

How it works

The shell resolves your current working directory; relative paths are interpreted against it, while absolute paths start at /. ls lists directory entries; flags such as -la and -lh add hidden files and human-readable sizes. cp -a preserves mode and timestamps for archives; mv renames or relocates within or across directories on the same host. rm unlinks names — recursive -r is powerful and dangerous on production. Pagers and head/tail avoid dumping huge files to the terminal. stat reads inode metadata; file uses magic bytes to guess content type. Shell history and reverse search (Ctrl-R) speed repetition without retyping secrets into tickets.

Key concepts and comparisons

Need Prefer
Whole small file cat
Browse / search large file less
First or last lines head / tail (-f to follow)
Copy preserving attributes cp -a
Rename or relocate mv
Metadata (mode, times, inode) stat
Habit Safer alternative
Blind rm -rf with variables Quote paths; use -i/-I; dry-run with ls first
cat huge logs less or tail
Guessing file type by extension file

Common pitfalls

  • Running rm -rf on an unquoted variable that expands empty (classic “delete from cwd” failure).
  • Using cat on multi-gigabyte logs and locking your session.
  • Assuming cd succeeded without checking (cd … \|\| exit in scripts).
  • Copying with cp without -a and losing permissions needed by services.
  • Leaving secrets in shell history; disable history for sensitive one-offs or use dedicated secret stores.

Hands-on Lab

Create a workspace for this tutorial.

mkdir -p ~/rebash-linux/lab03 && cd ~/rebash-linux/lab03

Focus: navigate lab tree; practise cp/mv/rm safely; use less/stat/history

Step 1 – Command workout

mkdir -p docs/bin
touch docs/readme.txt
echo 'hello rebash' > docs/readme.txt
cp docs/readme.txt docs/readme.copy
mv docs/readme.copy docs/readme.bak
head -n 1 docs/readme.txt
tail -n 1 docs/readme.txt
cat docs/readme.txt
less -f docs/readme.txt </dev/null || true
stat docs/readme.txt
file docs/readme.txt
history | tail -n 5 || true
ls -la docs

Final step – Cleanup note

# Keep ~/rebash-linux/ for later tutorials; destroy disposable cloud resources from this lab

Validation

  • Lab commands run under ~/rebash-linux/lab03/
  • You can explain each Theory bullet in your own words
  • You used modern tooling where applicable (ip/ss, systemctl/journalctl)
  • You can describe one production failure mode for this topic

Code Walkthrough

Production Linux practice for Essential Linux Commands always combines:

  1. Inspect before you change (status, df, ip, logs)
  2. Prefer reversible, documented changes (config management, drop-ins)
  3. Capture evidence (command output, journal snippets) for handovers
  4. Prefer systemctl/journalctl and ip/ss over legacy tools
  5. Least privilege — escalate with sudo only when required

Keep runbooks short enough to follow at 03:00. Automate the boring checks; keep humans for judgement.

Security Considerations

  • Treat host access and sudo as privileged — audit who can do what
  • Never paste secrets into shell history, tickets, or screenshots
  • Validate device names and paths before destructive disk or rm operations
  • Prefer key-based SSH and deny password auth on internet-facing hosts
  • Collect logs centrally; restrict who can read authentication and audit trails

Common Mistakes

Using legacy networking tools by default

ifconfig/netstat are missing or incomplete on modern images. Fix: use ip and ss.

Editing vendor unit files in place

Package upgrades overwrite /lib/systemd/system. Fix: systemctl edit drop-ins under /etc.

Trusting df without checking inodes and mounts

A full /var or exhausted inodes looks different from root. Fix: df -h, df -i, and findmnt.

Best Practices

  • Golden images + config as code over snowflake hosts
  • Alert on symptoms (failed units, disk, load) with runbooks attached
  • Time-sync (chrony) everywhere — logs and TLS depend on it
  • Separate OS and data volumes on Cloud VMs
  • Practise restore and rescue paths before you need them

Troubleshooting

Symptom Likely cause Fix
Permission denied Mode/owner/ACL/MAC namei -l, id, getfacl, SELinux/AppArmor logs
No route / timeout Routing, DNS, firewall ip route, dig, ss, security groups
Service won’t start Unit/config/deps systemctl status, journalctl -u, config -t
Disk full Logs, containers, deleted-open df/du, lsof +L1, rotate/expand
High load CPU, I/O wait, thrash vmstat, iostat, ps

Summary

Essential Linux Commands is essential for Cloud and DevOps engineers operating Linux hosts. Practise the lab until the inspection path is muscle memory, then continue the track.

Interview Questions

  1. How does this topic show up when operating Cloud VMs or Kubernetes nodes?
  2. What would you check first if this area misbehaves in production?
  3. Which modern Linux tools replace older equivalents here?
  4. What security control should accompany this capability?
  5. How would you automate verification of this topic in CI or a cron/timer job?

Sample answer — question 2

Start with blast radius and recent changes, then gather host signals (systemctl --failed, df, ip/ss, journalctl) before making changes. Fix forward with evidence, not guesswork.

References