Intermediate Linux: 200 Commands and Techniques

You already navigate, edit and install packages. These 200 items are the turning point: combining commands, automating with scripts, administering services with systemd, scheduling tasks, mastering SSH and diagnosing disk, network and logs.

It is the set that separates someone who uses the terminal from someone who administers the server.

The Unix philosophy in one sentence: each command does one thing well, and the pipe (|) joins it all together. Most of this post is about that.

Contents

• 1–20 · Pipes, redirection and expansion
• 21–50 · grep, sed and awk
• 51–85 · Shell scripts
• 86–105 · systemd and services
• 106–117 · Cron and scheduling
• 118–135 · SSH
• 136–155 · Intermediate networking
• 156–175 · Disks, partitions and filesystems
• 176–190 · Logs
• 191–200 · Security and access automation

Pipes, redirection and expansion

What turns isolated commands into a single tool.

1. Pipe (|)

Sends the output of one command into the input of the next.

ps aux | grep nginx | wc -l

2. Redirect the output

> overwrites the file; >> appends to the end.

comando > saida.txt
comando >> log.txt

3. Separate the error from the output

1 is standard output, 2 is the error.

comando > saida.txt 2> erros.txt

4. Merge the error with the output

The order matters: redirect the file first, then join 2 to 1.

comando > tudo.txt 2>&1
comando &> tudo.txt        # a bash shortcut

5. Discard the output

/dev/null is the system's drain.

comando 2>/dev/null
comando >/dev/null 2>&1

6. Input from a file

< feeds the command with the file's content.

sort < nomes.txt
while read linha; do echo "$linha"; done < lista.txt

7. Here-document

A block of text straight into the command. Heavily used for configuration and SQL.

cat <<EOF > config.yml
servidor: producao
porta: 8080
EOF

8. Here-string

Sends a string straight into the input.

grep "erro" <<< "$conteudo"

9. tee — write and show

Saves to a file and keeps the pipe going. Essential with sudo.

comando | tee saida.txt
echo "linha" | sudo tee -a /etc/hosts

10. xargs — turn input into arguments

Some commands do not read from the pipe; xargs solves that.

find . -name "*.log" | xargs rm
cat urls.txt | xargs -n1 curl -sI

11. xargs in parallel

-P processes several at once. A huge gain on a repetitive task.

cat urls.txt | xargs -P 8 -n 1 curl -sO

12. Command substitution

$(...) inserts the output of one command inside another.

echo "Hoje é $(date +%F)"
kill $(pgrep -f meu-script)

13. Process substitution

<(...) turns a command's output into a temporary file.

diff <(ls pasta1) <(ls pasta2)
comm -13 <(sort a.txt) <(sort b.txt)

14. Brace expansion

Generates lists and sequences without a loop.

mkdir -p projeto/{src,test,docs}
touch arquivo{1..5}.txt
cp config.yml{,.bak}

15. Arithmetic expansion

Does the maths in the shell itself.

echo $((2 + 3 * 4))
total=$((total + 1))

16. Single vs double quotes

Double quotes expand variables; single quotes expand nothing.

nome="Jhonatan"
echo "Olá $nome"    # Olá Jhonatan
echo 'Olá $nome'    # Olá $nome

17. Always quote your variables

Without quotes, a space in the value becomes two arguments — the source of half the bugs in scripts.

arquivo="meu arquivo.txt"
rm "$arquivo"     # right
rm $arquivo       # tries to delete "meu" and "arquivo.txt"

18. Exit code

$? holds the result of the last command: 0 is success.

comando
if [ $? -ne 0 ]; then echo "falhou"; fi

19. pipefail

Without it, a pipe only fails if the last command fails.

set -o pipefail
falso | true; echo $?   # now it reports the failure

20. Conditional chaining

Runs according to the success of the previous command.

make build && make deploy
comando || echo "falhou" >&2

grep, sed and awk

The trio that processes text on any server, with nothing to install.

