Linux essentials

Correct — the everyday combination.

Correct — - = file, d = directory, l = symlink.

Correct — toggles between two locations.

Correct — -r = recursive.

Correct — watch a log in real time.

Correct — quit, forcibly, discarding changes — the escape hatch.

Correct — -v inverts — useful to see the non-200 responses.

Correct — sort first (uniq only collapses adjacent), then count.

Correct — -d sets the delimiter, -f picks the field.

Correct — the classic find-and-replace.

Correct — c=create, z=gzip, f=file.

Correct — x=extract, z=gzip, f=file, -C=target dir.

Correct — fast re-syncs after small changes.

Correct — find with lsof | grep deleted, restart the holder.

Correct — the printed list is your dry run.

Correct — useful when several versions are installed.

Correct — "print working directory".

Correct — unambiguous from anywhere on the system.

Correct — the manual works offline on every box.

Correct — ideal for watching logs in real time.

Correct — e.g. grep -rn "listen" /etc/nginx/.

Correct — the basis of composing small tools.

Correct — use >> to append instead.

Correct — each runs as its owner — potential escalation paths.

Correct — editable text config for the system and services.

Correct — "everything is a file" — cat/grep work on them.

Correct — each gets its own rwx set.

Correct — read it as rw- / r-- / ---.

Correct — read 4 + write 2 + execute 1.

Correct — without x you cannot cd in even if you can see it.

Correct — a world/group-readable key is a leak.

Correct — your identity picks the triad.

Correct — a SUID-root binary runs as root for any caller — a classic escalation target.

Correct — shown as t in drwxrwxrwt.

Correct — a stricter default that avoids world-readable files.

Correct — attackers drop SUID shells to keep root access.

Correct — the all-powerful account.

Correct — so ordinary users cannot even see the hashes.

Correct — good for daemons that never need to log in.

Correct — shared logins destroy attribution.

Correct — attribution + least privilege.

Correct — your effective sudo privileges.

Correct — a broken sudoers can lock out admin access.

Correct — e.g. only systemctl restart nginx.

Correct — a narrow-looking grant becomes total.

Correct — a lingering active account is a standing way in.

Correct — why a web server should not run as root.

Correct — everything descends from it.

Correct — a live, updating view — first stop when a server is slow.

Correct — great for spotting a process masquerading under a fake name.

Correct — try TERM first; KILL is the last resort.

Correct — why databases can be corrupted by -9.

Correct — use --now to also start it immediately.

Correct — start (now) and enable (boot) are independent.

Correct — far less dangerous if compromised.

Correct — unit + priority + time filters.

Correct — TCP, listening, numeric, with owning process.

Correct — localhost-only — good for internal services like a DB.

Correct — every 0.0.0.0 listener is an exposed door — account for each.

Correct — a quick reachability test for a specific port.

Correct — .deb and .rpm respectively.

Correct — rejects tampered or impostor-served packages — OS-level supply-chain trust.

Correct — patching is a top-impact security control.

Correct — critical fixes land without waiting on a human.

Correct — read scripts before piping them to a root shell.

Correct — verified provenance, like the CI/CD supply-chain lessons.

Correct — the $ tells the shell to expand the variable.

Correct — export makes it available to child processes.

Correct — first match wins, left to right.

Correct — the shell reads it on startup; source it to apply now.

Correct — you run commands on the remote server.

Correct — no password to brute-force.

Correct — anyone who copies it can log in as you.

Correct — why you preview with ls before using it in rm.

Correct — && chains on success — a broken build stops the deploy.

Correct — type a few chars of a past command to recall it.

Correct — minute 0, hour 3, every day/month/weekday.

Correct — python3 may not be found; /usr/bin/python3 is.

Correct — capture stdout+stderr so you can see failures.

Correct — keep root scripts non-writable; run jobs least-privileged.