Linux Complete Cheatsheet

# Format: [type][owner rwx][group rwx][other rwx]
  -  r w x  r - x  r - -
  │  │ │ │  │ │ │  │ │ │
  │  └─┴─┘  └─┴─┘  └─┴─┘
  │  Owner   Group  Others
  │
  └─ Type: - file | d directory | l symlink | c char device | b block device

# Octal values:  r=4  w=2  x=1
# rwx = 4+2+1 = 7 | rw- = 4+2+0 = 6 | r-x = 4+0+1 = 5
# Common: 755 = rwxr-xr-x | 644 = rw-r--r-- | 777 = rwxrwxrwx | 600 = rw-------

# Special bits:
# SUID (4xxx) — execute as file owner (e.g. /usr/bin/passwd)
# SGID (2xxx) — execute as file group / new files inherit group
# Sticky (1xxx) — only owner can delete file in dir (e.g. /tmp = 1777)

# /etc/systemd/system/myapp.service
[Unit]
Description=My Application Server
After=network.target        # Start after network is up

[Service]
Type=simple
User=www-data
WorkingDirectory=/opt/myapp
ExecStart=/usr/bin/node /opt/myapp/server.js
Restart=on-failure         # Auto-restart on crash
RestartSec=5
Environment=NODE_ENV=production
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target  # Enable for multi-user mode

# Allows: ssh prod  (instead of ssh -i ~/.ssh/mykey.pem -p 22 ubuntu@203.0.113.5)
Host prod
    HostName    203.0.113.5
    User        ubuntu
    IdentityFile ~/.ssh/mykey.pem
    Port        22

Host bastion
    HostName    10.0.0.1
    User        admin
    IdentityFile ~/.ssh/bastion.pem

# Jump through bastion to reach internal hosts
Host internal-*
    ProxyJump   bastion
    User        ubuntu
    IdentityFile ~/.ssh/internal.pem

# Global settings
Host *
    ServerAliveInterval 60
    ServerAliveCountMax 3
    AddKeysToAgent  yes

# Enable/disable UFW
sudo ufw enable
sudo ufw disable
sudo ufw status verbose

# Allow and deny rules
sudo ufw allow 22               # Allow SSH
sudo ufw allow 80/tcp           # Allow HTTP
sudo ufw allow 443              # Allow HTTPS
sudo ufw allow from 192.168.1.0/24  # Allow from subnet
sudo ufw deny 23                # Deny telnet
sudo ufw delete allow 80        # Remove a rule
sudo ufw reset                  # Reset to defaults

# Allow app profiles
sudo ufw app list
sudo ufw allow 'Nginx Full'     # Allow both HTTP+HTTPS for nginx
sudo ufw allow 'OpenSSH'

# List rules with line numbers
sudo iptables -L -n -v --line-numbers

# Allow established connections (critical!)
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow loopback
sudo iptables -A INPUT -i lo -j ACCEPT

# Allow SSH, HTTP, HTTPS
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Drop everything else
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP

# Flush all rules
sudo iptables -F

# Key flags: c=create, x=extract, t=list, v=verbose, f=file, z=gzip, j=bzip2, J=xz

# CREATE archives
tar -czf archive.tar.gz /path/to/dir/     # gzip compressed
tar -cjf archive.tar.bz2 /path/to/dir/   # bzip2 (better compression)
tar -cJf archive.tar.xz /path/to/dir/    # xz (best compression)
tar -cf archive.tar /path/to/dir/         # no compression

# EXTRACT archives
tar -xzf archive.tar.gz                   # extract gzip
tar -xzf archive.tar.gz -C /target/dir/  # extract to specific dir
tar -xjf archive.tar.bz2                  # extract bzip2

# LIST contents (without extracting)
tar -tzf archive.tar.gz                   # list gzip archive
tar -tf archive.tar | head -20            # list first 20 items

# Extract specific file from archive
tar -xzf archive.tar.gz path/to/specific/file.txt

# Flags: -i case-insensitive | -r recursive | -n line numbers | -v invert
#        -c count matches | -l list filenames | -E extended regex | -P Perl regex
#        -w whole word | -A N after N lines | -B N before N lines | -C N context

grep "error" /var/log/syslog              # basic search
grep -i "error" app.log                    # case-insensitive
grep -rn "TODO" ./src/                      # recursive with line numbers
grep -v "#" /etc/nginx/nginx.conf           # invert (exclude comments)
grep -E "(ERROR|WARN|FATAL)" app.log        # extended regex OR
grep -P "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}" log  # Perl regex (IP addresses)
grep -C 3 "panic" kernel.log               # 3 lines context around match
grep -c "200 OK" access.log                  # count of matching lines
grep -l "password" /etc/*.conf               # list files with match

# sed 's/PATTERN/REPLACEMENT/FLAGS'  — substitution
sed 's/foo/bar/' file.txt             # replace first occurrence per line
sed 's/foo/bar/g' file.txt            # replace ALL occurrences (global)
sed 's/foo/bar/gi' file.txt           # case-insensitive global replace
sed -i 's/old/new/g' file.txt         # in-place edit (modifies file!)
sed -i.bak 's/old/new/g' file.txt     # in-place with .bak backup
sed -n '5,10p' file.txt               # print lines 5-10 only
sed '/^#/d' config.conf               # delete lines starting with #
sed '/^$/d' file.txt                  # delete empty lines
sed 's/[[:space:]]*$//' file.txt      # strip trailing whitespace
# Multi-expression:
sed -e 's/foo/bar/g' -e 's/baz/qux/g' file.txt

