Command Line for IT: Bash and PowerShell

Glossary

149 terms from Command Line for IT: Bash and PowerShell, in plain words, each with the chapter that teaches it.

Search the glossary

#

$( ): In bash, $( ) runs the command inside it and puts that command's output in its place. For example, kb=$(df --output=avail / | tail -n 1) saves the free space on / in the variable kb.
$(( )): bash does arithmetic inside $(( )). It works only with whole numbers, so division rounds down: $(( kb / 1024 / 1024 )) turns KB into whole GB.
$1: Inside a bash script, $1 is the first argument (the first word after the script name), $2 is the second, $# is how many arguments there are, and $0 is the script's own name. check-disk.sh reads its GB limit from $1.
$?: A bash variable that holds the exit code of the last command. After a failed sha256sum -c, echo $? prints 1.
$@: Inside a bash script, "$@" stands for all the arguments, each kept as a separate word. After shift, check-disk.sh loops over "$@" to visit each folder.
$_: In PowerShell, $_ means the object being handled right now inside a { } block, as in Where-Object or ForEach-Object. $_.Length reads that object's Length property.
$Matches: After a successful -match, PowerShell puts the captured groups in $Matches. $Matches[1] is group 1, and a named group can be read by name, such as $Matches.ip.
&&: Joins two commands so that the second runs only if the first succeeds (exits with code 0). For example, nc -z order1 8080 && echo "3 port 8080 open".
-match: A PowerShell operator that tests a string against a regular expression and answers True or False. When it matches, it puts the groups in $Matches; it ignores case, while -cmatch pays attention to case.
-replace: A PowerShell operator that replaces whatever a regular expression matches. '2026-10-29T03:12:45' -replace 'T.*', '' leaves just the date, and '$1' in the replacement means group 1.
-split: A PowerShell operator that cuts a string into an array of pieces at a regex pattern, such as a space. For example, `($_.Line -split ' ')[-4]` picks the fourth word from the end of a log line, which is the address in a "Failed password" line.
/dev/null: A special Linux file that throws away anything written to it. 2>/dev/null hides error messages, such as find's Permission denied lines.
/etc/hosts: A Linux file that matches names to IP addresses before DNS is asked. Adding "10.77.0.20 order1" to it lets lab reach order1 by name.
2>&1: A redirection that means "send standard error (channel 2) to the same place as standard output (channel 1)". Put it after > file, as in cmd > all.txt 2>&1, so errors end up in the same file as the output.
>&2: Sends a command's output to standard error instead of standard output. check-disk.sh prints its usage message this way, so the message isn't mixed in with normal results.
[ ]: A bash command that only tests something (numbers with -lt or -gt, strings with =, files with -f or -d) and sets the exit code to 0 if the test is true. Keep a space inside each bracket, and quote variables.
||: Joins two commands so that the second runs only if the first fails. Alex's crontab uses check-disk.sh … || date >> disk-alerts.log.

A

absolute path: A path that starts at the root: / on Linux, or a drive such as C:\ on Windows. /home/ubuntu/kc/shipping is one, and Get-ChildItem calls it FullName.
adm: A Linux group whose members may read most logs in /var/log. The VM's ubuntu user is in it, and Alex's account on order1 is created with -G adm.
administrator: A Windows account with full rights over the machine. Commands such as Get-WinEvent on the Security log, Get-ScheduledTask or Restart-Service need PowerShell started with Run as administrator.
alias: A short second name for a command, such as `gci` or `dir` for `Get-ChildItem`; `Get-Alias` lists them. Aliases differ between systems: on Windows PowerShell `ls` is an alias for `Get-ChildItem`, but on Linux it runs the real Linux `ls`, so full cmdlet names are safer in scripts.
apt: The main package manager on Ubuntu and other Debian-based Linux systems, used to install, update and remove software, as in `sudo apt install NAME`. `winget` plays a similar role on Windows.
archive: One file that packs many files and folders, usually compressed. Alex packs the raw logs into week44.zip for the vendor.
array: A numbered list of values in PowerShell. [0] is the first item and [-1] the last, so $parts[-4] is the fourth word from the end.
authorized_keys: The file on a server that lists the public keys allowed to log in to an account. For Alex on order1, it is /home/alex/.ssh/authorized_keys.
awk: A Linux tool that splits each line into fields at spaces: $1 is the first field, $NF the last, and $(NF-3) the fourth from the end, which is the address in a Failed password line. It can also filter, as in awk '$1 >= 100'.

