Linux Server Basics: Essential Commands, Permissions, and Log Management

On a cloud server, nearly everything happens in a terminal. Whether you're a backend developer or a full-time sysadmin, Linux is the daily environment you can't avoid. When you take over a fresh box, the routine is always the same: log in over SSH, check system info, confirm disk and memory, then get to work. This guide turns those operations into a checklist you can follow, with the scenario for each command so you can start building your own command library.

1. SSH Connection

1.1 Basic Connection

SSH is the standard way to log into a remote server. Start with password auth on first login, then switch to key auth as soon as possible — password auth is far too vulnerable to brute force.

ssh user@server_ip
ssh -i ~/.ssh/id_rsa user@server_ip
ssh -p 2222 user@server_ip

1.2 SSH Config

Write frequently used servers into ~/.ssh/config; after that, one ssh myserver connects you, and you can pin the key, port, and jump host there too.

# ~/.ssh/config
Host myserver
    HostName 123.456.789.0
    User root
    Port 22
    IdentityFile ~/.ssh/id_rsa

To harden SSH further (disable password login, restrict IPs), see our SSH hardening guide.

2. File Management

2.1 File and Directory Operations

File operations are the most frequently used commands of all. ls -la lists everything including hidden files; du -sh reports directory usage, and piping to sort -hr quickly tells you which directory is eating your disk.

ls -la              # List all files
pwd                 # Current path
cd /var/www         # Change directory
mkdir -p a/b/c      # Recursive create
rm -rf dir/         # Force delete
cp file1 file2      # Copy file
mv file1 dir/       # Move file
rm file.txt         # Delete file
touch newfile.txt   # Create empty file
cat file.txt        # Show all content
less file.txt       # Paginated view
head -20 file.txt   # First 20 lines
tail -f file.txt    # Real-time tail

tail -f is the workhorse of debugging — after deploying a service, leave tail -f /var/log/nginx/error.log running and errors stream by in real time.

2.2 File Permissions

Permissions are expressed in numbers: read r=4, write w=2, execute x=1, summed per group. chmod 755 means owner can read/write/execute (7=4+2+1) while group and others can read/execute (5=4+1) — the standard for scripts and executables.

chmod 755 file.sh   # rwxr-xr-x
chmod 644 config    # rw-r--r--
chown user:group file.txt
chown -R www-data:www-data /var/www/

The most common web-permission problem is "nginx can't read the file." Usually, setting the site directory owner to www-data, files to 644, and directories to 755 fixes it. Remember the principle: grant write only where necessary, and remember execute (x) on a directory is required to enter it.

3. Process Management

ps aux              # All processes
top                 # Real-time monitor
kill 1234           # End process
kill -9 1234        # Force end
pkill nginx         # Kill by name
nohup command &     # Background run
screen              # Virtual terminal
tmux                # Terminal multiplexer

kill -9 is the last resort: it terminates a process without letting it clean up. Prefer plain kill (SIGTERM) first. For long-running jobs (like a backup at 3 a.m.), wrap them in tmux or screen so they survive your SSH session disconnecting.

4. Disk and Memory

df -h               # Disk space
du -sh /var/www/    # Directory size
du -sh * | sort -hr # Largest first
free -h             # Memory usage
vmstat 5            # System stats

Disk-alert is the most common alert a site owner sees. When df -h shows / above 85%, run du -sh * to find the culprit, then decide to clean or expand. In free -h, available is a truer measure than free — it counts reclaimable cache.

5. Log Viewing

# Common log locations
/var/log/nginx/access.log
/var/log/nginx/error.log
/var/log/mysql/error.log
/var/log/syslog

# Log viewing tips
tail -f /var/log/nginx/access.log
grep "ERROR" /var/log/app.log
journalctl -u nginx --since "1 hour ago"

Logs are the first place to look when something breaks. A 502? Check nginx's error log. An API error? Grep the app log for ERROR. Want to know "what nginx did in the last hour"? journalctl -u nginx --since "1 hour ago" handles it in one line. In production, consider centralizing logs with a collection stack for long-term retention rather than only reading local files during incidents — see ELK log analysis platform setup.

6. Useful System Commands

curl -I https://example.com
ping -c 4 example.com
ss -tlnp
netstat -tulpn
uname -a
cat /etc/os-release
lscpu
lsblk
apt update && apt upgrade -y
apt install nginx
apt remove nginx

ss -tlnp is the go-to for "which process is holding this port." When a service won't start, confirm the port isn't already taken; lscpu and lsblk are quick ways to verify specs after buying a server.

7. Shortcuts

Ctrl + C    # Interrupt
Ctrl + D    # Logout
Ctrl + R    # Search history
Ctrl + L    # Clear screen
Ctrl + A    # Line start
Ctrl + E    # Line end
Ctrl + W    # Delete previous word
!!          # Repeat last command
!nginx      # Rerun last nginx command

Ctrl + R reverse-history search is the biggest efficiency win: type a few letters and retrieve long commands you typed before, no retyping.

8. A Typical Troubleshooting Scenario

Say your site suddenly returns 502. The chain is: curl -I https://your-domain to confirm the error → ss -tlnp | grep 80 to check whether port 80 is listening → tail -f /var/log/nginx/error.log to see if the backend is refusing connections → systemctl status php-fpm or ps aux | grep php to confirm PHP is alive. Every step is just a combination of the commands above — none of them are "advanced."

9. Summary

These commands cover 80%+ of daily server management needs. Use man (e.g., man ls) to learn more about each command — it's the best way to learn and remember. For destructive operations (formatting, deleting, overwriting configs), get into the habit of backing up first; verify unfamiliar commands on a test machine before running them on production.