Linux Commands A-Z Part 6: rsync, sed, semanage, sort, ss, ssh, stat and More with Examples

reboot in depth: restart a server safely

Why do we need this?

Kernel updates, stuck drivers and some config changes need a restart. A careless reboot of the wrong server causes an outage, so check first and reboot cleanly.

What is it?

reboot asks systemd to stop services in order, unmount filesystems and restart. It equals systemctl reboot. needs-restarting -r (RHEL) or /var/run/reboot-required (Ubuntu) tells you whether a reboot is needed.

Common options

How to do it (step by step)

1. Is a reboot needed?

sudo needs-restarting -r

Output:

Core libraries or services have been updated since boot-up:
  * kernel
Reboot is required to fully utilize these updates.

What it means: A new kernel is waiting.

2. Check the host first.

hostname; uptime

Output:

web02
 20:51:02 up 41 days,  2 users

What it means: Right server; tell the other user.

3. Reboot.

sudo reboot

Output:

Connection to web02 closed by remote host.

What it means: SSH drops; reconnect in a minute.

4. Confirm.

uname -r; uptime

Output:

5.14.0-503.el9.x86_64
 20:52:40 up 1 min

What it means: New kernel running.

Practise this in the tasks below: Practice tasks

renice in depth: change priority of a running process

Why do we need this?

A report job is already running and slowing the app. You do not want to kill it, just make it yield. renice changes its priority live.

What is it?

renice sets a new niceness (-20 to 19) for PIDs, users (-u) or groups (-g). Users can only raise niceness (lower priority) of their own processes; root can do anything.

Common options

How to do it (step by step)

1. Find the hog.

ps -eo pid,ni,%cpu,cmd --sort=-%cpu | head -2

Output:

  PID  NI %CPU CMD
 8120   0 98.0 python3 monthly_report.py

What it means: At normal priority.

2. Lower it.

renice -n 19 -p 8120

Output:

8120 (process ID) old priority 0, new priority 19

What it means: The app gets CPU first now.

3. Also lower disk.

sudo ionice -c3 -p 8120

What it means: Idle disk class.

4. Cannot raise back as a user.

renice -n 0 -p 8120

Output:

renice: failed to set priority for 8120 (process ID): Permission denied

What it means: Only root can lower niceness again.

Practise this in the tasks below: Practice tasks

restorecon in depth: fix SELinux labels

Why do we need this?

You moved web files from your home folder into /var/www and nginx now gives 403. Permissions look right. The SELinux label is wrong, and restorecon fixes it.

What is it?

restorecon resets file labels to what the policy says for that path (from semanage fcontext rules). mv keeps the old label; cp creates a new one. -R recurses, -v shows changes, -n dry-run.

Common options

How to do it (step by step)

1. The wrong label.

ls -Z /var/www/html/index.html

Output:

unconfined_u:object_r:user_home_t:s0 /var/www/html/index.html

What it means: user_home_t came with mv from home.

2. Dry run.

sudo restorecon -Rnv /var/www/html

Output:

Would relabel /var/www/html/index.html from user_home_t to httpd_sys_content_t

What it means: Shows what it will do.

3. Fix.

sudo restorecon -Rv /var/www/html

Output:

Relabeled /var/www/html/index.html from unconfined_u:object_r:user_home_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0

What it means: nginx can read it now.

4. Confirm.

curl -s -o /dev/null -w "%{http_code}\n" http://localhost/

Output:

200

What it means: 403 is gone.

Practise this in the tasks below: Practice tasks

rpm in depth: query and verify RPM packages

Why do we need this?

Which package owns this file? What version is installed? Did someone change a package file? dnf installs, but rpm answers these questions.

What is it?

rpm is the low-level package tool on RHEL, Rocky, Fedora and SUSE. -q queries: -qa all, -qi info, -ql files, -qf owner of a file, -qc config files. -V verifies files against the package. Install with dnf, not rpm -i, so dependencies resolve.

Common options

How to do it (step by step)

1. Version.

rpm -q openssl

Output:

openssl-3.0.7-27.el9.x86_64

What it means: For security advisories.

