Home / Learn Linux / Lesson 3

Terminal speed: Tab, shortcuts, history and sudo

Type less with Tab and shortcuts, reuse old commands, and run things as root safely.

Lesson

3 of 30

Time

About 40 minutes

On this page

1. Tab completion
2. Keyboard shortcuts
3. Command history
4. Keeping commands out of history
5. Timestamps in history
6. root and sudo
7. Common mistakes
8. Practice
9. Cheat sheet

Tab completion

Tab is the most useful key in the terminal. Type the start of a command, a file name or a folder, press Tab, and Bash finishes it for you.

• If there's only one match, Bash fills it in. Type ls /etc/hostn and press Tab, and it becomes ls /etc/hostname.
• If there are several matches, nothing happens on the first Tab. Press Tab again and Bash lists them all. Type ls /etc/ap and press Tab twice to see apparmor/ apparmor.d/ apport/ apt/. Type one or two more letters to pick one, then Tab again.
• It works for command names too. Type hostn and Tab to get hostname, or sys and Tab twice to see every command starting with sys.
• For many commands it also completes options and arguments. systemctl sta and Tab twice lists start, status and the rest.

Tab saves typing, but the real win is fewer mistakes. If Tab won't complete a path, the path is wrong, and you find out before you press Enter.

Try it

1. Type cat /etc/os-r, press Tab, then Enter.
2. Type ls /usr/share/doc/a and press Tab twice. How many folders start with a?
3. Type whoa and press Tab.

Keyboard shortcuts

These work in Bash and in most other places where you type a line of text in a terminal. Learn the first six this week and you'll never hold down the arrow key again.

On a Mac, Alt is the Option key, and you may need to turn on "Use Option as Meta key" in Terminal's settings (Profiles, then Keyboard) for Alt+B and Alt+F to work.

Careful with Ctrl+S: in many terminals it freezes the screen, and it looks like everything hung. Ctrl+Q unfreezes it.

Try it

1. Type echo one two three four, but don't press Enter. Jump to the start, then to the end, then delete just four with one key.
2. Now delete the whole line with one key, then paste it back.

Command history

Bash remembers what you type. The up arrow walks back through it, and history prints it with numbers. Here's a short session followed by history:

$ echo one
one
$ cd /etc
$ ls -d a*
adduser.conf  alternatives  apparmor  apparmor.d  apport  apt
$ cd
$ history
    1  echo one
    2  cd /etc
    3  ls -d a*
    4  cd
    5  history

Every command has a number. Use it, or use one of these shortcuts, to run something again without typing it:

Bash prints the expanded command first, so you can see what actually ran:

ubuntu@linux:~$ cd /etc
ubuntu@linux:/etc$ ls -d a*
adduser.conf  alternatives  apparmor  apparmor.d  apport  apt
ubuntu@linux:/etc$ !!
ls -d a*
adduser.conf  alternatives  apparmor  apparmor.d  apport  apt
ubuntu@linux:/etc$ echo !$
echo a*
adduser.conf alternatives apparmor apparmor.d apport apt
ubuntu@linux:/etc$ cd

sudo !! is the one you'll use most. You type a command, it fails because it needed root, and you fix it in five keystrokes:

$ apt update
Error: Could not open lock file /var/lib/apt/lists/lock - open (13: Permission denied)
Error: Unable to lock directory /var/lib/apt/lists/
Warning: Problem unlinking the file /var/cache/apt/pkgcache.bin - RemoveCaches (13: Permission denied)
Warning: Problem unlinking the file /var/cache/apt/srcpkgcache.bin - RemoveCaches (13: Permission denied)
$ sudo !!
sudo apt update
Hit:1 http://archive.ubuntu.com/ubuntu resolute InRelease
Hit:2 http://security.ubuntu.com/ubuntu resolute-security InRelease
Hit:3 http://archive.ubuntu.com/ubuntu resolute-updates InRelease
Hit:4 http://archive.ubuntu.com/ubuntu resolute-backports InRelease
9 packages can be upgraded. Run 'apt list --upgradable' to see them.

Search with Ctrl+R

Press Ctrl+R and start typing any part of an old command. Bash shows the most recent match:

(reverse-i-search)`upd': sudo apt update

Press Ctrl+R again to go further back, Enter to run it, the right arrow to edit it first, or Ctrl+G to give up. Once you're used to it, you'll find yourself searching for commands from last week instead of retyping them.