B

bash: The usual shell on Linux. Its commands pass plain text to each other through pipes.
brace expansion: bash turns a word like {raw,reports} into several words before the command runs. mkdir -p ~/kc/triage/{raw,reports} makes both folders at once.

C

calculated property: A new column that Select-Object works out for each object, written @{Name='KB'; Expression={ … }}. It can show file sizes in KB, or rename columns to time, user and ip for triage.ps1.
chmod +x: Marks a file as executable, so a script with a #!/bin/bash first line can be run as ./name.sh. Without it, ./check-disk.sh gives Permission denied.
cmdlet: A built-in PowerShell command ("command-let") named Verb-Noun, such as Get-Process.
Compress-Archive: A PowerShell cmdlet that packs files or folders into a zip file: Compress-Archive -Path DIR -DestinationPath out.zip.
cron: The Linux service that runs commands on a schedule. The CRON lines in auth.log come from it, and Alex uses it to get a failed-password count every weekday at 6 a.m.
crontab: A user's table of cron jobs: five time fields (minute, hour, day of month, month, day of week) and a command on each line. crontab -l lists it, crontab -e edits it, and crontab - replaces the whole table with what comes in through a pipe.
CSV: CSV (comma-separated values) is a plain-text table: a header line, then one row per line, with values separated by commas. Spreadsheets open it directly, which is why Alex sends Jo big-logs.csv.
curl: A command that fetches a web page or file from a URL: -I asks only for the headers, -O saves the file under its own name, and -s keeps it quiet. In Windows PowerShell 5.1, curl is an alias, so type curl.exe there.
cut: Picks parts of each line by fixed position. cut -c 1-10 keeps the first 10 characters, which is the date in an auth.log line.

D

dig: Asks a DNS server for a name's address. dig @order1 shop.kettleandcrane.com +short asks order1's DNS server and prints just the answer.
DNS: DNS (Domain Name System) is the system that turns names like order1.kettleandcrane.com into IP addresses. In the lab, Sam's laptop couldn't load the order page because it used the wrong DNS server.

E

Enter-PSSession: Opens an interactive PowerShell session on another machine. With -HostName order1 it goes over SSH, and the prompt becomes [order1]: PS>.
event ID: The number that says what kind of Windows event something is. Key Security log IDs: 4624 successful logon, 4625 failed logon, 4634 logoff, 4672 logon with admin rights, 4720 account created, 4740 account locked out, 1102 Security log cleared.
Event Log: Windows' store of logs, kept in binary .evtx files and split into Security, System and Application. You read it with Event Viewer or Get-WinEvent.
exit code: The number a command or script leaves when it ends: 0 means success, anything else means failure. check-disk.sh exits with 0 (all fine), 1 (a warning) or 2 (used wrongly).

F

fingerprint: A short hash of a server's SSH key. ssh shows it the first time you connect, so you can compare it with what the server itself reports before you type yes.
for: A bash loop, written for NAME in LIST; do …; done, that runs once per item. check-disk.sh uses it to check each folder in "$@".
foreach: PowerShell's loop, written foreach ($d in $drives) { }, that runs the block once for each item in a list.
ForEach-Object: A PowerShell cmdlet that runs a block once for each object in a pipeline, with $_ as the current object, and passes on whatever the block outputs.
Format-List: Prints each property of an object on its own line, which suits long values such as a SHA-256 hash. Put it last in a pipeline.

