Basic Linux Commands with Examples: The Beginner's Cheat Sheet

Why Linux Commands Matter for Embedded and IoT Work

• Many embedded Linux boards run headless (no screen), so the terminal is your only window into the device
• Raspberry Pi, BeagleBone, Yocto and Buildroot images all expect you to work over SSH or a serial console
• Toolchains, build systems and CI servers run on Linux, so builds and logs live behind commands
• The same commands work on a laptop, a cloud VM and a small board, so the skill transfers everywhere
• Debugging gets faster: you can read logs, check memory, spot crashed processes and fix permissions in seconds

How a Linux Command Is Built

Every command follows one pattern: command, options, arguments.

ls -l /home/pi

• ls is the command, the program that runs
• -l is the option, which changes behavior (short options start with -, long ones with --)
• /home/pi is the argument, the thing the command works on

Habits that make you faster from day one:

• Press Tab to autocomplete file names and commands
• Press the Up arrow to bring back earlier commands
• Press Ctrl+C to stop a running command
• Use man ls or ls --help when you forget an option
• Linux is case-sensitive, so Notes.txt and notes.txt are different files
• In most terminal apps, copy and paste are Ctrl+Shift+C and Ctrl+Shift+V, because plain Ctrl+C means stop
• A prompt ending in $ means a normal user, and # means root

1. Basic Linux Commands for Files and Directories

The Linux filesystem is one big tree that starts at the root directory (/). These commands show you where you are, move you around, and let you create, copy, move or delete files and folders.

pwd, ls and cd: Find Your Way Around

pwd  # print the current directory
ls  # list files and folders
ls -l  # long format: permissions, owner, size, date
ls -a  # include hidden files (names starting with a dot)
ls -lah  # long format + hidden files + human-readable sizes
cd projects  # move into the folder called projects
cd ..  # go up one level
cd ../firmware  # go up, then into a sibling folder named firmware
cd ~  # jump to your home directory (plain cd does the same)
cd -  # hop back to the previous directory

• -h means human-readable in many commands (ls, df, du, free), so you see 4.2M instead of 4404019
• ls -a also reveals config files such as .bashrc and the .ssh/ folder
• cd - becomes a daily habit when you switch between two folders

mkdir, touch, cp, mv, rm and ln: Create, Copy, Move and Delete

mkdir sensors  # create a folder
mkdir -p project/src/drivers  # create nested folders in one go
touch main.c  # create an empty file (or update its timestamp)
cp main.c backup.c  # copy a file
cp -r project project_backup  # copy a folder (-r = recursive)
mv backup.c old_main.c  # rename a file
mv old_main.c ~/archive/  # move a file into another folder
rm old_main.c  # delete a file
rm -r project_backup  # delete a folder and everything inside it
rm -i notes.txt  # ask before deleting
ln -s main.c shortcut.c  # symbolic link: ln -s EXISTING NEW

• mv does two jobs: it renames and it moves
• rm has no recycle bin, so deleted means gone. Run ls on the same path first to see exactly what will disappear
• For ln -s, remember the same order as cp: the existing thing first, the new name second

cat, head, tail, less, wc and diff: Read Files Without an Editor

cat notes.txt  # print a whole file
head -n 5 boot.log  # first 5 lines
tail -n 20 boot.log  # last 20 lines
tail -f app.log  # follow a log live as new lines arrive (Ctrl+C to stop)
less boot.log  # scroll page by page (q to quit, / to search)
wc -l boot.log  # count the lines in a file
diff -u old.c new.c  # show what changed between two files

• tail -f is a lifesaver when you debug a service or device in real time
• less beats cat for long files because you can scroll and search

echo, > and >>: Write to Files

echo 'sensor=DHT22' > config.txt  # create the file (or overwrite it)
echo 'interval=5' >> config.txt  # append to the end
cat > todo.txt  # type text, then Ctrl+D to save (overwrites)
cat >> todo.txt  # type text, then Ctrl+D to append
ls -l > listing.txt  # save any command's output to a file

• > overwrites and >> appends. One extra arrow can save your data or destroy it

2. Search Commands: grep, find, locate and which

grep searches inside files for text, and find searches for files by name, type, size or date. Together they answer most where-did-I-put-that questions.

