CyberPatriot Resources · Resource 07
Linux Commands & Manual Pages
Build the habit of checking Linux documentation before using unfamiliar commands, options, configuration files, or system administration tools.
Linux commands can be extremely precise, but a single option can also expand a change across an entire system. Manual pages help you understand syntax, scope, files, side effects, and related tools.
Command reference rule
Never guess a high-impact option
If a flag changes files recursively, removes data, alters permissions, disables services, or modifies firewall state, check its documentation before running it.
Official references
Ubuntu Manpages
Search Ubuntu manual pages for commands, configuration files, system calls, libraries, and administrative utilities.
Open reference →
GNU Coreutils Manual
Official documentation for common GNU tools such as ls, cp, mv, rm, chmod, chown, stat, sort, cut, head, tail, and many others.
Open reference →
systemd Manual Pages
Reference documentation for systemctl, journalctl, unit files, timers, targets, services, and other systemd components.
Open reference →
Linux Kernel Documentation
Primary documentation for Linux kernel behavior, networking, filesystems, security features, and kernel interfaces.
Open reference →
Understanding manual sections
Section 1
User Commands
Commands normally used directly from a shell by users and administrators.
Examples: ls, cat, grep, find, ps, ssh
Section 2
System Calls
Interfaces programs use to request services from the Linux kernel.
Examples: open, read, write, fork
Section 3
Library Functions
Functions provided by programming libraries.
Examples: printf, malloc
Section 4
Devices
Special files and device interfaces.
Examples: /dev entries
Section 5
File Formats
Configuration-file formats and structured system files.
Examples: passwd, shadow, sudoers
Section 7
Miscellaneous
Standards, protocols, concepts, and general system information.
Examples: protocols and conventions
Section 8
Administration
System administration and privileged management commands.
Examples: useradd, ip, mount
Finding the right documentation
man command
man systemctlOpen the primary manual page for a command.
Specific manual section
man 5 passwdOpen a specific manual section when a name exists in multiple sections.
Keyword search
man -k passwordSearch manual-page names and descriptions for a keyword.
Short description
whatis chmodDisplay the one-line manual description for a known command.
Built-in help
command --helpQuickly review syntax and common options without leaving the terminal.
Shell help
help cdUse shell-provided help for commands implemented as shell built-ins.
Command groups worth knowing
Identity & Privilege
idDisplay UID, GID, and group membership.
whoShow logged-in users.
wShow logged-in users and their activity.
getent passwdQuery account information through system databases.
getent groupQuery group information.
sudo -lShow sudo permissions available to the current user.
Processes & Services
ps auxReview running processes.
pstree -apShow process parent-child relationships.
systemctlInspect and manage systemd units.
systemctl status NAMEReview a specific service.
systemctl list-unit-filesReview configured unit startup states.
journalctl -u NAMEView journal entries for a service.
Files & Permissions
ls -laReview files, ownership, and permissions.
stat FILEDisplay detailed file metadata.
findSearch using path, owner, permission, time, and other criteria.
chmodChange permission bits.
chownChange file ownership.
readlinkResolve symbolic-link targets.
Networking
ip addrReview interface addressing.
ip routeReview routing state.
ss -tulpnReview listening TCP and UDP sockets.
pingTest basic network reachability.
tracerouteObserve the path toward a destination when installed.
ufw status verboseReview UFW firewall state and rules.
Logs & Text Analysis
journalctlQuery the systemd journal.
grepSearch text using patterns.
headDisplay the beginning of a file.
tailDisplay the end of a file.
lessRead long output interactively.
sort | uniqGroup and count repeated text values.
Packages & System State
dpkg -lList Debian packages known to the system.
apt list --installedReview installed APT packages.
uname -aDisplay kernel and system information.
hostnamectlReview hostname and operating-system information.
df -hReview mounted filesystem space.
lsblkReview block devices and mount relationships.
How to read a manual page
Read the SYNOPSIS to understand required argument order.
Check DESCRIPTION before copying an example.
Review OPTIONS for scope-changing flags such as recursive or force.
Check FILES to learn which configuration files the command uses.
Review EXIT STATUS when troubleshooting scripts or failed commands.
Read EXAMPLES only after understanding the command's purpose.
Check SEE ALSO for related utilities and configuration references.
Confirm whether the documentation matches the installed distribution and command version.
Competition reference situations
You remember the command but not the option
Do not guess a destructive or scope-changing flag.
Open the manual page or --help output.
Find the exact option and read its description.
Check whether it is recursive, destructive, or requires privilege.
Run the narrowest command that satisfies the task.
A configuration file is unfamiliar
Determine which program owns the file.
Search for the file-format manual page, often in section 5.
Identify valid directives and defaults.
Preserve the original configuration before meaningful edits.
Verify the affected service after the change.
A service command behaves unexpectedly
Check systemctl and the relevant unit documentation.
Review systemctl status output.
Review journalctl evidence.
Inspect the unit file and any override files.
Understand dependencies before restarting or disabling the service.
You need to locate suspicious files
Read the find manual if the expression is complex.
Start with observation-only criteria.
Confirm quoting and operator behavior.
Review results before combining find with a modifying command.
Avoid broad deletion pipelines during investigation.
High-impact patterns
Read the documentation before using these broadly
chmod -RCan alter permissions across an entire directory tree.
chown -RCan break application ownership across many files.
rm -rfRemoves files recursively without normal confirmation.
find ... -deleteCan delete every object matching a search expression.
systemctl disable --nowChanges startup behavior and immediately stops a service.
iptables / nft flush operationsCan remove active firewall policy and change network exposure.
Weak habit vs better habit
Weak habit
Run the command from memory when the flags are uncertain.
Better habit
Check the manual page or --help before using unfamiliar or high-impact options.
Weak habit
Copy commands from random forum answers.
Better habit
Start with installed man pages and official project or distribution documentation.
Weak habit
Assume a command has the same behavior on every Linux system.
Better habit
Confirm the installed command, distribution, version, and implementation.
Weak habit
Use recursive options to save time.
Better habit
Make the smallest targeted change that solves the verified problem.
Weak habit
Pipe investigation output directly into a modifying command.
Better habit
Review the result set first, then separately perform justified changes.
Weak habit
Treat example commands as universal instructions.
Better habit
Understand what each argument means before adapting an example to the current system.
Linux command reference checklist
Use installed man pages as a first-line Linux reference.
Know that manual sections distinguish commands, file formats, administration, and other topics.
Use man -k when you know the concept but not the command name.
Use section 5 references for important configuration-file formats.
Use section 8 references for many administration commands.
Read scope-changing options carefully.
Avoid guessing recursive, force, delete, or disable flags.
Use observation commands before modification commands.
Confirm distribution and version differences.
Use official project documentation when man pages are insufficient.
Verify the system after meaningful administrative changes.
Let the CyberPatriot scenario determine what should remain enabled and functional.