2. Who owns this file?

rpm -qf /usr/sbin/sshd

Output:

openssh-server-8.7p1-38.el9.x86_64

What it means: openssh-server.

3. Config files.

rpm -qc nginx | head -3

Output:

/etc/nginx/nginx.conf
/etc/nginx/mime.types
/etc/logrotate.d/nginx

What it means: Where to look.

4. Changed files.

sudo rpm -V openssh-server

Output:

S.5....T.  c /etc/ssh/sshd_config

What it means: Size, md5 and time changed on a config file: expected after hardening.

5. What was installed recently?

rpm -qa --last | head -2

Output:

kernel-5.14.0-503.el9.x86_64   Mon 26 Oct 2026 02:01:10 AM IST
nginx-1.20.1-20.el9.x86_64     Sun 25 Oct 2026 11:30:02 PM IST

What it means: Helps after an incident.

Practise this in the tasks below: Practice tasks

rsync in depth: fast, resumable copies and backups

Why do we need this?

Copying 200 GB again every night wastes hours. rsync sends only what changed, resumes after breaks, and works locally or over SSH.

What is it?

rsync compares source and destination and transfers differences. -a keeps permissions, times, links; -v verbose; -z compress; -P progress and resume; --delete removes files gone from the source; -n dry-run. A trailing slash on the source means "contents of".

Common options

How to do it (step by step)

1. Copy a folder to a server.

rsync -avzP /srv/media/ backup01:/backup/media/

Output:

sending incremental file list
video1.mp4
  1.21G 100%  98.20MB/s    0:00:12
sent 1.21G  received 35 bytes

What it means: The trailing slash copies the contents.

2. Run again.

rsync -avzP /srv/media/ backup01:/backup/media/

Output:

sending incremental file list
sent 1.20K  received 19 bytes

What it means: Nothing changed, nothing sent.

3. Preview a mirror.

rsync -avn --delete /srv/media/ backup01:/backup/media/

Output:

deleting old/promo.mp4

What it means: Dry run: see what would be deleted.

4. Skip and limit.

rsync -az --exclude="*.tmp" --bwlimit=5M /srv/app/ dr01:/srv/app/

What it means: Leaves bandwidth for users.

5. Slash difference.

rsync -a src dst/; ls dst

Output:

src

What it means: No slash: the folder itself is copied inside dst.

Practise this in the tasks below: Practice tasks

screen in depth: sessions that survive disconnects

Why do we need this?

A long migration over SSH must not die when your network drops, and you want to come back and watch it. screen keeps a terminal running on the server.

What is it?

screen starts a session that keeps running after you detach (Ctrl+A then d) or lose the connection. screen -ls lists, -r reattaches, -S names a session. tmux (Part 7) is the modern alternative.

Common options

How to do it (step by step)

1. Start.

screen -S migrate

Output:

(a new shell inside screen)

What it means: Run the long job here.

2. Detach and list.

Ctrl+A d ; screen -ls

Output:

There is a screen on:
        7310.migrate    (Detached)

What it means: Still running.

3. Reattach later.

screen -r migrate

Output:

(back in the session, output intact)

What it means: Nothing was lost.

4. Attached somewhere else.

screen -r migrate

Output:

There is a screen on: 7310.migrate (Attached)
There is no screen to be resumed matching migrate.

What it means: Use -dr to take it over.

Practise this in the tasks below: Practice tasks

sed in depth: find, replace and edit text in streams and files

Why do we need this?

Changing a port in 40 config files, cleaning a CSV, deleting comment lines, or printing lines 100 to 120 of a huge log: by hand it takes hours, with sed it is one line. It is in every Linux and every interview.

What is it?

sed is a stream editor: it reads input line by line, applies commands and prints the result. The most used command is s/old/new/flags (g all matches, i ignore case, N the Nth). Addresses choose lines: a number, a range 5,10, a /regex/, or $ for the last line. Other commands: d delete, p print (with -n), i insert before, a append after, c change. -i edits the file in place (-i.bak keeps a backup), -E enables extended regex, and a different delimiter like | avoids escaping slashes. Groups ( ) with \1 reuse matched text.

Common options

How to do it (step by step)

1. Replace on screen first.

echo "port=8080 port=8080" | sed "s/8080/9090/"

Output:

port=9090 port=8080

What it means: Only the first match per line.

