LinuxHandbook — The Authoritative Linux Reference & Systems Playbook

An authoritative, upstream-verified reference library and operational systems playbook covering 53 essential Linux binaries.

Every guide provides exhaustive option matrices, verified real-world terminal workflows, exit code specifications, security boundaries, and upstream-cited best practices compliant with IEEE Std 1003.1-2024 (POSIX.1-2024) and modern Linux distributions.

Quick Navigation

• ⚡ Operational Playbooks • 📦 Upstream Command Catalog • 🛡️ Execution Safety Tiers • 📐 Quality Standards & Verification

---

⚡ Operational Playbooks

These incident response and systems administration playbooks organize utilities by practical operational scenario rather than upstream package origin.

Playbook 1: System Triage & Incident Response

Scenario: Diagnosing CPU/memory resource exhaustion, identifying rogue tasks, inspecting daemon health, and analyzing systemd service failures.

Command	Role & Operational Focus	Quick-Reference Invocations
top	Interactive dynamic resource monitoring, CPU/Memory per-task triage	`top -b -n 1
ps	Exact process snapshots, thread hierarchy, PID tree parentage	`ps -eo pid,ppid,user,%cpu,%mem,cmd --sort=-%cpu
free	Physical RAM, swap usage, available memory breakdown	free -h --wide
vmstat	Virtual memory paging, context switches, disk I/O pacing	vmstat 1 5
uptime	System elapsed runtime and 1/5/15-minute load averages	uptime
pgrep	Fast process search by name, UID, or full command line	pgrep -a -u www-data nginx
pkill	Coordinated signal dispatch to matched process groups	pkill -TERM -f worker
w	Active login sessions, idle times, and user task attribution	w -u
journalctl	Live & boot error logs, service diagnostic queries	journalctl -u <service> -p err -b
systemctl	Daemon lifecycle, service status inspection, failed units	systemctl --failed

Playbook 2: Storage, Partitions & Filesystem Auditing

Scenario: Storage hardware discovery, fstab syntax validation before reboot, partition alignment, and filesystem mounting.

Command	Role & Operational Focus	Quick-Reference Invocations
lsblk	Block device hierarchy, SSD TRIM discovery, partition trees	lsblk -f -o NAME,SIZE,FSTYPE,MOUNTPOINTS,UUID
blkid	Low-level UUID and filesystem token extraction for fstab	blkid -s UUID -o value /dev/sdX
findmnt	Active VFS mount tree, fstab syntax verification prior to reboot	findmnt --verify
mount	VFS filesystem attachment, read-only remounts, bind mounts	mount -o remount,ro /data
umount	Safe filesystem detachment, lazy and force unmounting	umount -l /mnt
fdisk	Sector-aligned GPT/MBR partition table creation and manipulation	fdisk -l /dev/nvme0n1

Playbook 3: Network Diagnostics & Traffic Control

Scenario: Layer 2/3 network configuration, open socket auditing, bufferbloat mitigation, and bridge VLAN isolation.

Command	Role & Operational Focus	Quick-Reference Invocations
ip	Interface state, CIDR addressing, routing tables, network namespaces	ip -br addr show
ss	High-performance Netlink socket statistics, port audits, state filters	ss -tulpn
tc	Kernel traffic shaping, bufferbloat mitigation (FQ-CoDel), WAN latency simulation	tc qdisc replace dev eth0 root fq_codel
bridge	Ethernet bridge links, Forwarding Database (FDB), 802.1Q VLAN filtering	bridge vlan show

Playbook 4: Remote Access & Cryptographic Identity

Scenario: Hardened remote terminal administration, modern key generation, agent caching, and encrypted file transfers.

Command	Role & Operational Focus	Quick-Reference Invocations
ssh	Encrypted interactive remote shell, bastion ProxyJump, port forwarding	ssh -J jump.host user@target
ssh-keygen	Modern Ed25519 keypair generation and fingerprint auditing	ssh-keygen -t ed25519 -C "admin"
ssh-agent	Background authentication agent daemon lifecycle management	eval "$(ssh-agent -s)"
ssh-add	Private key registration and time-limited agent caching	ssh-add -t 1h ~/.ssh/id_ed25519
ssh-keyscan	Automated remote host key gathering for known_hosts	ssh-keyscan -H -t ed25519 host >> ~/.ssh/known_hosts
scp	SFTP-backed secure remote file copying	scp -P 2222 file.tar.gz remote:/tmp/
sftp	Interactive secure file transfer protocol client	sftp user@remote

Playbook 5: Data Pipelines, Stream Filtering & Log Slicing

Scenario: Parsing multi-gigabyte log streams, transforming structured data, regex filtering, and parallel command execution.

