第5周作業
1、顯示/boot/grub/grub.conf中以至少一個空白字符開頭的行;
[root@iZ28zld7ztoZ ~]# grep '^[[:space:]]' /boot/grub/grub.conf
[root@iZ28zld7ztoZ ~]# grep -E '^[[:space:]]' /boot/grub/grub.conf //也可以加上-E參數
2、顯示/etc/rc.d/rc.sysinit文件中以#開頭,后面跟至少一個空白字符,而后又有至少一個非空白字符的行;
[root@iZ28zld7ztoZ ~]# grep -E '^#[[:space:]]+[^[:space:]]+' /etc/rc.d/rc.sysinit # /etc/rc.d/rc.sysinit - run once at boot time # Taken in part from Miquel van Smoorenburg's bcheckrc.
[root@iZ28zld7ztoZ ~]# egrep "^#[[:space:]]{1,}[^[:space:]]{1,}" /etc/rc.d/rc.sysinit # /etc/rc.d/rc.sysinit - run once at boot time # Taken in part from Miquel van Smoorenburg's bcheckrc
3、打出netstat -tan命令執行結果中以‘LISTEN’,后或跟空白字符結尾的行;
[root@iZ28zld7ztoZ ~]# netstat -tan | grep 'LISTEN[[:space:]]' tcp 0 0 0.0.0.0:9998 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:9999 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:9009 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:6071 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:6072 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:7072 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:47746 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:2181 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:8071 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:8009 0.0.0.0:* LISTEN
[root@iZ28zld7ztoZ ~]# netstat -anpt | grep 'LISTEN[[:space:]]' tcp 0 0 0.0.0.0:9998 0.0.0.0:* LISTEN 21777/java tcp 0 0 0.0.0.0:9999 0.0.0.0:* LISTEN 21489/java tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN 696/nginx tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 696/nginx tcp 0 0 0.0.0.0:9009 0.0.0.0:* LISTEN 21777/java tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 24475/sshd tcp 0 0 127.0.0.1:6071 0.0.0.0:* LISTEN 21489/java tcp 0 0 0.0.0.0:6072 0.0.0.0:* LISTEN 21489/java tcp 0 0 0.0.0.0:7072 0.0.0.0:* LISTEN 21777/java tcp 0 0 0.0.0.0:47746 0.0.0.0:* LISTEN 5799/java tcp 0 0 0.0.0.0:2181 0.0.0.0:* LISTEN 5799/java tcp 0 0 127.0.0.1:8071 0.0.0.0:* LISTEN 21777/java tcp 0 0 0.0.0.0:8009 0.0.0.0:* LISTEN 21489/java
4、添加用戶bash, testbash, basher, nologin (此一個用戶的shell為/sbin/nologin),而后找出當前系統上其用戶名和默認shell相同的用戶的信息;
[root@iZ28zld7ztoZ ~]# useradd bash [root@iZ28zld7ztoZ ~]# useradd testbash [root@iZ28zld7ztoZ ~]# useradd basher [root@iZ28zld7ztoZ ~]# useradd -s /sbin/nologin nologin [root@iZ28zld7ztoZ ~]# grep '^\([^:]\+\):.*/\1$' /etc/passwd sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt bash:x:901:902::/home/bash:/bin/bash nologin:x:904:905::/home/nologin:/sbin/nologin
或: [root@iZ28zld7ztoZ ~]# grep -E "(^[[:alpha:]]+):.*\1$" /etc/passwd sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt bash:x:901:902::/home/bash:/bin/bash nologin:x:904:905::/home/nologin:/sbin/nologin
5、顯示當前系統上root、fedora或user1用戶的默認shell;
[root@iZ28zld7ztoZ ~]# grep -E '^(root|fedora|user1)' /etc/passwd root:x:0:0:root:/root:/bin/bash [root@iZ28zld7ztoZ ~]# grep -E '^(root|fedora|user1)' /etc/passwd | cut -d: -f7 /bin/bash
