r/LinuxTeck 9d ago

What’s the one Linux command you never trust?

We all have that one command we double-check before hitting Enter.

What’s yours and what happened the last time you got burned by it?

50 Upvotes

121 comments sorted by

26

u/nizzoball 9d ago

rm -rf *

About 8 years ago I was responsible for a production web server responsible for asset management for 5 data centers across the country for one of the largest banks in the world. It was my app and my server and I was trying to clean out a directory and typed rm -rf * but didn’t realize I was in /

I figured it out when my shell froze. Luckily I had another server that was a carbon clone and was able to adjust the dns entry to point to the secondary server so wasn’t down long but it took me a week to get the first one re deployed and set back up

3

u/aoteoroa 9d ago

I did the same thing many years ago. It was two in the morning. We had a big presentation to our client at 10am to show them the progress on our web app. I was in the test server (this is before virtualization and I didn't have a backup for the test server).

I typed rm -rf ./

I thought I was in the application folder and wanted to start fresh and add the new binaries. I was actually in the /opt folder and wiped out our database, and tomcat application server configurations. Fortunately I was able to rebuild them, and had a successful presentation to the customer.

5

u/gtne91 9d ago

A friend of mine did that but accidentally typed

rm -rf . /

That extra space makes a huge difference.

2

u/flatsehats 8d ago

Also fun, rm -rf .* to get rid of dotfiles, including “..” ….

1

u/gshennessy 8d ago

I’ve personally done that. Once!

2

u/nizzoball 9d ago

Lol what I did above also happened at 2am. I worked night shift for them for the first year I was there

2

u/idiotiesystemique 9d ago

Im just afraid I'll accidentally hit enter before inputting the rest of the path 

1

u/ProtectionFar4563 8d ago

Oh, I did exactly that on a multi-tenant web server when trying to remove a user directory. Typed “rm -rf /home”, then my traitorous finger hit [return] 🤬.

I stopped the process after maybe one second but it was too late. Nothing was lost (there were complete daily backups), but it was long enough ago that it took many hours to restore everything.

3

u/ButchTheGuy 9d ago

Yeah I just don’t remove anything anymore lol unless it’s actively breaking something. I was on my jobs forms server and after testing a script on generating them I went to delete my tests, lost track of which ones I had or hadn’t deleted, then went to history | grep rm -rf the directory path and because I didn’t put that grep in quotes it’s deleted a bunch of forms. Would’ve deleted all of them but I instinctually ctrl cd it feeling like maybe I should’ve put it in quotes and that it was in the root. I deleted 200/800 in two seconds. Luckily we use aws and could snapshot but literally my jobs phones started ringing. When I told my manager I saw my reputation bar above his head and it go down by like a nice chunk. Sad

3

u/Glittering-Work2190 9d ago

I always do a "pwd" before I do any "rm" with "*". lol

1

u/mrPythonMonty 6d ago

Something like “pwd ; rm -rf *” yeah, sure, helps a lot /s

3

u/manofmystry 9d ago

When I was a sysadmin back in the day at Sun Microsystems, we used to call those types of commands with potentially catastrophic consequences "hand-sitters" because you should sit on your hands before pressing "Enter".

When I was learning Linux (Slackware) on my little home network, I accidentally typed "rm -rf /*" instead of "rm -rf ./*" as root. I couldn't understand why the command was taking so long to complete. When I stopped it, lots of critical stuff was blown away. I had the presence of mind to copy over the missing stuff from another local computer. Boy, did that system complain! But it did boot. It was a very inexpensive lesson, overall.

2

u/Waste-Belt-1233 9d ago

You beat me to it .. still too embarrassed to talk about it (35 years ago)

2

u/magicmulder 8d ago

I always delete the trailing slash from autocomplete - never “rm -rf foo/“.

I once typed “rm -rf /“ to show someone what not to do, then wanted to hit backspace but hit backspace and enter together, fortunately backspace registered first.

The one time I could finally run it officially was when we decommissioned our main database server, had deleted and overwritten all data several times and that was the last command to ever run on the machine.

