Skip to content

The list of commonly used Redhat command for Linux System Administration

License

Notifications You must be signed in to change notification settings

mismailzz/Red-Hat-Linux-Command-Cheatsheet

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

21 Commits
 
 
 
 
 
 
 
 

Repository files navigation

CentOS/Red-Hat-Command-Cheatsheet

The below list are not covering all the commands for Linux Administration. These are commands that are not oftenly used but would be needed extermely in hours of matter of troubleshooting. This list is limited but can be improved much more.

Redhat Package Manager (RPM)

#Check RPM signature  
rpm --checksig <.rpm pkg>
#Install RPM package
rpm -ivh <.rpm pkg> 
#Check dependencies of RPM pkg 
rpm -qpR <.rpm pkg> 
#Install RPM pkg without dependencies
rpm -ivh --nodeps <.rpm pkg>  
#List all files of installed RPM packages
rpm -ql <.rpm pkg> 
#List installed RPM packages
rpm -qa  
#List installed RPM packages
rpm -q <.rpm pkg> 
#List all recently installed RPM packages
 rpm -qa --last  
#Upgrade a RPM package
rpm -Uvh <.rpm pkg> 
#Remove RPM package 
rpm -evvnx <.rpm pkg> 
#Remove RPM package without dependencies 
rpm -ev --nodeps 
#Query a file that belongs which RPM package 
rpm -qf /usr/bin/htpasswd 
#Show the information of installed RPM package 
rpm -qi vsftpd 
#Show the information of RPM package before install 
rpm -qip <.rpm pkg> 
#Show documentation of instal RPM package 
rpm -qdf /usr/bin/vmstat 
#Verifying a package compares information of installed files against rpm db 
rpm -Vp <.rpm pkg> 
#Verifying all packages 
rpm -Va 

YUM (Yellowdog Updater and Modifier)

yum upgrade <pkg>
yum localinsatll <pkg*>
yum remove <pkg/command/rpm>
#install/update/upgrade or transaction history
yum history list 
yum history list all 
#pkg info install/update/upgrade or transaction history by id
yum history info <id> 
#undo the transaction by id
yum history undo <id> 
#redo the transaction by id
yum history redo <id> 
#yum stores transaction in single SQLite db. To start new transaction history
yum history new 
yum whatprovides <pkg/command>
yum --showduplicates list httpd | expand
yum list available java*
yum list installed

Permission

#set suid bit such as -rwSr-xr-x. capital S means (rws)
chmod 4655 <file> 
#Setgid on dir, all dir/files in it will get same ownership as parent dir. It doesn't matter who is creating
#setting setgid bit
chmod g+s <dir/file> 
#setting sticky bit such as drwxrwxrwt. small t means (rwxt)
chmod 1777 <dir> 
#setting sticky bit such as drwxrwxrwT. capital T means (rwt)
chmod 1776 <dir> 
#asssigning recursive permission of all files/dir in  target dir
chown -R <user>:<group> <dir> 

User Administration

useradd -g itadmin -c "DB User" -u 1135 -s "/bin/sh" -d /home/techguy1 
#In the above command, we are creating the new user with custom options as simple "#useradd <user>" will create with default setting. The -g (group) -c (description) -u (user id) -s (which shell to be assigned) -d (landed home dir)
useradd -g <primary group> -G <secondary group> <user> # assign the user primary and secondary group
passwd -l <user> #locking password of user
passwd -u <user> #unlocking password of user
passwd -e <user> #expire password 
echo 'myPassword123' | sudo passwd --stdin <user> 
passwd -x -1 <user> #Turnoff password expiry
usermod -L <user> #locking user
usermod -U <user> #unlocking user
chage #set password expiry

Access Control Lists (ACLs)

setfacl -m u:priya:rw <file> #assiging the a new user 'priya' with read/write permission on the file. -m (modifying) -u (user)
setfacl -m mask:r <file> #setting mask on file
setfacl -d -m u:priya:rw <dir> #setting ACL for directory
getfacl -R <dir> > permissions.acl #BackUp ACL's in file having all info related ownership/dir inside the dir,subdir,files
setfacl --restore=permissions.acl #Restore the Permissions/Ownership

Crontab

crontab -l #show crontab for all users
crontab -u <user> -l #show crontab for specific user
crontab -e #add cron entry in crontab file