21. grep with regex

Patterns instead of fixed text.

grep -E "^[0-9]{3}-[0-9]{4}$" telefones.txt

22. grep -o — only what matched

Extracts the fragment, not the whole line.

grep -oE "[0-9]{1,3}(\.[0-9]{1,3}){3}" access.log | sort | uniq -c | sort -nr

23. grep -P — Perl regex

Enables lookahead, \d, \s and the like.

grep -P "(?<=usuario=)\w+" app.log

24. grep on binary and compressed files

Searches inside a rotated log without decompressing it.

zgrep "erro" /var/log/syslog.2.gz
grep -a "texto" arquivo.bin

25. grep excluding directories

Avoids sweeping node_modules and .git.

grep -r "TODO" . --exclude-dir={node_modules,.git,dist}

26. sed — substitute

The most used operation: swapping text.

sed 's/antigo/novo/' arquivo.txt        # the first occurrence in the line
sed 's/antigo/novo/g' arquivo.txt       # all of them

27. sed editing the file

-i writes to the file itself. Always make a backup with -i.bak.

sed -i.bak 's/porta=8080/porta=9090/' config.ini

28. sed with another delimiter

Avoids escaping slashes when working with paths.

sed 's|/var/www|/srv/www|g' config.conf

29. sed on a specific line

Restricts the substitution to a line or a range.

sed '3s/erro/ok/' arquivo.txt
sed '10,20s/dev/prod/g' arquivo.txt

30. sed deleting lines

Removes by number, by pattern or empty ones.

sed '5d' arquivo.txt
sed '/^#/d' config.conf        # comments
sed '/^$/d' arquivo.txt        # blank lines

31. sed inserting lines

Before (i), after (a) or in place (c).

sed '1i #!/bin/bash' script.sh
sed '/\[servidor\]/a porta=8080' config.ini

32. sed printing a range

-n silences the default output; p prints what matters.

sed -n '10,20p' arquivo.txt
sed -n '/INICIO/,/FIM/p' log.txt

33. sed with groups

Captures parts and reorders them.

echo "2026-08-10" | sed -E 's/([0-9]{4})-([0-9]{2})-([0-9]{2})/\3\/\2\/\1/'

34. sed across several files

Batch substitution, combined with find.

find . -name "*.md" -exec sed -i 's/http:/https:/g' {} +

35. awk — print columns

Splits the line into fields automatically.

awk '{print $1, $3}' arquivo.txt
ps aux | awk '{print $2, $11}'

36. awk with a delimiter

-F sets the field separator.

awk -F: '{print $1}' /etc/passwd
awk -F, '{print $2}' dados.csv

37. awk with a filter

It only processes the lines matching the condition.

awk '$3 > 100 {print $1, $3}' vendas.txt
awk '/erro/ {print}' app.log

38. awk summing

Accumulates values and prints at the end.

awk '{soma += $2} END {print "Total:", soma}' vendas.txt

39. awk with an average

A counter and a sum in the same pass.

awk '{soma += $1; n++} END {print "Média:", soma/n}' numeros.txt

40. awk grouping

An associative array: the terminal's "GROUP BY".

awk '{contagem[$1]++} END {for (chave in contagem) print chave, contagem[chave]}' acessos.log

41. awk with a header

NR is the line number; NF, the number of fields.

awk 'NR > 1 {print $1}' dados.csv       # skips the header
awk '{print NF}' arquivo.txt            # fields per line

42. awk formatting

printf gives full control of the format.

awk '{printf "%-20s %8.2f\n", $1, $2}' precos.txt

43. awk with multiple conditions

Combines filters as in SQL.

awk -F, '$3 == "SP" && $4 > 1000 {print $1}' clientes.csv

44. awk changing the output separator

OFS defines how the fields come out.

awk -F: 'BEGIN {OFS=","} {print $1, $3}' /etc/passwd

45. Analysing an access log

The classic recipe: the top 10 IPs by number of hits.

awk '{print $1}' access.log | sort | uniq -c | sort -nr | head -10

46. Top URLs with a 500 error

awk combined with a status filter.

awk '$9 == 500 {print $7}' access.log | sort | uniq -c | sort -nr | head

47. Average response time

Extracts the metric straight from the log.

awk '{soma += $NF; n++} END {printf "média: %.3fs\n", soma/n}' tempos.log

48. cut vs awk

cut is faster for fixed columns; awk copes with variable spacing.

cut -d, -f1,3 dados.csv        # simple and fast
awk '{print $1, $3}' saida.txt # irregular spacing

49. paste and join

Joins files by column or by key, like a JOIN.

paste nomes.txt idades.txt
join -t, -1 1 -2 1 clientes.csv pedidos.csv

50. column — align the output

Makes a messy output readable.

mount | column -t
cat /etc/passwd | column -t -s:

Shell scripts

Automating what you repeat — with the fewest possible traps.

