Linux Basics

A working reference for getting around a Linux server. Commands are for current Ubuntu/Debian; RHEL, Rocky and Alma differences are noted where they matter. Prefix with sudo where you are not root.

Where am I?

cat /etc/os-release      # distro and version
uname -r                 # kernel version
hostnamectl              # hostname, OS, virtualization
uptime                   # load average and time since boot
whoami; id               # current user and groups

Services (systemd)

Every current distro uses systemd. systemctl replaces the old service and /etc/init.d commands.

systemctl status apache2           # running? last log lines
systemctl restart apache2          # also: start, stop, reload
systemctl enable --now apache2     # start now and at every boot
systemctl disable --now apache2    # stop now and at every boot
systemctl list-units --type=service --state=failed

Logs for a service:

journalctl -u apache2 -f                 # follow live
journalctl -u apache2 --since "1 hour ago"
journalctl -p err -b                     # all errors since this boot

Networking

Interfaces now have names like enp3s0 or ens18, not eth0. ifconfig, netstat and /etc/network/interfaces are legacy; use ip and ss.

ip -br addr              # interfaces and IPs, one line each
ip route                 # routing table, default gateway
ss -tulpn                # listening ports and owning processes
resolvectl status        # DNS servers in use (systemd-resolved)
ping -c 4 1.1.1.1
curl -I https://example.com
dig example.com          # apt install dnsutils / dnf install bind-utils

Static IP on Ubuntu (netplan)

Edit the YAML file in /etc/netplan/ (name varies, e.g. 50-cloud-init.yaml):

network:
  version: 2
  ethernets:
    enp3s0:
      dhcp4: false
      addresses: [192.168.1.50/24]
      routes:
        - to: default
          via: 192.168.1.1
      nameservers:
        addresses: [1.1.1.1, 9.9.9.9]

sudo netplan try         # applies, rolls back after 120 s unless you confirm
sudo netplan apply

netplan try is the safe choice over SSH: a typo that drops your connection reverts itself.

Static IP on RHEL / Rocky / Alma (NetworkManager)

nmcli con show
nmcli con mod "enp3s0" ipv4.method manual ipv4.addresses 192.168.1.50/24 \
  ipv4.gateway 192.168.1.1 ipv4.dns "1.1.1.1 9.9.9.9"
nmcli con up "enp3s0"

Bounce an interface

ip link set enp3s0 down && ip link set enp3s0 up

Run this over SSH on the same interface and you will lose the session. Use the console, or chain it in one line as above so the up still runs.

Firewall

ufw status verbose                 # Ubuntu
ufw allow from 192.168.1.0/24 to any port 22 proto tcp
firewall-cmd --list-all            # RHEL family
firewall-cmd --add-service=https --permanent && firewall-cmd --reload

Disks and filesystems

lsblk -f                 # disks, partitions, filesystems, mount points
df -h                    # free space per filesystem
du -sh /var/* | sort -h  # what is using the space
findmnt                  # mount tree

Root filesystem mounted read-only after an error (common in recovery):

mount -o remount,rw /

Check a filesystem (unmounted only, never on a mounted disk):

umount /dev/sdb1 && fsck -f /dev/sdb1

Packages

apt update && apt full-upgrade     # Ubuntu / Debian
apt install htop
apt search nginx
dnf upgrade                        # RHEL / Rocky / Alma
dnf install htop

Check whether a reboot is pending on Ubuntu: ls /var/run/reboot-required.

Users, permissions, SSH

adduser jsmith                     # interactive, creates home dir
usermod -aG sudo jsmith            # admin rights (group is "wheel" on RHEL)
passwd jsmith
sudo -i                            # root shell
chown -R www-data:www-data /var/www/site
chmod 640 file                     # owner rw, group r, others none

Key-based SSH login:

ssh-keygen -t ed25519              # on your machine
ssh-copy-id jsmith@server          # copy the public key over

Once keys work, set PasswordAuthentication no in /etc/ssh/sshd_config and systemctl reload ssh (sshd on RHEL).

Processes and performance

htop                               # or top
free -h                            # memory and swap
ps aux --sort=-%mem | head         # top memory users
ps aux --sort=-%cpu | head         # top CPU users
kill <pid>                         # kill -9 only if it ignores a normal kill

Logs

journalctl -b -1 -p warning        # warnings from the previous boot
dmesg -T | tail -50                # kernel messages, readable timestamps
tail -f /var/log/syslog            # Ubuntu (/var/log/messages on RHEL)

Finding things

find / -name "*.conf" -mtime -1 2>/dev/null   # .conf files changed in the last day
grep -rn "ServerName" /etc/apache2/
tar czf backup.tgz /etc/nginx                 # archive
tar xzf backup.tgz                            # extract

Rescue tasks from a live USB

Reset a local Windows password

Boot a Linux live USB, mount the Windows disk, then:

cd /mnt/windows/Windows/System32/config
chntpw -l SAM                      # list accounts
chntpw -u Administrator SAM        # menu: clear password, unlock account

This does not work on a BitLocker-encrypted disk, and it does nothing for Microsoft or Entra ID accounts, only local ones.

Wipe a disk

Destroys everything on the target. Check the device name with lsblk first.

dd if=/dev/zero of=/dev/sdX bs=1M status=progress   # HDD: zero fill
blkdiscard /dev/sdX                                  # SSD: discard all blocks
nvme format /dev/nvme0n1 --ses=1                     # NVMe: secure erase

shred and multi-pass overwrites are not reliable on SSDs because of wear levelling. Use the drive's own erase commands instead.