Add ssh
This commit is contained in:
parent
5720f66b42
commit
97e0c3b9a5
|
|
@ -0,0 +1,497 @@
|
|||
# root.whispers — Linux Commands Cheatsheet
|
||||
> AlmaLinux 9 / RHEL 9 family and Ubuntu 22.04 tested. Some commands vary by distro. Read before you run.
|
||||
|
||||
---
|
||||
|
||||
## Table of Contents
|
||||
- [System Basics](#system-basics)
|
||||
- [Users & Groups](#users--groups)
|
||||
- [Permissions & Modes](#permissions--modes)
|
||||
- [ACLs](#acls)
|
||||
- [Files, Search & Text](#files-search--text)
|
||||
- [Processes & Services](#processes--services)
|
||||
- [Time & NTP](#time--ntp)
|
||||
- [Networking](#networking)
|
||||
- [SSH (Client & Server)](#ssh-client--server)
|
||||
- [Firewall](#firewall)
|
||||
- [Packages (RPM & Debian)](#packages-rpm--debian)
|
||||
- [Disks, Filesystems & Mounting](#disks-filesystems--mounting)
|
||||
- [LVM / VDO / Stratis](#lvm--vdo--stratis)
|
||||
- [Logging](#logging)
|
||||
- [Scheduling (cron / at)](#scheduling-cron--at)
|
||||
- [Containers (Podman & Docker)](#containers-podman--docker)
|
||||
- [Git Essentials](#git-essentials)
|
||||
- [Security Quick Checks](#security-quick-checks)
|
||||
- [Misc Snippets](#misc-snippets)
|
||||
|
||||
---
|
||||
|
||||
## System Basics
|
||||
```sh
|
||||
hostnamectl # Hostname / chassis / OS info
|
||||
lsb_release -a # Distro info (Debian/Ubuntu)
|
||||
cat /etc/os-release # Generic OS info
|
||||
uname -a # Kernel
|
||||
uptime -p # Pretty uptime
|
||||
whoami && who && last -n 5 # User/session audit
|
||||
free -h # Memory
|
||||
vmstat 1 # Quick CPU/mem view
|
||||
df -hT # Disks with FS types
|
||||
lsblk -f # Block devices with labels/UUIDs
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Users & Groups
|
||||
```sh
|
||||
# Key files
|
||||
/etc/passwd # User accounts
|
||||
/etc/group # Groups
|
||||
/etc/shadow # Password hashes
|
||||
/etc/login.defs # Defaults for new users
|
||||
/etc/skel # Skeleton for new home dirs
|
||||
/etc/security/pwquality.conf # Password complexity rules
|
||||
|
||||
# Users
|
||||
useradd <username>
|
||||
useradd -r <username> # System account
|
||||
passwd <username> # Set/change password
|
||||
echo "user:pass" | chpasswd # Batch update passwords
|
||||
|
||||
id <user> # Show uid/gids
|
||||
userdel <username>
|
||||
userdel -r <username> # Remove and delete $HOME
|
||||
|
||||
# Groups
|
||||
groupadd <group>
|
||||
groupdel <group>
|
||||
usermod -a -G <group> <user> # Add user to group
|
||||
gpasswd -a <user> <group> # Alternative add
|
||||
gpasswd -d <user> <group> # Remove from group
|
||||
|
||||
# Lock / unlock user (account)
|
||||
passwd -l <user> # Lock
|
||||
passwd -u <user> # Unlock
|
||||
|
||||
# Shell
|
||||
chsh -s /bin/bash <user> # Change login shell
|
||||
usermod -s /sbin/nologin <user> # Disable interactive logins
|
||||
usermod -s /bin/false <user> # Drop immediately on login
|
||||
|
||||
# Sudo
|
||||
usermod -a -G sudo <user> # Debian/Ubuntu
|
||||
usermod -a -G wheel <user> # RHEL/CentOS/Fedora
|
||||
|
||||
# Password aging
|
||||
chage -m MIN -M MAX -W WARN -I INACT -E EXPIRE <user>
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Permissions & Modes
|
||||
```sh
|
||||
ls -l tmp # List perms
|
||||
chmod g-w tmp # Remove write (group)
|
||||
chmod a-r tmp # Remove read (others)
|
||||
chmod u+rw file # Add rw (user)
|
||||
chmod u+x file # Add execute (user)
|
||||
chmod a+rwx path # rwx for all
|
||||
|
||||
# SetUID / SetGID / Sticky
|
||||
chmod u+s file # SetUID on executable
|
||||
chmod g+s file_or_dir # SetGID on file/dir
|
||||
chmod +t dir # Sticky bit on dir (only owner can delete)
|
||||
chmod -t dir # Remove sticky
|
||||
|
||||
# chown / chgrp
|
||||
chown -R user path
|
||||
chgrp -R group path
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ACLs
|
||||
```sh
|
||||
setfacl -m u:USER:rwx PATH
|
||||
setfacl -m g:GROUP:r PATH
|
||||
setfacl -Rm g:GROUP:r PATH # Recursive
|
||||
setfacl -x g:GROUP PATH # Remove entry
|
||||
setfacl -b PATH # Remove all ACLs
|
||||
getfacl PATH # Show ACLs
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Files, Search & Text
|
||||
```sh
|
||||
# Existence tests
|
||||
test -f FILE && echo "file exists"
|
||||
test -d DIR && echo "dir exists"
|
||||
|
||||
# Find / grep
|
||||
find . -type f -mtime -1
|
||||
grep -Rni --color "pattern" .
