Skip to main content
Ctrl+K

CYBINT Operator Handbook

  • Linux
    • Platform
      • Distributions
      • Boot
      • Kernel
      • The Terminal
      • Coreutils
      • Filesystem
        • Files
        • FHS
        • Navigation
        • Transfers
        • Reading and Writing
        • Archives
        • Hashing
        • Encryption
        • Disks
      • Processes
      • Memory
      • Users
      • Permissions
      • Devices
      • Packages
      • Services
      • Administration
      • Standard I/O
      • Hardening
    • Shells
    • Agents
    • Editors
    • Scripting
    • Networking
    • Desktop
  • Development
  • Operations
  • Intelligence
  • References
  • Disclaimers
  • License
  • Repository
  • Show source
  • Suggest edit
  • Open issue

Navigation

Contents

  • Change Directories
  • List Directories
  • Create / Remove Directories
  • Move / Rename Directories
  • Create Files
  • Remove Files
  • Move / Rename Files
  • Compress Files
  • Inspect Files
  • Edit Files
  • Search Files
  • Search Content
  • Disk Usage
  • Common Tasks
  • References

Navigation#

Commands for moving around the tree, listing what’s in it, and operating on the entries the operator finds. The shell tracks $PWD and $OLDPWD for the operator; cd, pushd, and popd are the levers that change them. Path traversal walks each component in turn, so the x bit on every intermediate directory is what actually controls where the operator can go.

On objective the operator lands in someone else’s tree. The first job is orientation. Where am I, what is here, what was touched recently, and what is the fastest path to the artifact I want. On home turf the same verbs run for housekeeping. Both jobs share cd, ls, find, and grep.

Filesystem navigation is a small set of verbs the operator chains together. The shell tracks state, the kernel walks paths, and the tools provide search and manipulation.

Stage

Role

Move

Change $PWD. cd, pushd, popd, and the directory stack.

List

Enumerate the entries at a level. ls, tree, eza.

Inspect

Read metadata (mode, size, type, hash). stat, file, du, sha256sum.

Operate

Create, copy, move, or remove entries. mkdir, cp, mv, rm, ln, rsync.

Find

Locate paths by name, type, size, or time. find, fd, locate.

Grep

Search inside file contents. grep, rg, awk, sed.

Change Directories#

cd, pushd, and popd move $PWD; $OLDPWD holds the previous directory. The -L flag keeps the logical path (symlinks preserved); -P resolves them. -L is the default.

Command

Effect

pwd

Print the working directory ($PWD)

pwd -L / pwd -P

Logical (default) / physical (resolves symlinks)

cd PATH

Change directory

cd / cd ~

Jump to $HOME

cd -

Jump back to $OLDPWD (and print it)

cd .. / cd ../..

One / two levels up

cd ~user

Jump to another user’s home (read from passwd)

cd -P PATH

Resolve symlinks while changing dir

cd -- -tricky

Stop option parsing; for paths starting with -

pushd PATH

Push current dir on the stack, then cd

pushd +N / pushd -N

Rotate the stack from the left / from the right

popd

Pop the stack and cd to the top

popd +N / popd -N

Drop entry at +N / -N without cd

dirs -v

List the directory stack with indices

dirs -c

Clear the stack

$ pwd
$ cd /etc && pwd && cd -
$ pushd /var/log >/dev/null
$ pushd /tmp     >/dev/null
$ dirs -v
$ popd >/dev/null

List Directories#

Command

Effect

ls

Sorted listing, no hidden files

ls -a / ls -A

Include hidden; -A skips . and ..

ls -l

Long listing (mode, owner, size, mtime)

ls -lh

Human-readable sizes

ls -ltr

Sorted by mtime, oldest first

ls -lS

Sorted by size, largest first

ls -R

Recursive

ls -d */

Only directories at this level

ls --color=auto

Colored output

tree

Recursive tree view (separate package)

tree -L 2

Limit depth

tree -I 'node_modules'

Ignore patterns

eza / exa

Modern ls with colors and Git status

lsd

Another colored ls

$ ls -lhA
$ ls -lhS /var/log | head
$ ls -d /etc/*/
$ tree -L 2 /etc/ssh

Create / Remove Directories#

Command

Effect

mkdir DIR

Create a directory

mkdir -p a/b/c

Create parents as needed (no error if existing)

mkdir -m 0750 DIR

Create with an explicit mode

rmdir DIR

Remove an empty directory

rmdir -p a/b/c

Remove if empty, plus newly-empty parents

rm -r DIR

Recursive remove (non-empty)

rm -rf DIR

The foot-gun; verify the path twice

rm -rI DIR

Prompt once for recursive deletes (safer -rf)

