First five minutes on a strange box
What am I even on
cat /etc/os-releaseIs the service running
systemctl status nginxWhy did it stop
journalctl -u nginx -n 50Is the disk full
df -hWhat is listening
ss -tulpnGet out of the editor
Esc then :q!
Read this before the command tables. Distributions disagree about package managers, firewalls and network configuration, and a command from the wrong family fails in a way that reads like a broken system. Every table below names the family it belongs to. Start with
/etc/os-release and you will not guess.
Getting in from Windows
| Step | Command, in PowerShell or cmd |
|---|---|
Connect with the Windows OpenSSH client. Check it first with ssh -V. | ssh zaur@10.0.0.21 |
| Connect on another port | ssh -p 2222 zaur@10.0.0.21 |
| First time it asks about a fingerprint | Type yes once. It is remembered in known_hosts. |
| Make a key instead of typing a password | ssh-keygen -t ed25519 |
| Put that key on the server | ssh-copy-id zaur@10.0.0.21 |
| Send a file up | scp report.csv zaur@10.0.0.21:/tmp/ |
| Bring a file down | scp zaur@10.0.0.21:/var/log/syslog . |
| Where did I land | pwd and whoami |
| Do one thing as root | sudo systemctl restart nginx |
| Stay as root for a while | sudo -i, and exit to drop back |
| Leave the server | exit, or Ctrl+D |
sudo is not quite UAC. There is no prompt on the screen to click: you type your own password, not root’s, and only if your account is allowed to.
sudo -l lists what you may run. If the answer is nothing, the account was never granted it, and no amount of retrying changes that.
Password refused although it is correct? Many servers accept keys only. That is not a broken password, it is
PasswordAuthentication no on the far side, and the fix is a key. The SSH cheat sheet covers keys, the config file, tunnels and file transfer in full.
Which family am I on
| Family | Distributions you will actually meet |
|---|---|
| RHEL family | RHEL, Rocky, AlmaLinux, Oracle Linux, CentOS Stream, Fedora |
| Debian family | Debian, Ubuntu, and most appliances built on them |
| SUSE family | SLES, openSUSE Leap |
| Photon OS | The vCenter Server Appliance and several VMware appliances |
| Alpine | Containers, rarely a full machine |
| Question | Command |
|---|---|
| Distribution and version | cat /etc/os-release |
| Kernel and architecture | uname -a |
| Hostname, OS and virtualisation | hostnamectl |
| Uptime and load | uptime |
| Am I root | id |
| Time and time zone | timedatectl |
Windows to Linux
| Windows | Linux |
|---|---|
dir | ls -la |
cd \ | cd / |
type file.txt | cat file.txt, or less file.txt for long output |
copy / xcopy /E | cp / cp -r |
move / ren | mv, which does both |
del / rd /s | rm / rm -r |
md | mkdir -p |
robocopy | rsync -avh --progress |
findstr "text" file | grep "text" file |
dir /s /b | findstr name | find / -name "name*" 2>/dev/null |
tasklist | ps aux |
taskkill /PID 123 /F | kill -9 123 |
taskkill /IM name.exe /F | pkill -9 name |
| Task Manager | top, or htop if installed |
sc query / net start | systemctl status / systemctl start |
| Event Viewer | journalctl |
netstat -ano | ss -tulpn |
ipconfig /all | ip a |
route print | ip r |
arp -a | ip neigh |
nslookup | dig, or host |
tracert | traceroute, or tracepath |
systeminfo | hostnamectl plus free -h and lscpu |
diskpart / list volume | lsblk -f and df -hT |
icacls | chmod and chown |
takeown | chown user:group file |
schtasks | crontab -e, or a systemd timer |
shutdown /r /t 0 | reboot |
cls | clear |
where cmd | which cmd |
set | env |
help cmd / cmd /? | man cmd, or cmd --help |
| Run as administrator | sudo before the command |
Two traps that catch everyone. Paths are case sensitive, so
/etc/Hosts is not /etc/hosts. And rm has no recycle bin and no confirmation: rm -rf on the wrong path is final.