6、找出/etc/rc.d/init.d/functions文件中某單詞后面跟一組小括號的行,形如:hello();
[root@iZ28zld7ztoZ ~]# grep --color=auto '[[:alpha:]]\+()' /etc/rc.d/init.d/functions fstab_decode_str() { checkpid() { __readlink() { __fgrep() { __umount_loop() { __umount_loopback_loop() { __pids_var_run() { __pids_pidof() { daemon() { killproc() { pidfileofproc() { pidofproc() { status() { echo_success() { echo_failure() { echo_passed() { echo_warning() { update_boot_stage() { success() { failure() { passed() { warning() { action() { strstr() { confirm() { get_numeric_dev() { is_ignored_file() { is_true() { is_false() { apply_sysctl() { key_is_random() { find_crypto_mount_point() { init_crypto() {
7、使用echo命令輸出一個絕對路徑,使用grep取出其基名;
擴展:取出其路徑名
[root@iZ28zld7ztoZ ~]# echo "/etc/rc.d/init.d/functions" | grep -E -o "[^/]+/?$" functions [root@iZ28zld7ztoZ ~]# echo "/etc/rc.d/init.d/functions" | grep -E -o "[^/]+/?$" | cut -d"/" -f 1 functions [root@iZ28zld7ztoZ ~]# echo "/etc/rc.d/init.d/functions" | grep -o -E "(/.*/)" /etc/rc.d/init.d/
8、找出ifconfig命令結果中的1-255之間數字;
[root@iZ28zld7ztoZ ~]# ifconfig eth0 Link encap:Ethernet HWaddr 00:16:3E:00:18:DD inet addr:10.251.142.220 Bcast:10.251.143.255 Mask:255.255.248.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:60515 errors:0 dropped:0 overruns:0 frame:0 TX packets:114069 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:4386520 (4.1 MiB) TX bytes:8523620 (8.1 MiB) Interrupt:165 eth1 Link encap:Ethernet HWaddr 00:16:3E:00:0B:F7 inet addr:139.129.20.55 Bcast:139.129.23.255 Mask:255.255.252.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:3242396 errors:0 dropped:0 overruns:0 frame:0 TX packets:1762547 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:3011542125 (2.8 GiB) TX bytes:164042924 (156.4 MiB) Interrupt:164 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:9068 errors:0 dropped:0 overruns:0 frame:0 TX packets:9068 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:1250304 (1.1 MiB) TX bytes:1250304 (1.1 MiB)
[root@iZ28zld7ztoZ ~]# ifconfig | grep -E -o --color=auto '\<[0-9]\>|\<[1-9][0-9]\>|\<1[0-9][0-9]\>|\<2[0-4][0-9]\>|<25[0-5]\>' 16 18 10 142 220 10 143 248 0 1 0 0 0 0 0 0 0 0 0 4 1 8 1 165 16 139 129 20 55 139 129 23 0 1 0 0 0 0 0 0 0 0 0 2 8 156 4 164 127 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1 1 1 1
下面是列出帶有數字的行: [root@iZ28zld7ztoZ ~]# ifconfig | grep -wE '([1-9]|[1-9][0-9]|1[0-9][0-9]|2[0-5][0-5])' eth0 Link encap:Ethernet HWaddr 00:16:3E:00:18:DD inet addr:10.251.142.220 Bcast:10.251.143.255 Mask:255.255.248.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX bytes:4386624 (4.1 MiB) TX bytes:8523752 (8.1 MiB) Interrupt:165 eth1 Link encap:Ethernet HWaddr 00:16:3E:00:0B:F7 inet addr:139.129.20.55 Bcast:139.129.23.255 Mask:255.255.252.