$ mkdir -p project/{src,test,docs}
$ mkdir -m 0750 secret/
$ rmdir empty/
$ rm -rI build/

Move / Rename Directories#

Command

Effect

mv OLD NEW

Move or rename a directory

mv -i / mv -n

Prompt before / never overwrite

mv -T OLD NEW

Treat NEW as a normal target (don’t “move into”)

cp -r DIR DST

Recursive copy

cp -a DIR DST

Archive copy (preserves perms, links, mtimes)

cp -r --reflink=auto DIR DST

CoW reflink recursive copy where supported

rsync -a SRC/ DST/

Mirror; preferred for large or remote trees

rsync -aP --delete SRC/ DST/

Mirror with progress; delete extras at DST

$ mv old-name/ new-name/
$ cp -a /etc/ssh/ /tmp/ssh.bak/
$ rsync -aP --delete src/ /mnt/backup/src/

Create Files#

Command

Effect

touch FILE

Create empty file or bump mtime

touch -a FILE / touch -m

Update only atime / only mtime

touch -d '2024-01-01' FILE

Set mtime to a specific date

: > FILE

Create or truncate to zero bytes (one syscall)

> FILE

Same (only when noclobber is off)

cp /dev/null FILE

Copy /dev/null to FILE

install -m 0600 /dev/null FILE

Create with explicit mode (and owner)

mktemp

Create a unique temp file in $TMPDIR

mktemp -d

Create a unique temp directory

$ touch placeholder.txt
$ : > log.txt
$ tmp=$(mktemp /tmp/work.XXXXXX)
$ tmpd=$(mktemp -d /tmp/work.XXXXXX)
$ sudo install -m 0600 /dev/null /etc/myapp.conf

Creating a multi-line file.

$ cat > file.txt <<EOF
> This is the first line
> This is the second line
> This is the third line
> EOF

Remove Files#

Command

Effect

rm FILE

Remove a file

rm -i FILE

Prompt before each delete

rm -f FILE

Never prompt; ignore missing

rm -- -tricky

Stop option parsing; for filenames starting with -

unlink FILE

Single-file POSIX remove (no globbing, one arg)

shred -u FILE

Overwrite then unlink (limited on CoW / journaled FS)

find DIR -name 'PAT' -delete

Delete matches in one walk

$ rm -i *.tmp
$ rm -- -dash-prefixed-file
$ shred -u secret.key
$ find /var/log -name '*.log' -mtime +30 -delete

Move / Rename Files#

Command

Effect

mv OLD NEW

Move or rename

mv -i / mv -n

Prompt before / never overwrite

mv -t DIR FILE...

Move many into DIR (target first; safer in scripts)

cp SRC DST

Copy a file

cp -a SRC DST

Archive copy (preserves perms, links, mtimes)

cp --reflink=auto SRC DST

CoW reflink (Btrfs / XFS / APFS)

ln SRC NAME

Hard link (same inode)

ln -s TARGET LINK

Symbolic link (path string)

rename 's/foo/bar/' *.txt

Batch rename via Perl regex (Debian, Ubuntu)

$ mv draft.md final.md
$ mv -t /tmp a.txt b.txt c.txt
$ cp --reflink=auto big.iso big.iso.copy
$ ln -s /usr/bin/python3 ~/bin/python
$ rename 's/\.JPEG$/.jpg/' *.JPEG

Compress Files#

Quick reference. The Archives page covers the full table of formats, ratios, and pipelines.

Command

Effect

gzip FILE / gunzip FILE.gz

.gz (ubiquitous default)

gzip -k FILE

Keep the original

zstd FILE / unzstd FILE.zst

.zst (modern default, fast, good ratio)

xz FILE / unxz FILE.xz

.xz (slow, best ratio)

bzip2 FILE / bunzip2 FILE.bz2

.bz2 (legacy)

tar -czf out.tgz dir/

Archive + gzip

tar -cJf out.txz dir/

Archive + xz

tar --zstd -cf out.tar.zst dir/

Archive + zstd

tar -xf archive.tar.zst

Extract (modern tar auto-detects compressor)

