Zkitszo - The Real
October 27, 2026

Know the Command, Then the Tool

Edited - October 27, 2026

Don't worry, towards the end of the post you'll find a list of all the resources that are mentioned, broken out by category- If that is what you came here for then skip the post, jump straight to the goods- Go to the list!

Linux has hundreds of commands.. nobody types hundreds of commands. Day to day it's the same sixty or so, over and over. Most of them are three or four letters long. The trick is knowing which one fits what we're trying to do- get around, make a file, find the error in a log, kill the thing hogging the CPU.

Type them in one at a time- the # and everything after it on a line is just a note, the shell ignores it. Names like notes.txt, user and 192.168.1.50 are stand-ins, swap in your own.

Getting In and Getting Around

Half the time the Linux machine isn't even in front of us- it's a server, a Raspberry Pi in a closet, a cloud box somewhere. ssh gets us onto it: a username, an @, and the machine's address. Once in, the first three things to find out are always the same.. which user we're logged in as, where we are, and what's here.

ssh user@192.168.1.50     # log in to another machine
ssh user@192.168.1.50 -p 2220   # same, on a different port
whoami                    # which user am I
pwd                       # where am I (print working directory)
ls                        # what's in here
ls -la                    # everything, hidden files too, long format
ls -lh                    # long format, sizes in K, M, G
cd /var/log               # go somewhere
cd ..                     # up one folder
cd                        # straight back home (same as cd ~)
clear                     # wipe the screen

Hidden files are just files whose names start with a dot- .bashrc, .ssh- and plain ls skips them. The -a shows them. The first time ssh meets a machine it asks whether to trust its host key, type yes. If a wall of @ signs and "REMOTE HOST IDENTIFICATION HAS CHANGED" ever shows up instead, that one has a one-command fix.

Making, Moving and Deleting Files

mkdir notes               # make a folder
mkdir -p lab/logs         # make a folder inside a folder, parents included
touch notes.txt           # make an empty file
echo "first note" > notes.txt     # write a line (wipes what was there)
echo "second note" >> notes.txt   # add a line to the end
cat notes.txt             # print the whole file
nano notes.txt            # edit it in the terminal
cp notes.txt notes.bak    # copy
mv notes.txt my-notes.txt # rename (or move, if the second name is a folder)
rm notes.bak              # delete a file
rm -r lab                 # delete a folder and everything in it
rmdir notes               # delete a folder, only if it's empty
ln -s /var/log logs       # a shortcut (symbolic link) called logs
find . -name "*.txt"      # find files by name, from here down
find . -type d -empty     # find empty folders
file my-notes.txt         # what kind of file is this
stat my-notes.txt         # size, permissions, timestamps

The > versus >> difference bites everyone once.. one arrow overwrites, two arrows append. cat is fine for a short file and a mess for a long one.

Saving in nano starts arguments. One camp says Ctrl+O to save, then Ctrl+X to leave. The other says Ctrl+X, then Y, then Enter. Both work- Ctrl+X on a changed file stops to ask about saving before it closes, and Ctrl+O writes it out ("Save as", in nano's own cheat sheet). Newer nano also takes Ctrl+S, same as every other program. vim is the other editor folks swear by: press i to start typing, then Esc and :wq to write and quit.

rm has no recycle bin. Gone is gone, at least as far as we're concerned- GNU's own manual warns "it is usually possible to recover the contents of that file" with the right tools. It points at shred for files that should stay gone. Then the shred manual lists where shredding falls apart: journaled file systems like ext4 in data=journal mode, Btrfs, XFS and ZFS, RAID setups, snapshots, and SSDs, where wear leveling spreads writes to other blocks so "overwritten" data blocks are still present in the underlying device.

Reading Files Without Flooding the Screen

Log files run thousands of lines long. Dumping one with cat just scrolls the useful part off the top of the screen.

less /var/log/syslog      # scroll through it, q to quit
head -n 5 app.log         # first five lines
tail -n 20 app.log        # last twenty lines
tail -f app.log           # watch new lines show up live, Ctrl+C to stop
diff old.conf new.conf    # show exactly which lines differ
cmp old.bin new.bin       # are these two files identical, byte for byte

tail -f is the one to remember when an app is misbehaving- start it in one window, poke the app in another, and watch the errors roll in as they happen. cmp only says where two files first differ. diff says what changed. Some systems keep their logs in systemd's journal instead of /var/log/syslog- journalctl reads those.