grep 'GPIO' main.c  # lines that contain GPIO
grep -i 'error' boot.log  # ignore upper and lower case
grep -n 'timeout' config.txt  # show line numbers
grep -rn 'TODO' src/  # search every file in a folder, with line numbers
find . -name '*.c'  # all C files under the current folder
find /var/log -type f -mtime -1  # files changed in the last 24 hours
find . -type f -size +10M  # files larger than 10 MB
locate uart.h  # instant search using a pre-built index
which gcc  # exact path of the program that will run
whereis gcc  # binary, source and manual page locations
man -k compress  # search manual pages by keyword

• locate is fast because it reads a database. Run sudo updatedb first, or recent files will not show up (if it is missing, install it with sudo apt install plocate)
• which shows the single program that will actually run, while whereis lists more locations. That helps when several compiler versions or toolchains are installed
• Inside a Git repository, git grep 'pattern' searches tracked files only and skips build output
• Newer tools such as ripgrep (rg) are faster, but grep is installed almost everywhere, so learn it first

3. System Information Commands

These commands answer two questions: what am I running on, and is it healthy? They matter even more on boards with limited RAM and storage.

date  # current date and time
date +%Y-%m-%d  # custom format, for example 2026-10-28
uptime  # time since boot, plus load averages
whoami  # your current username
w  # who is logged in and what they are running
uname -a  # kernel name, hostname, kernel version, architecture
uname -m  # CPU architecture only (armv7l, aarch64, x86_64)
cat /proc/cpuinfo  # CPU details
cat /proc/meminfo  # detailed memory statistics
free -h  # RAM and swap usage, human-readable
df -h  # free and used space on each mounted disk
du -sh myproject/  # total size of one folder
du -sh *  # size of every item in the current folder

Sample output of df -h:

Filesystem      Size  Used Avail Use% Mounted on
/dev/root        29G  6.1G   22G  22% /

• df reports disk free space, while du reports disk usage of folders
• In du -sh, s means summary and h means human-readable. It picks KB, MB or GB for you, so it never forces GB
• uname -m tells you which architecture your toolchain must target
• On free -h, check the available column to see how much memory programs can really use

4. Process Management Commands

A process is a running program with its own ID (PID). These commands show what is running and stop what should not be.

ps  # processes in the current terminal
ps aux  # every process, with owner, CPU and memory use
ps aux | grep python  # find a specific process
pgrep python3  # print only the PIDs of matching processes
top  # live process view (q to quit)
htop  # friendlier live view (install: sudo apt install htop)
kill 1234  # politely ask process 1234 to stop
kill -9 1234  # force it to stop (last resort)
killall python3  # stop every process with this name
pkill -f myscript.py  # stop processes matching a name or pattern
sleep 300 &  # run a command in the background
jobs  # list background jobs
fg %1  # bring job 1 back to the foreground

• kill sends a polite stop signal (SIGTERM) by default. kill -9 sends SIGKILL, which gives the program no chance to clean up, so try the polite one first
• pgrep is neat because ps aux | grep also lists the grep command itself
• Ctrl+C stops the foreground program, Ctrl+Z pauses it, and bg resumes it in the background

Embedded tip: A board with 512 MB of RAM runs out of memory sooner than you expect. Keep top or free -h open in a second terminal while your application runs.

5. Networking and Remote Access Commands

Check connectivity, DNS and downloads

ping -c 4 google.com  # send 4 packets (without -c, Linux pings until Ctrl+C)
ip a  # IP addresses of all network interfaces
ip r  # routing table, including the default gateway
dig example.com  # DNS records for a domain
dig +short example.com  # just the answer
dig -x 8.8.8.8  # reverse lookup: IP address to hostname
host example.com  # simpler DNS lookup
whois example.com  # domain registration details
curl https://example.com  # print a web page in the terminal
curl -o page.html https://example.com  # save the response to a file
curl -I https://example.com  # headers only
wget https://example.com/file.zip  # download a file
wget -c https://example.com/file.zip  # resume a broken download
wget -r https://example.com/docs/  # download recursively (use responsibly)