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX bytes:3011580193 (2.8 GiB) TX bytes:164085744 (156.4 MiB) Interrupt:164 inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:16436 Metric:1 RX bytes:1250304 (1.1 MiB) TX bytes:1250304 (1.1 MiB) [root@iZ28zld7ztoZ ~]# ifconfig | grep -wE '[1-9][0-9]?|1[0-9][0-9]|2[0-5][0-5]' eth0 Link encap:Ethernet HWaddr 00:16:3E:00:18:DD inet addr:10.251.142.220 Bcast:10.251.143.255 Mask:255.255.248.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX bytes:4386624 (4.1 MiB) TX bytes:8523752 (8.1 MiB) Interrupt:165 eth1 Link encap:Ethernet HWaddr 00:16:3E:00:0B:F7 inet addr:139.129.20.55 Bcast:139.129.23.255 Mask:255.255.252.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX bytes:3011580635 (2.8 GiB) TX bytes:164087098 (156.4 MiB) Interrupt:164 inet addr:127.0.0.1 Mask:255.0.0.0
9、挑戰題:寫一個模式,能匹配合理的IP地址;
IP為:[0-255].[0-255].[0-255].[0-255] [root@iZ28zld7ztoZ ~]# ifconfig | grep -wE '(([0-1]?[0-9]?[0-9]|2[0-5]{2})\.){3}([0-1]?[0-9]?[0-9]|2[0-5]{2})' inet addr:10.251.142.220 Bcast:10.251.143.255 Mask:255.255.248.0 inet addr:139.129.20.55 Bcast:139.129.23.255 Mask:255.255.252.0 inet addr:127.0.0.1 Mask:255.0.0.0
[root@iZ28zld7ztoZ ~]# ifconfig | egrep -o '[1-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' 255.255.248.0 139.129.20.55 139.129.23.255 255.255.252.0 127.0.0.1 255.0.0.0
10、挑戰題:寫一個模式,能匹配出所有的郵件地址;
grep -E '[[:alnum:]]+.*@[[:alnum:]]+\.[[:alnum:]]+\.?[[:alpha:]]+' //抄的
[root@iZ28zld7ztoZ ~]# vi /home/mail.txt www@mail.com zhouyong@365.com 123 abcdef01234
[root@iZ28zld7ztoZ home]# grep -E "^([a-zA-Z0-9_\-\.\+]+)@([a-zA-Z0-9_\-\.\+]+)\.([a-zA-Z]{2,5})$" mail.txt www@mail.com zhouyong@365.com
或: [root@iZ28zld7ztoZ home]# grep -E '[[:alnum:]]+.*@[[:alnum:]]+\.[[:alnum:]]+\.?[[:alpha:]]+' mail.txt www@mail.com zhouyong@365.com
11、查找/var目錄下屬主為root,且屬組為mail的所有文件或目錄;
[root@iZ28zld7ztoZ ~]# find /var -user root -group mail /var/spool/mail [root@iZ28zld7ztoZ ~]# find /var/ -user root -a -group mail -ls 786973 4 drwxrwxr-x 2 root mail 4096 Aug 6 22:50 /var/spool/mail
11.1 關于find
命令-ls
參數的用法總結
在
find
命令中使用了-a
(邏輯與)或-o
(邏輯或)時,如果還需要使用-ls
參數,則需要注意:
-a
: 使用邏輯與時,各條件是否使用()括起來均可,建議使用()括起來;
-O
: 使用邏輯或時,各條件必須使用()括起來,否則查找結果顯示錯誤。
-o
:若不使用(),一般認為會顯示最后一個邏輯條件的查找結果,但是實驗發現,最后一個邏輯條件的查找結果顯示也是錯誤的,所以邏輯或查找條件中,必須將各條件用()括起來。
示例:
-a
: 可以省略不寫
[root@rhel-5 var]# find /var -user oracle -group mail -ls 2763626 0 -rw-r--r-- 1 oracle mail 0 8月 1 14:48 /var/123.sh 3390953 0 -rw-rw---- 1 oracle mail 0 7月 29 15:34 /var/spool/mail/oracle [root@rhel-5 var]# find /var \( -user oracle -group mail \) -ls 2763626 0 -rw-r--r-- 1 oracle mail 0 8月 1 14:48 /var/123.sh 3390953 0 -rw-rw---- 1 oracle mail 0 7月 29 15:34 /var/spool/mail/oracle
-o
:該參數配合-ls
使用時,注意以下兩點:
第一條命令中,各邏輯條件不用()括起來,一般認為其只會顯示最后一個邏輯條件的結果,即 -group mail,但是/var/123.sh的屬組為mail,結果卻沒有顯示出來,所以顯示最后一個邏輯條件的查找結果的說法也是錯誤的。
find命令使用邏輯或進行條件查找時,各條件必須使用()括起來。
