Basic Linux Administration Guide

Created2026-07-14

This guide contains common Linux administration commands useful when managing a VPS, especially Ubuntu/Debian-based servers.

Most administrative commands require sudo.

1. Check the current user

1
whoami

Show information about the current user and groups:

1
id

Show currently logged-in users:

1
who

2. Create a new user

Create a new user:

1
sudo adduser username

Example:

1
sudo adduser deployuser

The command will ask you to set a password and optionally enter additional user information.

Check that the user exists:

1
id deployuser

3. Add a user to the sudo group

On Ubuntu/Debian, users in the sudo group can execute administrative commands.

1
sudo usermod -aG sudo username

Example:

1
sudo usermod -aG sudo deployuser

Verify the user’s groups:

1
groups deployuser

or:

1
id deployuser

You should see:

1
sudo

The user may need to log out and log back in before the new group membership is applied.

4. Test sudo access

Switch to the user:

1
su - deployuser

Then test:

1
sudo whoami

Expected result:

1
root

5. Switch users

Switch to another user:

1
su - username

Example:

1
su - deployuser

Open a root shell:

1
sudo -i

Exit the current shell:

1
exit

6. Change a user’s password

Change your own password:

1
passwd

Change another user’s password:

1
sudo passwd username

Example:

1
sudo passwd deployuser

7. Lock or unlock a user account

Lock a user:

1
sudo passwd -l username

Unlock a user:

1
sudo passwd -u username

8. Delete a user

Delete a user but keep their home directory:

1
sudo deluser username

Delete the user and their home directory:

1
sudo deluser --remove-home username

Example:

1
sudo deluser --remove-home deployuser

9. Create and manage groups

Create a group:

1
sudo groupadd groupname

Add a user to a group:

1
sudo usermod -aG groupname username

Example:

1
sudo usermod -aG docker deployuser

Remove a user from a group:

1
sudo deluser username groupname

List all groups:

1
cat /etc/group

10. File and directory navigation

Show the current directory:

1
pwd

List files:

1
ls

Detailed listing:

1
ls -la

Change directory:

1
cd /path/to/directory

Go to the home directory:

1
cd ~

Go one directory up:

1
cd ..

11. Create files and directories

Create a directory:

1
mkdir directory-name

Create nested directories:

1
mkdir -p parent/child

Create an empty file:

1
touch file.txt

12. Copy, move, and delete files

Copy a file:

1
cp source.txt destination.txt

Copy a directory recursively:

1
cp -r source-directory destination-directory

Move or rename a file:

1
mv old-name new-name

Delete a file:

1
rm file.txt

Delete a directory recursively:

1
rm -r directory

Force recursive deletion:

1
rm -rf directory

Be very careful with rm -rf. Deleted files are usually not recoverable.

13. View file contents

Display a file:

1
cat file.txt

Read a file page by page:

1
less file.txt

Show the first lines:

1
head file.txt

Show the last lines:

1
tail file.txt

Follow a log file in real time:

1
tail -f /var/log/syslog

14. Edit files

Using Nano:

1
nano file.txt

Useful Nano shortcuts:

1
2
3
Ctrl + O  -> save
Ctrl + X  -> exit
Ctrl + W  -> search

15. File ownership

Show ownership:

1
ls -l

Change the owner of a file:

1
sudo chown username file.txt

Change owner and group:

1
sudo chown username:groupname file.txt

Change ownership recursively:

1
sudo chown -R username:groupname directory

Example:

1
sudo chown -R deployuser:deployuser /opt/myapp

16. File permissions

Example:

1
chmod 644 file.txt

Common permission values:

1
2
3
4
600 -> owner read/write only
644 -> owner read/write, everyone else read
700 -> owner full access only
755 -> owner full access, others read/execute

Example for an SSH directory:

1
2
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Make a script executable:

1
chmod +x script.sh

17. Check disk usage

Show filesystem usage:

1
df -h

Show the size of a directory:

1
du -sh /path/to/directory

Show directory sizes:

1
du -h --max-depth=1 /path/to/directory

Example:

1
du -h --max-depth=1 /var

18. Check memory usage

1
free -h

19. Check CPU and running processes

Interactive process viewer:

1
top

A more convenient alternative:

1
htop

Install it if necessary:

1
sudo apt install htop

List processes:

1
ps aux

Find a process:

1
ps aux | grep process-name

Example:

1
ps aux | grep nginx

20. Stop a process

Find the PID:

1
ps aux | grep process-name

Gracefully stop it:

1
kill PID

Force stop:

1
kill -9 PID

Use kill -9 only when a normal kill does not work.

