Enterprise Linux Administration Cheatsheet

Command Syntax & Usage:

ls -la /var/log
ls -lh /home/user

`ls -la` lists all files including hidden dotfiles (`.`), showing file permissions, ownership, and timestamps. `ls -lh` prints file sizes in human-readable units (KB, MB, GB).

Command Syntax & Usage:

find /var/log -name "*.log" -mtime -7
find / -size +100M

Searches directory trees. Example 1 finds `.log` files modified within the last 7 days. Example 2 locates files larger than 100 Megabytes across root volume.

Command Syntax & Usage:

df -h
du -sh /var/log/*

`df -h` displays mounted disk partitions, file system types, and available capacity. `du -sh` calculates total disk usage of specific directories.

Command Syntax & Usage:

tar -czvf backup.tar.gz /etc/data
tar -xzvf backup.tar.gz -C /opt/

`-czvf` creates a gzipped tarball archive. `-xzvf` extracts specified tarball content into a target directory (`-C`).

Command Syntax & Usage:

grep -rnI "Failed password" /var/log/
grep -i "error" /var/log/syslog | tail -n 20

Searches for matching strings inside files. `-r` recursive, `-n` line numbers, `-i` case-insensitive. Pipes output into `tail` to view recent entries.

Command Syntax & Usage:

chmod 755 /var/www/html/script.sh
chmod 644 /etc/config.conf
chmod -R 700 ~/.ssh

Sets file access mode bits (**Read=4, Write=2, Execute=1**).

• `755`: Owner Full (7), Group Read+Exec (5), Others Read+Exec (5).
• `644`: Owner Read+Write (6), Group Read-only (4), Others Read-only (4).

Command Syntax & Usage:

chown nginx:www-data /var/www/html/index.html
chown -R sysadmin:sysadmin /opt/app

Changes system user and group ownership of files or recursively (`-R`) across entire directory structures.

Command Syntax & Usage:

useradd -m -s /bin/bash john
usermod -aG sudo john
passwd john

Creates a new system user with home directory (`-m`), default shell (`-s`), appends user to elevated wheel/sudo group (`-aG`), and updates account password.

Command Syntax & Usage:

sudo systemctl restart nginx
sudo visudo

`sudo` executes single commands with superuser privileges. `visudo` opens `/etc/sudoers` safely using strict syntax checking to prevent lockout syntax errors.

Command Syntax & Usage:

ss -tulpn
ss -tulpn | grep :22

Modern replacement for `netstat`. Displays active open TCP (`-t`) and UDP (`-u`) listening ports (`-l`) alongside process names and PIDs (`-p`).

Command Syntax & Usage:

ip a
ip route show

`ip a` displays attached network interface cards, MAC addresses, and assigned IPv4/IPv6 subnets. `ip route` displays kernel routing tables and default gateway.

Command Syntax & Usage:

tcpdump -i eth0 -n port 80
tcpdump -i any -w /tmp/capture.pcap host 10.0.0.5

Captures raw network frames. Filters traffic by interface (`-i`), disables DNS resolution (`-n`), and exports PCAP files for Wireshark analysis (`-w`).

Command Syntax & Usage:

ufw allow 22/tcp && ufw enable
iptables -L -n -v
iptables -A INPUT -p tcp --dport 445 -j DROP

UFW manages Ubuntu firewalls. `iptables` configures kernel packet filtering rules directly to block specific ports, protocols, or source IP subnets.

Command Syntax & Usage:

sestatus
setenforce 1   # Enforcing
setenforce 0   # Permissive

`sestatus` displays SELinux mandatory access control status. Permanent mode edits reside in `/etc/selinux/config`.

Command Syntax & Usage:

chattr +i /etc/passwd /etc/shadow
lsattr /etc/passwd
chattr -i /etc/passwd

`chattr +i` makes a critical configuration file completely immutable—preventing root users or rootkits from modifying, overwriting, or deleting it until `-i` is removed.

Command Syntax & Usage:

last -n 20
sudo lastb -n 20

`last` reads `/var/log/wtmp` to show recent successful user logons. `lastb` reads `/var/log/btmp` to display bad/failed login attempts for brute-force investigation.

Command Syntax & Usage:

fail2ban-client status
fail2ban-client status sshd
fail2ban-client set sshd unbanip 192.168.1.50

Monitors dynamic log-scraping brute force defense. Displays currently banned malicious IP addresses and unbans false-positive internal IPs.

Command Syntax & Usage:

free -h
uptime

`free -h` displays total, used, free, and cached RAM/Swap storage in human units. `uptime` displays system running time and 1, 5, and 15-minute CPU load averages.

Command Syntax & Usage:

lsblk
lscpu
lspci | grep -i network

`lsblk` displays block storage devices and mount partitions. `lscpu` prints CPU architecture. `lspci` queries PCI bus controllers (NICs, GPUs).

Command Syntax & Usage:

iostat -xz 1 10

Part of `sysstat` package. Displays real-time disk read/write throughput, disk queue lengths (`avgqu-sz`), and %utilization to diagnose storage I/O bottlenecks.

Command Syntax & Usage:

# Debian/Ubuntu:
sudo apt update && sudo apt upgrade -y
sudo apt install nginx -y

# RHEL/CentOS/Fedora:
sudo dnf update -y
sudo dnf install httpd -y

Updates package repositories, upgrades installed security updates, and installs packages silently (`-y`).

Command Syntax & Usage:

pvs && vgs && lvs
lvextend -L +10G /dev/vg01/lv_root
resize2fs /dev/vg01/lv_root        # Ext4
xfs_growfs /                       # XFS

Inspects Physical Volumes (PV), Volume Groups (VG), and Logical Volumes (LV). Dynamically extends live logical volumes and resizes underlying file systems without rebooting.