G

Get-ChildItem: The PowerShell cmdlet that lists what's in a folder as objects, like ls. -Force adds hidden files, -Filter picks names with a wildcard, -Recurse looks in every folder below, and -File keeps only files.
Get-Command: Finds cmdlets, for example by -Noun or -Verb. Get-Command NAME -Syntax lists every way to call one, even when the help pages aren't downloaded.
Get-Content: The PowerShell cmdlet that reads a file line by line, each line a string. -TotalCount N works like head, -Tail N like tail, and -Wait keeps watching like tail -f.
Get-Date: The PowerShell cmdlet that gives the current date and time. -Format yyyy-MM-dd prints it as year-month-day, and (Get-Date).AddDays(-1) is this time yesterday.
Get-FileHash: A PowerShell cmdlet that calculates a file's SHA-256 hash, printed in capital letters. -Algorithm MD5 or SHA1 gives the older kinds.
Get-Help: Explains a cmdlet, and -Examples shows examples of using it. Run Update-Help first to download the full help pages.
Get-Member: Lists an object's properties and other members. Get-Process pwsh | Get-Member -MemberType Property shows what you can ask a process object for.
Get-Process: Lists running processes as objects. WorkingSet64 is the memory each one uses, in bytes, so sorting on it shows the biggest.
Get-ScheduledTask: A Windows cmdlet, run as administrator, that lists the tasks in Task Scheduler.
Get-Service: A Windows-only cmdlet that lists services with their Status and StartType, for example to find what starts automatically at boot.
Get-WinEvent: A Windows-only cmdlet that reads the Event Log; the Security log needs administrator rights. It returns events with TimeCreated, Id and Message, newest first.
grep: Prints the lines of a file that match a pattern. Its options count matches (-c), invert the match (-v), number the lines (-n), stop after N matches (-m), add lines before or after each match (-B, -A), match whole words (-w) or whole lines (-x), or stay quiet and just set the exit code (-q).
grep -E: Makes grep use extended regular expressions, so (, |, + and { } do their special jobs. Plain grep would look for them as ordinary characters.
grep -o: Prints only the part of each line that matched, not the whole line. With an IPv4 pattern, it pulls every address out of auth.log.
group: In a regex, round brackets make a group that captures what it matched. sed refers to the groups as \1, \2… in its replacement, and PowerShell puts them in $Matches.
Group-Object: A PowerShell cmdlet that counts equal values, like sort | uniq -c. -NoElement keeps just the Count and Name columns.

H

hash: A fixed-length fingerprint of every byte of a file. Change even one byte and the hash is completely different, which is how Alex proves the logs sent to the vendor are unchanged.
hashtable: A set of name = value pairs written @{ }, such as @{ LogName = 'Security'; Id = 4625 } for -FilterHashtable. Export-Logons.ps1 also uses an empty one, @{}, to collect event fields.
head: Prints the first lines of a file or pipe. head -n 2 auth.log shows the two oldest lines.

I

if: In bash, if runs a block when a command (usually a [ ] test) succeeds; elif adds another test, else covers the rest, and fi ends it. PowerShell writes if () { } else { }.
Import-Csv: Reads a CSV file back as objects, with the headers as property names. All values come back as strings, so convert numbers with [int] before sorting them.
Invoke-Command: Runs a script block on another machine; with -HostName it goes over SSH. The results come back as objects stamped with PSComputerName.
Invoke-RestMethod: Fetches a web page and turns JSON into an object, so you can read fields by name, such as $s.status from order1's status.json.
Invoke-WebRequest: Fetches a web page and returns an object with StatusCode, Headers and Content. In Windows PowerShell 5.1, curl is an alias for it.
ip: The Linux command for network settings. ip -br addr lists addresses, one line each, and ip route shows the routing table, including the default route.
IPv4 address: A network address written as four numbers with dots, such as 203.0.113.45. The regex ([0-9]{1,3}\.){3}[0-9]{1,3} matches one, loosely.

J

journalctl: Reads the systemd journal, with options that combine: -u picks a service, -t a program tag, --since and --until set a time window, -n the last N messages, -f keeps following, and -o short-iso prints full dates.
JSON: JSON (JavaScript Object Notation) is a text format for named values, such as {"service": "orders", "status": "ok"} on order1's status page.

K

key pair: A matching private key and public key, used to log in with SSH instead of a password. The server checks that you hold the private key without it ever crossing the network.

L

less: Pages through a file. G jumps to the end, /word searches, n goes to the next match, -S stops long lines from wrapping, and q quits.
log: A text file that a program adds a line to whenever something happens. Each line in auth.log has a time, a host, a program with its process ID, and a message.
logon type: A number in Windows logon events that says how the logon happened: 2 at the keyboard, 3 over the network, 10 Remote Desktop. Failed Remote Desktop attempts usually show type 3.
logrotate: A Linux tool that rotates logs weekly so they don't grow forever: syslog becomes syslog.1, older copies are compressed to .gz, and after 4 weeks the oldest is deleted.

M

Multipass: A free tool that makes Ubuntu virtual machines. multipass launch creates one, multipass shell opens it, and multipass transfer copies files into it.

N

nc: nc (netcat) is a network tool; with -z it only checks whether a TCP connection to a port opens. -v also reports failures, such as Connection refused.

O

objects: Bundles of named values that PowerShell passes through pipes, such as a file's name, size and date. Because of them, cmdlets use properties by name instead of positions in a line of text.