Searching and Slicing Text

The vertical bar | is a pipe- it hands the output of one command straight to the next, so small commands chain into big answers.

grep error app.log        # lines containing "error"
grep -i error app.log     # same, ignoring upper/lower case
grep -r "api_key" .       # search every file in every folder from here down
grep -c error app.log     # just count the matching lines
grep error app.log | wc -l   # same count, the pipe way
sort names.txt            # alphabetical order
sort -n numbers.txt       # numeric order
sort codes.txt | uniq -c  # count how many times each line appears
cut -d, -f2 hits.csv      # the second column of a comma-separated file
awk -F, '$2 == 500 {print $1}' hits.csv   # first column, where the second is 500
sed 's/staging/production/' config.txt    # preview a find-and-replace

A tiny test to see the whole chain work- a fake list of web server status codes and a fake log of who got them:

printf "200\n404\n200\n500\n200\n404\n" > codes.txt
sort codes.txt | uniq -c
printf "10.0.0.1,200\n10.0.0.2,500\n10.0.0.3,500\n" > hits.csv
awk -F, '$2 == 500 {print $1}' hits.csv

The counts come back 3 200, 2 404, 1 500, then 10.0.0.2 and 10.0.0.3- the two addresses that got a server error. The sort has to come before uniq, since uniq only collapses repeated lines sitting right next to each other. The sed line only previews the swap on screen, the file itself stays untouched.

Permissions and Users

Every file has an owner, a group, and a set of permissions saying who can read it, write it, or run it. A brand new script won't run until it's allowed to:

echo 'echo hello from my script' > hello.sh
./hello.sh                # Permission denied
chmod +x hello.sh         # allow it to run (execute)
./hello.sh                # hello from my script
sudo chown user:user hello.sh   # change the owner and group
id                        # my user ID, group ID, and groups
sudo apt update           # run one command as the administrator
su -l user                # become another user, exit to come back
sudo adduser newuser      # add a user (Debian/Ubuntu)
passwd                    # change my own password
exit                      # leave a shell, an su, or an ssh session

sudo is the "with great power" command.. it runs one command as root, the all-powerful administrator account. Root can delete things nobody else can. Read the line twice before hitting Enter.

What's Running, and Stopping It

ps aux                    # every process, with its PID, CPU and memory
ps aux | grep python      # find a particular one
top                       # live view, busiest first, q to quit
htop                      # prettier top (install it first)
kill 1234                 # politely ask process 1234 to stop
kill -9 1234              # force it
pkill -f myscript         # stop it by name, no PID needed

Every running program gets a number, its PID (process ID). Plain kill with that number sends the TERM signal- the manual says "If no signal is specified, the TERM signal is sent"- a polite request to shut down. kill -9 sends KILL, the forceful one. Some lists reach for -9 straight away.. try the polite one first, keep -9 for the process that ignores it.

How Healthy Is This Machine?

free -h                   # memory and swap, human-readable
df -h                     # free space on each drive
du -sh lab                # how big is this folder
uptime                    # how long it's been up, and the load
uname -a                  # kernel version and architecture

The -h on free, df and du means human-readable, megabytes and gigabytes instead of a wall of digits. df says a drive is full, du finds out what filled it.

Networking

ip address                # my network interfaces and IP addresses
ping -c 4 1.1.1.1         # four pings to Cloudflare's DNS: can I reach anything?
traceroute example.com    # every hop between here and there
curl -I https://example.com          # just the response headers
curl -o page.html https://example.com   # download to a file
wget https://example.com/file.zip    # download, keeping the file name
ss -tuln                  # which ports are listening
scp notes.txt user@192.168.1.50:/home/user/   # copy a file over ssh
rsync -av lab/ user@192.168.1.50:/home/user/lab/   # copy a folder, only what changed
sudo ufw allow 22/tcp     # keep ssh open before turning the firewall on
sudo ufw allow 80/tcp     # open port 80 for a web server
sudo ufw enable           # turn the firewall on
sudo ufw status           # what's allowed