Where things live
| Path | What it holds |
|---|---|
/etc | Configuration. The closest thing to the registry, except it is text. |
/var/log | Log files |
/home/user | User profiles. Root’s own home is /root. |
/opt | Third-party software, the rough equivalent of Program Files |
/usr/bin, /usr/sbin | Programs on the PATH |
/tmp | Temporary files, usually cleared on reboot |
/mnt, /media | Mount points for other file systems |
/proc, /sys | Kernel state presented as files, not real files on disk |
| Windows idea | Linux reality |
|---|---|
| Drive letters | One tree from /. Other disks are mounted into it. |
| Backslash | Forward slash |
| Case-insensitive names | Case sensitive, always |
| Extension decides what runs | The execute bit decides. Extensions are a convention. |
| Hidden attribute | A leading dot in the name, shown by ls -a |
| Recycle bin | None from the command line |
| Locked files in use | A running process keeps deleted files alive until it closes them |
Packages, by family
| Task | RHEL family | Debian family |
|---|---|---|
| Refresh metadata | dnf check-update | apt update |
| Install | dnf install nano | apt install nano |
| Remove | dnf remove nano | apt remove nano |
| Update everything | dnf upgrade | apt upgrade |
| Search | dnf search term | apt search term |
| Which package owns a file | rpm -qf /usr/bin/ss | dpkg -S /usr/bin/ss |
| Is it installed | rpm -q iproute | dpkg -l iproute2 |
| Other families | Install command |
|---|---|
| RHEL 7 and older | yum install nano |
| SLES and openSUSE | zypper install nano |
| Photon OS, including the vCenter appliance | tdnf install nano |
| Alpine, mostly containers | apk add nano |
Package names are not portable either. The same tool ships as
iproute on RHEL and iproute2 on Debian, and ss or ip missing usually means the package is absent, not the system broken.
Services and logs, by family
| Task | Command |
|---|---|
| State of a service | systemctl status sshd |
| Start, stop, restart | systemctl start|stop|restart sshd |
| Start at boot | systemctl enable --now sshd |
| Everything that failed | systemctl --failed |
| Logs for one service | journalctl -u sshd -n 50 |
| Follow, like tail -f | journalctl -u sshd -f |
| Detail | RHEL family | Debian family |
|---|---|---|
| SSH service name | sshd | ssh |
| General system log file | /var/log/messages | /var/log/syslog |
| Authentication log file | /var/log/secure | /var/log/auth.log |
| Admin group for sudo | wheel | sudo |
| Mandatory access control | SELinux, getenforce | AppArmor, aa-status |
| Editor that is always there | vi | vi, usually nano as well |
The service is not always called what you expect.
systemctl restart ssh works on Ubuntu and fails on Rocky, where the unit is sshd. When in doubt, systemctl list-units --type=service | grep -i ssh.
Network and firewall, by family
| Task | Command, any modern distribution |
|---|---|
| Addresses, short form | ip -br a |
| Routing table | ip r |
| Neighbours, the ARP cache | ip neigh |
| Listening sockets with processes | ss -tulpn |
| Interface counters and errors | ip -s link |
| Which DNS server is in use | cat /etc/resolv.conf, or resolvectl status where systemd-resolved runs |
| Where the config lives | Distribution |
|---|---|
nmcli, NetworkManager | RHEL family, and Ubuntu with a desktop |
/etc/netplan/*.yaml then netplan apply | Ubuntu Server 18.04 and later |
/etc/network/interfaces | Debian, and older Ubuntu |
/etc/sysconfig/network-scripts/ifcfg-* | RHEL 7 and older. Deprecated on RHEL 9. |
wicked or YaST | SLES |
/etc/systemd/network/*.network | Photon OS and anything using systemd-networkd |
| Firewall task | RHEL family, firewalld | Ubuntu, ufw |
|---|---|---|
| Is it on | firewall-cmd --state | ufw status |
| What is open | firewall-cmd --list-all | ufw status verbose |
| Open a port | firewall-cmd --add-port=8443/tcp --permanent | ufw allow 8443/tcp |
| Apply the change | firewall-cmd --reload | applied immediately |
ifconfig and netstat are not the answer any more. They come from the unmaintained net-tools package and are absent by default on RHEL 8 and later, on recent Ubuntu, and on most appliances. Use
ip and ss: they are installed, and they report things the old tools cannot.