51. Shebang

The first line: it says which interpreter runs the file.

#!/usr/bin/env bash

52. Make it executable

Without execute permission, the script does not run.

chmod +x script.sh
./script.sh

53. Strict mode

The three lines that prevent most bugs: exit on error, complain about undefined variables and propagate a pipe failure.

set -euo pipefail

54. Variables

No space around the =. Quotes when using them.

nome="Jhonatan"
echo "Olá, $nome"

55. A local variable in a function

Without local, everything is global — and a repeated name becomes a silent bug.

minha_funcao() {
  local contador=0
  contador=$((contador + 1))
}

56. Script arguments

$1, $2... and $@ for all of them.

echo "primeiro: $1"
echo "todos: $@"
echo "quantidade: $#"

57. Default value for a variable

Uses the default when the variable is empty.

porta="${PORTA:-8080}"
destino="${1:?informe o destino}"   # aborts with a message

58. Simple if

A conditional with double brackets (a bash feature, safer).

if [[ -f config.yml ]]; then
  echo "config encontrado"
fi

59. if / elif / else

The full chain.

if [[ $1 == "prod" ]]; then
  echo "produção"
elif [[ $1 == "hml" ]]; then
  echo "homologação"
else
  echo "ambiente desconhecido" >&2
  exit 1
fi

60. File tests

Exists, is a directory, is readable, has content.

[[ -e caminho ]]   # exists
[[ -f arquivo ]]   # is a file
[[ -d pasta ]]     # is a directory
[[ -r arquivo ]]   # readable
[[ -s arquivo ]]   # is not empty

61. String tests

Empty, equal, different, matches a pattern.

[[ -z "$var" ]]          # empty
[[ -n "$var" ]]          # not empty
[[ "$a" == "$b" ]]
[[ "$arquivo" == *.log ]]

62. Numeric tests

Comparing numbers uses its own operators.

[[ $n -eq 10 ]]   # equal
[[ $n -ne 10 ]]   # different
[[ $n -gt 10 ]]   # greater
[[ $n -lt 10 ]]   # less

63. case

More readable than a stack of elifs.

case "$1" in
  start) iniciar ;;
  stop) parar ;;
  restart) parar; iniciar ;;
  *) echo "uso: $0 {start|stop|restart}"; exit 1 ;;
esac

64. for over a list

Iterates over literal values.

for ambiente in dev hml prod; do
  echo "implantando em $ambiente"
done

65. for over files

Use the glob directly — never the output of ls.

for arquivo in *.log; do
  gzip "$arquivo"
done

66. Numeric for

A range of numbers with a sequence or in C style.

for i in {1..10}; do echo "$i"; done
for ((i = 0; i < 10; i++)); do echo "$i"; done

67. while

Repeats while the condition is true.

contador=0
while [[ $contador -lt 5 ]]; do
  echo "$contador"
  contador=$((contador + 1))
done

68. while read — read line by line

The correct way to process a file: IFS= and -r preserve spaces and backslashes.

while IFS= read -r linha; do
  echo "Linha: $linha"
done < arquivo.txt

69. until

The inverse of while: it repeats until the condition becomes true.

until curl -sf http://localhost:8080/health; do
  echo "aguardando o serviço..."
  sleep 2
done

70. break and continue

Leaves the loop or skips to the next iteration.

for i in {1..10}; do
  [[ $i -eq 5 ]] && continue
  [[ $i -eq 8 ]] && break
  echo "$i"
done

71. Functions

They group logic and receive arguments like the script does.

saudacao() {
  local nome="$1"
  echo "Olá, $nome"
}
saudacao "Jhonatan"

72. Returning from a function

return gives back an exit code; to return text, use echo and capture it.

soma() { echo $(( $1 + $2 )); }
resultado=$(soma 2 3)

73. Arrays

An indexed list, with all the elements in [@].