2. All matches.

echo "port=8080 port=8080" | sed "s/8080/9090/g"

Output:

port=9090 port=9090

What it means: g means global.

3. Edit a file with a backup.

sed -i.bak "s/^Listen 80$/Listen 8080/" httpd.conf; diff httpd.conf.bak httpd.conf

Output:

< Listen 80
---
> Listen 8080

What it means: Anchors ^ and $ stop "Listen 8000" from matching too.

4. Print a line range.

sed -n "100,103p" app.log

Output:

2026-10-27 20:10:01 INFO ...
2026-10-27 20:10:02 WARN slow query
2026-10-27 20:10:02 INFO ...
2026-10-27 20:10:03 ERROR timeout

What it means: -n stops normal printing; p prints only the range.

5. Lines between two patterns.

sed -n "/BEGIN CERT/,/END CERT/p" bundle.pem | head -2

Output:

-----BEGIN CERTIFICATE-----
MIIDdzCCAl+gAwIBAgIE...

What it means: Regex ranges cut blocks out of files.

6. Clean config view.

sed -e "/^\s*#/d" -e "/^\s*$/d" /etc/ssh/sshd_config | head -3

Output:

Include /etc/ssh/sshd_config.d/*.conf
AuthorizedKeysFile .ssh/authorized_keys
Subsystem sftp /usr/libexec/openssh/sftp-server

What it means: Comments and blank lines removed.

7. Paths with another delimiter.

echo "root=/var/www/old" | sed "s|/var/www/old|/srv/www/new|"

Output:

root=/srv/www/new

What it means: No need to escape every slash.

8. Reorder with groups.

echo "2026-10-27" | sed -E "s/([0-9]{4})-([0-9]{2})-([0-9]{2})/\3\/\2\/\1/"

Output:

27/10/2026

What it means: \1 \2 \3 are the captured parts.

9. Change only matching lines.

sed "/^env=/s/dev/prod/" app.ini

Output:

name=dev-tools
env=prod

What it means: The address limits the replace to env= lines.

10. Insert and append.

sed -e "1i # managed by ansible" -e "/^\[mysqld\]/a max_connections=500" my.cnf | head -3

Output:

# managed by ansible
[mysqld]
max_connections=500

What it means: Adds lines without opening an editor.

11. Replace a whole line.

sed "/^PermitRootLogin/c PermitRootLogin no" sshd_config | grep PermitRootLogin

Output:

PermitRootLogin no

What it means: c swaps the full line, whatever its old value.

12. Delete the header of a CSV.

sed "1d" sales.csv | head -2

Output:

2026-10-01,Pune,18200
2026-10-01,Nashik,9100

What it means: Line 1 removed.

13. Many files at once.

grep -rl "db-old.internal" /etc/myapp | xargs sed -i.bak "s/db-old.internal/db-new.internal/g"; grep -rc db-new /etc/myapp

Output:

/etc/myapp/api.conf:1
/etc/myapp/worker.conf:2

What it means: grep finds the files, sed edits them, each with a .bak.

14. Trim spaces.

printf "  web01   \n" | sed -E "s/^\s+|\s+$//g" | cat -A

Output:

web01$

What it means: Leading and trailing spaces gone.

Practise this in the tasks below: Practice tasks

semanage in depth: change SELinux rules permanently

Why do we need this?

You want nginx on port 8443 or web files under /srv/www. SELinux blocks both until you tell the policy. semanage makes the change permanent, unlike chcon.

What is it?

semanage edits the local SELinux policy. port -a adds a port to a type (http_port_t), fcontext -a adds a path rule (then restorecon applies it), boolean -l lists booleans. It is in policycoreutils-python-utils.

Common options

How to do it (step by step)

1. nginx fails on a new port.

sudo journalctl -u nginx -n 2 --no-pager

Output:

nginx: [emerg] bind() to 0.0.0.0:8443 failed (13: Permission denied)

What it means: Permission denied on bind: SELinux.

2. Allow the port.

sudo semanage port -a -t http_port_t -p tcp 8443; sudo semanage port -l | grep ^http_port_t

Output:

http_port_t  tcp  8443, 80, 81, 443, 488, 8008, 8009, 8443, 9000

What it means: 8443 is now a web port.

