The ls command — short for list — is the first command most people learn on Linux. It shows you what’s inside a directory. This guide takes you from the basics all the way to exploring the root filesystem and /etc/ with real simulated terminal output.
ls stands for list. It prints the names of files and directories inside a folder. Run it with no arguments and it lists your current working directory. Pass a path and it lists that path instead.
ls # list current directory ls /path/to/dir # list a specific path ls ~ # list your home directory (~ = home)
ls followed by Enter. You’ll see the contents of wherever you are right now.
Flags change how ls behaves. You can combine them freely. Here are the most important ones:
| Flag | Long form | What it does |
|---|---|---|
| -a | –all | Show hidden files (names starting with .) |
| -l | — | Long format — permissions, owner, size, date |
| -h | –human-readable | Human-readable sizes (4.0K, 12M) — requires -l |
| -1 | — | One entry per line (the number 1, not letter L) |
| -t | — | Sort by modification time, newest first |
| -r | –reverse | Reverse the sort order |
| -R | –recursive | List all subdirectories recursively |
| -S | — | Sort by file size, largest first |
| -F | –classify | Append type indicators (/ for dirs, * for executables) |
| -i | –inode | Show inode numbers |
| -d | –directory | List directories themselves, not their contents |
ls -la # long format + show hidden files ls -lh # long format + human-readable sizes ls -ltr # long format + sorted by time, oldest first ls -lAh # long format + all (except . and ..) + human sizes ls -1 # one item per line, clean for piping
Many Linux systems define shell aliases so you don’t have to type the full flags every time:
alias ll='ls -lh' # long + human-readable alias la='ls -lAh' # long + all hidden + human-readable alias l='ls -1' # one per line
man ls for the complete reference. Press q to exit. You can also combine ls with pipes: ls /etc | grep ssh
The root directory / is the top of the entire Linux filesystem. Everything lives inside it. Running ls / gives you the Filesystem Hierarchy Standard (FHS) — the standardised layout used by all major Linux distributions.
$ ls /
bin boot dev etc home lib lib64 media mnt opt
proc root run sbin srv sys tmp usr var
Here is what each top-level directory does:
| Directory | Purpose |
|---|---|
| /bin | Essential user binaries (ls, cp, mv, bash, etc.) |
| /sbin | System administration binaries (only root typically uses these) |
| /etc | System-wide configuration files — the most important directory |
| /home | Personal directories for each user (/home/username) |
| /var | Variable data — logs (/var/log), databases, mail spools |
| /dev | Device files (hard drives, USB, terminals — everything is a file) |
| /proc | Virtual filesystem — live kernel and process information |
| /sys | Virtual filesystem — hardware and kernel subsystem info |
| /tmp | Temporary files, cleared on reboot |
| /boot | Bootloader and kernel images |
| /usr | User programs, libraries, and documentation |
| /root | Home directory for the root user (not /home/root) |
| /run | Runtime data since last boot (PIDs, sockets) |
| /lib | Shared libraries needed by /bin and /sbin |
| /mnt | Mount point for temporarily mounted filesystems |
| /opt | Optional/add-on software packages |
$ cd /
$ pwd
/
Now run ls -lh from here to see the root directory in long format with human-readable sizes:
$ ls -lh
total 72K
lrwxrwxrwx 1 root root 7 Apr 1 2024 bin -> usr/bin
drwxr-xr-x 4 root root 4.0K Jan 15 08:22 boot
drwxr-xr-x 19 root root 3.8K Apr 3 10:01 dev
drwxr-xr-x 133 root root 12K Apr 3 09:55 etc
drwxr-xr-x 3 root root 4.0K Mar 29 18:42 home
lrwxrwxrwx 1 root root 7 Apr 1 2024 lib -> usr/lib
drwx------ 2 root root 16K Mar 28 11:00 lost+found
drwxr-xr-x 2 root root 4.0K Mar 28 11:00 media
drwxr-xr-x 2 root root 4.0K Mar 28 11:00 mnt
drwxr-xr-x 5 root root 4.0K Apr 1 10:35 opt
dr-xr-xr-x 220 root root 0 Apr 3 10:01 proc
drwx------ 5 root root 4.0K Apr 3 11:30 root
drwxr-xr-x 30 root root 840 Apr 3 10:01 run
lrwxrwxrwx 1 root root 8 Apr 1 2024 sbin -> usr/sbin
drwxr-xr-x 2 root root 4.0K Apr 1 2024 srv
dr-xr-xr-x 13 root root 0 Apr 3 10:01 sys
drwxrwxrwt 12 root root 4.0K Apr 3 11:28 tmp
drwxr-xr-x 14 root root 4.0K Apr 1 2024 usr
drwxr-xr-x 12 root root 4.0K Apr 1 10:35 var
cd ~ takes you back to your home directory. cd - takes you back to the previous directory. pwd always shows you where you are.