21. Manage services with systemd

Check a service:

1
sudo systemctl status nginx

Start a service:

1
sudo systemctl start nginx

Stop a service:

1
sudo systemctl stop nginx

Restart a service:

1
sudo systemctl restart nginx

Reload configuration:

1
sudo systemctl reload nginx

Enable a service at boot:

1
sudo systemctl enable nginx

Disable it at boot:

1
sudo systemctl disable nginx

22. View service logs

Show logs for a service:

1
sudo journalctl -u nginx

Follow logs in real time:

1
sudo journalctl -u nginx -f

Show logs from the current boot:

1
sudo journalctl -b

23. Update the server

Refresh available package information:

1
sudo apt update

Upgrade installed packages:

1
sudo apt upgrade

Run both:

1
sudo apt update && sudo apt upgrade

Remove unused packages:

1
sudo apt autoremove

24. Install and remove software

Install a package:

1
sudo apt install package-name

Example:

1
sudo apt install curl

Remove a package:

1
sudo apt remove package-name

Remove package and configuration files:

1
sudo apt purge package-name

25. Check Linux version

1
cat /etc/os-release

Kernel version:

1
uname -a

Hostname:

1
hostname

More host information:

1
hostnamectl

26. Change the hostname

1
sudo hostnamectl set-hostname new-hostname

Example:

1
sudo hostnamectl set-hostname my-vps

Check it:

1
hostnamectl

27. Network information

Show IP addresses:

1
ip addr

Short version:

1
ip a

Show routes:

1
ip route

Test network connectivity:

1
ping google.com

Find the public IP:

1
curl ifconfig.me

28. Check open/listening ports

Recommended:

1
sudo ss -tulpn

Typical output can show services listening on ports such as:

1
2
3
22   SSH
80   HTTP
443  HTTPS

29. Check which process uses a port

Example for port 80:

1
sudo lsof -i :80

or:

1
sudo ss -ltnp | grep :80

30. Basic firewall with UFW

Install UFW if necessary:

1
sudo apt install ufw

Allow SSH before enabling the firewall:

1
sudo ufw allow OpenSSH

Allow HTTP:

1
sudo ufw allow 80/tcp

Allow HTTPS:

1
sudo ufw allow 443/tcp

Enable UFW:

1
sudo ufw enable

Check status:

1
sudo ufw status

Detailed status:

1
sudo ufw status verbose

Show firewall rules with rule numbers:

1
sudo ufw status numbered

Always allow SSH before enabling UFW on a remote VPS, otherwise you may lock yourself out.

Block an IP address

Block all incoming traffic from a specific IP:

1
sudo ufw deny from 203.0.113.10

Block an IP only from accessing a specific port, for example SSH on port 22:

1
sudo ufw deny from 203.0.113.10 to any port 22

Check whether an IP is blocked

Search the current UFW rules for a specific IP:

1
sudo ufw status | grep 203.0.113.10

For numbered rules:

1
sudo ufw status numbered

If the IP appears in a rule similar to:

1
DENY IN    203.0.113.10

then UFW is configured to block traffic from that IP.

You can also inspect the active UFW rules in more detail:

1
sudo ufw show raw

Unblock an IP address

If the IP was blocked with:

1
sudo ufw deny from 203.0.113.10

remove that rule with:

1
sudo ufw delete deny from 203.0.113.10

If the IP was blocked only for a specific port:

1
sudo ufw delete deny from 203.0.113.10 to any port 22

Remove a rule by number

First list numbered rules:

1
sudo ufw status numbered

Example:

1
2
[ 1] 22/tcp                     ALLOW IN    Anywhere
[ 2] Anywhere                   DENY IN     203.0.113.10

Delete rule number 2:

1
sudo ufw delete 2

Then verify the result:

1
sudo ufw status numbered

Be careful when deleting rules by number. Rule numbers can change after a rule is removed.