[root@rhel-5 var]# find /var -user oracle -o -group mail -ls 3381291 8 drwxrwxr-x 2 root mail 4096 8月 1 13:44 /var/spool/mail 3413767 0 -rw-rw---- 1 nologin mail 0 7月 31 19:26 /var/spool/mail/nologin 3413764 0 -rw-rw---- 1 bash mail 0 7月 31 19:26 /var/spool/mail/bash 3390134 4 -rw-rw---- 1 rpc mail 0 7月 29 10:01 /var/spool/mail/rpc 3413766 0 -rw-rw---- 1 basher mail 0 7月 31 19:26 /var/spool/mail/basher 3413765 0 -rw-rw---- 1 testbasher mail 0 7月 31 19:26 /var/spool/mail/testbasher 3413768 0 -rw-rw---- 1 testbash mail 0 8月 1 13:44 /var/spool/mail/testbash 3413763 0 -rw-rw---- 1 hadoop mail 0 7月 31 19:04 /var/spool/mail/hadoop 70581 8 drwx------ 2 root mail 4096 7月 28 2011 /var/spool/mqueue [root@rhel-5 var]# find /var \( -user oracle -o -group mail \) -ls 397605 0 srwxrwxrwx 1 oracle oinstall 0 7月 29 15:59 /var/tmp/.oracle/sEXTPROC1521 397606 0 srwxrwxrwx 1 oracle oinstall 0 7月 29 15:59 /var/tmp/.oracle/s#27699.2 397604 0 srwxrwxrwx 1 oracle oinstall 0 7月 29 15:59 /var/tmp/.oracle/s#27699.1 41919 16 -rw------- 1 oracle oinstall 15000 7月 29 15:35 /var/cache/coolkey/coolkeypk11sE-Gate\ 0\ 0-500 2763626 0 -rw-r--r-- 1 oracle mail 0 8月 1 14:48 /var/123.sh 3381291 8 drwxrwxr-x 2 root mail 4096 8月 1 13:44 /var/spool/mail 3413767 0 -rw-rw---- 1 nologin mail 0 7月 31 19:26 /var/spool/mail/nologin 3413764 0 -rw-rw---- 1 bash mail 0 7月 31 19:26 /var/spool/mail/bash 3390134 4 -rw-rw---- 1 rpc mail 0 7月 29 10:01 /var/spool/mail/rpc 3413766 0 -rw-rw---- 1 basher mail 0 7月 31 19:26 /var/spool/mail/basher 3413765 0 -rw-rw---- 1 testbasher mail 0 7月 31 19:26 /var/spool/mail/testbasher 3413768 0 -rw-rw---- 1 testbash mail 0 8月 1 13:44 /var/spool/mail/testbash 3413763 0 -rw-rw---- 1 hadoop mail 0 7月 31 19:04 /var/spool/mail/hadoop 3390953 0 -rw-rw---- 1 oracle mail 0 7月 29 15:34 /var/spool/mail/oracle 70581 8 drwx------ 2 root mail 4096 7月 28 2011 /var/spool/mqueue
12、查找當前系統上沒有屬主或屬組的文件;
進一步:查找當前系統上沒有屬主或屬組,且最近3天內曾被訪問過的文件或目錄;
[root@iZ28zld7ztoZ ~]# find / -nouser -o -nogroup find: `/proc/29618/task/29618/fd/5': No such file or directory find: `/proc/29618/task/29618/fd/5': No such file or directory find: `/proc/29618/task/29618/fdinfo/5': No such file or directory find: `/proc/29618/task/29618/fdinfo/5': No such file or directory find: `/proc/29618/fd/5': No such file or directory ……
[root@iZ28zld7ztoZ ~]# find / \( -nouser -o -nogroup \) -a -atime -3
或:[root@iZ28zld7ztoZ ~]# find / -nouser -o -nogroup -a -atime -3 [root@iZ28zld7ztoZ ~]# find /var -user oracle -o -group mail -ls
find
命令的邏輯條件查找中使用-ls
參數,需要用()將各邏輯條件括起來。
13、查找/etc目錄下所有用戶都有寫權限的文件;
[root@iZ28zld7ztoZ ~]# find /etc/ -perm -222
14、查找/etc目錄下大于1M,且類型為普通文件的所有文件;
[root@iZ28zld7ztoZ ~]# find /etc/ -size +1M -type f /etc/backup/1/initramfs-2.6.32-431.23.3.el6.x86_64.img /etc/selinux/targeted/policy/policy.24 /etc/selinux/targeted/modules/active/policy.kern
