1、显示/boot/grub/grub.conf中以至少一个空白字符开头的行；
[root@localhost proc]# grep "^[[:space:]]\{1,\}" /boot/grub/grub.conf
root (hd0,0)
kernel /vmlinuz-2.6.32-358.el6.i686 ro root=UUID=a7a4e707-a51b-41fd-9ac6-7c36e53afb26 rd_NO_LUKS rd_NO_LVM.UTF-8 rd_NO_MD SYSFONT=latarcyrheb-sun16 crashkernel=auto KEYBOARDTYPE=pc KEYTABLE=us rd_NO_DM rhgb quiet
initrd /initramfs-2.6.32-358.el6.i686.img
2、显示/etc/rc.d/rc.sysinit文件中以#开头，后面跟至少一个空白字符，而后又有至少一个非空白字符的行；
[root@localhost proc]# grep "^#[[:space:]][[:space:]]\{1,\}" /etc/rc.d/rc.sysinit
# /etc/rc.d/rc.sysinit - run once at boot time
[root@localhost proc]# grep "^#[[:space:]][[:space:]]\+" /etc/rc.d/rc.sysinit
# /etc/rc.d/rc.sysinit - run once at boot time
3、打出netstat -tan命令执行结果中以‘LISTEN’，后或跟空白字符结尾的行；
[root@localhost proc]# netstat -tan | grep "LISTEN[[:space:]]*$" tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN tcp 0 0 :::22 :::* LISTEN tcp 0 0 ::1:631 :::* LISTEN tcp 0 0 ::1:25 :::* LISTEN
4、添加用户bash, testbash, basher, nologin (此一个用户的shell为/sbin/nologin)，而后找出当前系统上其用户名和默认shell相同的用户的信息；
[root@localhost proc]# useradd bash
useradd: user 'bash' already exists
[root@localhost proc]# useradd testbash
[root@localhost proc]# useradd basher
useradd: user 'basher' already exists
[root@localhost proc]# userad nologin -s /sbin/nologin
[root@localhost ~]# grep "^\(\<[[:alpha:]]\{1,\}\>\).*\1$" /etc/passwd
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
bash:x:2005:2005::/home/bash:/bin/bash
nologin:x:2008:2008::/home/nologin:/sbin/nologin
5、显示当前系统上root、fedora或user1用户的默认shell；
[root@localhost ~]# egrep "^(root|fedora|user1)" /etc/passwd | cut -d : -f 7 /bin/bash /bin/bash
6、找出/etc/rc.d/init.d/functions文件中某单词后面跟一组小括号的行，形如：hello()；
[root@localhost proc]# grep --color=auto "\<[[:alpha:]]*\>()" /etc/rc.d/init.d/functions
checkpid() {
daemon() {
killproc() {
pidfileofproc() {
pidofproc() {
status() {
success() {
failure() {
passed() {
warning() {
action() {
strstr() {
confirm() {
7、使用echo命令输出一个绝对路径，使用grep取出其基名；
扩展：取出其路径名
[root@localhost ~]# echo "/etc/yum/dre/" | egrep -o "[^/]+/?$" | cut -d / -f 1 dre
[root@localhost ~]# echo "/etc/yum/dre/" | egrep "[^/]+/?$" /etc/yum/dre/
8、找出ifconfig命令结果中的1-255之间数字；
[root@localhost ~]# ifconfig | grep --color -o "[0-2]\?[0-5]\?[0-5]\?" | sort -u -n 0 1 2 3 4 5 10 12 20 23 25 40 42 43 52 100 103 150 202 255
9、挑战题：写一个模式，能匹配合理的IP地址；
[root@localhost ~]# ifconfig | grep -o "[1-9]\{1,3\}.[0-9]\{1,3\}.[0-9]\{1,3\}.[0-9]\{1,2\}[2-9]"
192.168.0.103
192.168.0.255
255.255.255.0
1161024
127.0.0.1
255.0.0.0
10、挑战题：写一个模式，能匹配出所有的邮件地址；
[root@localhost ~]# cat mail.txt | egrep ".*@(163|qq|126|gmail|dfl)\." iwangl_3242@163.com 446323389@qq.com wanzhihao@gmail.com zhangdsew_1232@126.com sdfsa@dfl.com.cn
11、查找/var目录下属主为root，且属组为mail的所有文件或目录；
[root@localhost ~]# ll /var | grep "\<root\>[[:space:]]\<mail\>" | cut -d " " -f 11 test