Now that you are in /, let’s experiment with different flag combinations. This is where most beginners learn what each flag actually does by seeing real output.
$ ls -1
bin
boot
dev
etc
home
lib
lib64
media
mnt
opt
proc
root
run
sbin
srv
sys
tmp
usr
var
The -1 flag (the digit 1) forces one item per line — clean and easy to pipe into grep, wc, or other tools.
$ ls -1 -h
bin
boot
dev
etc
home
lib
lib64
media
mnt
opt
proc
root
run
sbin
srv
sys
tmp
usr
var
-h flag (human-readable sizes) has no effect without -l. Sizes only appear in long format. To see sizes, use ls -1lh instead.
$ ls -a
. .. bin boot dev etc home lib lib64
media mnt opt proc root run sbin srv
sys tmp usr var
The -a flag reveals hidden items — those whose names begin with a dot. Every directory has . (current directory) and .. (parent directory) as special hidden entries. The real / on most systems has almost no other hidden files, but home directories have many (like .bashrc, .ssh/, .gitconfig).
$ ls --all
. .. bin boot dev etc home lib lib64
media mnt opt proc root run sbin srv
sys tmp usr var
-a and --all are identical. Short flags are faster to type; long flags are more readable in scripts.
/etc/ is the most important configuration directory on a Linux system. Every major service — networking, SSH, DNS, package management, user accounts — stores its configuration files here.
$ ls -1 /etc/
adduser.conf
alternatives/
apt/
bash.bashrc
ca-certificates.conf
cron.d/
cron.daily/
cron.hourly/
cron.monthly/
cron.weekly/
crontab
default/
environment
fstab
grub.d/
group
gshadow
hostname
hosts
init.d/
inputrc
issue
locale.gen
logrotate.conf
logrotate.d/
lsb-release
machine-id
motd
network/
nsswitch.conf
os-release
pam.d/
passwd
profile
profile.d/
protocols
resolv.conf
security/
services
shadow
shells
ssh/
ssl/
sudoers
sudoers.d/
sysctl.conf
sysctl.d/
systemd/
timezone
udev/
vim/
X11/
Here are the most important files and directories in /etc/:
| Path | Purpose |
|---|---|
| /etc/passwd | User account database (username, UID, home, shell) |
| /etc/shadow | Encrypted user passwords (root-readable only) |
| /etc/group | Group definitions |
| /etc/sudoers | Who can run sudo and with what permissions |
| /etc/fstab | Filesystem mount table — auto-mounts at boot |
| /etc/hostname | The machine’s hostname |
| /etc/hosts | Static hostname-to-IP mappings |
| /etc/resolv.conf | DNS resolver settings |
| /etc/ssh/ | SSH server and client configuration |
| /etc/systemd/ | Systemd service definitions and overrides |
| /etc/apt/ | APT package manager configuration (Debian/Ubuntu) |
| /etc/cron.d/ | System cron jobs |
| /etc/profile | System-wide shell environment settings |
| /etc/os-release | OS identity (name, version, ID) |
-h only affects the size column in -l (long format). Without -l, there is no size column to format, so -h silently does nothing. Use ls -lh /etc/ to see sizes.
ls -la /etc/ # full details including hidden files ls /etc/ | grep ssh # find SSH-related configs ls -lh /etc/ssh/ # detailed view of SSH config dir cat /etc/os-release # show current OS version cat /etc/hostname # show the machine hostname
ls -lh /etc/ssh/ to see SSH configs, ls /etc/apt/ for package manager settings, or ls -la ~ to see all the hidden dot-files in your home directory.