servidores=("web1" "web2" "db1")
echo "${servidores[0]}"
echo "${#servidores[@]}"      # count
for s in "${servidores[@]}"; do echo "$s"; done

74. Associative array

A key-value map in bash 4+.

declare -A porta
porta[web]=80
porta[api]=3000
for servico in "${!porta[@]}"; do echo "$servico: ${porta[$servico]}"; done

75. Manipulating strings

Length, slice and prefix/suffix removal, without calling an external command.

s="arquivo.tar.gz"
echo "${#s}"          # length
echo "${s%.gz}"       # removes the suffix
echo "${s#*.}"        # removes up to the first dot
echo "${s/tar/zip}"   # substitutes

76. trap — clean up on exit

Ensures the temporary file is deleted even if the script dies.

temporario=$(mktemp)
trap 'rm -f "$temporario"' EXIT
# ... use the file

77. Temporary file and directory

mktemp creates one with a unique name and safe permissions.

arquivo=$(mktemp)
pasta=$(mktemp -d)

78. Read input from the user

-p shows the prompt; -s hides what is typed.

read -p "Nome: " nome
read -s -p "Senha: " senha; echo

79. Confirmation before acting

The minimum protection in a destructive script.

read -p "Apagar tudo? (s/N) " resposta
[[ "$resposta" == "s" ]] || exit 0

80. Options with getopts

Flag parsing in the Unix style.

while getopts "a:p:v" opcao; do
  case $opcao in
    a) ambiente="$OPTARG" ;;
    p) porta="$OPTARG" ;;
    v) verboso=1 ;;
    *) exit 1 ;;
  esac
done

81. Logging with a date

A simple log function that saves debugging later.

log() { echo "[$(date +'%F %T')] $*"; }
log "iniciando implantação"

82. Write to stderr

An error message should not pollute the script's output.

echo "erro: arquivo não encontrado" >&2

83. Guarantee a single run

flock prevents two simultaneous instances — essential in cron.

flock -n /tmp/meu-script.lock ./meu-script.sh || echo "já está rodando"

84. Debug a script

-x prints each command as it runs.

bash -x script.sh
set -x   # turns it on mid-script
set +x   # turns it off

85. shellcheck — the linter

It points out the classic mistakes before you suffer from them. Always use it.

shellcheck script.sh

systemd and services

How a service starts at boot, restarts on its own and records what it did.

86. The status of a service

Current state, PID and the last lines of the log.

systemctl status nginx

87. Start, stop, restart

The everyday trio.

sudo systemctl start nginx
sudo systemctl stop nginx
sudo systemctl restart nginx

88. Reload without dropping

Rereads the configuration while keeping open connections.

sudo systemctl reload nginx
sudo systemctl reload-or-restart nginx

89. Enable at boot

enable only configures it; --now also starts it right away.

sudo systemctl enable nginx
sudo systemctl enable --now nginx

90. Disable

Stops it coming up at the next boot.

sudo systemctl disable --now nginx

91. Check whether it is active

It returns an exit code — perfect for a script.

systemctl is-active nginx
systemctl is-enabled nginx

92. List services

Everything that exists, or only what is running.

systemctl list-units --type=service
systemctl list-units --type=service --state=running

93. Failed services

The first query when you log into a server with a problem.

systemctl --failed

94. Create a service

A minimal unit file to run your application.

# /etc/systemd/system/minha-api.service
[Unit]
Description=Minha API
After=network.target

[Service]
Type=simple
User=app
WorkingDirectory=/opt/minha-api
ExecStart=/usr/bin/node server.js
Restart=on-failure
RestartSec=5
Environment=NODE_ENV=production

[Install]
WantedBy=multi-user.target

95. Reload the units

Mandatory after creating or editing any service file.

sudo systemctl daemon-reload

96. Edit a unit safely

Creates an override instead of altering the package's file.

sudo systemctl edit nginx
sudo systemctl cat nginx     # shows the effective unit

97. The service's environment variables

A separate file, outside git, with the credentials.

# in the unit:
EnvironmentFile=/etc/minha-api/env
# in the file:
DATABASE_URL=postgres://...

98. Dependencies between services

After orders them; Requires forces the other to be active.