Command	Role & Operational Focus	Quick-Reference Invocations
grep	High-speed regular expression pattern matching, PCRE searching	grep -P '(?<=error: )\w+' app.log
sed	Non-interactive stream editing, safe in-place file replacement	sed -i.bak 's/old/new/g' config.ini
awk	Pattern-directed scanning, column arithmetic, structured report generation	awk '{sum += $5} END {print sum}' data.tsv
cut	Field and byte slicing by delimiter or position	cut -d: -f1,7 /etc/passwd
sort	Stable multi-key sorting, numeric collation, human-readable sizes	sort -hr -k5 disk_usage.txt
uniq	Adjacent line deduplication and frequency counting	`sort access.log
tr	Character translation, case conversion, squeezing repeated characters	tr -s ' ' '\t'
find	Filesystem traversal with predicate filtering and null-delimited output	find /var/log -type f -mtime +30 -print0
xargs	Null-delimited batch argument execution, parallel worker execution	`find ... -print0
cat	Sequential file streaming, line numbering, non-printing characters	cat -n script.sh
head	Leading record and byte extraction	head -n 20 data.csv
tail	Descriptor-based live log following (-F), trailing record extraction	tail -F -n 50 /var/log/syslog
locate	Rapid database index file search	locate -i "*.conf"

Playbook 6: Transfer, Archiving & Compression

Scenario: REST API interactions, delta-transfer synchronization, incremental backups, and high-ratio multi-threaded compression.

Command	Role & Operational Focus	Quick-Reference Invocations
curl	REST API interaction, data transfers, TLS validation, latency benchmarks	curl -sSfL -w "%{time_total}\n" https://api.example.com
rsync	Delta-transfer sync, archive mode, snapshot hardlinks (--link-dest)	rsync -avzP --delete /src/ remote:/dest/
tar	Tape archive creation, compression filter chaining, incremental backups	tar -caf backup.tar.xz -C /dir .
gzip	DEFLATE stream compression with file retention (-k), integrity testing	gzip -kv -9 database.dump
xz	Multi-threaded LZMA2 high-ratio compression (-T0), memory limit constraints	xz -k -T0 -9e release.tar

---

🛡️ Execution Safety Tiers

To prevent operational accidents on production infrastructure, every command is classified by its execution safety tier in the upstream inventory:

Safety Tier	Operational Impact	Privilege Scope	Example Utilities
Safe (Read-Only)	Strictly non-destructive; performs queries without altering system state.	Unprivileged User	ps, top, free, findmnt, lsblk, ss, journalctl, locate
Unprivileged Write	Alters files or streams in user-space without system-wide side effects.	Unprivileged User	cat, sed, awk, curl, rsync, tar, gzip, xz
Privileged Network	Alters kernel networking tables, socket filters, or Layer 2 bridging.	CAP_NET_ADMIN / Root	ip, tc, bridge
Privileged Destructive	Modifies disk partitions, filesystems, or system runlevel states.	CAP_SYS_ADMIN / Root	fdisk, mount, umount, systemctl

---

📦 Upstream Command Catalog

The master reference matrix lists all 53 utilities grouped by official upstream suite, displaying researched target versions, POSIX compliance, safety tiers, and verified article links.

OpenSSH Utilities

Command	Article	Upstream Version	POSIX.1-2024	Safety Tier	Status
scp	scp	OpenSSH 10.5	No	Unprivileged Write	Available
sftp	sftp	OpenSSH 10.5	No	Unprivileged Write	Available
ssh	ssh	OpenSSH 10.5	No	Safe (Read-Only)	Available
ssh-add	ssh-add	OpenSSH 10.5	No	Safe (Read-Only)	Available
ssh-agent	ssh-agent	OpenSSH 10.5	No	Safe (Read-Only)	Available
ssh-keygen	ssh-keygen	OpenSSH 10.5	No	Unprivileged Write	Available
ssh-keyscan	ssh-keyscan	OpenSSH 10.5	No	Safe (Read-Only)	Available

GNU Coreutils

Command	Article	Upstream Version	POSIX.1-2024	Safety Tier	Status
cat	cat	GNU Coreutils 9.11	Yes	Safe (Read-Only)	Available
cp	cp	GNU Coreutils 9.11	Yes	Unprivileged Write	Available
cut	cut	GNU Coreutils 9.11	Yes	Safe (Read-Only)	Available
head	head	GNU Coreutils 9.11	Yes	Safe (Read-Only)	Available
ln	ln	GNU Coreutils 9.11	Yes	Unprivileged Write	Available
ls	ls	GNU Coreutils 9.11	Yes	Safe (Read-Only)	Available
mkdir	mkdir	GNU Coreutils 9.11	Yes	Unprivileged Write	Available
mv	mv	GNU Coreutils 9.11	Yes	Unprivileged Write	Available
rm	rm	GNU Coreutils 9.11	Yes	Privileged Destructive	Available
rmdir	rmdir	GNU Coreutils 9.11	Yes	Unprivileged Write	Available
sort	sort	GNU Coreutils 9.11	Yes	Safe (Read-Only)	Available
tail	tail	GNU Coreutils 9.11	Yes	Safe (Read-Only)	Available
touch	touch	GNU Coreutils 9.11	Yes	Unprivileged Write	Available
tr	tr	GNU Coreutils 9.11	Yes	Safe (Read-Only)	Available
uniq	uniq	GNU Coreutils 9.11	Yes	Safe (Read-Only)	Available