Where history lives

History is kept in memory while the shell runs and saved to ~/.bash_history when you exit. On Ubuntu it keeps 1,000 commands in memory and 2,000 in the file:

$ echo $HISTSIZE $HISTFILESIZE
1000 2000

Try it

1. Run date, then whoami, then run date again using only history.
2. Run ls /etc/apt, then list the same folder with ls -l without typing the path.
3. Find your apt update from lesson 1 with Ctrl+R.

Keeping commands out of history

Sometimes you type something that shouldn't be saved, like a password or an API key on the command line. Ubuntu's .bashrc sets this:

$ echo $HISTCONTROL
ignoreboth

ignoreboth means two things. Repeating the same command several times in a row is only saved once, and any command that starts with a space isn't saved at all:

$ echo visible
visible
$  echo "token=abc123"
token=abc123
$ history
    1  echo visible
    2  history

The command with the leading space ran, but it's not in the list. Ubuntu sets this by default, but other distros may not, so check echo $HISTCONTROL before trusting it.

If something slipped in anyway, delete it by its number. history -d removes one entry, and history -c clears everything in memory. Then history -w writes the cleaned list over ~/.bash_history:

$ echo one
one
$ echo "password=hunter2"
password=hunter2
$ echo three
three
$ history
    1  echo one
    2  echo "password=hunter2"
    3  echo three
    4  history
$ history -d 2
$ history -w
$ history
    1  echo one
    2  echo three
    3  history
    4  history -d 2
    5  history -w
    6  history

Try it

1. Run echo test with a space in front, then check that history doesn't show it.
2. Run echo oops, then remove it from history.

Timestamps in history

By default, history doesn't tell you when you ran something. Set HISTTIMEFORMAT and it will. %F %T means date and time:

$ export HISTTIMEFORMAT="%F %T  "
$ echo hello
hello
$ history
    1  2026-10-21 11:06:20  export HISTTIMEFORMAT="%F %T  "
    2  2026-10-21 11:06:20  echo hello
    3  2026-10-21 11:06:20  history

Bash quietly records the time of every command you type, so even commands from before you set it show the right time. Commands loaded from an older ~/.bash_history are different: no times were saved for them, so they all show the same one. To keep it on for good, add it to ~/.bashrc, the file Bash runs every time it starts:

$ echo 'export HISTTIMEFORMAT="%F %T  "' >> ~/.bashrc
$ source ~/.bashrc

>> adds a line to the end of a file (lesson 8 covers it), and source reloads the file in the shell you're in, so you don't have to log out and back in.

Try it

1. Turn on timestamps for good, then open a new shell (exit, then multipass shell linux) and check that history shows times.

$ tail -1 ~/.bashrc
export HISTTIMEFORMAT="%F %T  "

root and sudo

Every Linux system has one all-powerful user: root. Root can read any file, change any setting, delete anything and stop any program, with no questions asked. That's exactly why you shouldn't work as root all the time. One typo as root can wipe the system.

Normal users like ubuntu can't change the system:

$ cat /etc/shadow
cat: /etc/shadow: Permission denied

/etc/shadow holds the password hashes, so only root may read it. To run a single command as root, put sudo in front:

$ sudo head -3 /etc/shadow
root:*:20654:0:99999:7:::
daemon:*:20654:0:99999:7:::
bin:*:20654:0:99999:7:::
$ sudo whoami
root

How sudo decides

sudo doesn't ask for root's password. It asks for your password, then checks whether you're allowed. On Ubuntu, members of the sudo group may run anything:

$ groups
ubuntu adm cdrom sudo dip lxd
$ sudo -l
User ubuntu may run the following commands on linux:
    (ALL : ALL) ALL
    (ALL) NOPASSWD: ALL

The first line comes from the sudo group. The second, NOPASSWD, is a rule Multipass adds so the ubuntu user never needs a password. On WSL or a normal server, sudo asks for your password the first time, then remembers it for 15 minutes in that terminal. On Ubuntu 26.04 you'll see * for each key you press. Older versions show nothing while you type, which is normal and doesn't mean it froze.

Who may use sudo is set in /etc/sudoers and the files in /etc/sudoers.d/. Never edit them with a normal editor. Use sudo visudo, which checks the file before saving, because a typo in sudoers can lock you out of sudo completely.