Process

ps -a #all terminal 
ps -e #list of all the processes
ps -o #customer properties
ps -ao tty,comm,pid,%mem,%cpu #<command/script> & #run the task in background
ps -fp $(pgrep -d, -x logrotate)
pgrep -u <userid> unison
ps -p <pid> -o etime #process execution time
ps -eo user,pid,ppid,%mem,%cpu --sort=-%cpu | head
ps lax
ps fax

Network

dig +trace www.google.com
nmcli dev status
nmcli con del <interface name>
ip addr show <interface name>
nmcli con show
nmcli con add con-name <interface name> type <ethernet> ifname <interface name> ip4 <ip address> gw4 <gateway>
nmcli con up <interface name>
nmcli con mod <interface name> ipv4.gateway <ip address>
hostnamectl set-hostname <hostname>
netstat -rn
route -n
tcpdump -i <interface>
tcpdump -i <interface> host <ipaddress>  -nn
tcpdump -i <interface> -s 0 -w <output file name example.pcap> host <ipaddress/hostname> and udp
ping <hostname/ipaddress>
telnet <hostname/ipaddress> <port>
nslookup <domain/hostname>
netstat -an |grep <ipaddress>.<port>|grep ESTAB|awk '{print $5}'|awk -F: '{print $1}'|sort|uniq -c|sort -rn #show which remote hosts make how many connection to specfic port, the output is sort on number of connections by host to port 

Memory

egrep --color 'Mem|Cache|Swap' /proc/meminfo | awk '{print $1 " " $2/1000/1000 "GB"}' #show information in GB
smem -s swap -t -k -n -r
smem -u -p -r
free -h

Disk

df -h
df -Th
du -sh <path/*>
df --local -P #in KBs
du -sch .[!.]* * | grep --regex="[0-9]*G"
lsof -u <user> #list of openfiles by specific user
lsof | grep delete #list of openfiles that are deleted
lsof | awk '{print $1}' | sort | uniq -c | sort -r -n #sort number of open files by process

SFTP/SCP

sftp -oPort=<port> <user>@<ipaddress/domain>
sftp -oPort=<port> -oIdentityFile=<path to key> <user>@<ipaddress/domain>
sftp -o KexAlgorithms=<keyExchangeAlgo> -o HostKeyAlgorithms=<HostKeyAlgoName> -oIdentityFile=<path to key> -oPort=<port> <user>@<domain/ipaddress>
sftp -oPort=<port> -o KexAlgorithms=diffie-hellman-group14-sha1 -o HostKeyAlgorithms=+ssh-dss -oIdentityfile=<path to key> <user>@<domain/ipaddress>
scp -P <port> <path to src file> <user>@<domain/ipaddress>:<target path> #send the file to target system
scp -P <port> <user>@<domain/ipaddress>:<src file path> <target file path locally> #fetch/download file from the target system
scp -r /path/to/local/source user@ssh.example.com:/path/to/remote/destination #send dir from the target system
scp -r user@ssh.example.com:/path/to/remote/source /path/to/local/destination #fetch/download dirctory from the target system

Bolt

For the --tmpdir flag we can use the home directory path of the remote user which will logged in on the behalf of the bolt. At some time /tmp is not executable due to which the command gets failed. (~mizz - will be confirm)

bolt command run "<command>"  --no-host-key-check --tmpdir=/tmp -p <password>  --tty --targets @<ipaddress/hostname list file>  -u <user>
bolt command run "<command>"  --no-host-key-check --tmpdir=/tmp -p <password>  --tty --targets <ipaddress/hostname separate by ,>  -u <user>
bolt script run <script>  --no-host-key-check --tmpdir=/tmp -p <password>  --tty --targets @<ipaddress/hostname list file>  -u <user>
bolt script run <script>  --no-host-key-check --tmpdir=/tmp -p <password>  --tty --targets <ipaddress/hostname separate by ,>  -u <user>

Sed

sed -n -e "/<$hostname>/,/ismail.com/ p" <targetfile> #replace the string by variable, result will be stdout
sed -i -n -e "/<$hostname>/,/ismail.com/ p" <targetfile> #replace the string by variable, result will be saved in target file
sed -i 's/stringtoreplace/newstring/g' myfile.txt #replace the string from the file globally

