Intermediate Linux Commands: Seven Toolkits That Give You Control

by Souy Soeng /October 30, 2026

Terminal window with Linux commands grouped into seven toolkits: navigation, files, text, processes and networking

Intermediate Linux commands are the everyday tools for navigating, editing, inspecting and controlling a Linux system from the terminal, and they're easiest to learn by job, not alphabetically. Every system on the TOP500 list of supercomputers runs Linux. These commands work the same on your laptop, a cloud server and those machines.

This guide follows the video's seven toolkits in order: navigation, file surgery, text power, permissions, processes, system health and networking. Each one builds on the last. Every section says when to reach for that toolkit, shows the commands working on a real example, and ends with a one-line verdict.

TL;DR

Learn commands in groups by the job they do, not as a random list.
Pipes turn small tools like grep, awk, sort and uniq into a query engine for text.
rm -rf has no undo, and chmod 777 opens your files to every user on the machine.
Check processes, disk space and logs before your users notice a problem.
Once you know ssh, any server you have access to is one command away.

Use this toolkit the moment you open a terminal or land on an unfamiliar server. Five commands answer three questions: where am I, take me there, and show me around. pwd prints your current location, such as /home/dev/projects. cd moves you into a folder. ls -la lists everything inside it. tree draws the layout, and find searches for anything below you.

Why ls -la instead of plain ls? Plain ls hides dotfiles, including config files like .env that often decide how an app behaves. The a flag reveals them. The l flag adds permissions, owners, sizes and timestamps. One listing tells you what's there, who owns it and when it last changed.

tree shows a whole project as an indented diagram of folders and files. It often isn't installed by default, so add it with your package manager. find searches by name, size or modification time. In the example, find . -name '*.log' turns up every log file under the current directory, including ./logs/error.log.

pwd: print where you are
ls -la: show hidden files, owners and permissions
find: search by name, size or age
Verdict: master these five and you won't get lost in a filesystem again.

pwd
cd api && ls -la
find . -name '*.log'

2. File commands: cp, mv, mkdir, touch, ln and rm

Use these whenever you create, copy, move, link or delete files, which is most days. Six commands cover a file's whole life. mkdir -p builds a nested path in one go. touch creates an empty file. cp makes a copy, which is useful as a backup before you edit something. mv moves or renames. ln -s creates a shortcut. rm -rf deletes a folder and everything in it.

The danger is real: rm -rf has no undo. There's no trash can to recover files from. One stray space turns /tmp into / tmp, and the command now targets the root of the filesystem as well as tmp. A single typo can wipe out everything you have permission to delete.

ln -s is the friendlier side of this toolkit. A symbolic link is a signpost that points to the real file. A long, awkward path becomes a short name you can type without thinking, and the original file stays where it is.

mkdir -p: create nested folders at once
cp then mv: back up first, then move
rm -rf: permanent, with no trash can
Verdict: cut with care, and reread every command before you press Enter.

mkdir -p app/src/utils  # nested in one go
touch app/src/main.py
cp main.py main.bak && mv main.bak old/
ln -s /var/log/app logs  # shortcut
rm -rf build/  # no undo, no trash

3. Text processing with pipes: grep, sed, awk and more

Use this toolkit whenever you need answers from logs, configs or command output. It has eight small tools. cat prints a file and less lets you scroll through it. tail -f streams new lines as they're written. grep filters matching lines, sed rewrites text, awk pulls out columns, sort orders lines and uniq collapses repeats. Each one does a single job. The pipe connects them.

The pipe symbol | sends one command's output straight into the next. Take an app.log with four lines, three of them errors. grep ERROR keeps the three error lines. awk grabs the second field: db, auth, db. sort orders them as auth, db, db. uniq -c counts the repeats: one auth error and two db errors. Four commands on one line give you a real answer.

tail -f is the command to keep open during a deploy, because it shows new log lines as they arrive. sed edits text without opening an editor. A single substitution can swap every dev for prod as the text streams through, which saves time when the same change is needed across files.

grep finds matching lines; awk extracts columns
sort + uniq -c counts repeated values
tail -f watches a log live
Verdict: learn to pipe, and text becomes data you can query.

grep ERROR app.log | awk '{print $2}' \
  | sort | uniq -c
tail -f app.log  # watch it live

4. Linux permissions: chmod, chown, sudo and whoami

Use this toolkit when a script won't run, a file won't save, or you're about to share a server. Every file has three audiences: its owner, its group and everyone else. Each audience gets its own read, write and execute permissions. chmod sets them, chown changes who owns a file, sudo borrows admin power, whoami confirms who you are, and passwd changes a password.

Decode chmod 755 deploy.sh one digit at a time. The owner digit, 7, means rwx: read, write and execute. The group digit, 5, means r-x: read and execute. The others digit is also 5, so r-x again. The result is -rwxr-xr-x. You can edit the script, and everyone else can only read and run it.