• ip a is the quickest way to find your board’s IP address before you SSH into it
• Older guides use ifconfig, but many modern systems ship ip instead and may not include ifconfig at all
• host is a simpler alternative to dig when you only need an address
• whois and dig may need extra packages (whois and dnsutils on Debian-based systems)

ssh, scp and rsync: Work on Remote Machines

ssh pi@192.168.1.50  # log in to a remote machine
ssh -p 2222 pi@192.168.1.50  # connect on a custom port
ssh -D 1080 user@server.example.com  # local SOCKS proxy on port 1080 through the server
scp firmware.bin pi@192.168.1.50:/home/pi/  # copy a file to the board
scp -r build pi@192.168.1.50:/home/pi/  # copy a folder to the board
rsync -avh --progress build/ pi@192.168.1.50:/home/pi/build/  # sync only what changed

• ssh -p picks the port, and ssh -D creates a dynamic tunnel (a SOCKS proxy) that sends traffic through the remote host
• rsync transfers only the differences, so re-running it after a dropped connection is quick
• Mind the trailing slash: build/ copies the folder’s contents, while build copies the folder itself

6. File Permissions: chmod, chown and sudo

chmod changes who can read, write or execute a file, using either numbers (755) or letters (u+x). Linux checks permissions separately for three groups: the file’s owner, its group and everyone else.

ls -l script.sh
# -rwxr-xr-x 1 pi pi 214 Oct 28 10:15 script.sh

How to read the first column:

• The first character is the type: - file, d directory, l link
• The next nine characters are three triplets: owner, group, others
• r is read (4), w is write (2), x is execute (1). Add them up: rwx = 7, r-x = 5, r-- = 4

chmod 755 deploy.sh  # owner: read, write, execute. Group and others: read, execute
chmod +x deploy.sh  # make a script executable, leave other permissions alone
chmod u+w,go-w notes.txt  # add write for the owner, remove it for group and others
chown pi:pi config.txt  # change owner and group (usually needs sudo)
sudo apt update  # run any command as administrator (Debian, Ubuntu, Raspberry Pi OS)

• chmod 755 means the owner can do everything while everyone else can read and run
• +x adds a permission, while a number like 755 sets everything at once and replaces what was there
• chmod 777 lets every user on the system modify the file. It hides the real problem, so fix the owner or group instead
• A script copied from a Windows machine refuses to run? It probably lost its execute bit, so try chmod +x script.sh

7. Compress and Archive Files with tar

tar bundles many files into one archive, and with a flag it compresses them too. That is why .tar.gz files are everywhere, from source releases to root filesystem images.

tar cf logs.tar logs/  # create an archive (no compression)
tar czf logs.tar.gz logs/  # create a gzip-compressed archive
tar cjf logs.tar.bz2 logs/  # bzip2 compression (smaller, slower)
tar tf logs.tar.gz  # list contents without extracting
tar xf logs.tar.gz  # extract into the current folder
tar xf logs.tar.gz -C /tmp/out  # extract into an existing folder of your choice
zcat app.log.gz | grep error  # search a compressed log without unpacking it

• Easy memory aid: create, extract, table of contents, file
• Modern GNU tar detects the compression when extracting, so tar xf works for most archives
• Need a Windows-friendly .zip? Use zip -r project.zip project/ and unzip project.zip

8. Shell Shortcuts That Save Hours

Once the basics feel natural, these tricks make you noticeably faster.

sudo !!  # repeat the last command, now with sudo
mkdir release_v2  # create a folder...
cd !$  # ...then !$ reuses its name (last argument of the previous command)
history | grep ssh  # search your command history
!57  # re-run command number 57 from history
alias ll='ls -lah'  # create a shortcut (add it to ~/.bashrc to keep it)
pushd /var/log  # jump to a folder and remember where you were
popd  # return to the remembered folder

• sudo !! rescues you every time you forget sudo and get permission denied
• Press Ctrl+R and start typing to search backwards through your history. Press it again to cycle through matches
• !^ gives the first argument and !* gives all arguments of the previous command
• && runs the second command only if the first one succeeds, so mkdir build && cd build is safe to chain

Pipes: Connect Commands Like Building Blocks

ls | wc -l  # count the items in a folder
sudo dmesg | grep -i usb  # filter kernel messages for USB events
cut -d' ' -f1 access.log | sort | uniq -c | sort -nr | head  # busiest IP addresses in a web server log

• The pipe | feeds the output of one command into the next
• The last example reads like a sentence: take the first column, sort it, count duplicates, sort by count, show the top ten

9. Embedded Linux Field Kit: Commands You Will Use on Real Boards

These commands show up again and again with a Raspberry Pi, a BeagleBone or a custom Yocto or Buildroot image.