A failed ping doesn't always mean a machine is down- plenty of networks block it. Allow port 22 before running ufw enable on a machine we're logged into over ssh.. the firewall doesn't care that we're the ones knocking. The older lists still teach ifconfig and netstat. On a fresh install they may not even be there. The net-tools README says it "is generally considered deprecated, in most cases use the iproute2 package instead". The netstat manual opens its notes with "This program is mostly obsolete. Replacement for netstat is ss." So ip address replaces ifconfig, ss replaces netstat.

Bundling and Squashing Files

tar -czf lab.tar.gz lab   # bundle and compress a folder
tar -xzf lab.tar.gz       # unpack it
gzip -k big.log           # compress one file, keep the original
zip -r lab.zip lab        # zip a folder
unzip lab.zip             # unzip it

The tar letters read like a sentence once they click- create or extract, through gzip, to this file.

Installing, Services and Logs

sudo apt update           # refresh the list of available packages
sudo apt install nginx    # install something (Debian/Ubuntu)
systemctl status nginx    # is the service running
sudo systemctl restart nginx   # restart it (also start, stop)
journalctl -u nginx -n 30 # the last thirty log entries for it
journalctl -f             # follow the whole system log live
systemd-analyze blame     # which services slowed down the last boot

systemd is the program that starts and babysits services on Debian, Ubuntu and plenty of other distros, systemctl is how we talk to it and journalctl reads its logs. On Red Hat and CentOS the package manager is yum instead of apt.

When the Memory Goes Blank

man tar                   # the full manual, q to quit
whatis tar                # the one-line version
history                   # everything typed lately
history | tail -n 10      # just the last ten

Nobody memorizes every flag, even folks who've been at it for years keep man handy. For the short version with examples, tldr pages and explainshell are the quick fix.

The Newer Tools, Once the Basics Stick

There's a whole wave of friendlier replacements- ncdu for finding what's eating the disk, duf as a nicer df, ripgrep and fd for fast searching, fzf for fuzzy-picking out of any list, zoxide as a cd that learns where we go, mtr as ping and traceroute in one, jq for slicing JSON, mosh for ssh sessions that survive flaky Wi-Fi. They're worth learning once the basics stick- the basics are the ones already sitting on almost any Linux box we log into.

A few of the shiny ones have gone stale already. exa, the prettier ls, now says on its own page "exa is unmaintained, use the fork eza instead." neofetch is an archived repository- fastfetch calls itself "A maintained, feature-rich and performance oriented, neofetch like system information tool". dstat is archived too, with development moved to the Dool fork. dog, the colourful dig, hasn't had a release since 0.1.0 in 2020 and isn't packaged by Debian at all. On Debian and Ubuntu, fd installs as fdfind since the short name was already taken.

Where to Practice Without Breaking Anything

Reading commands sticks about as well as reading phone numbers. The fingers have to do it.. a browser tab is a safe place to let them.

Pretend Shell JavaScript acting like bash Runs: inside the web page WebTerm · StackMonsters Linux Survival · Terminus Catch: a fixed menu of commands, imitation output Real Linux, In the Tab Linux programs run through WebAssembly or emulation Runs: on your own computer WebVM · JSLinux · v86 Catch: gaps- no systemd, man or ping in WebVM Real Machine, Remote A server streams its shell into the browser Runs: someone else's server Killercoda · SadServers Incus Try-It · Webminal Catch: a sign-up, a timer, or both closer to a real server

WebTerm is a pretend shell- JavaScript acting like bash, with guided lessons and a Free Play sandbox. Typing rm -rf / in there (the infamous delete-everything command) empties the whole file tree without a word of complaint. Reload the page and it's all back. The labs on StackMonsters are "simulated in your browser" too- "The first chapter of every course is free", the rest sits behind Pro.

WebVM runs a real Debian right in the tab, "fully client-side". The file and text basics all ran there. It has holes though- man isn't installed, df -h "cannot read table of mounted file systems", ping dies with "Function not implemented", and systemctl refuses because the system "has not been booted with systemd as init system".