P

passphrase: A password that protects a private key file, so a stolen copy is useless. ssh-agent lets Alex type it just once per session.
ping: Sends echo requests to see if a machine answers. -c 3 sends three, and -q prints only the summary.
pipeline: Commands joined with |, so each one's output becomes the next one's input: lines of text in bash, objects in PowerShell. A line ending in | continues on the next.
port: A numbered door on a machine that a service listens on: 22 for SSH, 3389 for Remote Desktop, 8080 for order1's web page. A machine can answer ping while its service's port is closed.
PowerShell: Microsoft's shell, whose commands pass objects. PowerShell 7 (the program pwsh) is a free download that runs on Windows, Linux and macOS.
private key: The half of a key pair that never leaves your machine, such as ~/.ssh/id_ed25519. A passphrase protects it.
property: A named value inside a PowerShell object, such as a file's Length or LastWriteTime. (Get-Item auth.log).Length reads one.
ps: Lists processes. -eo picks the columns, and --sort=-%mem sorts by memory, biggest first.
public key: The half of a key pair that you copy to servers, into ~/.ssh/authorized_keys. It is safe to share.

R

redirection: Sends a command's output to a file instead of the screen: > replaces the file, >> adds to it, and 2> sends errors there. bash reads redirections left to right.
regular expression (regex): A pattern that describes many texts at once, such as "any IP address" or "the word after for". It is built from pieces like . (any character), [0-9] (a class), + (repeat), ^ and $ (anchors) and (a|b) (a choice and group).
relative path: A path that starts where you are now, such as shipping/label-1041.pdf. . means here and .. the folder above.
Remote Desktop: Windows' way to use a PC's screen from another machine, on port 3389; it is logon type 10. Someone at 192.0.2.150 was guessing Remote Desktop passwords on KC-FS1.
Remove-Item: The PowerShell cmdlet that deletes files and folders, like rm. Add -Recurse for full folders, and preview first with -WhatIf, because there's no recycle bin.
root: The Linux superuser account, which may do anything; some files, such as /var/log/btmp, can be read only by root. sudo runs one command as root.
rsyslog: The Linux service that copies system messages into text files in /var/log, such as auth.log and syslog. It can also forward them to a central server.

S

scp: Copies files over SSH, like cp, with remote places written HOST:PATH. scp check-disk.sh order1: copies the script to Alex's home folder on order1.
script: A text file of commands that a shell runs in order: a .sh file for bash (bash name.sh) or a .ps1 file for PowerShell (pwsh name.ps1). Scripts can take arguments, make decisions and set an exit code.
sed: The stream editor, which changes text as it passes through a pipe: s/PATTERN/REPLACEMENT/ substitutes matches, -E uses extended regex, and \1, \2 bring back captured groups. Alex uses it to turn log lines into CSV rows.
Select-Object: Picks properties (columns) or a number of objects: -First 3 keeps three and -Skip 3999 skips that many. It can also add calculated properties.
Select-String: PowerShell's grep: it finds matching lines in files, and each match has properties such as LineNumber and Line. -NotMatch works like grep -v, and -Context 2,0 like grep -B 2.
service: A program that runs in the background without anyone logged in, such as cron or sshd. "Enabled" means it starts at boot.
SHA-256: The everyday hash method, which gives 64 hex digits. sha256sum and Get-FileHash both use it.
SHA256SUMS: A checksum file with a hash, two spaces and a file name on each line. Makers publish one, and Alex puts one inside the vendor's zip so the vendor can check the logs.
shebang: The first line of a script, #!/bin/bash, which says which program runs it. It lets you run the script as ./name.sh after chmod +x.
shell: The program inside a terminal that reads each command you type, runs it and prints the result. Common examples are bash, the usual Linux shell, and PowerShell, Microsoft's shell for Windows, Linux and macOS.
SIEM: SIEM (Security Information and Event Management) is a kind of system that collects logs from many machines in one place and analyzes them to spot and alert on security problems, such as repeated failed logons from one address.
sort: Sorts lines: -n sorts as numbers, -r reverses the order, and -u keeps one copy of each value. So sort -u | wc -l counts distinct values.
Sort-Object: Sorts objects by a property, such as Length. -Descending puts the biggest first, and -Unique keeps one copy of each value.
ss: Shows network sockets. ss -tlnp lists listening TCP ports as numbers, and with sudo it also shows the program behind each one.
SSH: SSH (Secure Shell) gives you a shell on another machine over an encrypted connection to port 22. ssh USER@HOST COMMAND runs one command there, and without a command you get a shell.
ssh-agent: A program that keeps unlocked keys in memory, so you type the passphrase once per session. eval "$(ssh-agent)" starts it.
ssh-keygen: Makes SSH key pairs, as in ssh-keygen -t ed25519. -lf shows a key's fingerprint, and -R removes a server's old key from known_hosts.
sshd: The SSH server program; sshd-session is the part that handles one login and writes the Failed password lines in auth.log. Ubuntu can start it on demand through ssh.socket.
standard error: Channel 2, where commands write error messages, separate from normal output. 2> redirects it, and >&2 writes to it.
standard output: Channel 1, where commands write their normal results. Standard input, where they read from, is channel 0.
Stop-Process: Stops a process by -Name or -Id, like kill. Start-Process starts one, for example a sleep to practice on.
sudo: A Linux command that runs one other command as root, the all-powerful administrator account, as in `sudo snap install powershell --classic`. It is needed for tasks like installing software, reading root-only log files and changing system files.
syslog: The protocol for sending log lines to another machine. It is also the name of the Ubuntu file /var/log/syslog, which holds almost every message that isn't about logins.
systemctl: Controls Linux services: status shows their health, is-active and is-enabled answer with one word, restart restarts a service, and enable makes it start at boot.
systemd journal: systemd's store of log messages from the kernel, services and programs, read with journalctl.
systemd timer: systemd's way to run jobs on a schedule, alongside cron. systemctl list-timers shows them; they are easy to forget, so check them too.

