Terminal Safety Basics

Why Safety Matters

The shell is powerful because commands can rename, overwrite, delete, and move many files quickly. The same power can cause fast data loss when paths or variables are wrong.

Inspect Before Changing

Before running a command that modifies files, inspect the target.

pwd
ls
ls "./target-directory"

For deletion, list the files first:

ls "./old-logs"
rm "./old-logs/app.log"

Quote Paths and Variables

Always quote variables unless you intentionally want word splitting or glob expansion.

path="./Reports May/app.log"
ls "$path"

Without quotes, Bash treats spaces as separators.

Avoid Dangerous Patterns

Pattern	Risk	Safer Approach
rm -rf $dir	Empty variable can target wrong path	Use rm -rf -- "$dir" after validation
chmod -R 777 .	Overly broad permissions	Change only required files
sudo command blindly	Elevated accidental damage	Run without sudo first when possible
Piping internet scripts to shell	Executes unknown code	Download, read, then run

Use -- Before Paths

Some filenames begin with -, which commands may treat as options.

rm -- "-strange-file"
mv -- "$source" "$destination"

Dry Run Pattern

For loops, print before executing:

for file in *.log; do
  printf 'Would compress: %s\n' "$file"
done

Then replace the printf with the real command once the output is correct.

Quick Practice

Create a safe sandbox:

mkdir -p bash-practice
cd bash-practice
touch "report may.txt" "-odd-name"
ls
rm -- "-odd-name"

What's Next

• Commands, Arguments, and Exit Status

Server Environment Context

This lesson matters in server operations because Terminal Safety Basics supports server shell orientation, safe terminal habits, and understanding when Bash is the right operational tool. On a workstation, a mistake may affect one project. On a server, the same mistake can interrupt users, hide evidence, weaken access control, or make recovery harder.

Use the commands in this lesson with three questions in mind:

• What system state am I about to inspect or change?
• What evidence should I capture before changing it?
• How will I prove the server is healthier after the command runs?

Operational Runbook Pattern

Use this repeatable pattern when applying the lesson on a real host:

Phase	Goal	Bash Habit
Identify	Confirm host, user, and scope	hostname, id, pwd
Inspect	Read state before modifying it	systemctl status, ls -la, ss -tulpn
Change	Make the smallest safe change	Quote paths and prefer explicit options
Verify	Confirm the intended result	Check exit status, logs, and service health
Record	Leave a useful audit trail	Save command output or ticket notes

Example session header:

printf 'time=%s host=%s user=%s cwd=%s
'   "$(date -Is)" "$(hostname)" "$(id -un)" "$(pwd)"

Pre-Flight Checklist

Before running commands from this lesson on a production server, check:

• You are connected to the intended host.
• You know whether the command is read-only or state-changing.
• You have a rollback or recovery path for state-changing work.
• You understand whether sudo is required and why.
• You have captured current service, disk, or network state if the work is risky.

Useful pre-flight commands:

hostnamectl 2>/dev/null || hostname
id
uptime
systemctl --failed 2>/dev/null || true

Production Safety Notes

Risk	Safer Practice
Running on the wrong host	Print hostname and environment name first
Accidentally expanding paths	Quote variables: "$path"
Losing evidence	Copy logs or capture journalctl output before cleanup
Silent failure	Use set -euo pipefail in scripts and check exit codes interactively
Over-broad sudo usage	Run the smallest command possible with elevated permissions

When a command can delete, overwrite, restart, reload, or reconfigure something, do a dry run or read-only inspection first.

Validation Commands

After applying the technique from this lesson, validate with commands appropriate to the changed area:

printf 'exit_status=%s
' "$?"
systemctl --failed 2>/dev/null || true
journalctl -p warning -n 50 --no-pager 2>/dev/null || true
df -h
ss -tulpn 2>/dev/null || true

For application-facing changes, add an endpoint or process check:

curl -fsS http://127.0.0.1:8080/health >/dev/null || true
ps -eo pid,cmd,%cpu,%mem --sort=-%cpu | head

Automation Example

The following template shows how to turn this lesson into a repeatable server check. Adapt names and commands before using it.

#!/usr/bin/env bash
set -euo pipefail

log() {
  printf '%s INFO %s
' "$(date -Is)" "$*" >&2
}

die() {
  printf '%s ERROR %s
' "$(date -Is)" "$*" >&2
  exit 1
}

run_03_terminal_safety_basics_check() {
  log 'running Terminal Safety Basics validation'
  hostname >/dev/null
  uptime >/dev/null
}

run_03_terminal_safety_basics_check "$@"

Troubleshooting Flow

If the expected result does not appear, diagnose in this order:

1. Confirm the command ran on the correct host and shell.
2. Check whether the command failed with a non-zero exit status.
3. Re-run the read-only inspection command with more explicit paths or options.
4. Check recent logs for permission, path, DNS, disk, or service errors.
5. Undo only the specific change you made, not unrelated user or system changes.

Useful debug commands:

set -x
# repeat the smallest failing command here
set +x
printf 'PATH=%s
' "$PATH"
type command 2>/dev/null || true

Practice Lab

Use a non-production VM, container, or temporary directory for practice:

1. Capture a baseline using date -Is, hostname, uptime, and df -h.
2. Apply the main command pattern from Terminal Safety Basics to a safe test target.
3. Intentionally trigger one harmless failure, such as a missing file or inactive service.
4. Capture the error message and explain what Bash exit status it produced.
5. Convert the manual check into a small script with logging and validation.

Review Questions

• Which commands in Terminal Safety Basics are read-only, and which can change server state?
• What is the safest way to test the command before using it on production data?
• What log, service, or health check proves the operation succeeded?
• What rollback step would you use if the result is wrong?
• Which parts of the process should be automated, and which should remain manual?

Field Notes

Server work rewards boring, explicit commands. Prefer commands that can be pasted into a runbook, reviewed by another operator, and repeated during an incident without relying on memory.

Keep lesson examples as starting points, not blind copy-paste snippets. Adjust paths, service names, package names, ports, and users to match the actual server environment.