Most Dangerous Linux Commands and How to Protect Your Server

Updated: 12 October 2026 · Applies to: Debian 13 and Ubuntu 26.04 (GNU coreutils 9.7, bash 5.2, e2fsprogs 1.47, sudo 1.9, cron 3.0) and any Linux server where you work as root

The most dangerous Linux command is rm -rf pointed at the wrong place: rm -rf /*, rm -rf ~ or a path built from an empty variable. Close behind are commands that write straight to a disk (dd, mkfs, > /dev/sda), the fork bomb :(){ :|:& };:, a recursive chmod on system folders, and piping a script from the internet into a shell. Run as root or with sudo, Linux carries them out without asking "are you sure?".

We ran the safe parts below in throwaway containers on our test server (Debian 13 and Ubuntu 26.04). Never try these commands on a real server or your own computer.

1. rm -rf / and rm -rf /*

rm -r deletes folders with everything inside them and -f stops it from asking (more in What does rm -rf command do on a Linux or Unix?). GNU rm protects the root folder itself:

# rm -rf /
rm: it is dangerous to operate recursively on '/'
rm: use --no-preserve-root to override this failsafe

That safety net is narrow. rm -rf --no-preserve-root / deletes everything, and so does rm -rf /*: the shell expands /* to /bin /boot /dev /etc ... before rm starts, so rm never sees /. Files on mounted disks and network shares go too.

2. rm with an empty variable

Many disasters come from scripts, not typing. If $DIR is empty, rm -rf "$DIR"/* becomes rm -rf /*. In our test the shell expanded it to:

rm -rf /bin /boot /dev /etc /home /lib /lib64 /media /mnt /opt /proc /root /run ...

Make the script stop instead. ${DIR:?} aborts when the variable is empty, and set -u aborts on a variable that was never set:

$ bash -c 'DIR=""; rm -rf "${DIR:?}"/*'
bash: line 1: DIR: parameter null or not set
$ bash -c 'set -u; rm -rf "$BACKUPDIR"/*'
bash: line 1: BACKUPDIR: unbound variable

3. rm -rf ~ and rm -rf .*

~ is your home folder, so rm -rf ~ wipes all your files (for root that is /root). A stray space does the same: rm -rf ~ /backup instead of rm -rf ~/backup deletes both. rm -rf .* removes every hidden file and folder where you stand: in our test it deleted .bashrc, .profile and the whole .ssh folder with authorized_keys, which ends key-based SSH logins for that user.

4. dd, mkfs and > /dev/sda: writing to the wrong disk

• dd if=/dev/zero of=/dev/sda (or if=/dev/urandom) overwrites the whole disk. dd never asks.
• mkfs.ext4 /dev/sda1 puts a new, empty file system on that partition. mke2fs refuses a mounted partition, and in a terminal it asks first (below). In a script or pipe it does not ask: in our test echo n | mkfs.ext4 disk.img formatted the image anyway.
• command > /dev/sda writes the output straight over the partition table and file system.

$ mkfs.ext4 disk.img
mke2fs 1.47.2 (1-Jan-2025)
disk.img contains a ext4 file system
	created on Sat Oct 10 02:53:19 2026
Proceed anyway? (y,N)

Before any of these, check the device with lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINTS, every time, and especially after a disk was added.

5. The fork bomb :(){ :|:& };:

This defines a function called : that starts two copies of itself in the background, again and again, until the system runs out of process slots and memory and stops responding. Nothing is deleted and a reboot clears it. Limits contain it: ulimit -u (or nproc in /etc/security/limits.conf) caps processes per user, and systemd caps each user slice with TasksMax=33% by default (we read this in systemd 259 on Ubuntu 26.04).

6. chmod -R 777 / and chown -R on system folders

A recursive permission or owner change on /, /etc or /usr has no undo, and programs that check permissions stop working. After chmod 777 /etc/sudoers, sudo refused to run in our test:

sudo: /etc/sudoers is world writable

SSH also checks the modes and ownership of your home folder and key files before it accepts a login (StrictModes, on by default according to OpenSSH). For a website folder, set the right owner and use 755 for folders and 644 for files, never 777.

7. curl ... | sh: running a script you have not read

curl -sL https://example.com/install.sh | sudo bash runs whatever that server sends, as root, without you seeing it. The same goes for long base64 or hex strings from forums: one old "exploit" that still circulates as C hex code decodes to rm -rf ~ / &. Download first, read it, then run it:

curl -fsSLo install.sh https://example.com/install.sh
less install.sh
sudo bash install.sh

8. mv something /dev/null

/dev/null is a special device that throws away what is written to it. As root, mv file.txt /dev/null does not destroy the file: it replaces the device with an ordinary file, and everything that writes to /dev/null now fills that file instead:

# mv f.txt /dev/null
# ls -l /dev/null
-rw-r--r-- 1 root root 6 Oct 10 02:53 /dev/null

Moving a folder there fails (mv: cannot overwrite non-directory '/dev/null' with directory 'd1'). To repair a replaced /dev/null, recreate the device:

# rm /dev/null
# mknod -m 666 /dev/null c 1 3
# ls -l /dev/null
crw-rw-rw- 1 root root 1, 3 Oct 10 02:53 /dev/null

9. crontab -r

r sits next to e on the keyboard. crontab -e edits your cron jobs; crontab -r deletes all of them at once, without a question:

# crontab -r
# crontab -l
no crontab for root

crontab -ri asks first (crontab: really delete root's crontab? (y/n)). Keep a copy with crontab -l > ~/crontab.bak, and see How to List Cron Jobs in Linux and Read Crontab Syntax.

10. Commands that lock you out over SSH

On a remote server, some commands are dangerous because they cut the connection you are using: iptables -P INPUT DROP, ufw enable without an SSH rule, ip link set eth0 down, stopping sshd, or moving SSH to a port the firewall blocks (see What Is the Default SSH Port and How to Change It Safely). ufw warns over SSH (Command may disrupt existing ssh connections. Proceed with operation (y|n)?); iptables does not. Allow SSH first (for example ufw allow 22/tcp) and keep a second session open while you test. Locked out of a Ucartz VPS? Log in through the VNC console (How to Access Your VPS via VNC in Virtualizor) and undo the change.

How to protect your server

• Keep backups off the server and test that they restore. Nothing else on this list undoes an rm -rf.
• Work as a normal user and use sudo only for the command that needs it.
• Use rm -I: GNU rm then asks once before removing more than three files or removing recursively. alias rm='rm -I' in ~/.bashrc makes it the default (How to Create and Use Alias Command in Linux).
• set -o noclobber stops > from overwriting an existing file (bash: notes.txt: cannot overwrite existing file); use >| when you mean it.
• In scripts, use set -u and ${VAR:?} in every path you delete.
• Check the target with ls or lsblk first, then type the destructive command.
• On Debian and Ubuntu, the molly-guard package makes reboot and shutdown ask for the host name when you run them over SSH, so you do not restart the wrong server.

If you already ran one

Stop writing to that disk at once (new files can overwrite deleted data), restore from your backup, and only then try recovery tools (How to Recover a Deleted Directory or Folder in Linux). To find out who deleted a file on a shared server, see How to Use auditd to Find Out Who Deleted a File in Linux. On a Ucartz VPS you can start the rescue system from Virtualizor and copy data off a damaged install (How to Enable Rescue Mode for Your VPS Using Virtualizor).