|
||||
grep -E "foo|bar" file
|
||||
grep -c "pattern" file # Count matches
|
||||
|
||||
# sed / awk
|
||||
sed -n '1,120p' file # Show lines 1..120
|
||||
awk '{print $1,$2}' file
|
||||
|
||||
# Sorting / uniq
|
||||
sort -nr file
|
||||
uniq file
|
||||
|
||||
# Copy/move including dotfiles
|
||||
# Zsh
|
||||
setopt glob_dots; mv Foo/* Bar/; unsetopt glob_dots
|
||||
# Bash
|
||||
shopt -s dotglob; mv Foo/* Bar/; shopt -u dotglob
|
||||
|
||||
# rsync
|
||||
rsync -avh --progress SRC/ DST/
|
||||
|
||||
# Checksums
|
||||
sha256sum file
|
||||
echo "<checksum> file" | sha256sum -c
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Processes & Services
|
||||
```sh
|
||||
# Processes
|
||||
ps -ef | grep <name>
|
||||
ps -ef --sort=-%cpu | head -10
|
||||
ps -ef --sort=-%mem | head -10
|
||||
pgrep <name> # PIDs by name
|
||||
pkill <name> # Kill by name
|
||||
kill <PID>; kill -9 <PID> # SIGTERM, SIGKILL
|
||||
killall -s 9 <proc> # Force kill all by name
|
||||
top -H -p <PID> # Threads view
|
||||
pstree # Tree view
|
||||
strace -f -p <PID> # Syscalls (careful)
|
||||
perf top # Hot functions
|
||||
|
||||
# systemd
|
||||
systemctl status/start/stop/restart NAME.service
|
||||
systemctl reload NAME.service
|
||||
systemctl enable/disable NAME.service
|
||||
systemctl mask/unmask NAME.service
|
||||
systemctl list-units --type=service --no-pager | grep -i term
|
||||
systemctl --all
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Time & NTP
|
||||
```sh
|
||||
timedatectl # Show time settings
|
||||
timedatectl list-timezones
|
||||
timedatectl set-timezone Europe/Stockholm
|
||||
timedatectl set-time '2025-08-08 20:15:50'
|
||||
timedatectl set-ntp true
|
||||
|
||||
# Chrony (RHEL family)
|
||||
dnf install -y chrony ntpstat
|
||||
systemctl enable --now chronyd
|
||||
ntpstat
|
||||
chronyc sources -v
|
||||
vi /etc/chrony.conf && systemctl restart chronyd
|
||||
chronyc makestep
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Networking
|
||||
```sh
|
||||
ip a # Addresses
|
||||
ip r # Routes
|
||||
ss -tulpn # Listening sockets
|
||||
lsof -i :443 # Who bound 443
|
||||
nc -zv host 1-1024 # Quick port sweep
|
||||
curl -I https://example.com # HEAD request
|
||||
dig +short A example.com # Just the answers
|
||||
traceroute example.com
|
||||
|
||||
# tcpdump
|
||||
tcpdump -i eth0 -nn port 53 -vv
|
||||
|
||||
# View & sort sizes
|
||||
du -h ~ | sort -nr
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## SSH (Client & Server)
|
||||
```sh
|
||||
# Client quality-of-life
|
||||
ssh -J jumpbox user@target
|
||||
ssh -o StrictHostKeyChecking=accept-new host
|
||||
scp -3 user1@host1:/p user2@host2:/p
|
||||
|
||||
# ~/.ssh/config
|
||||
# ---
|
||||
# Host prod
|
||||
# HostName 203.0.113.10
|
||||
# User ubuntu
|
||||
# IdentityFile ~/.ssh/id_ed25519
|
||||
# ForwardAgent no
|
||||
|
||||
# Keys
|
||||
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 -C "comment"
|
||||
ssh-copy-id USER@HOST -i ~/.ssh/id_ed25519.pub
|
||||
|
||||
# Server (/etc/ssh/sshd_config)
|
||||
# Client keepalive
|
||||
ClientAliveInterval 600
|
||||
ClientAliveCountMax 1
|
||||
# Disable root login
|
||||
PermitRootLogin no
|
||||
# Disable empty passwords
|
||||
PermitEmptyPasswords no
|
||||