12、查找当前系统上没有属主或属组的文件；
进一步：查找当前系统上没有属主或属组，且最近3天内曾被访问过的文件或目录；
[root@localhost ~]# find / -nouser -o -nogroup find: `/proc/12026/task/12026/fd/5': No such file or directory find: `/proc/12026/task/12026/fd/5': No such file or directory find: `/proc/12026/task/12026/fdinfo/5': No such file or directory find: `/proc/12026/task/12026/fdinfo/5': No such file or directory find: `/proc/12026/fd/5': No such file or directory find: `/proc/12026/fd/5': No such file or directory find: `/proc/12026/fdinfo/5': No such file or directory find: `/proc/12026/fdinfo/5': No such file or directory
[root@localhost ~]# find / -nouser -o -nogroup -atime -3 /var/spool/mail/user1 find: `/proc/12100/task/12100/fd/5': No such file or directory find: `/proc/12100/task/12100/fd/5': No such file or directory find: `/proc/12100/task/12100/fdinfo/5': No such file or directory find: `/proc/12100/task/12100/fdinfo/5': No such file or directory find: `/proc/12100/fd/5': No such file or directory find: `/proc/12100/fd/5': No such file or directory find: `/proc/12100/fdinfo/5': No such file or directory find: `/proc/12100/fdinfo/5': No such file or directory /home/user1 /home/user1/.bash_logout /home/user1/.bash_profile /home/user1/.mozilla /home/user1/.mozilla/plugins /home/user1/.mozilla/extensions /home/user1/.bashrc
13、查找/etc目录下所有用户都有写权限的文件；
[root@localhost ~]# ll /etc | grep --color "^...x..x..x" | cut -d " " -f 12 abc abrt acpi alsa alternatives avahi bash_completion.d blkid bluetooth bonobo-activation 2012 ConsoleKit cron.d cron.daily cron.hourly cron.monthly 2011 dbus-1 default depmod.d 2013 dracut.conf.d event.d 26 festival fonts foomatic gconf 2012 gdm ghostscript gnome-vfs-2.0 2010 26 gtk-2.0 hal hp httpd init 26 iproute2 kdump-adv-conf ld.so.conf.d libreport logrotate.d lvm makedev.d modprobe.d NetworkManager ntp obex-data-server openldap 2011 PackageKit pam.d pango pcmcia pki plymouth pm polkit-1 2010 portreserve postfix ppp prelink.conf.d profile.d pulse Jun 26 26 26 26 26 26 26 rc.d 26 26 26 rpm 2013 2013 samba sane.d sasl2 scl security selinux setuptool.d sgml skel snmp sound ssh ssl 2013 sysconfig 26 2010 04:48 udev vmware-tools vsftpd wpa_supplicant X11 xdg xinetd.d xml yum 2013
14、查找/etc目录下大于1M，且类型为普通文件的所有文件；
[root@localhost etc]# find /etc -type f -size +1M -ls 925752 7068 -rw-r--r-- 1 root root 7234873 Jun 26 16:17 /etc/selinux/targeted/modules/active/policy.kern 926031 7068 -rw-r--r-- 1 root root 7234873 Jun 26 16:17 /etc/selinux/targeted/policy/policy.24 924656 1976 -rw-r--r-- 1 root root 2020884 Jun 26 16:10 /etc/gconf/gconf.xml.defaults/%gconf-tree.xml
15、查找/etc/init.d/目录下，所有用户都有执行权限，且其它用户有写权限的文件；
[root@localhost etc]# ll /etc/init.d/ | grep "^...x..x.wx"
16、查找/usr目录下不属于root、bin或hadoop的文件；