Avoid chmod 777. It gives read, write and execute permission to every user on the machine, so any compromised account can rewrite your scripts. Use sudo instead of working as root. sudo grants admin power for one command and logs it, so there's a record of who did what.

Digits map to owner, group and others
7 = rwx, 5 = r-x
777 lets every user write and execute the file
Verdict: grant the least access you can.

5. Process management: ps, top, htop, kill and nohup

Use this toolkit when the fan screams and everything slows to a crawl. Every running program is a process with an ID number, and you use that ID to control it. ps lists processes, top and htop show them live, kill stops them, jobs shows your background tasks and nohup keeps a task running after you log out.

In the example, ps sorts processes by CPU and the culprit is at the top: process 4821, python3, using 98.7 percent. kill 4821 stops it. Then nohup ./backup.sh & starts a backup script in the background as job one. That's three commands to find the problem, stop it and get back to work.

Order matters with kill. Plain kill asks a process to exit cleanly. kill -9 forces it to stop instantly with no cleanup, so save it for processes that ignore the first request. For a live view, htop shows colour CPU and memory bars and lets you kill with a keypress. top is the older tool, and it's available on almost every system.

ps --sort=-pcpu: list the heaviest processes first
kill first, kill -9 only if needed
nohup: keep jobs alive after you disconnect
Verdict: find the process ID, ask it to stop, and force it only when you have to.

ps -eo pid,pcpu,comm --sort=-pcpu | head -3
kill 4821
nohup ./backup.sh &

6. System health: df, du, free, systemctl and journalctl

Use this toolkit for routine check-ups and whenever something seems wrong. df -h shows free disk space in readable sizes. du finds which folder is using it. free reports memory. tar bundles files into backups. apt installs updates on Debian and Ubuntu-based systems. systemctl manages services, and journalctl reads their logs. Sysadmins check these first.

Here's a real check. df -h shows the root disk, /dev/sda1, at 95 percent: 47G used out of 50G, with 3.0G left. That's the danger zone. Next, sudo systemctl restart nginx restarts the web server, and journalctl -u nginx -n 1 shows the latest log line confirming that nginx started.

Why does 95 percent matter? When a disk reaches 100 percent, writes fail. Databases stop writing and new logs get lost. The app stops working, and the logs that would explain why are lost too.

df -h and du: how full the disk is, and what's filling it
systemctl restart: restart a service
journalctl -u: read a single service's logs
Verdict: run df -h before your users find the problem for you.

df -h /
sudo systemctl restart nginx
journalctl -u nginx -n 1

7. Networking commands: ssh, scp, curl, ping, ip and ss

Use this toolkit whenever the machine you need isn't the one in front of you. Your terminal works the same whether a server is under your desk or on another continent. ping checks whether a server is reachable, ssh opens a shell on it, scp copies files to it, curl and wget talk to the web, and ip and ss inspect your own machine's network.

Here's one remote session. Ping the server and replies come back, 64 bytes each, so it's up. ssh dev@server gives you a shell prompt on that machine. scp backup.tar copies a file across, and the transfer reaches 100 percent. With three commands, you're working on a computer you may never physically see.

curl sends GET or POST requests to any URL and prints the raw response, which makes it a standard tool for testing APIs. wget downloads files and can resume large downloads that were interrupted. On your own machine, ip shows addresses and routes, and ss shows which ports are listening.

ping: is it reachable?
ssh and scp: log in and copy files
curl for APIs, wget for downloads
Verdict: once you know ssh, any server you have access to is one command away.

The bottom line

Navigate with pwd, cd, ls and find.
Treat rm -rf with respect, because it has no undo.
Pipe grep, sed and awk together to answer questions from text.
Never chmod 777, and use sudo sparingly.
Watch processes, disk space and logs, and manage remote machines with ssh.
Practise five commands a day and chain them until they're automatic.

Quick-fire questions

What's the difference between kill and kill -9?

Plain kill asks a process to exit cleanly, so it can finish up properly. kill -9 forces it to stop instantly with no cleanup. Try plain kill first, and use -9 only if the process ignores it.

Why is chmod 777 a bad idea?

It gives read, write and execute permission to every user on the machine. If any account is compromised, the attacker can rewrite your files and scripts. Give each audience only the access it needs, such as 755 for a script others only need to run.

What does the pipe symbol do in Linux?

The pipe | sends one command's output directly into the next command as input. This lets you chain small tools, for example grep to filter, awk to pick a column, then sort and uniq -c to count results.

How do I check disk space on a Linux server?

Run df -h to see how full each filesystem is in readable sizes. If a disk is close to full, use du to find which folder is using the space. Act early, because at 100 percent writes fail and logs get lost.

Why doesn't the tree command work on my system?

tree often isn't installed by default. Install it with your system's package manager, such as apt on Debian or Ubuntu-based systems. Once installed, it shows a project's folders and files as an indented diagram.

What's the fastest way to learn Linux commands?

Learn them in groups by job, then practise five commands a day. Chain them with pipes on real tasks until you can type them without stopping to think.

Watch the full video on YouTube →

Tag

Ad