[Unit]
After=postgresql.service
Requires=postgresql.service

99. Limit the service's resources

systemd applies cgroups without you having to configure them by hand.

[Service]
MemoryMax=512M
CPUQuota=50%

100. Harden the service

Options that greatly reduce the damage in case of a breach.

[Service]
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/minha-api

101. Mask a service

Stops it coming up at all, not even through a dependency.

sudo systemctl mask apache2
sudo systemctl unmask apache2

102. Targets (runlevels)

Graphical mode, multi-user or rescue.

systemctl get-default
sudo systemctl set-default multi-user.target
sudo systemctl isolate rescue.target

103. Boot time

Shows who is holding up the startup.

systemd-analyze
systemd-analyze blame | head -20

104. Dependency tree

Understands why one service starts before another.

systemctl list-dependencies nginx

105. systemd timers

The modern alternative to cron, with integrated logging and dependency control.

# /etc/systemd/system/backup.timer
[Unit]
Description=Backup diário

[Timer]
OnCalendar=*-*-* 03:00:00
Persistent=true

[Install]
WantedBy=timers.target

# sudo systemctl enable --now backup.timer
# systemctl list-timers

Cron and scheduling

Tasks that run on their own — and the details that make them fail silently.

106. Edit the crontab

Opens your user's schedule.

crontab -e
sudo crontab -e -u www-data   # another user's

107. List and remove

See what is scheduled; -r deletes everything (careful).

crontab -l
crontab -r

108. The five-field format

Minute, hour, day of month, month, day of week.

# * * * * * comando
# │ │ │ │ └── day of week (0-7, 0 and 7 = Sunday)
# │ │ │ └──── month (1-12)
# │ │ └────── day of month (1-31)
# │ └──────── hour (0-23)
# └────────── minute (0-59)

109. Common examples

The schedules that cover nearly everything.

0 3 * * *      /opt/backup.sh          # every day at 3 a.m.
*/15 * * * *   /opt/checa-saude.sh      # every 15 minutes
0 9 * * 1      /opt/relatorio.sh        # Mondays at 9 a.m.
0 0 1 * *      /opt/fechamento.sh       # the first day of the month

110. Special shortcuts

More readable than the five fields.

@daily   /opt/backup.sh
@hourly  /opt/sync.sh
@reboot  /opt/inicia.sh

111. PATH in cron

Cron runs with a minimal environment. Always use the absolute path.

# Silent failure:
0 3 * * * backup.sh
# Right:
0 3 * * * /usr/local/bin/backup.sh

112. Keep the output

Without redirection, the output goes to local email — which nobody reads.

0 3 * * * /opt/backup.sh >> /var/log/backup.log 2>&1

113. Define variables in the crontab

Declared at the top of the file, they apply to every line.

SHELL=/bin/bash
PATH=/usr/local/bin:/usr/bin:/bin
MAILTO=""

114. The system cron directories

Just drop an executable script into these folders.

ls /etc/cron.daily/
ls /etc/cron.d/
cat /etc/crontab

115. Avoid overlapping

A slow task can start again before it finishes. flock solves it.

*/5 * * * * flock -n /tmp/sync.lock /opt/sync.sh

116. at — schedule once

Runs a single time at a future moment.

echo "/opt/manutencao.sh" | at 02:00
atq        # lists
atrm 3     # removes

117. Test the command first

Run it with the same environment as cron to catch PATH problems.

env -i /bin/bash --noprofile --norc -c "/opt/backup.sh"

SSH

Remote access — and how to use it without a password and without risk.

118. Connect

User, host and port.

ssh usuario@servidor
ssh -p 2222 usuario@servidor

119. Generate a key

Ed25519 is the current standard: smaller and safer than RSA.

ssh-keygen -t ed25519 -C "voce@email.com"

120. Copy the key to the server

Enables login without a password.

ssh-copy-id usuario@servidor
ssh-copy-id -i ~/.ssh/id_ed25519.pub usuario@servidor

121. Permissions on ~/.ssh

SSH refuses the key if the permissions are loose.

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub
chmod 600 ~/.ssh/authorized_keys

122. The configuration file

Aliases that save you memorising IP, port and user.

# ~/.ssh/config
Host prod
  HostName 203.0.113.10
  User deploy
  Port 2222
  IdentityFile ~/.ssh/id_ed25519

# now: ssh prod

123. The key agent

Keeps the unlocked key for the session.

