Chapter 11 — Command reference
Quick tables for the commands used throughout the manual. READ-ONLY rows are safe to run anywhere; MUTATING rows change the host; [root] rows need privilege. Citations point to the authoritative man page or project documentation. Exact option sets are version-dependent — confirm against the installed man page.
Orientation and shell
| Command | Class | Purpose |
|---|
cat /etc/os-release | READ-ONLY | Distribution/release identity (os-release(5)) |
id; getent passwd NAME; getent group GROUP | READ-ONLY | Identity and NSS lookup (getent(1)) |
pwd, ls -la, cd -- /path, command -v tool, type tool | READ-ONLY | Navigation/discovery (POSIX) |
find . -type f -exec command {} + | READ-ONLY/execute | Filename-safe iteration (POSIX find) |
printf '%s\n' ... | sudo tee /etc/file | MUTATING · [root] | Privileged write (redirection trap workaround) (Sudo manual) |
Permissions, users, sudo
| Command | Class | Purpose |
|---|
ls -ld -- path; stat -- path; namei -l path; getfacl -p path; findmnt -T path | READ-ONLY | Permission chain inspection (getfacl(1)) |
chmod u+rw,o-rwx file; chmod 0640 file; umask 027 | MUTATING | Mode changes; umask affects new files only (GNU Coreutils: chmod) |
chgrp project /srv/project && chmod 2770 /srv/project | MUTATING | Shared-directory setgid pattern (GNU Coreutils: setgid) |
setfacl -m u:alice:rw file; setfacl -m d:g:project:rwx /srv/project | MUTATING | ACL entries (setfacl(1)) |
useradd --create-home alice; usermod -aG GROUP USER; id alice | MUTATING · [root] | Account + supplementary group (note -a) (useradd(8); usermod(8)) |
sudo -l; sudo -v; sudoedit FILE | READ-ONLY/EDIT | Privilege inspection and safe editing (Sudo manual) |
visudo -f /etc/sudoers.d/NAME; visudo -c | MUTATING · [root] | Validated sudoers editing (visudo(8)) |
Packages (per family)
| Command | Class | Purpose |
|---|
apt list --upgradable; apt show/policy P; apt-get -s install P | READ-ONLY | Inspect/simulate (apt(8)) |
sudo apt update | MUTATING · [root] | Refresh indexes only (Debian Reference) |
sudo apt install/remove P | MUTATING · [root] | Transactions; review removals (Ubuntu: Package management) |
dnf info P; dnf repoquery --whatprovides /path; dnf history list/info ID | READ-ONLY | Inspect/audit (DNF Command Reference) |
sudo dnf install/remove P; sudo dnf upgrade | MUTATING · [root] | Transactions; check-update exits 100/0/1 (DNF Command Reference) |
pacman -Ss/-Qi/-Ql/-Qo | READ-ONLY | Query (Arch) (ArchWiki: pacman) |
sudo pacman -S P; sudo pacman -Syu | MUTATING · [root] | Install; full system upgrade only (ArchWiki: System maintenance) |
systemd, processes, logs
| Command | Class | Purpose |
|---|
ps -p 1 -o comm=; systemctl --version | READ-ONLY | Init-system detection (systemctl(1)) |
systemctl status/cat/show UNIT; list-units --type=service --all | READ-ONLY | Unit inspection (systemctl(1)) |
systemctl start/stop/enable/disable [--now] UNIT | MUTATING | Runtime vs boot state (systemd.service(5)) |
systemctl restart UNIT vs systemctl reload UNIT | MUTATING | Restart vs application config reload (systemd.service(5)) |
sudo systemctl daemon-reload | MUTATING · [root] | Reread unit definitions after edits (systemd.unit(5)) |
systemctl edit UNIT; systemctl cat UNIT | EDIT/READ-ONLY | Drop-ins and merged config (systemctl(1)) |
systemctl list-timers --all; systemd-analyze calendar 'SPEC' | READ-ONLY | Timer inspection/validation [systemd] (systemd.timer(5)) |
journalctl -b; -u NAME -b; --since '1 hour ago'; -p warning..alert; -k -b -1 | READ-ONLY | Journal queries (journalctl(1)) |
journalctl --disk-usage; --vacuum-time=/--vacuum-size= | READ-ONLY / HIGH-RISK | Inspect / delete archived journals (journalctl(1)) |
ps -eo ... --sort=-%cpu; pgrep -a; pstree -ap; top; free -h; vmstat 1; uptime; nproc | READ-ONLY | Process/resource inventory (ps(1); loadavg) |
Networking, firewall, TLS
| Command | Class | Purpose |
|---|
ip -br address; ip route get DEST; ip rule; ip route show table all | READ-ONLY | Addresses/routes/policy (ip(8); ip-route(8)) |
getent ahosts NAME vs dig [@RESOLVER] [+tcp] NAME | READ-ONLY | NSS path vs raw DNS (getent(1); dig(1)) |
ss -lntup | READ-ONLY (attribution: [root]) | Listeners and binds (ss(8)) |
resolvectl status; readlink -f /etc/resolv.conf | READ-ONLY | Resolver ownership (resolvectl) |
sudo firewall-cmd --state/--get-active-zones/--zone=Z --list-all | READ-ONLY · [root] | firewalld inspection (firewall-cmd) |
sudo nft list ruleset; sudo nft -c -f FILE | READ-ONLY / validate | nftables inspection/validation (nft(8)) |
sudo ufw status verbose | READ-ONLY · [root] | UFW inspection (Ubuntu: Firewall) |
sudo sshd -t; sudo sshd -T [-C spec] | validate · [root] | sshd syntax/effective config (sshd(8)) |
openssl s_client -connect IP:PORT -servername HOST -verify_hostname HOST -verify_return_error -showcerts | READ-ONLY | TLS identity check (OpenSSL s_client; RFC 9525) |
sudo tcpdump -ni any "host IP and tcp port PORT" | READ-ONLY · [root] | Packet-path evidence (tcpdump(8)) |
Storage, backup, monitoring
| Command | Class | Purpose |
|---|
lsblk -o ...; blkid; `findmnt [--target | --fstab | --verify]` | READ-ONLY | Device/mount identity (lsblk(8); findmnt(8)) |
pvs; vgs; lvs -a -o +devices; cat /proc/mdstat; mdadm --detail /dev/mdX; cryptsetup status NAME; cryptsetup luksDump DEV | READ-ONLY · [root] | LVM/RAID/LUKS inventory (LVM2; mdadm(8); cryptsetup(8)) |
df -hT /path; df -ih /path; du -xhd1 /path [GNU]; du --inodes [GNU] | READ-ONLY | Capacity, both axes (df(1); du(1)) |
restic snapshots; restic ls SNAP; restic check [--read-data[--subset]] | READ-ONLY | Backup verification (restic) |
restic restore SNAP --target DIR [--dry-run -vv] [--include ...] | MUTATING (restore) | Restore; preview deletions with --dry-run -vv (restic restore) |
systemctl --failed; journalctl -b -p warning..alert; iostat -xz 1 [sysstat] | READ-ONLY | First-pass health (journalctl(1); sysstat) |