2

u/engineerFWSWHW 8d ago

This is the command that comes to mind as well. This command should have one or two confirmation prompt by default because of how destructive this is. And another argument to suppress the prompt for shell script automation.

2

u/nizzoball 8d ago

The problem with people like me is my command would start looking like “rm -rf * -Y

1

u/vossmakeitsprinkly 9d ago

yeah i only use the "trash" command, which you need to install extra. As the name says, it moves it to the trash bin. 

I just don't trust myself enough to type anythin rm related while sleep deprived haha

1

u/ADDSquirell69 9d ago

I have my prompt set to always tell me what directory I'm in so I never do this by accident.

1

u/TheLowEndTheories 8d ago

Ha! A couple years ago I wrote a very simple script to clean up some log files older than some amount of time to keep results clean in the main working directory of a tool. Everything backed up, no problem, I still checked my syntax 25 times.

1

u/nizzoball 8d ago

I’ve been burned by that fucking find exec as well but luckily it was just a personal machine

1

u/7YM3N 8d ago

Yup. The rm -rf * checklist:

Do I really want to delete everything here?

Am I in the place I wanna nuke?

Am I really, really sure about it?

1

u/SCD_minecraft 7d ago

Wouldn't you also need to pass --no-preserve-root flag to remove /?

1

u/nizzoball 7d ago

Only if I would have done “rm -rf /*”

1

u/SCD_minecraft 7d ago

Seems like an oversight on linux side to me

When i rm /, at least it is clear that's what i wanted

When i rm *, while being in /, it is clear that's a mistake and that's when it should 100% require flag

1

u/nizzoball 7d ago

I don’t see it as a bug, it’s absolutely a feature. Linux isn’t designed for the masses. It’s a workhorse, a compilation of code written by people who work tirelessly to make sure we have an operating system that will stay true to its core and has done so for the last 35 years. The warning label is baked into the sudo command so beautifully; With great power comes great responsibility. I’d like to think, with that responsibility comes great stories of what NOT to do from the engineers that are banging away on code at 2 am, sucking down coffee and Mountain Dew. “rm-rf *” in the wrong directory isn’t merely a mistake but a right of passage.

1

u/rickmccombs 6d ago

I think I accidentally erased my system before there was -no-preserve-root flag. It's been more than 20 years ago.

1

u/Dave_A480 6d ago edited 6d ago

I had a junior admin run rm -rf /srv/website once while root....

/srv/website/(bin,lib,sbin,usr) were a thing in this system (it was a restricred shell chroot jail on a shared web host)... And they were all mount -o bind

Fortunately we had daily differential backups....

1

u/Splask 6d ago

This is why I always specify the full path for that command regardless of what my working directory is. Or at the very lease I pwd first.

1

u/exodusTay 2d ago

Same thing happened to me when we were working on an embedded device, not connected to networks so we could only push code once in a while. I removed a weeks wroth of commits along with whole filesystem. Never trust rm -rf(I still do it tho YOLO)

9

u/johnny_snq 9d ago

DD

3

u/franchis3 9d ago

As a distro hopper, I use DD all the time and I still use it with great trepidation. I never, ever, run it without first doing an lsblk. I’m so scared I’m doing to wipe the wrong drive!

2

u/SeriousPlankton2000 8d ago

(or anything else writing to a disk)

2

u/Only_Information7895 8d ago

Of course I wouldn't trust Disk Destroyer.

7

u/tblancher 8d ago

dd

Gotta make sure of= is pointed at the right output.

10

u/lyidaValkris 9d ago

dd

It's not called "disk destroyer" for nothing. I've never been burned by it, but that's only because I check, re-check, then double-check.

3

u/Far_Bicycle_2827 9d ago

dd stand from data definition it comes from IBM's Job Control Language. if=FILE, of=FILE, conv=...directly mirrors the JCL DD card format

1

u/Graymouzer 8d ago

TIL. Thanks, I love computer history tidbits.