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
ssh-add -l

124. Run a remote command

Runs and comes back, without opening an interactive session.

ssh prod "df -h && uptime"

125. Local tunnel

Brings a remote port to your machine — the safe way to reach a database.

ssh -L 5432:localhost:5432 prod
# now localhost:5432 is the server's Postgres

126. Reverse tunnel

Exposes a port of yours on the remote server.

ssh -R 8080:localhost:3000 prod

127. SOCKS proxy

Browse as if you were on the server's network.

ssh -D 1080 prod

128. Jump through a bastion

Reaches the internal machine by way of the edge host.

ssh -J bastion usuario@servidor-interno

129. Keep the connection alive

Prevents the drop from inactivity.

# ~/.ssh/config
Host *
  ServerAliveInterval 60
  ServerAliveCountMax 3

130. Reuse the connection

Multiplexing: the second connection to the same host is instantaneous.

Host *
  ControlMaster auto
  ControlPath ~/.ssh/cm-%r@%h:%p
  ControlPersist 10m

131. Harden the SSH server

The three changes that cut the attack surface the most.

# /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no
Port 2222

sudo systemctl reload sshd

132. Test the configuration

Validate before reloading — a mistake here locks you out.

sudo sshd -t

133. Diagnose the connection

-v shows each step of the authentication.

ssh -vvv usuario@servidor

134. known_hosts

Has the server's key changed? Remove the old entry (and confirm it is not an attack).

ssh-keygen -R servidor

135. Copy a file over the session

scp and rsync use the same configuration from ~/.ssh/config.

scp arquivo.txt prod:/tmp/
rsync -avz ./site/ prod:/var/www/site/

Intermediate networking

Diagnosing connectivity, ports and traffic for real.

136. Configure a temporary IP

It lasts until the next reboot — useful during maintenance.

sudo ip addr add 192.168.1.50/24 dev eth0
sudo ip link set eth0 up

137. Default route

Adds or changes the gateway.

sudo ip route add default via 192.168.1.1
ip route get 8.8.8.8   # which way the traffic leaves

138. Netplan (Ubuntu)

Modern persistent configuration.

# /etc/netplan/01-config.yaml
network:
  version: 2
  ethernets:
    eth0:
      addresses: [192.168.1.50/24]
      routes:
        - to: default
          via: 192.168.1.1
      nameservers:
        addresses: [1.1.1.1, 8.8.8.8]

# sudo netplan apply

139. NetworkManager from the CLI

Common on RHEL and desktops.

nmcli device status
nmcli connection show
sudo nmcli connection modify eth0 ipv4.addresses 192.168.1.50/24

140. Established connections

Who is connected to what, right now.

ss -tan state established
ss -tp   # with the process

141. Count connections per IP

Detects a client abusing the service or a simple attack.

ss -tan | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head

142. tcpdump — capture traffic

Sees the actual packet. Irreplaceable when the log does not explain.

sudo tcpdump -i eth0 port 80 -n
sudo tcpdump -i any host 192.168.1.10 -w captura.pcap

143. Readable tcpdump

-A shows the ASCII content — good for HTTP.

sudo tcpdump -i eth0 -A -s0 'tcp port 80 and host api.exemplo.com'

144. nmap — scan ports

Finds out what is open. Only scan what is yours.

nmap -sT localhost
nmap -p 1-1000 192.168.1.10
nmap -sV 192.168.1.10   # detects the service and version

145. netcat — the network knife

Tests a port, transfers a file and stands up an improvised server.

nc -zv servidor 443
nc -l 9000              # listens on the port
nc servidor 9000 < arquivo.txt

146. curl with timing details

Shows where the time goes: DNS, connection, TLS, response.

curl -w "dns:%{time_namelookup} conn:%{time_connect} tls:%{time_appconnect} total:%{time_total}\n" -o /dev/null -s https://exemplo.com

147. Test a TLS certificate

Validity, chain and issuer.

openssl s_client -connect exemplo.com:443 -servername exemplo.com < /dev/null 2>/dev/null | openssl x509 -noout -dates -subject -issuer