T

tail: Prints the last lines of a file: tail -n +N starts at line N instead, and tail -f keeps printing new lines as they arrive. tail -F keeps following when a log is rotated.
tar: Linux's archive tool, often used with gzip to make .tgz files. -czf creates an archive, -tvzf lists it with details, and -xzf unpacks it (-C picks the folder).
Task Scheduler: Windows' tool for running tasks on a schedule. On KC-FS1, a scheduled task runs Export-Logons.ps1 and triage.ps1 every Monday at 6:45.
TCP: TCP (Transmission Control Protocol) is the connection-based protocol that services like SSH and web servers listen on. nc -z and Test-Connection -TcpPort check whether a TCP connection opens.
tee: Shows output on the screen and saves a copy to a file, named after a T-shaped pipe fitting. With sudo and -a, it adds a line to a file that only root may change.
terminal: The window that shows text and sends your keystrokes to the shell.
Test-Connection: PowerShell's ping, which also works on Linux and returns one object per reply. -TcpPort answers True or False for a port, -Traceroute lists the hops, and -Quiet answers just True or False.
Test-NetConnection: A Windows cmdlet that tests a connection, for example Test-NetConnection order1 -Port 8080.
Test-Path: Prints True or False for whether a file or folder exists. triage.ps1 uses it to check its -Path.
try/catch: In PowerShell, try { } catch { } runs the catch block when a command in try fails. Cmdlet errors only count if you add -ErrorAction Stop.

U

uniq: Joins repeated lines that sit next to each other, and uniq -c counts each group. So sort first, unless the input is already in order, as a time-ordered log is.
UTC: UTC (Coordinated Universal Time) is the world reference time. auth.log times end with the offset from it, such as -07:00 for Portland in October.

V

variable: A named value a shell keeps, read with $ in front, such as $kb in bash or $logons in PowerShell. bash sets one with name=value (no spaces), PowerShell with $name = value.
Verb-Noun: The naming pattern of cmdlets: an action, a dash and the thing it acts on, such as Get-Process or Stop-Process. The verbs come from a short list, so you can often guess a name.
VM: A VM (virtual machine) is a complete computer simulated by software inside a real one, with its own operating system, which you can create and throw away safely. For example, an Ubuntu practice lab can be made as a VM with Multipass using `multipass launch`.

W

wc: Counts the lines, words and characters in a file. wc -l counts lines, for example 8110 in auth.log.
Where-Object: Keeps the objects that pass a test, such as Where-Object Length -gt 10000, or a test in { } that uses $_.
while read: A bash loop that runs once per line of input: while read -r LINE; do …; done < FILE. triage.sh reads each login's address and user this way.
wildcard: A character that stands for others in a file name: * any run of characters, ? exactly one, [12] one of those listed. bash expands it before the command runs, and cmdlets accept it too.
Windows PowerShell 5.1: The older PowerShell that comes with Windows 10 and 11 (powershell.exe). It runs only on Windows, gets no new features, and blocks scripts by default.
WinRM: Windows' older remoting system, used by Invoke-Command -ComputerName between Windows machines in a domain. -HostName uses SSH instead.

Z

zgrep: Works like grep but also reads compressed .gz files, so zgrep kc-export /var/log/syslog* searches every rotated log.
zip: The archive format Windows users expect. zip -r packs a folder, unzip -l lists an archive's contents, and unzip -d unpacks into a folder.