[root@localhost ~]# find /usr/ -not \( -user root -o -user bin -o -user hadoop \) -ls 267966 4 drwxrwxr-x 2 weblogic weblogic 4096 Aug 7 03:13 /usr/test 289857 8 -rwsr-xr-x 1 abrt abrt 6676 Feb 22 2013 /usr/libexec/abrt-action-install-debuginfo-to-abrt-cache
17、查找/etc/目录下至少有一类用户没有写权限的文件；
[root@localhost ~]# find /etc/ -not -perm 222 -ls | head -n 10 917506 12 drwxr-xr-x 102 root root 12288 Aug 7 03:09 /etc/ 924864 4 drwxr-xr-x 3 root root 4096 Jun 26 16:10 /etc/scl 924866 4 drwxr-xr-x 2 root root 4096 Feb 21 2013 /etc/scl/prefixes 924719 4 -rw-r--r-- 1 root root 1314 Aug 6 02:52 /etc/tpvmlp.conf 917823 4 drwxr-xr-x 2 root root 4096 Jun 26 16:17 /etc/pulse 918306 8 -rw-r--r-- 1 root root 4771 Nov 22 2009 /etc/pulse/default.pa.BeforeVMwareToolsInstall 918226 4 -rw-r--r-- 1 root root 2134 Nov 22 2009 /etc/pulse/daemon.conf 917824 4 -rw-r--r-- 1 root root 1184 Jul 11 2012 /etc/pulse/client.conf 918813 8 -rw-r--r-- 1 root root 4780 Jun 26 16:17 /etc/pulse/default.pa 918307 4 -rw-r--r-- 1 root root 1978 Jul 11 2012 /etc/pulse/system.pa
18、查找/etc目录下最近一周内其内容被修改过，且不属于root或hadoop的文件；
[root@localhost ~]# find /etc -mtime -7 -not \( -user root -a -user hadoop \) -ls 917506 12 drwxr-xr-x 102 root root 12288 Aug 7 03:09 /etc 924719 4 -rw-r--r-- 1 root root 1314 Aug 6 02:52 /etc/tpvmlp.conf 917661 4 -rw------- 1 root root 1017 Aug 6 23:46 /etc/group- 927360 4 -rw-r--r-- 1 root root 403 Aug 6 04:44 /etc/mtab 917665 4 -rw-r--r-- 1 root root 1944 Aug 6 23:46 /etc/passwd- 917539 4 -rw------- 1 root root 812 Aug 6 23:46 /etc/gshadow- 917547 4 ---------- 1 root root 1121 Aug 6 23:46 /etc/shadow- 918106 4 -rw-r--r-- 1 root root 45 Aug 6 02:49 /etc/adjtime 927364 4 -rw-r--r-- 1 root root 1025 Aug 7 03:09 /etc/group 927358 4 -rw-r--r-- 1 root root 881 Aug 6 04:44 /etc/fstab 927366 4 ---------- 1 root root 1150 Aug 6 23:46 /etc/shadow 917614 4 drwxr-xr-x 10 root root 4096 Aug 6 23:32 /etc/rc.d 917628 4 drwxr-xr-x 2 root root 4096 Aug 6 02:52 /etc/rc.d/rc5.d 917517 0 lrwxrwxrwx 1 root root 16 Aug 6 02:52 /etc/rc.d/rc5.d/S11auditd -> ../init.d/auditd 927359 20 -rwxr-xr-x 1 root root 19473 Aug 6 23:32 /etc/rc.d/rc.sysinit 927365 4 -rw-r--r-- 1 root root 1987 Aug 6 23:46 /etc/passwd 927363 4 ---------- 1 root root 820 Aug 7 03:09 /etc/gshadow 918241 4 drwxr-xr-x 5 root lp 4096 Aug 6 02:52 /etc/cups 917522 4 -rw------- 1 root lp 2004 Aug 6 02:52 /etc/cups/printers.conf 918140 4 -rw------- 1 root lp 128 Aug 6 02:52 /etc/cups/classes.conf 918242 4 -rw------- 1 root lp 128 Aug 5 18:34 /etc/cups/classes.conf.O 917932 4 -rw------- 1 root lp 2004 Aug 5 18:34 /etc/cups/printers.conf.O 917548 4 -rw-r--r-- 1 root root 763 Aug 6 02:52 /etc/printcap 924810 4 -rw-r--r-- 1 root root 49 Aug 6 02:52 /etc/resolv.conf 927353 248 -rw-r--r-- 1 root root 253231 Aug 5 19:36 /etc/prelink.cache
原创文章，作者：liliangming，如若转载，请注明出处：http://www.178linux.com/30553
评论列表（1条）
写的很好，排版也很棒，加油，9 10 都不对，13 15也不对