A root shell: sudo -i

When you have many admin commands to run, sudo -i opens a shell as root. Watch the prompt change from $ to #:

ubuntu@linux:~$ sudo -i
root@linux:~# whoami
root
root@linux:~# pwd
/root
root@linux:~# exit
logout

Root's home folder is /root. Do what you need and exit straight away. A # prompt left open in a terminal is how accidents happen.

su, and why it doesn't work here

su (switch user) is the older way to become root. It asks for root's password, but Ubuntu locks root's password, so it can't work:

$ su -
Password:
su: Authentication failure

Root's account is locked, and it's meant to stay that way:

$ sudo passwd -S root
root L 2026-07-20 0 99999 7 -1

The L means locked. Don't "fix" it by giving root a password. Use sudo for single commands and sudo -i for a root shell. You'll also see sudo su - in old guides. It works, but sudo -i does the same thing more directly.

Try it

1. Show the first line of /etc/shadow, which ubuntu isn't allowed to read.
2. Open a root shell, check who you are, and leave it.
3. Is ubuntu in the sudo group?

$ sudo head -1 /etc/shadow
root:*:20654:0:99999:7:::

Common mistakes

• Using sudo for things that don't need it. sudo is for changing the system. Files in your own home folder never need it, and if you create them with sudo they end up owned by root and you can't edit them later without sudo again.
• sudo with a builtin. sudo runs programs, and builtins like cd aren't programs:

$ sudo cd /root
sudo: 'cd': command not found

To work inside root-only folders, use sudo -i instead.

• Forgetting you're root. Check the prompt. # means root.
• Secrets on the command line. A password typed into a command ends up in ~/.bash_history. Start the line with a space, or better, let the program ask for it.
• Panicking at Ctrl+S. The screen isn't frozen for good. Press Ctrl+Q.

Practice

1. Run ls /etc/apt. Then, using history, run the same command with -l added, without retyping the path.

$ ls /etc/apt
apt.conf.d   keyrings       sources.list    trusted.gpg.d
auth.conf.d  preferences.d  sources.list.d
$ ls -l !$
ls -l /etc/apt
total 28
drwxr-xr-x 2 root root 4096 Oct 21 11:03 apt.conf.d
drwxr-xr-x 2 root root 4096 Apr  7  2026 auth.conf.d
drwxr-xr-x 2 root root 4096 Apr  7  2026 keyrings
drwxr-xr-x 2 root root 4096 Jul 20 16:38 preferences.d
-rw-r--r-- 1 root root  270 Jul 20 16:38 sources.list
drwxr-xr-x 2 root root 4096 Jul 20 16:39 sources.list.d
drwxr-xr-x 2 root root 4096 Jul 20 16:34 trusted.gpg.d

1. Run apt list --installed without sudo and count the lines with wc -l (lesson 8 explains the |). Then run history and re-run that command by its number.

$ apt list --installed | wc -l

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

678
$ history
    1  apt list --installed | wc -l
    2  history
$ !1
apt list --installed | wc -l

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

678

1. Type cat /etc/hosts, press Ctrl+A, and turn it into sudo cat /etc/hosts before pressing Enter.

1. Run echo "api_key=12345" so that it never appears in history, and prove it.

$  echo "api_key=12345"
api_key=12345
$ history
    1  history

1. Using one sudo command, list the files in /root, then check what sudo -l says you're allowed to run.

$ sudo ls -la /root
total 24
drwx------  3 root root 4096 Oct 21 11:06 .
drwxr-xr-x 19 root root 4096 Oct 21 11:06 ..
-rw-------  1 root root   16 Oct 21 11:06 .bash_history
-rw-r--r--  1 root root 3106 Apr 20  2026 .bashrc
-rw-r--r--  1 root root  132 Apr 20  2026 .profile
drwx------  2 root root 4096 Oct 21 11:01 .ssh
$ sudo -l
User ubuntu may run the following commands on linux:
    (ALL : ALL) ALL
    (ALL) NOPASSWD: ALL

1. Turn on history timestamps permanently, run three commands, and show the last four lines of history with their times.

$ echo 'export HISTTIMEFORMAT="%F %T  "' >> ~/.bashrc
$ source ~/.bashrc
$ date
$ whoami
$ uptime
$ history | tail -4

Cheat sheet

← The shell, commands and getting helpThe Linux filesystem and paths →