Reload UFW

Most UFW rule changes are applied immediately, but you can reload the firewall if needed:

1
sudo ufw reload

32. Fail2ban basics

Fail2ban can automatically block IP addresses that repeatedly fail authentication attempts, such as SSH login attempts.

Install Fail2ban:

1
sudo apt install fail2ban

Check the Fail2ban service:

1
sudo systemctl status fail2ban

Start Fail2ban:

1
sudo systemctl start fail2ban

Enable it at boot:

1
sudo systemctl enable fail2ban

Check active jails

1
sudo fail2ban-client status

Typical output may include:

1
Jail list: sshd

Check SSH jail status

1
sudo fail2ban-client status sshd

This shows information such as:

  • currently failed attempts;
  • total failed attempts;
  • currently banned IPs;
  • total banned IPs;
  • the list of banned IP addresses.

Example output:

1
2
3
4
5
6
7
8
Status for the jail: sshd
|- Filter
|  |- Currently failed: 0
|  `- Total failed: 12
`- Actions
   |- Currently banned: 1
   |- Total banned: 3
   `- Banned IP list: 203.0.113.10

Check whether a specific IP is banned

You can inspect the SSH jail:

1
sudo fail2ban-client status sshd

Or search for a specific IP:

1
sudo fail2ban-client status sshd | grep 203.0.113.10

If the IP appears in the Banned IP list, it is currently banned by Fail2ban.

Unban an IP address

Unban an IP from the SSH jail:

1
sudo fail2ban-client set sshd unbanip 203.0.113.10

Example:

1
sudo fail2ban-client set sshd unbanip 89.x.x.x

Then verify:

1
sudo fail2ban-client status sshd

Manually ban an IP

1
sudo fail2ban-client set sshd banip 203.0.113.10

Check Fail2ban logs

On Ubuntu/Debian:

1
sudo tail -f /var/log/fail2ban.log

Search for bans:

1
sudo grep "Ban " /var/log/fail2ban.log

Search for unbans:

1
sudo grep "Unban " /var/log/fail2ban.log

Restart Fail2ban

1
sudo systemctl restart fail2ban

UFW and Fail2ban are different tools. UFW manages firewall rules, while Fail2ban watches logs and can dynamically add or remove blocks based on suspicious behavior.

32. Reboot or shut down the server

Reboot:

1
sudo reboot

Shutdown:

1
sudo shutdown now

Schedule shutdown:

1
sudo shutdown +10

This shuts down the server in 10 minutes.

Cancel a scheduled shutdown:

1
sudo shutdown -c

33. Useful directories

Common Linux directories:

1
2
3
4
5
6
7
8
9
/home          -> user home directories
/root          -> root user's home directory
/etc           -> system configuration
/var           -> logs and changing application data
/var/log       -> logs
/opt           -> optional/custom software
/tmp           -> temporary files
/usr           -> installed programs and libraries
/srv           -> service/application data

A useful place for your own deployed application can be:

1
/opt/myapp

or:

1
/srv/myapp

34. Example: Create a dedicated VPS user

Create the user:

1
sudo adduser deployuser

Give sudo access:

1
sudo usermod -aG sudo deployuser

Check groups:

1
groups deployuser

Switch to the user:

1
su - deployuser

Test sudo:

1
sudo whoami

Expected result:

1
root

Then configure SSH key authentication for that user and disable password-based SSH login after verifying that the key works.

35. Useful daily commands

1
2
3
4
5
6
7
8
9
10
11
12
whoami
id
pwd
ls -la
df -h
free -h
top
ip a
sudo ss -tulpn
sudo systemctl status SERVICE
sudo journalctl -u SERVICE -f
sudo apt update

Security recommendations for a VPS

For a public server:

  • use SSH keys instead of SSH passwords;
  • disable direct root SSH login;
  • keep the server updated;
  • use a firewall;
  • expose only required ports;
  • avoid running applications as root;
  • create separate users where appropriate;
  • use strong permissions on configuration and secret files;
  • regularly back up important data;
  • never commit passwords, private keys, tokens, or production secrets to Git.