For the networking, services and logs commands, a real machine is the better bet. Killercoda hands over plain Ubuntu 24.04 with root after a free sign-in, an hour at a time. Incus Try-It lends out a throwaway virtual machine for thirty minutes, no account. An old Raspberry Pi running Ubuntu Server, set up headless never times out. OverTheWire's Bandit turns ssh, ls, cat, find and grep into a game "aimed at absolute beginners"- level zero is ssh bandit0@bandit.labs.overthewire.org -p 2220, password bandit0.

The terminal.guide getting-started roundup is written by the person who made WebTerm. It ranks WebTerm first. Play with Docker, the old free Docker sandbox, says it "will be unavailable starting March 1, 2026".

Which command took longest to trust- or which one still gets looked up every single time? Drop it in the comments with whatever finally made it stick.

The List

Browser Terminals, No Sign-Up

Lessons and Challenges in the Browser

Real Linux, With a Timer or a Free Account

Games and Wargames

Read, Then Type

Help While Typing

  • man- the built-in manual, man ls; press q to quit
  • tldr- "Simplified and community-driven man pages."
    https://tldr.sh/
  • explainshell- paste in a command, see each argument matched to its help text
    https://explainshell.com/
  • cheat.sh- community cheat sheets straight from curl cheat.sh/tar
    https://cheat.sh/

Newer Tools Worth Installing

Gone or Going

Glossary

  • Working directory — the folder the shell is "in" right now; pwd prints it
  • Home directory — each user's own folder, shortened to ~
  • Hidden file — any file whose name starts with a dot; ls -a shows them
  • Symbolic link — a shortcut pointing at another file or folder
  • Firewall — rules deciding which network connections get in; ufw manages one
  • Terminal — the window we type commands into; on its own it just shows text and passes keystrokes along
  • Shell — the program inside the terminal that reads each command and runs it
  • Bash — the most common Linux shell
  • Pretend shell (simulated shell) — a web page that imitates a shell with a fixed list of commands; nothing real runs
  • Emulator — software that pretends to be a whole computer so a real operating system can boot inside it
  • WebAssembly — a format browsers run at close to native speed, used to run compiled programs in a tab
  • Virtual machine (VM) — a complete computer simulated in software, with its own operating system
  • Container — an isolated space on a Linux system that looks like its own machine but shares the host's kernel
  • Kernel — the core of the operating system that talks to the hardware
  • Root — the all-powerful administrator account on Linux
  • sudo — runs one command with administrator rights
  • SSH — Secure Shell, a way to log in to another computer's shell over a network
  • Host key — a server's ID card for SSH; our computer remembers it and complains if it changes
  • Wargame — a security puzzle game where solving each level opens the next
  • Flag (option) — the extra letters after a command that change what it does, like -h or -la
  • Redirect — > or >>, sending a command's output into a file instead of the screen
  • Pipe — |, sending one command's output straight into the next command
  • CSV — comma-separated values, a plain-text table with commas between the columns
  • HTTP status code — the number a web server answers with: 200 OK, 404 not found, 500 server error
  • Permissions — who may read, write or run a file; chmod changes them
  • Process ID (PID) — the number Linux gives every running program
  • Signal — a message sent to a process; TERM asks it to stop, KILL forces it
  • systemd — the program that starts and manages services on most modern Linux distributions
  • Service — a program that runs in the background, like a web server
  • Journal — systemd's log, read with journalctl
  • ICMP — the network protocol ping uses
  • DNS resolver — the server that turns names like example.com into IP addresses
  • Tailscale — a private network service; WebVM can use it to get network access
  • Package manager — the tool that installs software, like apt on Debian and Ubuntu
  • Archive (tar) — many files bundled into one; tar -czf also compresses it
  • gzip — a compressor; -k keeps the original file
  • Journaled file system — a file system that logs changes before making them, so old data can live on in the log
  • Wear leveling — an SSD spreading writes across its memory, so "overwriting" a file may write somewhere else
  • Man page — a command's built-in manual, opened with man

Sources

Comments

Post a Comment

← Newer