1、显示/etc/rc.d/rc.sysinit文件中以不区分大小的h开头的行:
[root@server ~]# grep -n ^[Hh] /etc/rc.d/rc.sysinit
2、显示/etc/passwd中以sh结尾的行;
[root@server ~]# grep -n "sh$" /etc/passwd
1:root:x:0:0:root:/root:/bin/bash
37:fox:x:1000:1000::/home/fox:/bin/bash
3、显示/etc/fstab中以#开头,且后面跟一个或多个空白字符,而后又跟了任意非空白字符的行:
[root@server ~]# egrep "^#[[:space:]]+[^[:space:]]" /etc/fstab
# /etc/fstab
# Created by anaconda on Wed Sep 6 12:53:07 2023
# Accessible filesystems, by reference, are maintained under '/dev/disk/'.
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info.
# After editing this file, run 'systemctl daemon-reload' to update systemd
# units generated from this file.
4、查找/etc/rc.d/rc.oca1中包含“以to开始并以to结尾”的字串行;
[root@server ~]# grep "^to.to$" /etc/rc.d/rc.oca1
5、查找/etc/inittab中含有“以s开头,并以d结尾的单词”模式的行;
[root@server ~]# egrep -n '\<s[[:alnum:]]+d\>' /etc/inittab
5:# Ctrl-Alt-Delete is handled by /usr/lib/systemd/system/ctrl-alt-del.target
7:# systemd uses 'targets' instead of runlevels. By default, there are two main targets:
6、查找ifconfig命令结果中的1-255之间的整数;
[root@server ~]# ifconfig | egrep -o "\<([1-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\>"
192
168
224
130
255
255
255
192
168
224
255
64
29
7
7
73
127
1
255
1
128
19
2
1
19
2
1
7、显示/var/log/secure文件中包含“Failed”或“FAILED”的行
[root@server ~]# egrep -n "(failed|FAILED)" /var/log/secure
12:Dec 19 13:20:29 server unix_chkpwd[1717]: password check failed for user (root)
8、在/etc/passwd中取出默认she11为bash
[root@server ~]# grep -o ':[^:]*:/bin/bash$' /etc/passwd
:/root:/bin/bash
:/home/fox:/bin/bash
9、以长格式列出/etc/目录下以ns开头、.conf结尾的文件信息10、高亮显示passwd文件中冒号,及其两侧的字符
匹配/etc/services中开头结尾字母一样的单词
[root@server etc]# egrep -o "\<[a-zA-Z][[:alnum:]]+[a-zA-Z]\>" /etc/services
[root@server etc]# ll /etc/ns*.conf
lrwxrwxrwx. 1 root root 29 sep 6 20:58 /etc/nsswitch.conf -> /etc/authselect/nsswitch.conf
[root@server etc]# egrep -o "[[:alnum:]]+:[[:alnum:]]+" /etc/passwd
root:x
0:0
bin:x
1:1
daemon:x
2:2
adm:x
3:4
lp:x
4:7
sync:x
5:0
shutdown:x
6:0
halt:x
7:0
mail:x
8:12
operator:x
11:0
games:x
12:100
ftp:x
14:50
nobody:x
65534:65534
coredump:x
999:997
dbus:x
81:81
polkitd:x
998:996
avahi:x
70:70
tss:x
59:59
colord:x
997:993
clevis:x
996:992
rtkit:x
172:172
sssd:x
995:991
geoclue:x
994:990
libstoragemgmt:x
993:989
setroubleshoot:x
992:988
pipewire:x
991:986
flatpak:x
990:985
gdm:x
42:42
ws:x
989:984
wsinstance:x
988:983
setup:x
987:982
sshd:x
74:74
chrony:x
986:981
dnsmasq:x
985:980
tcpdump:x
72:72
oom:x
978:978
fox:x
1000:1000
dovecot:x
97:97
dovenull:x
977:977
[root@server etc]# egrep -o "\<[a-zA-Z][[:alnum:]]+[a-zA-Z]\>" /etc/services