$ tar -czf logs.tgz /var/log
$ tar --zstd -cf src.tar.zst src/
$ tar -xf release.tar.zst -C /opt
$ zgrep -h ERROR /var/log/syslog.*.gz | head

Inspect Files#

Command

Effect

stat FILE

Full metadata (size, mode, owner, a/m/c times)

file FILE

Detect type from contents (ELF, JPEG, …)

file -i FILE

With MIME type

wc FILE

Line, word, byte counts

du -sh FILE

Size on disk, human-readable

md5sum / sha256sum

Cryptographic hash

b3sum

BLAKE3 (fast modern hash)

cmp A B

Compare two files byte-by-byte

diff A B

Show line-level differences

lsof FILE

Who has this file open

lsof -p PID

All files / sockets PID has open

lsof +D DIR

All open files anywhere under DIR

fuser FILE / -v

PIDs using FILE (verbose)

fuser -km /mnt/usb

Kill processes blocking an unmount

$ stat /etc/passwd
$ file -i unknown.bin
$ sha256sum *.iso > SHA256SUMS
$ diff -u config.yml config.yml.bak | less
$ sudo lsof /var/log/syslog
$ sudo lsof +D /mnt/usb

Edit Files#

Command

Effect

vi / vim / nvim FILE

Modal editors (POSIX vi, Vim, Neovim)

nano FILE

Beginner-friendly editor

emacs FILE

Emacs (TUI with -nw)

view FILE

Read-only vim

ed FILE / ex FILE

POSIX line editors

sed -i 's/old/new/g' FILE

In-place substitution (GNU)

sed -i '' 's/old/new/g' FILE

BSD / macOS in-place (note empty arg)

perl -pi -e 's/old/new/g' FILE

Portable in-place

ex -s -c '%s/old/new/g|wq' FILE

POSIX-correct in-place edit

$ sudo nano /etc/hosts
$ sed -i.bak 's/foo/bar/g' config.yml
$ perl -pi -e 's/\r$//' file.txt

Search Files#

Find files by name, type, size, or time. find is POSIX and walks the tree on every call; locate consults a pre-built index (updatedb); fd is the modern fast replacement; fzf and sk are interactive fuzzy filters that read paths from stdin.

Command

Effect

find DIR -name 'PAT'

By filename glob

find DIR -iname 'PAT'

Case-insensitive

find DIR -type f

Restrict to regular files (or d, l, s)

find DIR -size +100M

By size

find DIR -mtime -7

Modified in the last 7 days

find DIR -newer REF

Newer than a reference file

find DIR -name '*.tmp' -delete

Delete matches

find DIR -exec cmd {} \;

Run cmd once per file

find DIR -exec cmd {} +

Batch cmd invocations (faster)

find DIR -print0 | xargs -0 cmd

NUL-delimited piping (handles spaces)

locate PATTERN

Pre-indexed search (updatedb to refresh)

which CMD

Where a command resolves on $PATH

whereis CMD

Binary, source, man page

type CMD

Shell built-in vs alias vs external

command -v CMD

Portable which

fd PATTERN

Friendlier find (gitignore-aware)

fd -e py PATTERN

Restrict by extension

fd -t f -H PATTERN

Files only, include hidden

fzf

Interactive fuzzy filter (reads paths on stdin)

find . -type f | fzf

Pick a file interactively

fd . | fzf --preview 'bat {}'

Fuzzy find with file preview

rg --files | fzf

ripgrep-listed files into fzf

sk (skim)

Rust fuzzy finder; same idea as fzf

peco

Go fuzzy filter; pipe-friendly

Ctrl-T / Ctrl-R

fzf shell bindings, file picker / history search

zoxide (z)

Frecency-ranked cd (jumps to remembered dirs)

$ find /var/log -type f -name '*.log' -mtime -1
$ fd -e py main
$ fd . | fzf --preview 'bat {}'
$ command -v python3
$ sudo updatedb && locate sshd_config

Search Content#

Search inside file contents. grep is POSIX and everywhere; rg (ripgrep) is the modern fast default and respects .gitignore. Pipe results into fzf for an interactive picker.