Surviving vi
| Goal | Keys |
|---|---|
| Start typing | i |
| Stop typing, back to command mode | Esc |
| Save and quit | :wq |
| Quit, discarding everything | :q! |
| Undo the last thing you did | u |
| Delete the current line | dd |
| Search | /text then n for the next hit |
| Top and bottom of the file | gg and G |
| Go to line 42 | :42 |
| Show line numbers | :set number |
Two habits worth building. Copy the file before editing it, with
cp /etc/fstab /etc/fstab.bak, and prefer nano when it exists. vi matters because it is the only editor guaranteed to be there, including on an ESXi host. The vi cheat sheet covers selecting, deleting, search and replace in full.
Where a Windows admin actually meets Linux
| Platform | What to know before typing |
|---|---|
| ESXi shell | Not Linux. VMkernel with a BusyBox shell, so no systemctl, no package manager and a reduced set of options on ordinary commands. |
| ESXi, restart a service | /etc/init.d/hostd restart, and services are listed under /etc/init.d/ |
| ESXi, the logs | /var/log/vmkernel.log, hostd.log, vpxa.log, vobd.log |
| ESXi, version | vmware -vl or esxcli system version get |
| ESXi, keeping a change | Configuration is restored from a backup at intervals, so force a save with /sbin/auto-backup.sh |
| vCenter Server Appliance | Real Linux, Photon OS. You land in the appliance shell: type shell to get bash. |
| VCSA, services | service-control --status --all, and systemctl works as well |
| VCSA, logs and packages | Logs under /var/log/vmware/, packages through tdnf |
| WSL on your own workstation | A real distribution, usually Ubuntu. Windows drives appear under /mnt/c. |
| NAS and appliances | Often BusyBox with a cut-down shell. Check what exists before relying on it. |
Do not treat an ESXi host as a Linux server. It has no package manager, its shell is deliberately minimal, and SSH is off by default for a reason. Installing things, editing files by hand or leaving SSH enabled all count as an unsupported configuration. Use
esxcli and the API, and turn SSH back off when you are done.
FAQ
Permission denied, and I am root. How?
Three usual causes: the file has no execute bit, so
chmod +x; the file system is mounted read-only, which findmnt or mount | grep ro, will show; or SELinux on the RHEL family is refusing it, which getenforce and the audit log confirm. Unlike Windows, root can still be stopped by the second and third.
I deleted a big log file and the space did not come back.
A process still holds the file open, so the blocks stay allocated until it closes. Find it with
lsof | grep deleted and restart that service. Truncating instead of deleting avoids the problem: : > /var/log/big.log.
Which command shows the equivalent of Event Viewer?
journalctl on anything with systemd. Useful forms are -u name for one service, -p err for errors only, -b for this boot and --since "1 hour ago". On older systems without systemd, read /var/log/messages or /var/log/syslog directly.
Do I need to learn bash scripting?
Not to troubleshoot. Reading a script and running commands one at a time covers most of what a Windows admin needs on Linux, and PowerShell 7 runs on Linux if you want your own tooling there. Learn pipes, redirection and
grep first, they carry the most weight.
Why does the same command work on Ubuntu and fail on Rocky?
Because they are different families. Package managers, firewall front ends, network configuration, service names and log file locations all differ, and the tables above name which is which. The kernel is common ground; almost everything around it is a distribution decision.