[root@iZ28zld7ztoZ ~]# find /etc/ \( -size +1M -type f \) -ls 918464 16712 -rw------- 1 root root 17109426 Jul 24 2015 /etc/backup/1/initramfs-2.6.32-431.23.3.el6.x86_64.img 919180 7124 -rw-r--r-- 1 root root 7292905 Aug 14 2014 /etc/selinux/targeted/policy/policy.24 919175 7124 -rw-r--r-- 1 root root 7292905 Aug 14 2014 /etc/selinux/targeted/modules/active/policy.kern [root@iZ28zld7ztoZ ~]#
15、查找/etc/init.d/目錄下,所有用戶都有執行權限,且其它用戶有寫權限的文件;
[root@iZ28zld7ztoZ ~]# find /etc/init.d/ -perm -113 [root@iZ28zld7ztoZ ~]# find /etc/init.d/ -perm -113 -ls
16、查找/usr目錄下不屬于root、bin或hadoop的文件;
[root@iZ28zld7ztoZ ~]# find /usr ! \( -user root -o -user bin -o -user hadoop \) -ls 9136 4 drwx------ 2 nobody root 4096 Jun 30 16:55 /usr/local/nginx/client_body_temp 9137 4 drwx------ 2 nobody root 4096 Jun 30 16:55 /usr/local/nginx/proxy_temp 9138 4 drwx------ 2 nobody root 4096 Jun 30 16:55 /usr/local/nginx/fastcgi_temp 9140 4 drwx------ 2 nobody root 4096 Jun 30 16:55 /usr/local/nginx/scgi_temp 9139 4 drwx------ 2 nobody root 4096 Jun 30 16:55 /usr/local/nginx/uwsgi_temp
[root@iZ28zld7ztoZ ~]# find /usr \( -not -user root -a -not -user bin -a -not -user hadoop \) /usr/local/nginx/client_body_temp /usr/local/nginx/proxy_temp /usr/local/nginx/fastcgi_temp /usr/local/nginx/scgi_temp /usr/local/nginx/uwsgi_temp
[root@iZ28zld7ztoZ ~]# find /usr -not \( -user root -o -user bin -o -user hadoop \) -ls 9136 4 drwx------ 2 nobody root 4096 Jun 30 16:55 /usr/local/nginx/client_body_temp 9137 4 drwx------ 2 nobody root 4096 Jun 30 16:55 /usr/local/nginx/proxy_temp 9138 4 drwx------ 2 nobody root 4096 Jun 30 16:55 /usr/local/nginx/fastcgi_temp 9140 4 drwx------ 2 nobody root 4096 Jun 30 16:55 /usr/local/nginx/scgi_temp 9139 4 drwx------ 2 nobody root 4096 Jun 30 16:55 /usr/local/nginx/uwsgi_temp
17、查找/etc/目錄下至少有一類用戶沒有寫權限的文件;
[root@iZ28zld7ztoZ ~]# find /etc ! -perm -222 -ls [root@iZ28zld7ztoZ ~]# find /etc ! -perm -222 -ls | tail -fn 10 917782 4 drwxr-xr-x 2 root root 4096 Aug 14 2014 /etc/event.d 917815 4 -rw-r--r-- 1 root root 141 Nov 11 2010 /etc/event.d/ck-log-system-start 917816 4 -rw-r--r-- 1 root root 137 Nov 11 2010 /etc/event.d/ck-log-system-stop 917814 4 -rw-r--r-- 1 root root 146 Nov 11 2010 /etc/event.d/ck-log-system-restart 918495 4 drwxr-xr-x 2 root root 4096 Aug 3 10:57 /etc/portreserve 918525 4 -rw-r--r-- 1 root root 29 May 12 03:22 /etc/portreserve/dhcpd 918503 4 drwxr-xr-x 3 root root 4096 Aug 3 17:11 /etc/ansible 918566 4 drwxr-xr-x 2 root root 4096 May 25 23:50 /etc/ansible/roles 918565 4 -rw-r--r-- 1 root root 1016 May 25 23:50 /etc/ansible/hosts 918564 16 -rw-r--r-- 1 root root 13819 May 25 23:50 /etc/ansible/ansible.cfg
#find /etc/ -not -perm -222 –ls //! 等價于not
18、查找/etc目錄下最近一周內其內容被修改過,且不屬于root或hadoop的文件;
[root@iZ28zld7ztoZ ~]# find /etc/ -mtime -7 -a ! -user root -a ! -user hadoop
[root@iZ28zld7ztoZ ~]# find /etc/ -mtime -7 -a -not -user root -a -not -user hadoop
[root@iZ28zld7ztoZ ~]# find /etc/ -mtime -7 -a -not \( -user root -o -user hadoop \)
原創文章,作者:365,如若轉載,請注明出處:http://www.www58058.com/30381
寫的很好,排版也很棒,加油,ip的匹配不對