Command

Effect

grep PAT FILE

Print matching lines

grep -r PAT DIR

Recursive search

grep -rn PAT DIR

Recursive with line numbers

grep -ri PAT DIR

Case-insensitive

grep -w 'word' FILE

Whole-word match

grep -v PAT FILE

Invert match (lines NOT matching)

grep -c PAT FILE

Count matching lines

grep -l PAT -r DIR

Just the filenames that match

grep -L PAT -r DIR

Files that do NOT match

grep -E 'a|b' FILE

Extended regex (alternation, +, ?)

grep -P '\d+' FILE

Perl-compatible regex (GNU)

grep -F 'literal' FILE

Fixed string, no regex

grep -A 3 PAT FILE

3 lines of context after each match

grep -B 3 PAT FILE / -C 3

Context before / before+after

grep --include='*.py' -r PAT .

Restrict by glob

grep --exclude-dir=.git -r PAT .

Skip directories

grep -z PAT FILE

NUL-delimited records (binary safe)

rg PAT

Ripgrep (recursive, gitignore-aware)

rg -t py PAT

Restrict to a file type (Python here)

rg -i -C 2 PAT

Case-insensitive, two lines of context

rg -l PAT

Filenames only

rg --files

List files ripgrep would search

ag PAT

Silver searcher (similar to rg)

ack PAT

Perl-based, programmer-oriented

awk '/PAT/{print}' FILE

Match lines via awk

sed -n '/PAT/p' FILE

POSIX line search

look STRING SORTED_FILE

Binary search a sorted file

strings BINARY | grep PAT

Search printable strings in a binary

rg --line-number PAT | fzf

Interactive jump-to-match picker

zgrep PAT *.gz / xzgrep

Search compressed files in place

$ grep -rn 'TODO' src/
$ grep -rn --include='*.py' --exclude-dir=.venv 'def main' .
$ rg -t py 'def main'
$ rg -i -C 2 'connection refused' /var/log/
$ zgrep -h ERROR /var/log/syslog.*.gz | head

Disk Usage#

Command

Effect

df -h

Free space per mounted filesystem

df -hT

With filesystem-type column

df -i

Inode usage

du -sh DIR

Total size of a directory

du -h --max-depth=1

Per-child sizes

du -ah | sort -rh | head

Largest entries under the current dir

ncdu /

Interactive disk-usage TUI (third-party)

dust

Modern du with bars (third-party)

$ df -hT
$ du -sh /var/log /var/lib/docker
$ du -ah . | sort -rh | head -n 10
$ sudo ncdu /

Common Tasks#

The day-to-day filesystem verbs run as one-liners. List, copy, move, remove, make a directory, stat, count usage, find. These are the recipes the operator reaches for in any session, regardless of distribution or filesystem type.

List the current directory in long form.

$ ls -lah

Mirror a tree, preserving metadata.

$ cp -a src/ dst/

Move or rename in place.

$ mv old new

Recursive remove (verify the path twice).

$ rm -rf path/

Create a nested directory tree in one call.

$ mkdir -p a/b/c

Read full metadata for a single entry.

$ stat file

Total size of a directory.

$ du -sh dir

Free space per mounted filesystem.

$ df -h

Find and delete old logs in one walk.

$ find . -name '*.log' -mtime +7 -delete

References#

  • man 1 cd, man 1 pushd, man 1 popd, man 1 dirs (shell builtins for movement).

  • man 1 ls, man 1 tree, man 1 stat, man 1 file (listing and inspection).

  • man 1 cp, man 1 mv, man 1 rm, man 1 mkdir, man 1 rmdir, man 1 ln (basic file operations).

  • man 1 find, man 1 locate, man 8 updatedb, man 1 xargs (path search).

  • man 1 grep, man 1 sed, man 1 awk (content search).

  • man 1 du, man 1 df, man 1 lsof, man 1 fuser (usage and open files).

  • man 1 tar, man 1 gzip, man 1 zstd, man 1 xz, man 1 bzip2 (compression).

  • man 1 rsync, man 1 install, man 1 mktemp, man 1 shred (transfer and creation).

  • Permissions for the x bit on directories controlling path traversal.

  • Files for the file model the navigation verbs operate on.

  • FHS for the standard tree the operator walks.

  • Archives for the full compression and archive reference.

  • Linux for the per-letter Linux command reference.

previous

FHS

next

Transfers

Contents
  • Change Directories
  • List Directories
  • Create / Remove Directories
  • Move / Rename Directories
  • Create Files
  • Remove Files
  • Move / Rename Files
  • Compress Files
  • Inspect Files
  • Edit Files
  • Search Files
  • Search Content
  • Disk Usage
  • Common Tasks
  • References

By @Rangertaha

© Copyright 2014-2026 CYBINT LLC.