3. New web folder rule.

sudo semanage fcontext -a -t httpd_sys_content_t "/srv/www(/.*)?"; sudo restorecon -Rv /srv/www

Output:

Relabeled /srv/www/index.html from var_t to httpd_sys_content_t

What it means: Survives a full relabel.

4. App calls a backend.

sudo setsebool -P httpd_can_network_connect on

What it means: Lets nginx proxy to upstream apps.

Practise this in the tasks below: Practice tasks

seq in depth: number sequences for loops

Why do we need this?

Create 50 test users, ping 20 hosts web01 to web20, or make dated folders: you need a list of numbers. seq prints them.

What is it?

seq FIRST STEP LAST prints numbers. -w pads with zeros to equal width, -s sets the separator, -f a printf format. Bash {1..10} does the same for fixed ranges.

Common options

How to do it (step by step)

1. Simple.

seq 3

Output:

1
2
3

What it means: One per line.

2. Padded hosts.

seq -f "web%02g" 1 3

Output:

web01
web02
web03

What it means: Names for a loop.

3. Loop.

for h in $(seq -f "web%02g" 1 3); do ping -c1 -W1 $h >/dev/null && echo "$h up"; done

Output:

web01 up
web02 up
web03 up

What it means: Check a range of hosts.

4. Comma list.

seq -s, 1 5

Output:

1,2,3,4,5

What it means: For CSV or URLs.

Practise this in the tasks below: Practice tasks

setfacl in depth: give one extra user access

Why do we need this?

An auditor needs read access to /srv/finance, but you cannot change the owner or group. ACLs add per-user rights on top of normal permissions.

What is it?

setfacl sets Access Control List entries. -m modifies (u:user:rwx, g:group:rx), -x removes one, -b removes all, -R recurses, -d sets defaults that new files inherit. getfacl (Part 3) reads them. A + after ls -l permissions shows an ACL exists.

Common options

How to do it (step by step)

1. Give read to one user.

sudo setfacl -R -m u:auditor:rX /srv/finance

What it means: Capital X adds execute only on folders.

2. New files too.

sudo setfacl -d -m u:auditor:rX /srv/finance

What it means: Default ACL is inherited.

3. Check.

getfacl -p /srv/finance | grep auditor; ls -ld /srv/finance

Output:

user:auditor:r-x
default:user:auditor:r-x
drwxrwx---+ 4 root finance 4096 Oct 27 /srv/finance

What it means: The + marks an ACL.

4. Remove after the audit.

sudo setfacl -R -x u:auditor /srv/finance; sudo setfacl -R -x d:u:auditor /srv/finance

What it means: Access ends.

Practise this in the tasks below: Practice tasks

sestatus in depth: is SELinux on?

Why do we need this?

Before you debug a strange "Permission denied", check whether SELinux is enforcing. sestatus shows the mode and policy at a glance.

What is it?

sestatus prints SELinux status, current mode (enforcing, permissive, disabled), the mode in config, and the policy. getenforce prints only the mode; setenforce 0 switches to permissive until reboot for testing. -b lists booleans.

Common options

How to do it (step by step)

1. Check.

sestatus

Output:

SELinux status:                 enabled
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing

What it means: Enforcing with the targeted policy.

2. Quick check.

getenforce

Output:

Enforcing

What it means: One word for scripts.

3. Test if SELinux is the cause.

sudo setenforce 0; curl -s -o /dev/null -w "%{http_code}\n" localhost; sudo setenforce 1

Output:

200

What it means: Works in permissive: fix the label or port, then go back to enforcing.

4. Find the denial.

sudo ausearch -m avc -ts recent | tail -1

Output:

type=AVC msg=audit(...): avc:  denied  { read } for comm="nginx" name="index.html" scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0

What it means: Wrong file label.

Practise this in the tasks below: Practice tasks

sha256sum in depth: verify file integrity

Why do we need this?

A downloaded ISO, a release artifact or a backup must be exactly what it should be. sha256sum gives a fingerprint you can compare with the published one.