find

find /tmp/* -mtime +7 -exec rm {} \; #remove files from dir "tmp/" that are older than 7 days 
find /home/ -type f -name ".errors*.gz" -mtime +7 -exec rm {} \; #remove files from dir "tmp/" that are older than 7 days - with filename
find /home/ -type f -size +500M -name "*tempfile*" -exec du -sh {} \; #found the tempfile that has file size >500MB
find /home/ -type f -size +1G -exec ls -lh {} \; | awk '{ print $9 "|| Size : " $5 }' #find output in custom defined format like in this "dirname || Size:_"
#Combine find exec multiple commands
find /tmp/dir1/ -type f -exec chown root:root {} \; -exec chmod o+x {} \;
#Combine find exec multiple commands
find /tmp/dir1/ -type f -exec chown root:root {} \; -exec chmod o+x {} \;
#World-Writable dir
#CIS
find / -path /proc -prune -o -path /sys -prune -o -type d -perm -0002 -mindepth 3 -maxdepth 4 -printf "World-Writable dir %p\n" 2>/dev/null
#find files with permission
find / -xdev \( -perm -4000 -o -perm -2000 \) -type f 
#4000 for suid, 2000 for guid
#Combine find exec shell script function
#[Ref: https://www.golinuxcloud.com/find-exec-multiple-commands-examples-unix/#:~:text=Linux%20or%20Unix.-,Find%20exec%20multiple%20commands%20syntax,%5C%3B%20or%20as%20%22%20%3B%20%22.]
find /tmp/dir1/ -type f -exec bash -c '
for item do
[[ $item =~ "file1" ]] && mv -v $item ${item}_renamed
done
' bash {} +

grep

cat myfile | grep -B 1 -A 4 -i 'string one\|string two' #it will show 1 line before and 4 lines after matching the strings form myfile
grep -lr "string" * #search recursively the string from all filesystem hierarchy, as its start from which current dir you are standing and it will list files
grep -ir "string" <* or file> #search recursively the string from all filesystem hierarchy and show the content what matches - * for all files otherwise specify a single file
grep -E -s "<regex>" <file>
#grep with -E extended regex -s with silent mode as no error message on screen
grep -P -s -- "<regex>" <file>
#grep with -P perl regex -s with silent mode as no error message on screen
grep -Eq '<regex>' <file> && grep -Eq '<regex>' file2 && result=pass
#grep with -E extended regex -q with quite mode as no error/stdout message on screen

Gzip/Tar/Compress directory

#The gzip command in Linux can only be used to compress a single file. In order to compress a folder, tar + gzip (which is basically tar -z) is used.
#ref: https://www.educative.io/edpresso/how-to-gzip-a-directory-in-linux
tar -zcvf myfolder.tar.gz myfolder #Compress folder/dir with -z in Linux
tar -tf myfolder.tar.gz #view the content of compressed file
gzip filename #view the content of compressed file
unzip file.gz #uncompress the zip file

AWK

#Multiple Conditional Statement - Not Equal, Regex, Equal
awk -F: '($1!="root" && $1!="sync" ) {print}' /etc/passwd
awk -F: '($1!="root" && $1!~/^\+/) {print}' /etc/passwd
awk -F: '($1=="virusgroup") {print $3}' /etc/group
du -sh * | grep G | awk '($1~/[0-9]+\.?[0-9]*G$/)'
awk '/^\s*UID_MIN/{print $2}' /etc/login.defs
df --local -P | awk {'if (NR!=1) print $6'} #skip first or header line
df --local -P | awk {'if (NR!=1) print $6'} #skip first or header line
#Variable in awk statement
awk -F: -v GID="$(awk -F: '($1=="shadow") {print $3}' /etc/group)" '($4==GID) {print $1}' /etc/passwd
#Awk result with loop
awk -F: -v GID="$(awk -F: '($1=="shadow") {print $3}' /etc/group)" '($4==GID) {print $1}' /etc/passwd | (while read -r usr; do
        [ -z "$output" ] && output="\"$usr\"" || output=",\"$usr\""
done

XARGS

#XARGS Application - to use last command result for next command
df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -nouser -printf "%p has no owner\n" 2>/dev/null

stat

stat -L -c "%A" "$dir"
stat --printf='Name: %n\nPermissions: %a\n' /etc
stat --printf='User: %U | Group: %G' /etc 

lsof

lsof -u <user> #list the openfiles by a user

Other

top -b -n 1 | head -n +5
uptime
sestatus #check selinux status
collectl -sc -p /var/log/collectl/server1-20220411-000000.raw.gz --top --from 00:00-03:00 -oTm
collectl -scn -p /var/log/collectl/server2-20220411-000000.raw.gz --from 00:15-00:41 --top
collectl -scD -p server1-000000.raw.gz --from 00:00-00:55 --top iokb | grep -w 'cp\|sdb\|Wait\|Pct\|PID' | less