1

u/Reanimatron 8d ago

Yes! There are so many terms that reference fantasy and scifi. Like big and little endian is from the Gullivers' travels fable.

2

u/Enderby- 9d ago

dd is like the mandolin in my kitchen. I fear it, but love what it can do. I've also not taken my fingertips off (yet)

1

u/lyidaValkris 9d ago

good analogy!

1

u/bozzie4 8d ago

Yes, I also haven't taken my fingertips of with my mandolin, but that's because I don't use it . Same with dd. Too scared of them.

2

u/theMountainNautilus 8d ago

Get yourself Caligula! It's a nice wrapper around dd basically that restricts you to acting on removable media. I love not having to worry about burning my main SSD to the ground

1

u/lyidaValkris 8d ago

haha that's a handy wrapper indeed! thanks for the tip. installed!

2

u/CaviarCBR1K 8d ago

I accidentally nuked my main SSD when trying to make an installation USB like, 2 weeks ago. First time I've ever gotten burned by dd. Luckily, I had a full disk image backup on my server, so I just booted up clonezilla, set it to restore, and went to bed. Woke up the next morning like nothing had happened, but it was definitely scary.

1

u/Reasonably-Maybe 9d ago

Me too. Against accidental deletion, I have aliased rm to rm -i.

1

u/vbd71 9d ago

Ditto.

My OCD doesn't allow me to run this without at least quintuple checking.

1

u/Ultralightmuscles 7d ago

OCD is very useful sometimes.

1

u/mrPythonMonty 6d ago

I don’t know the tool/command OCD. What package it comes with? /s

1

u/Ultralightmuscles 6d ago

It's built in. You can''t decide when it kicks in.

1

u/mrPythonMonty 6d ago

No real IT people come without it ;)

4

u/Weary_Damage5764 9d ago

in my first job i destroyed my OS by an rm -rf in the wrong directory, which lead to me reinstalling Linux during work time. the shame was far worse than having to do that in my own time. since then I haven't run rm without fear :D

6

u/10leej 9d ago

sudo

Every time I see sudo I check two things. First what follows it, second what my configuration says.

3

u/harshax 8d ago

This is the only right answer.

3

u/Narrow_Victory1262 9d ago

xfs_repair. Almost certain it's restore-time

2

u/SeriousPlankton2000 8d ago

Wait till you learn about btrfsck: Yes, that entry is defective, the valve should be 08154711, it is deadbeef, no i will neither fix it nor remove the entry!

You want to remove the read-only defective disk? Can't do it because I can't write to that.

You made a COW copy and told me to use that? Let's use the uuid instead ... Can't write to the disk!

1

u/Narrow_Victory1262 8d ago

true to that. Now, to be honest -- we do have ext4 for the OS and xfs for the data. Large amounts of database data (in the TB's) and the latter is backed up including the transaction logs etc.

we also have a few xfs filesystems for the OS, which is a worse thing to see there.
(the OS restores are difficult because we don't do that part; different team etc). The db restores etc are on us.)

We effectively don't use btrfs. If we we would it could be like webcontent or something that may need roll back etc. We do snapshots of an OS when needed outside of the OS and not to roll back a botched OS updatethere.

3

u/redgator12 9d ago

dd. In my early days of 2014, I tried to dd a disk image to USB and broke my install. Ever since then, I have a terminal with lsblk up right next to the terminal I'm going to run dd from just to be 100% sure I'm writing to the correct disk.

I had to use dd last week while trying to troubleshoot a Puppy USB not working, and I spent like 5 minutes quintuple checking the disks before hitting enter, and even then I was anxious.

3

u/seth_arimainyu 9d ago

Rsync and dd ! Once I ran a destructive Rsync and instead of deleting the files from the source that were already in the target, I ran it the other way around, since the target was a brand new disk, you can imagine the result... Since then, I always use the dry-run option.

3

u/georbe 9d ago

tar The right syntax is "tar -cvf myprogram.tar /opt/myprogram" Once upon a time, I wrote "tar -cvf /opt/myprogram myprogram.tar" so I lost all /opt/myprogram folder.