# Allow only certain users
|
||||
AllowUsers user1 user2
|
||||
# Change port
|
||||
Port 2222
|
||||
# Reload
|
||||
# systemctl restart sshd
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Firewall
|
||||
```sh
|
||||
# firewalld (RHEL family)
|
||||
firewall-cmd --list-all
|
||||
firewall-cmd --get-active-zones
|
||||
firewall-cmd --zone=public --list-all
|
||||
firewall-cmd --get-services
|
||||
firewall-cmd --add-service=http --permanent
|
||||
firewall-cmd --add-port=8080/tcp --permanent
|
||||
firewall-cmd --reload
|
||||
firewall-cmd --runtime-to-permanent
|
||||
|
||||
# iptables (legacy)
|
||||
iptables -L
|
||||
iptables -F
|
||||
|
||||
# nftables
|
||||
nft list ruleset
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Packages (RPM & Debian)
|
||||
```sh
|
||||
# RHEL / Fedora
|
||||
dnf install PACKAGE
|
||||
dnf remove PACKAGE
|
||||
rpm -qa # List installed
|
||||
rpm -qi PACKAGE # Info
|
||||
rpm -qc PACKAGE # Config files
|
||||
rpm -qf /path/to/file # What pkg owns this file?
|
||||
rpm -ihv PACKAGE.rpm # Install local rpm
|
||||
cat /etc/redhat-release
|
||||
yum update # Minor updates
|
||||
yum upgrade # Full upgrade
|
||||
|
||||
# Debian / Ubuntu
|
||||
apt update && apt list --upgradable
|
||||
apt install PACKAGE
|
||||
apt remove PACKAGE
|
||||
dpkg -S /usr/bin/foo # What pkg owns file
|
||||
apt-cache policy PACKAGE # Candidate version/source
|
||||
cat /var/log/apt/history.log
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Disks, Filesystems & Mounting
|
||||
```sh
|
||||
lsblk
|
||||
blkid
|
||||
fdisk -l /dev/sda
|
||||
df -hT
|
||||
|
||||
# Quick single-partition + format (ext4)
|
||||
fdisk /dev/sdx # g|o, n (defaults), w
|
||||
mkfs.ext4 /dev/sdx1
|
||||
mkdir -p /data && mount /dev/sdx1 /data
|
||||
|
||||
# Labels & mounts
|
||||
e2label /dev/sdx1 DATA_VOL
|
||||
mount -L DATA_VOL /data
|
||||
echo "UUID=$(blkid -s UUID -o value /dev/sdx1) /data ext4 defaults 0 0" >> /etc/fstab
|
||||
mount -a
|
||||
|
||||
# Integrity
|
||||
e2fsck -f /dev/sdx1
|
||||
|
||||
# Loop ISO
|
||||
mount -o loop file.iso /mnt/iso
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## LVM / VDO / Stratis
|
||||
```sh
|
||||
# LVM
|
||||
pvcreate /dev/sdb1
|
||||
vgcreate vg0 /dev/sdb1
|
||||
lvcreate -n lvdata -L 50G vg0
|
||||
mkfs.ext4 /dev/vg0/lvdata
|
||||
mount /dev/vg0/lvdata /data
|
||||
|
||||
lvextend -l +100%FREE /dev/vg0/lvdata
|
||||
resize2fs /dev/vg0/lvdata
|
||||
|
||||
lvremove vg0/lvdata && vgremove vg0 && pvremove /dev/sdb1
|
||||
|
||||
# VDO (RHEL 9+ note: requires correct packages)
|
||||
lvcreate --type vdo -n vdotank -L 100G -V 300G vg0
|
||||
lvs -o lv_name,vdo_compression,vdo_deduplication
|
||||
vdostats --human-readable
|
||||
lvchange --compression y /dev/vg0/vdotank
|
||||
|
||||
# Stratis
|
||||
dnf install -y stratis-cli stratisd
|
||||
systemctl enable --now stratisd
|
||||
stratis pool create pool0 /dev/sdb
|
||||
stratis filesystem create pool0 fs0
|
||||
mount /dev/stratis/pool0/fs0 /stratis
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Logging
|
||||
```sh
|
||||
# Classic logs (RHEL)
|
||||
/var/log/boot
|
||||
/var/log/messages
|
||||
/var/log/secure
|
||||
/var/log/cron
|
||||
/var/log/maillog
|
||||
/var/log/chronyd
|
||||
