Using
Linux cheat sheet
Last reviewed
One page of Linux commands for the VMs I only log in to now and then. One line per command, what it does next to it, and a map of where things live.
Why a cheat sheet
- I don't work on these VMs every day, so the commands don't stick. I write them down once, the same way I treat my Obsidian vault: note what I know I'll forget.
- Simple commands, one line each.
sudoin front means "as root". - It started with the two VMs behind my Self-hosted LLMs on Azure setup; most of it works on any Ubuntu server.
What is where
| What | Where |
|---|---|
| User homes | /home/<user> |
| SSH keys of a user | /home/<user>/.ssh/authorized_keys |
| My own SSH settings | /etc/ssh/sshd_config.d/10-hardening.conf |
| Main SSH file (the Entra login block sits at the end) | /etc/ssh/sshd_config |
| Who may sudo | /etc/sudoers.d/ |
| Host entries | /etc/hosts |
| Internal root CA | /usr/local/share/ca-certificates/ |
| System-wide variables | /etc/environment, /etc/profile.d/ |
| Cron jobs | /etc/cron.d/ |
| Swarm stack files | /srv/stacks/<stack>/ |
| Container data (bind mounts) | /srv/docker/<service>/ |
Move around
| Command | What it does |
|---|---|
pwd |
Where am I? |
ls -la |
What's here, including hidden files, with owner and rights |
cd /etc/ssh |
Go to a folder |
cd ~ |
Back to my home |
cd .. |
One folder up |
Read and edit files
| Command | What it does |
|---|---|
cat /etc/hosts |
Show a short file |
less /etc/ssh/sshd_config |
Page through a long file (q quits, /word searches) |
sudo cp file file.bak |
Back up before editing |
sudo nano /etc/hosts |
Edit (Ctrl+O, Enter to save, Ctrl+X to quit) |
grep -n Password /etc/ssh/sshd_config.d/*.conf |
Find lines with "Password" |
Who am I, who is there
| Command | What it does |
|---|---|
whoami |
My username |
id |
My groups |
who |
Who is logged in right now |
last -n 20 |
Last 20 logins, with source IP |
getent passwd <user> |
Does the user exist? Empty means no |
getent group <group> |
Who is in a group |
Entra users show up with their sign-in name (user@domain) and sit in the group aad_admins.
Users
Create a local admin with a password:
sudo useradd --create-home --shell /bin/bash -G sudo <user>
| Command | What it does |
|---|---|
sudo passwd <user> |
Set or reset a password (asks twice) |
sudo chage -d 0 <user> |
Force a new password at next login |
sudo usermod -L <user> |
Lock: the user stays but can't log in with a password (-U unlocks) |
sudo pkill -u <user> |
Kick the user out now |
sudo userdel -r <user> |
Delete the user and the home folder |
Better than by hand
Keep the user list in a file in the repo and let a script create the accounts. The script prints each new password once.
Password login per user
Password login is allowed only for members of one group. The rule is a Match Group ssh-password block with PasswordAuthentication yes at the end of my own SSH settings file.
| Command | What it does |
|---|---|
sudo gpasswd -a <user> ssh-password |
Allow password login for this user |
sudo gpasswd -d <user> ssh-password |
Take it away; then only a key works |
Group changes apply at the next login, no reload needed. Check what sshd does for a user without logging in:
sudo sshd -T -C user=<user>,host=x,addr=192.0.2.10 | grep -E 'passwordauthentication|allowgroups'
Change SSH settings
Edit the file, test it, then reload. Open sessions stay connected.
sudo nano /etc/ssh/sshd_config.d/10-hardening.conf
sudo sshd -t
sudo systemctl reload ssh
No output from sshd -t means the file is fine.
Keep a door open
Keep one session open and test the login in a new window before closing the old one. If a setup script writes this file, a manual edit is gone after the next run: put the change into the script.
sudo
| Command | What it does |
|---|---|
sudo -n true && echo "sudo ok" |
Do I have sudo without a password? |
sudo -l |
What may I run? |
sudo -i |
Root shell (exit goes back) |
Logs
| Command | What it does |
|---|---|
sudo journalctl -u ssh --since "-60 min" |
SSH logins of the last hour |
sudo journalctl -u ssh | grep -i fail |
Failed logins |
sudo tail -f /var/log/auth.log |
Logins and sudo, live (Ctrl+C stops) |
Firewall
| Command | What it does |
|---|---|
sudo ufw status numbered |
Rules, numbered |
Ports published by Docker bypass ufw. Filter them in the network firewall instead (an NSG in Azure).
Disk, memory, processes, network
| Command | What it does |
|---|---|
df -h / |
Free disk |
du -sh ~/* |
Size of my folders |
free -m |
Memory |
top |
Processes, live (q quits) |
systemctl status ssh |
Is a service running? |
ip -br a |
My IP |
ss -tlnp |
Who listens on which port |
getent hosts <name> |
Name resolution |
Docker, read only
| Command | What it does |
|---|---|
sudo docker service ls |
All services; 1/1 means running |
sudo docker service ps <service> |
Tasks of one service |
sudo docker service logs --tail 50 <service> |
Last 50 log lines |
nvidia-smi |
GPU and its memory |
Never by hand
No docker service update, docker stack deploy or docker system prune on the VM. Changes go through the repo.
Links
- OpenSSH server on Ubuntu — Install, configure and harden sshd.
- sshd_config manual — Every option, including
Matchblocks. - Firewalls on Ubuntu — ufw basics and rules.
- Docker packet filtering and firewalls — Why published ports skip ufw.
- Entra login for Linux VMs — How Entra accounts and the
aad_adminsgroup work on a VM. - explainshell — Paste a command, see what each part does.
History
- 2 Oct 2026 Added as Using.