148. Firewall with ufw

A simple layer over iptables, common on Ubuntu.

sudo ufw status verbose
sudo ufw allow 22/tcp
sudo ufw allow from 192.168.1.0/24 to any port 5432
sudo ufw enable

149. Firewall with firewalld

The default on RHEL and Fedora.

sudo firewall-cmd --list-all
sudo firewall-cmd --add-service=https --permanent
sudo firewall-cmd --reload

150. See the iptables rules

What is really applied in the kernel.

sudo iptables -L -n -v
sudo nft list ruleset   # nftables, the successor

151. DNS: which server is in use

On systems with systemd-resolved, /etc/resolv.conf is misleading.

resolvectl status
cat /etc/resolv.conf

152. Flush the DNS cache

After changing a record, the local cache gets in the way of the test.

sudo resolvectl flush-caches

153. Measure bandwidth between machines

iperf3 measures the link's real throughput.

# on the server
iperf3 -s
# on the client
iperf3 -c 192.168.1.10 -t 30

154. Monitor bandwidth per process

Finds out who is consuming the network.

sudo nethogs
sudo iftop -i eth0

155. Wake-on-LAN and MAC

The physical address, and powering a machine on remotely.

ip link show eth0 | grep ether
wakeonlan 00:11:22:33:44:55

Disks, partitions and filesystems

From the raw disk to the mount point that survives a reboot.

156. List disks

A view of devices, partitions and mount points.

lsblk -f
sudo fdisk -l

157. Partition with fdisk

Interactive, for MBR and simple GPT tables.

sudo fdisk /dev/sdb
# n (new) · p (primary) · w (writes)

158. Partition with parted

Better for a disk larger than 2 TB (GPT).

sudo parted /dev/sdb mklabel gpt
sudo parted -a opt /dev/sdb mkpart primary ext4 0% 100%

159. Format

Creates the filesystem on the partition.

sudo mkfs.ext4 /dev/sdb1
sudo mkfs.xfs /dev/sdb1

160. Label and UUID

Use the UUID in fstab: the device name can change between boots.

sudo e2label /dev/sdb1 dados
blkid /dev/sdb1

161. Mount permanently

An entry in fstab with the UUID and options.

# /etc/fstab
UUID=abcd-1234  /mnt/dados  ext4  defaults,noatime  0  2

sudo mount -a   # tests without rebooting

162. Useful mount options

noatime reduces writes; ro protects; nosuid/nodev/noexec harden.

sudo mount -o noatime,nodev,nosuid /dev/sdb1 /mnt/dados

163. Check the filesystem

Only with the partition unmounted.

sudo umount /dev/sdb1
sudo fsck -f /dev/sdb1

164. Resize

Grows the filesystem after the partition has grown.

sudo resize2fs /dev/sdb1        # ext4
sudo xfs_growfs /mnt/dados      # xfs (while mounted)

165. Swap

Creates and activates the swap area.

sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
swapon --show

166. Swappiness

How much the kernel prefers to use swap. On a database server, low values.

cat /proc/sys/vm/swappiness
sudo sysctl vm.swappiness=10

167. LVM: the overview

A logical volume lets you grow the disk without repartitioning.

sudo pvs   # physical volumes
sudo vgs   # groups
sudo lvs   # logical volumes

168. Create the LVM structure

From the raw disk to a mountable volume.

sudo pvcreate /dev/sdb
sudo vgcreate dados-vg /dev/sdb
sudo lvcreate -L 50G -n dados-lv dados-vg
sudo mkfs.ext4 /dev/dados-vg/dados-lv

169. Expand an LVM volume

The big advantage: growing with no downtime.

sudo lvextend -L +20G /dev/dados-vg/dados-lv
sudo resize2fs /dev/dados-vg/dados-lv

170. LVM snapshot

A photo of the volume for a consistent backup.

sudo lvcreate -L 5G -s -n snap /dev/dados-vg/dados-lv

171. Mount an ISO or an image

Access the content without burning media.

sudo mount -o loop imagem.iso /mnt/iso

172. Mount a network share

NFS and SMB/CIFS.

sudo mount -t nfs servidor:/export /mnt/nfs
sudo mount -t cifs //servidor/compartilhado /mnt/win -o username=user

173. Disk health (SMART)

Anticipates a hardware failure.

sudo smartctl -a /dev/sda
sudo smartctl -t short /dev/sda

174. I/O per process

Finds out who is hammering the disk.

sudo iotop -o
pidstat -d 1

175. I/O statistics

Latency and utilisation per device. %util near 100 is a bottleneck.

iostat -xz 1

Logs

Where the server tells you what happened.