# awk 'PATTERN { ACTION }' file  — NR=line num, NF=field count, $1-$N=fields
awk '{print $1}' file.txt              # print first column
awk '{print $1, $3}' access.log        # print columns 1 and 3
awk -F: '{print $1, $6}' /etc/passwd   # use : as delimiter (username, home)
awk 'NR==5' file.txt                   # print only line 5
awk 'NR>=5 && NR<=10' file.txt         # print lines 5 to 10
awk '/ERROR/ {print NR": "$0}' app.log  # print ERROR lines with line num
awk '{sum+=$3} END {print sum}' data    # sum column 3
awk '{count[$1]++} END {for(k in count) print k, count[k]}' log # frequency count
awk '$5 > 100' metrics.txt             # rows where field 5 > 100
awk 'BEGIN{OFS=","} {print $1,$2,$3}' file.txt  # CSV output

# Top 10 largest files in current directory
du -ah . | sort -rh | head -10

# Count unique IP addresses in access.log
awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -20

# Find and kill processes by name
ps aux | grep "[n]ode" | awk '{print $2}' | xargs kill -9

# Watch live HTTP errors (follow + filter)
tail -f /var/log/nginx/access.log | grep --line-buffered " 5[0-9][0-9] "

# Backup and compress in one command
tar -czf - /var/www | ssh user@backup-server "cat > /backup/www-$(date +%F).tar.gz"

#  ┌─────────── minute (0 - 59)
#  │  ┌──────── hour (0 - 23)
#  │  │  ┌───── day of month (1 - 31)
#  │  │  │  ┌── month (1 - 12 or jan-dec)
#  │  │  │  │  ┌─ day of week (0-7, both 0&7=Sunday, or mon-sun)
#  │  │  │  │  │
#  *  *  *  *  *  command to execute

# EXAMPLES:
0  2  *  *  *  /usr/bin/backup.sh            # Every day at 02:00
*/5 * *  *  *  /usr/bin/check_disk.sh        # Every 5 minutes
0  9  *  *  1  /usr/bin/weekly_report.sh     # Every Monday at 09:00
0  0  1  *  *  /usr/bin/monthly_cleanup.sh   # 1st of every month at midnight
30 18 *  *  1-5 /usr/bin/eod_report.sh       # Mon-Fri at 18:30
@reboot         /usr/bin/startup_task.sh     # On every system boot
@daily          /usr/bin/daily_task.sh        # Once a day (0 0 * * *)
@weekly         /usr/bin/weekly_task.sh       # Once a week
@monthly        /usr/bin/monthly_task.sh      # Once a month

#!/bin/bash
# ^ Shebang: tells OS which interpreter to use
# Make executable: chmod +x script.sh

# ── Safe mode flags ──────────────────────────────────
set -euo pipefail    # -e: exit on error, -u: error on unset var, -o pipefail: pipe errors

# ── Variables ─────────────────────────────────────────
NAME="Alice"          # no spaces around =
AGE=30
echo "Name: $NAME, Age: $AGE"
echo "Uppercase: ${NAME^^}"     # parameter expansion
echo "Default: ${UNDEF:-'N/A'}" # default if unset
RESULT=$(date +%Y)    # command substitution
SUM=$(( 5 + 3 ))      # arithmetic expansion

# ── Arrays ────────────────────────────────────────────
FRUITS=("apple" "banana" "cherry")
echo "${FRUITS[0]}"    # first element: apple
echo "${FRUITS[@]}"    # all elements
echo "${#FRUITS[@]}"  # length: 3
FRUITS+=("date")      # append

# ── Conditionals ──────────────────────────────────────
if [[ "$NAME" == "Alice" ]]; then
    echo "Hello Alice!"
elif [[ "$NAME" == "Bob" ]]; then
    echo "Hello Bob!"
else
    echo "Who are you?"
fi

# Common test operators: [[ -f file ]] file exists
# [[ -d dir ]] directory exists | [[ -z "$var" ]] empty string
# [[ "$a" -gt "$b" ]] greater than | [[ "$a" == "$b" ]] equal
# [[ -r file ]] readable | [[ -w file ]] writable | [[ -x file ]] executable

# ── Loops ─────────────────────────────────────────────
for fruit in "${FRUITS[@]}"; do
    echo "I like $fruit"
done

for i in {1..5}; do         # brace expansion range
    echo "Count: $i"
done

for file in *.log; do        # iterate over files
    gzip "$file"
done

COUNT=0
while [[ "$COUNT" -lt 5 ]]; do
    echo "Count: $COUNT"
    (( COUNT++ ))
done

# ── Functions ─────────────────────────────────────────
greet() {
    local name="$1"     # $1 = first argument, local = scoped
    echo "Hello, ${name:-World}!"
    return 0            # exit code (0 = success)
}
greet "Alice"          # call function
greet                   # uses default "World"

# ── Script arguments ──────────────────────────────────
# $0=script name, $1-$9=positional args, $@=all args
# $#=number of args, $?=last exit code, $$=PID

# ── Error handling ────────────────────────────────────
cleanup() { echo "Cleaning up..."; }
trap cleanup EXIT      # run cleanup() on any exit
trap 'echo "Error on line $LINENO"' ERR

# ── Logging helper ────────────────────────────────────
LOG_FILE="/var/log/myscript.log"
log() { echo "[$(date +%H:%M:%S)] $*" | tee -a "$LOG_FILE"; }
log "Script started"

# Kill gracefully (SIGTERM — gives process time to clean up)
kill -15 1234     # or: kill 1234

# Force kill (SIGKILL — instant, no cleanup)
kill -9 1234      # or: kill -SIGKILL 1234

# Reload nginx config without downtime (SIGHUP)
sudo kill -HUP $(cat /var/run/nginx.pid)
# or: sudo nginx -s reload

# List all available signals
kill -l

# Trap signals in a bash script
trap 'echo "Caught SIGINT, cleaning up..."; cleanup; exit 1' SIGINT SIGTERM