Command the Terminal
From Core Shell to Server Hardening

Run an instant diagnostic probe against the simulated TeachCloud server to verify host kernel, architecture, and system load.

Queries the running Linux kernel release, hostname, SMP thread scheduling mode, and CPU architecture (x86_64).

Reads the standardized system database file defining the distribution name, LTS version codename, and upstream family (Debian/Ubuntu).

hostnamectl inspects whether your Linux instance runs bare-metal or inside a cloud hypervisor (KVM/QEMU), displaying active kernel and chassis type.

Gathers CPU architecture, core counts, thread topology, and byte endianness directly from the Linux /sys and /proc virtual subsystems.

Lists all physical and virtual disk drives (sda), partition slices (sda1, sda2), sizes, and active mountpoint associations.

Audits human-readable storage capacity on the root partition (/), reporting total disk space, consumed storage, and available headroom.

Audits RAM utilization. Notice how headless Linux servers operate with minimal overhead (~800Mi used), reserving maximum memory for databases and web applications.

Verifies how long the server has been running without reboots, active logged-in sessions, and exponential moving CPU load averages (1, 5, 15 min).

Queries Ubuntu cryptographic package archive servers for security patches and upgradable packages.

Lists root directories including /etc (system configurations), /var/log (runtime logs), /home (users), /opt (vendor packages), and /tmp (transient storage).

An absolute path begins at the root (/) and targets an exact location regardless of where you currently stand. Here we switch directly to /var/log.

A relative path starts from your current directory. Use .. to ascend to the parent directory and inspect sibling directories without spelling out the full root path.

The tilde character (~) expands dynamically to the currently logged-in user's home directory (e.g. /home/ubuntu), providing clean portability across environments.

Prints your current full absolute filesystem path. Essential before issuing recursive commands or configuring service working directories.

Lists all directory contents in long format (-l) including hidden dotfiles (-a) like .env and .git, alongside permission bits, owners, and file sizes.

The -p (parents) flag creates the entire directory chain in one call without throwing an error if the directory already exists. Critical for idempotent CI/CD scripts.

Creates a zero-byte placeholder file if it doesn't exist, or refreshes the modification timestamp if it does. Frequently used for deployment lock files and triggers.

Copies files or entire directory trees recursively. Always duplicate configuration files to .bak before applying live edits on production instances.

Moves or renames files and directories. On the same filesystem partition, mv is atomic (instant inode pointer swap with zero data copy overhead).

Concatenates and prints file contents directly to standard output. Best suited for short configuration files like /etc/hosts or .env.

Outputs the first N lines of large files without loading the rest into RAM. Useful for inspecting log formats or CSV header columns.

The -f (follow) flag keeps the file descriptor open and streams new log entries as services write them. Essential for live API debugging and deployment verification.

Searches files recursively (-r) and prints the line number (-n) of all matches. Use it to find HTTP 404/500 errors or environment variable usages across directories.

Recursively searches disk trees matching filename patterns, file types (-type f), modification times, or sizes.

Redirects standard output to a file, completely truncating and overwriting previous contents.

Appends standard output to the bottom of the destination file, preserving all existing historical records.

Isolates stderr (file descriptor 2) to a dedicated error log, keeping standard console output clean.

Redirects file descriptor 2 (stderr) to file descriptor 1 (stdout), ensuring chronological log order for background daemons.

Sends noisy cron output or high-frequency telemetry into the Linux bit-bucket (/dev/null) to prevent filling disks with unneeded logs.

Streams the output of one command as direct input into another. Here we read the web log, filter 404 responses with grep, and count them with wc -l in a single pass.

Outputs current effective UID (User ID), primary GID (Group ID), and all secondary security groups (e.g. sudo, docker).

Prints logged-in account name followed by space-separated group privileges.

Reads system account entries showing username, password placeholder (x), UID, GID, home directory, and default login shell.

Sets rw-------: Only the file owner can read or write. Group and all other accounts have 0 access. Essential for .env and SSH keys.

Sets rwxr-xr-x: Owner has full read/write/execute; Group and Others can read and execute. Standard mode for web directories and CLI scripts.

