Editing files: nano, vim, and changing a server safely

Why you edit files in the terminal

On a server, almost everything is a text file: nginx's settings, SSH's rules, cron jobs, systemd units, the app's .env. There's no desktop and no VS Code window, only an SSH session. So editing a file in the terminal isn't a nice-to-have. It's how most production changes are made, and how most production mistakes start.

You need two editors:

You'll also see Emacs (powerful, popular with some programmers, rarely installed on servers) and graphical editors like VS Code, which can edit server files over SSH with its Remote extension. Both are fine. Neither replaces knowing nano and vim, because the server you're fixing at 2 a.m. may have only vi.

nano: the editor you can use in a minute

$ nano notes.txt              # open (or create) a file
$ nano -l notes.txt           # with line numbers, which you'll want when an error says "line 42"
$ nano +42 /etc/hosts         # open with the cursor on line 42

⤢ View

nano prints its own cheat sheet. ^O means Ctrl+O; M-U means Alt+U.© Diagram: DevOps Academy

Close

You type, and the text goes in. The keys that matter:

vim: learn the modes and the keys follow

vim feels strange for one reason: the same key does different things depending on the mode. In normal mode keys are commands (dd deletes a line). In insert mode keys type text. Once you always know which mode you're in, vim stops being scary.

⤢ View

Everything goes through normal mode. Lost? Press Esc, and you're home.© Diagram: DevOps Academy

Close

$ vim app.conf                # vim opens in NORMAL mode: keys are commands, not text
$ vimtutor                    # the built-in 30-minute tutorial. Worth every minute

On most servers vi starts vim (or a small version of it), so everything here works with vi too.

Getting into insert mode, and out

Moving around (normal mode)

Put a number in front of a command to repeat it: 5j moves down five lines, 3dd deletes three.

Changing text (normal mode)

Search and replace

/listen        search forward for "listen"     n = next match, N = previous
?listen        search backward
:noh           clear the highlight

:s/8080/9090/            first match on this line only
:s/8080/9090/g           every match on this line
:%s/8080/9090/g          every match in the whole file
:%s/8080/9090/gc         every match, asking y/n/a/q for each one
:10,20s/http:/https:/g   only lines 10 to 20

% means every line, g every match on a line, c confirm. Use gc on anything that matters: :%s/80/8080/g would also turn 8000 into 808000. If a replace goes wrong, one u undoes all of it. In nano, Ctrl+\ asks the same questions: what to find, what to replace it with, then Y, N or A (all) for each match.

⤢ View

What :%s/8080/9090/gc really looks like: vim highlights each match and asks before changing it. y replaces, n skips, a replaces the rest, q stops.© Screenshot: DevOps Academy

Close

Save and quit safely

Three things go wrong sooner or later. Here's what each one means:

Editing a server's config without breaking it

One typo in nginx.conf or sshd_config, followed by a restart, can take a site down or lock you out of the server. Experienced engineers follow the same five steps every time:

⤢ View

Never restart on a config you haven't validated. Keep the backup until you've verified.© Diagram: DevOps Academy

Close

$ sudo cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak-$(date +%F)   # 1. back up
$ sudoedit /etc/nginx/nginx.conf                                       # 2. edit
$ sudo nginx -t                                                         # 3. validate
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
$ sudo systemctl reload nginx                                           # 4. reload, not restart
$ curl -sI http://localhost | head -n 1                                 # 5. verify
HTTP/1.1 200 OK

Most services have a check for step 3:

If step 3 or step 5 fails, roll back with sudo cp /etc/nginx/nginx.conf.bak-2026-10-13 /etc/nginx/nginx.conf (use your backup's date), then reload again. reload keeps the running service up while it reads the new config; restart stops it first, which is the moment a broken file takes you down.

When an editor isn't the right tool

Scripts and pipelines can't press Ctrl+O. To create a file without opening an editor:

$ cat > ~/lab2/app.conf <<'EOF'
port = 8080
log_level = info
EOF
$ cat ~/lab2/app.conf
port = 8080
log_level = info

<<'EOF' (a "heredoc") feeds the lines up to EOF into the command. The quotes stop the shell from expanding $VARIABLES inside it.

For a file only root may write, sudo cat > /etc/myapp/app.conf fails: the > belongs to your own shell, which runs without sudo. Let tee do the writing instead:

$ sudo tee /etc/myapp/app.conf > /dev/null <<'EOF'
port = 8080
EOF

For one-line changes in scripts (sed -i 's/8080/9090/' app.conf), see the Text processing lesson.

Choosing your default editor

git commit, crontab -e, kubectl edit and many other tools open an editor for you. They pick it from these variables:

$ echo 'export EDITOR=nano' >> ~/.bashrc     # or vim
$ echo 'export VISUAL=nano' >> ~/.bashrc     # some tools check VISUAL first
$ source ~/.bashrc
$ git config --global core.editor nano       # git's own setting wins over both

On Ubuntu and Debian, sudo update-alternatives --config editor sets the system-wide default, which is why visudo opens nano there. visudo and sudoedit also follow SUDO_EDITOR, VISUAL and EDITOR.

$ mkdir -p ~/lab2 && cat > ~/lab2/app.conf <<'EOF'
name = payments
port = 8080
log_level = info
health_url = http://localhost:8080/health
EOF
$ cp ~/lab2/app.conf ~/lab2/app.conf.bak      # 1. back up
$ vim ~/lab2/app.conf                          # 2. edit: :%s/8080/9090/gc, y, y, then :wq
$ grep -n 9090 ~/lab2/app.conf                 # 3. check the new value is there
2:port = 9090
4:health_url = http://localhost:9090/health
$ diff ~/lab2/app.conf.bak ~/lab2/app.conf     # 4. prove nothing else changed
2c2
< port = 8080
---
> port = 9090
4c4
< health_url = http://localhost:8080/health
---
> health_url = http://localhost:9090/health