Linux.

Linux keeps every file in one tree under the root directory, /, and most distributions lay it out by the Filesystem Hierarchy Standard (FHS). The main directories are:

• /bin: essential user commands
• /boot: boot loader files and the kernel
• /dev: device files
• /etc: system configuration files
• /home: user home directories
• /lib: essential shared libraries
• /media: mount points for removable media
• /mnt: temporary mount points
• /opt: optional software packages
• /proc: a virtual file system with process information
• /root: the root user's home directory
• /run: runtime data
• /sbin: system administration commands
• /tmp: temporary files
• /usr: user programs and data
• /var: variable data such as logs and databases

Permissions set what a file's owner, group and others may each do, and you change them with chmod. Each class gets its own read, write and execute rights. In symbolic mode, u, g and o name the classes, so chmod u+x adds execute for the owner.

Each right has a number. Read is 4, write is 2 and execute is 1, and a class's digit is their sum. So 755 gives the owner every right and the rest read and execute.

ls -l shows the bits as letters. Here rwxr-xr-- gives the owner every right, lets the group read and execute, and lets others only read.

chown changes the owner and chgrp changes the group.

New files start from a default mode, 666 for files, and the umask removes bits from it, so the usual 022 gives 644.

# Change permissions using chmod
chmod 755 file.txt        # rwxr-xr-x
chmod u+x script.sh       # Add execute for owner
chmod g-w file.txt        # Remove write for group
chmod o=r file.txt        # Set others to read only
# Change ownership
chown user:group file.txt
chgrp newgroup file.txt

Use find when you need an exact, current answer, because it walks the directory tree live. It can match on a file's name and type. It can also match on size and permissions, and act on each match by deleting it or running a command.

Sizes round up to whole units, so -size -1k matches only empty files. Use -size -1024c for files under 1024 bytes.

# Find by name
find /path -name "filename"
find . -name "*.txt"
# Find by type
find /home -type f        # Files only
find /home -type d        # Directories only
# Find by size
find /var -size +100M     # Files larger than 100MB
find . -size -1024c       # Files smaller than 1KB
# Find by permissions
find . -perm 755
find . -perm -u+x         # Files executable by owner
# Find and execute action
find /tmp -name "*.tmp" -delete
find . -name "*.log" -exec rm {} \;

Use locate when speed matters. It searches a database of file names instead of the disk, so it misses files created since updatedb last ran.

locate filename
updatedb              # Update locate database

For programs, which shows the first matching executable in PATH, and whereis also finds its source and manual pages.

which python           # Find executable in PATH
whereis python         # Find binary, source, manual

Use ps or top to view processes, then manage them by sending signals with kill or changing priority with renice. ps takes a snapshot, while top and htop show a live view sorted by CPU or memory. ps aux and ps -ef list every process with its owner, process ID and command, and pstree shows which process started which. To get a process ID from a name, use pgrep or pidof.

# View processes
ps aux                  # All processes with details
ps -ef                  # Full format listing
ps -u username          # Processes for specific user
pstree                  # Process tree view
# Real-time process monitoring
top                     # Interactive process viewer
htop                    # Enhanced version of top
atop                    # Advanced system monitor
# Process information
jobs                    # Current shell jobs
pgrep process_name      # Find process IDs by name
pidof process_name      # Get PID of running process

The state column in ps aux and top shows what each process is doing:

• R: running, or ready to run
• S: sleeping while it waits for an event
• D: uninterruptible sleep, usually waiting for disk I/O
• Z: zombie, finished, but its parent has not reaped it yet
• T: stopped

You send the process a signal. kill PID sends SIGTERM by default, which asks the process to exit so it can close files and clean up. If it does not exit, kill -9 sends SIGKILL. The process cannot catch or ignore it, so the kernel ends it with no chance to clean up.

To act by name instead of process ID, pkill matches a pattern and killall matches an exact name.

Signals do other jobs too. SIGHUP often tells a daemon to reload its configuration, and SIGSTOP and SIGCONT pause and resume a process. kill -l lists them all.

# Kill by PID
kill PID                # Send TERM signal (15)
kill -9 PID             # Send KILL signal (forceful)
kill -15 PID            # Send TERM signal (graceful)
# Kill by name
killall process_name    # Kill all processes with name
pkill pattern           # Kill processes matching pattern
# Common signals
kill -l                 # List all signals
kill -HUP PID          # Reload configuration (1)
kill -INT PID          # Interrupt (2)
kill -QUIT PID         # Quit (3)
kill -KILL PID         # Force kill (9)
kill -TERM PID         # Terminate (15)
kill -STOP PID         # Stop process (19)
kill -CONT PID         # Continue process (18)

A foreground process holds the terminal. It reads your keyboard input, and the shell waits for it to finish before giving you a prompt. A background process runs while the shell gives the prompt back, so you can keep working. Adding & to a command starts it in the background.

Job control moves processes between the two. Ctrl+Z suspends the foreground job, bg resumes it in the background, and fg brings it back. Closing the terminal sends a hangup signal that ends your jobs, so start long jobs with nohup or disown them.

# Run command in background
command &               # Start in background
nohup command &         # Continue after logout
# Job control
jobs                    # List current jobs
fg %1                   # Bring job 1 to foreground
bg %1                   # Send job 1 to background
Ctrl+Z                  # Suspend current process
Ctrl+C                  # Terminate current process
# Detach from terminal
nohup long_command > output.log 2>&1 &
disown %1               # Remove job from shell

useradd creates an account, usermod changes one and userdel deletes one. passwd sets a password. They edit /etc/passwd, /etc/shadow and /etc/group for you, so you rarely touch those files by hand. Pass -m to create a home directory and -s to set the login shell. groupadd, groupdel and gpasswd do the same job for groups.

The classic mistake is usermod -G without -a. On its own, -G replaces the user's supplementary groups and removes the user from every group you did not list. usermod -aG appends instead. A new group membership applies from the user's next login.

To check the result, id shows a user's groups, and getent shows what the system actually resolves for a user or group.

# User management
useradd username         # Add new user
useradd -m -s /bin/bash username  # Create with home directory
userdel username         # Delete user
userdel -r username      # Delete user and home directory
usermod -aG groupname username    # Add user to group
passwd username          # Change user password
chage -l username        # View password aging info
# Group management
groupadd groupname       # Create new group
groupdel groupname       # Delete group
gpasswd -a username groupname     # Add user to group
gpasswd -d username groupname     # Remove user from group
# View user/group information
id username              # Show user ID and groups
groups username          # Show user's groups
getent passwd username   # Get user info from database
getent group groupname   # Get group info