Lists target files with exact octal bit representation to verify zero credential leakage before production deployment.

Recursively transfers ownership of application directories to non-root service accounts, ensuring the web worker cannot alter system binaries.

Creates team group devops and appends user with usermod -aG without wiping other supplementary memberships.

Inspects drwxrwxrwt mode: prevents any user from deleting or renaming files owned by another user inside world-writable scratch space.

Verifies /etc/sudoers syntax integrity without opening an interactive editor, catching syntax errors that could lock admins out.

Lists active processes showing PID, CPU/RAM percentages, memory footprints (VSZ/RSS), state, and full command arguments.

Visualizes parent-child relationships linking master daemons to spawned worker sub-processes directly from PID 1.

Requests clean shutdown: process finishes in-flight requests, releases socket bindings, closes database pools, and exits code 0.

Matches regex patterns across full process command lines to terminate clusters of workers without looking up individual PIDs.

Lists all background jobs managed by the current shell session with job indices (`%1`) and OS Process IDs.

Shows total, used, free, and available RAM. Remember: Look at available, not free! Linux caches disk reads in RAM dynamically.

Reports server running time, active user sessions, and 1/5/15-minute load averages. Compare load numbers against your available CPU core count.

Calculates human-readable disk sizes per directory, sorted in descending order to identify oversized log files and core dumps.

Determines whether the host boots into headless server mode (multi-user.target) or graphical desktop mode (graphical.target).

Filters the global system unit table to show only background daemons currently loaded and actively executing.

Inspects teachcloud.service. Notice the security posture: executes under unprivileged appuser with Restart=always and RestartSec=5s.

Forces PID 1 to rescan unit files on disk after creating or modifying any .service file.

Displays whether the service is active, boot-enabled, memory footprint, main PID, and child worker forks in its dedicated slice.

Gracefully cycles all worker processes to load updated application source code, verifying exit code 0.

Creates a symlink inside /etc/systemd/system/multi-user.target.wants/ to launch the daemon automatically upon host reboot.

Streams the last 10 log messages for the teachcloud unit without opening an interactive terminal pager.

Filters journal records strictly for priority 3 (err) or higher generated since the current system boot (-b).

Lists all scheduled automated jobs registered under the current user account (ubuntu).

Registers a nightly backup script at 0 2 * * * (02:00 AM) redirecting both stdout and stderr (2>&1) into /var/log/backup.log.

Lists all physical and virtual network adapters (e.g. eth0, lo), MAC addresses, MTU, and IPv4/IPv6 CIDR allocations.

Reveals where egress packets are directed by default (default via <gateway_ip>) and interface subnets.

Displays listening sockets (-l), TCP (-t), UDP (-u), numeric ports (-n), and owner PID/process (-p).

Performs an HTTP HEAD request with verbose TLS handshake negotiation, cipher auditing, and HTTP status verification.

Probes open ports without transmitting application payload using zero-I/O mode (-z) and verbose output (-v).

Generates a high-security Edwards-curve Digital Signature (Ed25519) keypair with comments identifying the engineer.

Appends the public key into authorized_keys and strictly locks filesystem permissions to 600 (owner read/write only).

Verifies that PasswordAuthentication and PermitRootLogin are strictly disabled in /etc/ssh/sshd_config.

Drops all unrequested incoming connection attempts while permitting the server to establish outbound network requests.

Explicitly opens TCP port 22 (SSH administrative bastion), port 80 (HTTP redirect), and port 443 (HTTPS TLS).

Activates the firewall engine and outputs the comprehensive rule evaluation matrix.

Fetches the latest package version metadata from Ubuntu repositories and checks for pending security patches.

Audits /etc/apt/apt.conf.d/20auto-upgrades to ensure automatic downloading and unattended installation of security fixes.

Verifies active Linux kernel release, compilation timestamp, SMP thread scheduling mode, and x86_64 CPU architecture.

Audits whether the kernel runs directly on physical bare-metal hardware or atop a cloud hypervisor (KVM/QEMU).

Queries physical CPU architecture, core counts, thread topology, and byte endianness from the /proc virtual filesystem.