What is it?

sha256sum prints a 64-hex SHA-256 hash and file name. -c reads a checksum file and reports OK or FAILED. Unlike md5sum (Part 5), SHA-256 is safe against deliberate tampering.

Common options

How to do it (step by step)

1. Hash.

sha256sum release.tar.gz

Output:

9f2c1e7a...4b10  release.tar.gz

What it means: Share this with the deploy team.

2. Make a checksum file.

sha256sum *.tar.gz > SHA256SUMS; cat SHA256SUMS

Output:

9f2c1e7a...4b10  release.tar.gz
77ad03b1...e2c9  config.tar.gz

What it means: Ship it with the files.

3. Verify.

sha256sum -c SHA256SUMS

Output:

release.tar.gz: OK
config.tar.gz: OK

What it means: Identical.

4. Corrupted copy.

sha256sum -c SHA256SUMS

Output:

release.tar.gz: FAILED
sha256sum: WARNING: 1 computed checksum did NOT match

What it means: Download again; do not deploy.

Practise this in the tasks below: Practice tasks

shutdown in depth: planned power off or restart

Why do we need this?

A maintenance window at 11 PM: you want users warned and the server to go down on time, and the ability to cancel. shutdown schedules it.

What is it?

shutdown -h powers off, -r reboots, at a time (now, +15, 23:00), with an optional message broadcast to logged-in users. shutdown -c cancels. Logins are blocked 5 minutes before.

Common options

How to do it (step by step)

1. Schedule.

sudo shutdown -r 23:00 "Kernel patch, back by 23:10"

Output:

Reboot scheduled for Tue 2026-10-27 23:00:00 IST, use 'shutdown -c' to cancel.

What it means: Users get the message.

2. Cancel.

sudo shutdown -c

What it means: Plan changed.

3. Power off a test box.

sudo shutdown -h now

Output:

Connection to test01 closed by remote host.

What it means: Stopped. On EC2 a stop keeps EBS.

4. Users see.

(on another terminal)

Output:

Broadcast message from root@web02:
Kernel patch, back by 23:10
The system will reboot at Tue 2026-10-27 23:00:00 IST!

What it means: Clear warning.

Practise this in the tasks below: Practice tasks

sleep in depth: wait in scripts

Why do we need this?

Retry an API every 10 seconds, wait for a service to start, or space out requests: scripts need pauses.

What is it?

sleep pauses for a time: seconds by default, or with s, m, h, d suffixes; decimals like 0.5 work. timeout (Part 7) does the reverse: limits how long a command can run.

Common options

How to do it (step by step)

1. Retry loop.

for i in 1 2 3; do curl -sf localhost:8080/health && break; echo "try $i failed"; sleep 5; done

Output:

try 1 failed
OK

What it means: Gives the app time to start.

2. Rate limit.

for id in 101 102; do curl -s api/orders/$id >/dev/null; sleep 0.5; done

What it means: Two requests per second at most.

3. Time it.

time sleep 2

Output:

real    0m2.003s

What it means: Exactly two seconds.

4. Keep a container alive.

docker run -d alpine sleep infinity

Output:

3f1c2a9e0b7d

What it means: Useful for debugging.

Practise this in the tasks below: Practice tasks

sort in depth: order lines

Why do we need this?

Top IPs, biggest folders, sorted CSVs, and uniq (Part 8) which needs sorted input: sort is everywhere in pipelines.

What is it?

sort orders lines alphabetically by default. -n numeric, -h human sizes (2K, 1G), -r reverse, -k picks a column, -t sets the separator, -u removes duplicates, -V version order. Without -n, 10 sorts before 9.

Common options

How to do it (step by step)

1. Numeric trap.

printf "9\n10\n2\n" | sort; printf "9\n10\n2\n" | sort -n

Output:

10
2
9
2
9
10

What it means: Use -n for numbers.

2. Biggest folders.

du -sh /var/* 2>/dev/null | sort -rh | head -3

Output:

4.1G /var/log
2.3G /var/lib
120M /var/cache

What it means: -h understands G and M.

3. CSV by amount.

sort -t, -k3 -nr sales.csv | head -2

Output:

2026-10-01,Pune,18200
2026-10-01,Nashik,9100

What it means: Column 3, numeric, descending.