GNU Findutils

Command	Article	Upstream Version	POSIX.1-2024	Safety Tier	Status
find	find	GNU Findutils 4.10	Yes	Safe (Read-Only)	Available
locate	locate	GNU Findutils 4.10	No	Safe (Read-Only)	Available
xargs	xargs	GNU Findutils 4.10	Yes	Unprivileged Write	Available

GNU Grep

Command	Article	Upstream Version	POSIX.1-2024	Safety Tier	Status
grep	grep	GNU Grep 3.11	Yes	Safe (Read-Only)	Available

GNU Sed

Command	Article	Upstream Version	POSIX.1-2024	Safety Tier	Status
sed	sed	GNU Sed 4.9	Yes	Unprivileged Write	Available

GNU GAWK

Command	Article	Upstream Version	POSIX.1-2024	Safety Tier	Status
awk	awk	GNU GAWK 5.3.0	Yes	Safe (Read-Only)	Available

procps-ng (Process & System Inspection)

Command	Article	Upstream Version	POSIX.1-2024	Safety Tier	Status
free	free	procps-ng 4.0.4	No	Safe (Read-Only)	Available
pgrep	pgrep	procps-ng 4.0.4	No	Safe (Read-Only)	Available
pkill	pkill	procps-ng 4.0.4	No	Privileged Destructive	Available
ps	ps	procps-ng 4.0.4	Yes	Safe (Read-Only)	Available
top	top	procps-ng 4.0.4	No	Safe (Read-Only)	Available
uptime	uptime	procps-ng 4.0.4	No	Safe (Read-Only)	Available
vmstat	vmstat	procps-ng 4.0.4	No	Safe (Read-Only)	Available
w	w	procps-ng 4.0.4	No	Safe (Read-Only)	Available

util-linux (Storage & Core System Administration)

Command	Article	Upstream Version	POSIX.1-2024	Safety Tier	Status
blkid	blkid	util-linux 2.40	No	Safe (Read-Only)	Available
fdisk	fdisk	util-linux 2.40	No	Privileged Destructive	Available
findmnt	findmnt	util-linux 2.40	No	Safe (Read-Only)	Available
kill	kill	2.40	Yes	Privileged Destructive	Available
lsblk	lsblk	util-linux 2.40	No	Safe (Read-Only)	Available
mount	mount	util-linux 2.40	No	Privileged Destructive	Available
su	su	2.40	No	Privileged Destructive	Available
umount	umount	util-linux 2.40	No	Privileged Destructive	Available

iproute2 (Linux Networking Suite)

Command	Article	Upstream Version	POSIX.1-2024	Safety Tier	Status
bridge	bridge	iproute2 6.13	No	Privileged Network	Available
ip	ip	iproute2 6.13	No	Privileged Network	Available
ss	ss	iproute2 6.13	No	Safe (Read-Only)	Available
tc	tc	iproute2 6.13	No	Privileged Network	Available

systemd (Services & System Journal)

Command	Article	Upstream Version	POSIX.1-2024	Safety Tier	Status
journalctl	journalctl	systemd 256	No	Safe (Read-Only)	Available
systemctl	systemctl	systemd 256	No	Privileged Destructive	Available

curl (Network Transfer)

Command	Article	Upstream Version	POSIX.1-2024	Safety Tier	Status
curl	curl	curl 8.12.0	No	Unprivileged Write	Available

rsync (Remote Sync)

Command	Article	Upstream Version	POSIX.1-2024	Safety Tier	Status
rsync	rsync	rsync 3.5.0	No	Unprivileged Write	Available

GNU tar (Archiving)

Command	Article	Upstream Version	POSIX.1-2024	Safety Tier	Status
tar	tar	GNU tar 1.35	No	Unprivileged Write	Available

GNU gzip (Compression)

Command	Article	Upstream Version	POSIX.1-2024	Safety Tier	Status
gzip	gzip	GNU gzip 1.13	No	Unprivileged Write	Available

XZ Utils (Compression)

Command	Article	Upstream Version	POSIX.1-2024	Safety Tier	Status
xz	xz	XZ Utils 5.6.2	No	Unprivileged Write	Available

---

📐 Project Standards & Verification

This repository enforces rigorous architectural and quality contracts through automated CI-ready test scripts:

1. Article Quality Specification: Defined in docs/article-contract.md, requiring 9 mandatory top-level headings, ISO front matter, verified code fences, and zero hallucinated options.
2. Upstream Inventory Schema: Defined in schemas/upstream-inventory.schema.json, enforcing strict metadata contracts across all suite manifests.
3. Automated Verification Suite:

   # Validate all 53 articles against the 20-point contract
   python scripts/validate_articles.py --all
   
   # Validate all upstream inventory files against schema
   python scripts/validate_inventory.py
   
   # Regenerate this README deterministically
   python scripts/generate_readme.py

Catalog Summary: 55/64 articles available and verified.