My most-used Linux commands

Not a full reference — just what lives in my muscle memory. Built it over time, one "fifth trip to the man page" at a time.

Moving around and looking around

cd /var/log          # go to a directory
cd -                 # back to where you were — surprisingly handy
ls -la               # everything, with permissions and owners
pwd                  # where am I
tree -L 2 /opt       # two levels deep (apt install tree if missing)

Creating and deleting

mkdir -p /opt/apps/site/releases   # -p creates the whole chain at once
cp -r site site.bak                # copy a directory
mv site site_old                   # rename/move — same command
rm -rf site_old                    # delete without questions. I once "lost" a production config with this — since then I run ls in the same line first: look, then delete

Users and groups

useradd -m -s /bin/bash deploy    # create a user with a home dir and a proper shell
passwd deploy                     # set a password
usermod -aG docker deploy         # ADD to a group (-a is mandatory! without it usermod replaces all groups — learned the hard way)
groups deploy                     # check group membership
groupadd developers               # create a group
id deploy                         # uid, gid and all groups in one line

Permissions

chmod 644 index.html      # owner full, others read
chmod 755 script.sh       # owner executes, others read+execute
chmod -R 700 ~/.ssh       # recursively
chown deploy:deploy /opt/apps/site   # owner and group
chown -R runner:runner /opt/apps/site

The three digits are owner / group / others: 4 read, 2 write, 1 execute. 7 = all, 6 = read+write, 5 = read+execute, 4 = read only, 0 = nothing.

Restrictions I learned "the hard way"

chmod 600 ~/.ssh/id_rsa          # private key — OWNER ONLY. OpenSSH refuses looser permissions: "UNPROTECTED PRIVATE KEY FILE"
chmod 644 ~/.ssh/id_rsa.pub      # public key — 644 is fine, it's public
chmod 600 ~/.env                 # any file with secrets
chmod 644 /etc/nginx/nginx.conf  # configs are usually 644, unless they hold passwords — then 600

Related: when something "doesn't work" after copying files from another machine, my first check is ls -la. Nine times out of ten the owner turned out to be root when it should be the service user.