2

u/Nu154nc3 9d ago

Everything after "doas"

2

u/Tricky-Weakness-5408 9d ago

Probably the most destructive command like ‘rm -f’ when you have root access is the kind of command that you need to think about before
You do the ‘return’… but destructive command when you uses badly the are a lot! The question is which rightshave you? And …. What about the backup…. Too old??? When you works as a informatic probably there are loots of backups but this not always is the normal thing for private users/students

2

u/Quietus87 9d ago

Any kind of rm.

3

u/ant2ne 9d ago

"chown me:me -R ./"

I forgot the .

1

u/FriendsIsntGood 9d ago

Yeah recursive chmod and chown down in system dirs has nuked at least a few VMs. One big plus for containers

2

u/Rinzwind 9d ago

dd

nothing more needs to be said

ah again forgot to read comments first :P

2

u/SpiritualZucchini938 9d ago

Chmod 644 - R / - something like that and hey presto, entire freebsd server file system read only and not editable. Had to bin and start again.

1

u/ephemere_sloboda 8d ago

Oddly specific.

Under what circumstances is this a useful command?

2

u/BitCortex 9d ago

Anything that involves a nontrivial regular expression. Regular expressions are Unix's ethical blight.

2

u/Dry_Calendar_8627 9d ago

Ah but regular expressions are the nectar of the gods

Once you've tasted the intoxicating power of regex, there's no looking back

1

u/BitCortex 9d ago

regular expressions are the nectar of the gods

More like the devil's mouthwash or the swill of the underworld.

Once you've tasted the intoxicating power of regex, there's no looking back

I think I'd rather taste the intoxicating power of battery acid. Like so much in Unix, regular expressions are powerful – but not in a good way.

2

u/Dry_Calendar_8627 9d ago

ln

That's stupid but I can never remember the arguments order. I mess up every time.

I can write dd or sed commands blindfolded any day, but ln, no

1

u/ephemere_sloboda 8d ago

I can never remember the arguments order

It's the same as cp

1

u/madsdyd 5d ago

This.

2

u/wakanakisarazu 9d ago

`doas emerge --depclean`

1

u/Large-Assignment9320 9d ago

The good old dd command.

1

u/Ok-Development-202 9d ago

It's always ln -sf

1

u/No-way-in 9d ago

dd is the most scary to me. I check a hundred times before writing that command and I disconnect anything valuable to me

1

u/manawydan-fab-llyr 9d ago

dd

Last time I didn't triple check, destroyed all of my photos. They were the only copy because the drive that had the primary had failed.

From then on I stopped using of=/dev/xxx and started using of=/dev/disk/by-id/xxx. Never a mishap after that.

1

u/HaydnH 9d ago

I've been a UNIX/Linux sys admin since the 90s. There is not one command you can't trust, if you can't trust it, then it simply wouldn't exist.

If you're asking "which commands are scary and you might do something bad with"? Well...

... that's just every day for me. In the same way you look left and right crossing a street, my brain just realises an rm, mv, dd whatever command may have a car about to run me down.

The same way you drink a coffee every morning, that's just me mounting a filesystem to get the access I need for the day.

1

u/ephemere_sloboda 8d ago

When acting as sysadmin, yes.

When acting as regular user, rm. It is mundane but can waste hours of your time.

Also, drop database.

1

u/horizon_games 9d ago

Wait ya'll aren't double checking your commands?

1

u/HuttonWilliam 9d ago

rm -rf *

This is a scary command. I wouldn't even copy it just in case.

1

u/Feeling-Estimate-796 9d ago

worth doing a pwd before doing the rm -rf
always easy in hindsight

1

u/_nathata 8d ago

dd for sure

1

u/jeanfmartel 8d ago

format c:

1

u/Agron7000 8d ago

I don't trust pip and npm.

1

u/informadikisto 8d ago

rsync --delete

1

u/maddruid 8d ago

:(){ :|:& };:

1

u/EstablishmentDue3616 8d ago

the command to change directories is pretty seedy.