ssh pi@raspberrypi.local  # log in to a board on your network (your hostname may differ)
file ./hello_arm  # which CPU architecture does this binary target?
uname -m  # architecture of the board you are on
lsusb  # list connected USB devices
ls /dev/ttyUSB* /dev/ttyACM*  # find USB-serial adapters and boards
sudo dmesg | tail -n 20  # what the kernel noticed when you plugged something in
screen /dev/ttyUSB0 115200  # serial console at 115200 baud (exit: Ctrl+A, K, then y)
sudo i2cdetect -y 1  # scan I2C bus 1 for sensors (needs i2c-tools)
journalctl -u myservice -f  # follow a systemd service log live
cat /sys/class/thermal/thermal_zone0/temp  # CPU temperature in millidegrees Celsius

• Exec format error? The binary was built for a different CPU. Compare the file output with uname -m on the board. This is the classic cross-compilation mix-up
• Permission denied on /dev/ttyUSB0? On Debian-based systems, add yourself to the serial group with sudo usermod -aG dialout $USER, then log out and back in
• SD card filling up? Run df -h, then sudo du -sh /var/log/* to spot runaway logs
• Missing a tool? Install it with sudo apt update && sudo apt install i2c-tools screen htop (Debian, Ubuntu, Raspberry Pi OS)
• On Windows? Practice in WSL or a virtual machine before you touch hardware

10. Danger Zone: Commands That Deserve Respect

A few commands are harmless when used carefully and painful when rushed. Read twice, press Enter once.

• rm -rf deletes without prompts and without undo. The famous rm -rf / targets the entire system. Newer GNU rm refuses the bare version by default, yet typos, stray spaces and misplaced wildcards can still wipe real data. And no, it will not make your computer faster. That is an old joke, so please do not test it
• dd copies raw data between disks and image files. Point it at the wrong device and it overwrites the wrong drive without asking. Run lsblk and double-check the target before every use
• chmod -R 777 strips protection from a whole folder tree and never solves the real problem
• > silently replaces an existing file. Use >> when you mean add to the end
• Safe habits: run ls before rm, use rm -i when unsure, confirm your location with pwd, use sudo only when needed, and try risky commands on a copy first

Common Linux Command Mix-Ups, Cleared Up

Quick-reference sheets travel widely, and a few details get repeated incorrectly. Here is the accurate version:

• du -sh shows a human-readable summary in whatever unit fits (K, M or G). It does not always report GB
• uname -a prints system and kernel details such as version and architecture, not a kernel configuration
• chmod 755 gives the owner read, write and execute (rwx), not just read and write
• In tar, z means gzip, not the .zip format
• dig -x performs a reverse DNS lookup and expects an IP address
• locate needs an updated database (sudo updatedb) before it can find new files

Linux Commands Cheat Sheet: Quick Reference

Try It Yourself: A 10-Minute Practice Run

Paste these lines into a terminal and read what each one does. Everything stays inside one practice folder in your home directory.

mkdir -p ~/linux_practice/logs && cd ~/linux_practice/logs
echo 'boot ok' > boot.log
echo 'sensor timeout' >> boot.log
echo 'boot ok' > app.log
grep -n 'timeout' *.log  # expect: boot.log:2:sensor timeout
cd .. && du -sh logs  # size of the logs folder
tar czf logs.tar.gz logs/  # archive it
tar tf logs.tar.gz  # check the archive contents
echo '#!/bin/bash' > hello.sh  # start a tiny script
echo 'echo Hello from my first script' >> hello.sh
chmod +x hello.sh && ./hello.sh  # make it executable and run it
ls logs  # look before you delete
rm -r logs  # clean up

Final Thoughts

Linux commands feel awkward for about a week. After that, the terminal becomes the fastest tool you own.

• Start with five commands today: ls, cd, grep, chmod and man
• Repeat the practice run tomorrow without peeking at this guide
• Add one new command whenever a real task needs it
• Next in line: shell scripting, awk, sed, tmux and systemd basics

If your goal is embedded Linux, IoT or firmware development, these commands are the base under everything else, from cross-compiling and flashing to debugging devices over SSH. Ready to turn command-line confidence into real hardware projects? Explore the embedded systems programs at IIES, Bangalore, and build on these skills step by step.