4. Versions.

printf "v1.10\nv1.9\nv1.2\n" | sort -V

Output:

v1.2
v1.9
v1.10

What it means: Correct release order.

Practise this in the tasks below: Practice tasks

source in depth: run a file in the current shell

Why do we need this?

You edited ~/.bashrc and want the new alias now, or load env variables from a file before running an app. Running the file as a script will not keep them; source does.

What is it?

source FILE (or . FILE) reads and runs commands in the current shell, so variables, functions, aliases and cd stay. ./script.sh runs in a child shell, so its changes vanish. Python venvs use source venv/bin/activate.

Common options

How to do it (step by step)

1. Reload bashrc.

echo "alias k=kubectl" >> ~/.bashrc; source ~/.bashrc; type k

Output:

k is aliased to `kubectl'

What it means: Available now.

2. Script vs source.

echo "export STAGE=prod" > env.sh; bash env.sh; echo "[$STAGE]"; source env.sh; echo "[$STAGE]"

Output:

[]
[prod]

What it means: Only source keeps the variable.

3. Load a .env.

set -a; source .env; set +a; env | grep DB_HOST

Output:

DB_HOST=db01.internal

What it means: Exported for child processes.

4. Python venv.

source venv/bin/activate; which python

Output:

/home/ravi/app/venv/bin/python

What it means: The venv python is first.

Practise this in the tasks below: Practice tasks

split in depth: cut big files into parts

Why do we need this?

An email limit is 25 MB, an upload API takes 100 MB parts, or a 10-million-line CSV must be loaded in batches. split cuts files by size or lines.

What is it?

split -b cuts by bytes (100M), -l by lines, -n into N equal parts. -d uses numeric suffixes, --additional-suffix adds .csv. Join again with cat parts* > file and check with sha256sum.

Common options

How to do it (step by step)

1. By size.

split -b 100M -d backup.tar.gz backup.part.; ls

Output:

backup.part.00  backup.part.01  backup.part.02

What it means: Three parts.

2. Join and verify.

cat backup.part.* > restored.tar.gz; sha256sum backup.tar.gz restored.tar.gz

Output:

ab12...  backup.tar.gz
ab12...  restored.tar.gz

What it means: Same hash.

3. By lines.

tail -n +2 big.csv | split -l 500000 -d --additional-suffix=.csv - chunk_; ls chunk_* | head -2

Output:

chunk_00.csv
chunk_01.csv

What it means: Header removed first, batches for loading.

4. Equal parts.

split -n l/4 urls.txt part_; wc -l part_*

Output:

2500 part_aa
2500 part_ab
2500 part_ac
2500 part_ad
10000 total

What it means: Four workers, one each.

Practise this in the tasks below: Practice tasks

ss in depth: sockets and listening ports

Why do we need this?

Is my app listening? On which port and address? Who is connected? ss replaces netstat (Part 5) and is faster on busy servers.

What is it?

ss lists sockets. -t TCP, -u UDP, -l listening, -n numbers, -p process. -s summary. Filters like state established or dport = :443 narrow the list.

Common options

How to do it (step by step)

1. Who listens.

sudo ss -tlnp

Output:

State  Recv-Q Send-Q Local Address:Port  Peer Address:Port Process
LISTEN 0      511    0.0.0.0:80          0.0.0.0:*     users:(("nginx",pid=901,fd=6))
LISTEN 0      128    127.0.0.1:8080      0.0.0.0:*     users:(("java",pid=4388,fd=12))

What it means: java listens only on localhost.

2. Connections to the DB.

ss -tn state established "( dport = :5432 )" | wc -l

Output:

41

What it means: 40 connections plus the header.

3. Summary.

ss -s

Output:

Total: 612
TCP:   488 (estab 402, closed 60, orphaned 0, timewait 58)

What it means: A quick health view.

4. Port already used.

sudo ss -tlnp | grep :8080

Output:

LISTEN 0 128 *:8080 *:* users:(("node",pid=7712,fd=19))

What it means: An old node process holds it.

Practise this in the tasks below: Practice tasks

ssh in depth: secure remote login and commands

Why do we need this?