# Debian/Ubuntu auth
|
||||
/var/log/auth.log
|
||||
|
||||
# journald
|
||||
journalctl -b -1 # Previous boot
|
||||
journalctl -u ssh --since "2h"
|
||||
journalctl -xe # Errors with context
|
||||
journalctl -k -f # Kernel (follow)
|
||||
|
||||
# Persistent journal
|
||||
vi /etc/systemd/journald.conf # Storage=persistent
|
||||
mkdir -p /var/log/journal
|
||||
systemctl restart systemd-journald
|
||||
journalctl --flush
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Scheduling (cron / at)
|
||||
```sh
|
||||
# Access control
|
||||
echo USER >> /etc/cron.allow
|
||||
echo ALL >> /etc/cron.deny
|
||||
|
||||
crontab -e # Edit current user
|
||||
crontab -e -u <user> # Edit other user
|
||||
crontab -l # List
|
||||
|
||||
# at
|
||||
echo "echo hi" | at now + 1 hour
|
||||
systemctl enable --now atd
|
||||
echo USER >> /etc/at.allow
|
||||
echo ALL >> /etc/at.deny
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Containers (Podman & Docker)
|
||||
```sh
|
||||
# Podman
|
||||
dnf install -y podman
|
||||
podman info
|
||||
podman images && podman ps -a
|
||||
podman run -dt --name web -p 8080:80 docker.io/library/nginx:alpine
|
||||
podman exec -it web /bin/sh
|
||||
podman logs -f web
|
||||
podman rm -a -f
|
||||
|
||||
# Generate systemd unit for rootless container
|
||||
podman generate systemd --new --files --name web
|
||||
loginctl enable-linger <user>
|
||||
systemctl --user enable --now container-web.service
|
||||
|
||||
# Docker parity
|
||||
docker images && docker ps -a
|
||||
docker run -dt --name web -p 8080:80 nginx:alpine
|
||||
docker exec -it web /bin/sh
|
||||
docker logs -f web
|
||||
docker compose up -d
|
||||
docker compose logs -f <service>
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Git Essentials
|
||||
```sh
|
||||
git config --local user.name "Your Name"
|
||||
git config --local user.email "you@example.com"
|
||||
|
||||
git switch -c fix/thing
|
||||
git add -A && git commit -m "message"
|
||||
git pull --rebase origin main
|
||||
git push
|
||||
|
||||
git stash push -m "wip: foo" && git stash list
|
||||
git reflog # Recover lost refs
|
||||
git reset --soft HEAD~1 # Undo last commit keep changes
|
||||
git reset --hard HEAD~1 # Dangerous: drop changes
|
||||
git push --force # Use sparingly
|
||||
git commit --amend --reset-author
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Security Quick Checks
|
||||
```sh
|
||||
sudo -l # What can current user sudo?
|
||||
getcap -r / 2>/dev/null | grep cap_ # Files with caps
|
||||
stat -c "%a %n" * # Numeric perms
|
||||
sha256sum FILE # Hash
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Misc Snippets
|
||||
```sh
|
||||
# Nice / renice
|
||||
nice -n 10 command
|
||||
renice -n 19 -p <PID>
|
||||
|
||||
# Generate password
|
||||
tr -dc 'A-Za-z0-9' </dev/urandom | head -c 20; echo
|
||||
|
||||
# exiftool scrub
|
||||
exiftool -All= *.jpg
|
||||
exiftool -All= -overwrite_original *.png
|
||||
|
||||
# Tail
|
||||
tail -f FILE
|
||||
|
||||
# DNS
|
||||
dig example.com A +noall +answer
|
||||
|
||||
# sosreport (RHEL)
|
||||
sosreport
|
||||
|
||||
# wget
|
||||
wget -O out.html https://example.com
|
||||
|
||||
# traceroute
|
||||
traceroute example.com
|
||||
```
|
||||
Loading…
Reference in New Issue