176. journalctl

systemd's unified log.

journalctl
journalctl -n 100

177. The log of one service

Filters by unit — the command you will use the most.

journalctl -u nginx
journalctl -u nginx -f     # live

178. Log by period

Cuts out the time window of the incident.

journalctl --since "2026-08-10 14:00" --until "2026-08-10 15:00"
journalctl --since "1 hour ago"

179. Log by priority

Errors and above only.

journalctl -p err
journalctl -p warning..emerg

180. Boot log

The current boot or the previous one — essential after a crash.

journalctl -b
journalctl -b -1
journalctl --list-boots

181. Kernel log

Kernel messages, with a readable timestamp.

dmesg -T | tail -50
journalctl -k

182. Look for the OOM killer

Confirms whether the kernel killed your process for lack of memory.

dmesg -T | grep -i "out of memory"
journalctl -k | grep -i oom

183. Export the log

JSON format for analysis in an external tool.

journalctl -u nginx -o json > nginx.json
journalctl -u nginx --since today > nginx.txt

184. Journal size

It grows up to the configured limit — and fills the disk.

journalctl --disk-usage
sudo journalctl --vacuum-size=500M
sudo journalctl --vacuum-time=30d

185. Logs in /var/log

Where the traditional services write.

ls -lh /var/log/
sudo tail -f /var/log/auth.log      # authentication
sudo tail -f /var/log/syslog

186. logrotate

Rotates, compresses and discards old logs — what stops the disk filling up.

cat /etc/logrotate.conf
sudo logrotate -d /etc/logrotate.d/nginx   # simulates
sudo logrotate -f /etc/logrotate.d/nginx   # forces

187. Configure rotation for your app

Its own file in /etc/logrotate.d/.

/var/log/minha-api/*.log {
  daily
  rotate 14
  compress
  missingok
  notifempty
  copytruncate
}

188. logger — write to syslog

Makes your script show up in the system log.

logger -t meu-script "backup concluído"
logger -p user.err -t meu-script "falha ao conectar"

189. Find the error in the middle of the log

grep combined with context and a time window.

journalctl -u minha-api --since "30 min ago" | grep -i -C 5 "exception"

190. Intrusion attempts

Failed SSH authentications — the first sign of an attack.

sudo grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr | head

Security and access automation

Hardening the basics and automating what repeats.

191. sudoers safely

Always edit with visudo: it validates before saving and stops you locking sudo.

sudo visudo
sudo visudo -f /etc/sudoers.d/deploy

192. Passwordless sudo for one command

Allows only what is needed, instead of unrestricted access.

# /etc/sudoers.d/deploy
deploy ALL=(ALL) NOPASSWD: /bin/systemctl restart minha-api

193. fail2ban

Blocks an IP after failed login attempts.

sudo apt install fail2ban
sudo fail2ban-client status sshd
sudo fail2ban-client set sshd unbanip 192.168.1.10

194. Automatic security updates

Lets the server apply a critical fix on its own.

sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

195. Open ports vs expected ports

A simple audit: should what is listening be listening?

sudo ss -tulpn | grep LISTEN

196. Recently changed files

Post-incident investigation.

sudo find /etc -mtime -2 -type f
sudo find / -mmin -60 -type f -not -path "/proc/*" 2>/dev/null

197. Verify package integrity

Detects a modified system binary.

sudo debsums -c          # Debian/Ubuntu
sudo rpm -Va             # RHEL/Fedora

198. Another user's command history

Auditing — and a reminder that yours is recorded too.

sudo cat /home/usuario/.bash_history

199. Encrypt a file

GPG to protect a backup or a sensitive file.

gpg -c segredo.txt              # encrypts with a password
gpg -d segredo.txt.gpg > segredo.txt

200. Generate a strong password

Without depending on a third-party site.

openssl rand -base64 32
head -c 32 /dev/urandom | base64