Every Linux server is managed over SSH. Logging in, running one command on 20 servers, or jumping through a bastion: ssh does all of it.

What is it?

ssh user@host opens an encrypted shell. -i chooses a key, -p a port, -J a jump host, -v debug. ssh host "cmd" runs one command. ~/.ssh/config saves hosts. Keys, agents and tunnels are covered deeper in the SSH chapter.

Common options

How to do it (step by step)

1. Login with a key.

ssh -i ~/.ssh/prod.pem ec2-user@15.0.0.10

Output:

[ec2-user@ip-10-0-1-11 ~]$

What it means: You are on the server.

2. One command on many.

for h in web01 web02; do ssh $h "uptime"; done

Output:

10:01 up 41 days, load average: 0.20
10:01 up 12 days, load average: 0.31

What it means: Quick fleet check.

3. Through a bastion.

ssh -J ravi@bastion.example.in ravi@10.0.2.15

Output:

[ravi@db01 ~]$

What it means: No public IP needed on db01.

4. Debug a failure.

ssh -v app01 2>&1 | grep -i "permission\|offering"

Output:

debug1: Offering public key: /home/ravi/.ssh/id_ed25519
ravi@app01: Permission denied (publickey).

What it means: The server does not have this key.

Practise this in the tasks below: Practice tasks

ssh-keygen in depth: create and manage SSH keys

Why do we need this?

Passwords over SSH get brute-forced. Keys are safer and allow automation. ssh-keygen creates them and also shows fingerprints and removes old host entries.

What is it?

ssh-keygen -t ed25519 makes a key pair: private (keep secret, chmod 600) and .pub (share). -C adds a comment, -f the file name, -l -f shows a fingerprint, -R host removes an old known_hosts entry, -p changes the passphrase.

Common options

How to do it (step by step)

1. Create.

ssh-keygen -t ed25519 -C "ravi@laptop" -f ~/.ssh/id_ed25519

Output:

Your identification has been saved in /home/ravi/.ssh/id_ed25519
Your public key has been saved in /home/ravi/.ssh/id_ed25519.pub

What it means: Two files: keep the private one safe.

2. Install it.

ssh-copy-id -i ~/.ssh/id_ed25519.pub ravi@app01

Output:

Number of key(s) added: 1

What it means: Now log in without a password.

3. Fingerprint.

ssh-keygen -l -f ~/.ssh/id_ed25519.pub

Output:

256 SHA256:Xk3...Q9 ravi@laptop (ED25519)

What it means: Compare with what the server logs.

4. Host key changed.

ssh-keygen -R app01

Output:

# Host app01 found: line 12
/home/ravi/.ssh/known_hosts updated.

What it means: Only after you confirm the server was rebuilt.

Practise this in the tasks below: Practice tasks

stat in depth: every detail about a file

Why do we need this?

When was this config last changed? What are its exact permissions in numbers? Is it a symlink? stat shows everything ls hides.

What is it?

stat shows size, blocks, inode, links, permissions (octal and text), owner, SELinux context, and three times: Access, Modify (content), Change (metadata). -c prints a custom format; -f shows filesystem info.

Common options

How to do it (step by step)

1. Details.

stat /etc/nginx/nginx.conf

Output:

  File: /etc/nginx/nginx.conf
  Size: 2334      Blocks: 8   IO Block: 4096 regular file
Access: (0644/-rw-r--r--)  Uid: (0/root)  Gid: (0/root)
Modify: 2026-10-27 18:02:11 +0530
Change: 2026-10-27 18:02:11 +0530

What it means: Changed today at 18:02.

2. Octal permissions.

stat -c "%a %U:%G %n" ~/.ssh/id_ed25519

Output:

600 ravi:ravi /home/ravi/.ssh/id_ed25519

What it means: Correct for a private key.

3. Size for a script.

[ $(stat -c %s app.log) -gt 104857600 ] && echo "rotate"

Output:

rotate

What it means: Over 100 MB.

4. Symlink.

stat -c "%F %N" /opt/app/current

Output:

symbolic link '/opt/app/current' -> '/opt/app/releases/v42'

What it means: Points to v42.

Practise this in the tasks below: Practice tasks