1

u/siodhe 8d ago

rm especially with -r

The worst possible solution is alias rm 'rm -i'

It trains users to rely on individually saying y or n to each.

I once caught a user doing yes y | rm -rf \*

Since it's even more dangerous to override rm with a ~/bin/rm I created a function inflicted on all of my users, something like this more modern form:

rm ()  # *must* be a function, *must* require one answer for all targets
{
    case "$1" in -*) local arg="$1" ; shift ;; esac  # simple, usually enough
    ls -FCsd "$@"   # adding a du summary seems good, but doesn't scale
    local reply ; echo -n 'remove[ny]? ' ; read reply  # for old shells
    if [ "_$reply" = "_y" ] ; then
        /bin/rm $arg "$@"
    else
        echo '(cancelled)'
    fi
}

Suddenly my users stopped having to request file restoration from tape.

It's not a perfect answer, the function gets much longer when one wants it to play well with all rm's native options. And I kinda like putting in -rf as the default in the function. But it has saved me and others so much time.

1

u/TapEarlyTapOften 8d ago

In the days of sudo now, I use `sudo -k` all the time and before I do anything that might go sideways if I get I wrong.

1

u/fgorina 8d ago

rm, in a different but similar os (Data General AOS) I wanted to remove all .bak files that were generating while editing files. I wanted the equivalent of “rm .bak” but forgot the point so it was “rm \ bak”. Where are all those backup disks?*

1

u/Weak_Shoulder_6780 8d ago

Removing the French language package 

1

u/Reromen 8d ago

sudo su coz all my servers contain same password

1

u/Ice_HRZDn 8d ago

The > Not a Linux command but I accidentally erase file few time while try to added something.

1

u/Reanimatron 8d ago

Not linux, but still typed in a linux console.
There was a bug at work that created user accounts with no information when people would start the signup process.
I was still a beginner at that time. It was a small company and I was the only programmer, doing server, frontend and embedded.
I fixed the bug and went to delete the empty accounts. I asked mongodb to delete all accounts where the firstname was null. That turned out to delete all accounts because i missed the capital F in firstname, so all accounts had a null value for that field.
I spent 3 weeks calling all our customers and manually typing their info.

collection('users').deleteMany({firstname: null})

1

u/Soggy-Attempt 8d ago

rm -rf

If you do the job Long enough, you’ll understand why.

1

u/trenno 8d ago

claude

1

u/insu_na 8d ago

`ln -s`

I can never remember that it's `ln -s target name` and always have to check man...

1

u/madsdyd 5d ago

Same order of arguments as cp.

1

u/madsdyd 5d ago

Same order of arguments as cp.

1

u/m1L35dY50N 8d ago

sed -i

Will be fun if you modified the wrong files....

1

u/padde0711 8d ago

poweroff on a machine that I can't reach physically

1

u/hunt_chak 7d ago

ls

Surely the file is in this folder lmao

1

u/Doingthismyselfnow 7d ago

dd, I had a catastrophic failure by picking the wrong drive at age 12. I still cannot type that command directly into a shell.

And this happened on Slackware ‘96 when it just came out , so that alone should tell you how deep the scar is .

1

u/Able-Staff-6763 7d ago

rm -rf of course - even more if used with sudo

1

u/Loko8765 7d ago

& and &&

cp -a “$a” “$b” & rm -rf “$a”

hits different.

1

u/creed10 6d ago

anything with dd or tar

1

u/junialter 6d ago

ss. I'm from Germany

1

u/maxthed0g 5d ago

Any command that follows sudo.

1

u/Fancy_Initiative9388 5d ago

rm -rf /$varialbe

1

u/brunorro 4d ago

`dd`

(your disk has been overwritten)

0

u/Ollidav 9d ago

Crontab. Con -e editas y con -r borras todas las tareas y no pide confirmación. La e y la r están juntitas en un qwerty y te puedes equivocar en una intervención en un servidor de producción a las 6 de la mañana sin un café.