1、顯示/boot/grub/grub.conf中以至少一個空白字符開頭的行；
[root@localhost proc]# grep "^[[:space:]]\{1,\}" /boot/grub/grub.conf
root (hd0,0)
kernel /vmlinuz-2.6.32-358.el6.i686 ro root=UUID=a7a4e707-a51b-41fd-9ac6-7c36e53afb26 rd_NO_LUKS rd_NO_LVM.UTF-8 rd_NO_MD SYSFONT=latarcyrheb-sun16 crashkernel=auto KEYBOARDTYPE=pc KEYTABLE=us rd_NO_DM rhgb quiet
initrd /initramfs-2.6.32-358.el6.i686.img
2、顯示/etc/rc.d/rc.sysinit文件中以#開頭，后面跟至少一個空白字符，而后又有至少一個非空白字符的行；
[root@localhost proc]# grep "^#[[:space:]][[:space:]]\{1,\}" /etc/rc.d/rc.sysinit
# /etc/rc.d/rc.sysinit - run once at boot time
[root@localhost proc]# grep "^#[[:space:]][[:space:]]\+" /etc/rc.d/rc.sysinit
# /etc/rc.d/rc.sysinit - run once at boot time
3、打出netstat -tan命令執行結果中以‘LISTEN’，后或跟空白字符結尾的行；
[root@localhost proc]# netstat -tan | grep "LISTEN[[:space:]]*$" tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN tcp 0 0 :::22 :::* LISTEN tcp 0 0 ::1:631 :::* LISTEN tcp 0 0 ::1:25 :::* LISTEN
4、添加用戶bash, testbash, basher, nologin (此一個用戶的shell為/sbin/nologin)，而后找出當前系統上其用戶名和默認shell相同的用戶的信息；
[root@localhost proc]# useradd bash
useradd: user 'bash' already exists
[root@localhost proc]# useradd testbash
[root@localhost proc]# useradd basher
useradd: user 'basher' already exists
[root@localhost proc]# userad nologin -s /sbin/nologin
[root@localhost ~]# grep "^\(\<[[:alpha:]]\{1,\}\>\).*\1$" /etc/passwd
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
bash:x:2005:2005::/home/bash:/bin/bash
nologin:x:2008:2008::/home/nologin:/sbin/nologin
5、顯示當前系統上root、fedora或user1用戶的默認shell；
[root@localhost ~]# egrep "^(root|fedora|user1)" /etc/passwd | cut -d : -f 7 /bin/bash /bin/bash
6、找出/etc/rc.d/init.d/functions文件中某單詞后面跟一組小括號的行，形如：hello()；
[root@localhost proc]# grep --color=auto "\<[[:alpha:]]*\>()" /etc/rc.d/init.d/functions
checkpid() {
daemon() {
killproc() {
pidfileofproc() {
pidofproc() {
status() {
success() {
failure() {
passed() {
warning() {
action() {
strstr() {
confirm() {
7、使用echo命令輸出一個絕對路徑，使用grep取出其基名；
擴展：取出其路徑名
[root@localhost ~]# echo "/etc/yum/dre/" | egrep -o "[^/]+/?$" | cut -d / -f 1 dre
[root@localhost ~]# echo "/etc/yum/dre/" | egrep "[^/]+/?$" /etc/yum/dre/
8、找出ifconfig命令結果中的1-255之間數字；
[root@localhost ~]# ifconfig | grep --color -o "[0-2]\?[0-5]\?[0-5]\?" | sort -u -n 0 1 2 3 4 5 10 12 20 23 25 40 42 43 52 100 103 150 202 255
9、挑戰題：寫一個模式，能匹配合理的IP地址；
[root@localhost ~]# ifconfig | grep -o "[1-9]\{1,3\}.[0-9]\{1,3\}.[0-9]\{1,3\}.[0-9]\{1,2\}[2-9]"
192.168.0.103
192.168.0.255
255.255.255.0
1161024
127.0.0.1
255.0.0.0
10、挑戰題：寫一個模式，能匹配出所有的郵件地址；
[root@localhost ~]# cat mail.txt | egrep ".*@(163|qq|126|gmail|dfl)\." iwangl_3242@163.com 446323389@qq.com wanzhihao@gmail.com zhangdsew_1232@126.com sdfsa@dfl.com.cn
11、查找/var目錄下屬主為root，且屬組為mail的所有文件或目錄；
[root@localhost ~]# ll /var | grep "\<root\>[[:space:]]\<mail\>" | cut -d " " -f 11 test
12、查找當前系統上沒有屬主或屬組的文件；
進一步：查找當前系統上沒有屬主或屬組，且最近3天內曾被訪問過的文件或目錄；
[root@localhost ~]# find / -nouser -o -nogroup find: `/proc/12026/task/12026/fd/5': No such file or directory find: `/proc/12026/task/12026/fd/5': No such file or directory find: `/proc/12026/task/12026/fdinfo/5': No such file or directory find: `/proc/12026/task/12026/fdinfo/5': No such file or directory find: `/proc/12026/fd/5': No such file or directory find: `/proc/12026/fd/5': No such file or directory find: `/proc/12026/fdinfo/5': No such file or directory find: `/proc/12026/fdinfo/5': No such file or directory
[root@localhost ~]# find / -nouser -o -nogroup -atime -3 /var/spool/mail/user1 find: `/proc/12100/task/12100/fd/5': No such file or directory find: `/proc/12100/task/12100/fd/5': No such file or directory find: `/proc/12100/task/12100/fdinfo/5': No such file or directory find: `/proc/12100/task/12100/fdinfo/5': No such file or directory find: `/proc/12100/fd/5': No such file or directory find: `/proc/12100/fd/5': No such file or directory find: `/proc/12100/fdinfo/5': No such file or directory find: `/proc/12100/fdinfo/5': No such file or directory /home/user1 /home/user1/.bash_logout /home/user1/.bash_profile /home/user1/.mozilla /home/user1/.mozilla/plugins /home/user1/.mozilla/extensions /home/user1/.bashrc
13、查找/etc目錄下所有用戶都有寫權限的文件；
[root@localhost ~]# ll /etc | grep --color "^...x..x..x" | cut -d " " -f 12 abc abrt acpi alsa alternatives avahi bash_completion.d blkid bluetooth bonobo-activation 2012 ConsoleKit cron.d cron.daily cron.hourly cron.monthly 2011 dbus-1 default depmod.d 2013 dracut.conf.d event.d 26 festival fonts foomatic gconf 2012 gdm ghostscript gnome-vfs-2.0 2010 26 gtk-2.0 hal hp httpd init 26 iproute2 kdump-adv-conf ld.so.conf.d libreport logrotate.d lvm makedev.d modprobe.d NetworkManager ntp obex-data-server openldap 2011 PackageKit pam.d pango pcmcia pki plymouth pm polkit-1 2010 portreserve postfix ppp prelink.conf.d profile.d pulse Jun 26 26 26 26 26 26 26 rc.d 26 26 26 rpm 2013 2013 samba sane.d sasl2 scl security selinux setuptool.d sgml skel snmp sound ssh ssl 2013 sysconfig 26 2010 04:48 udev vmware-tools vsftpd wpa_supplicant X11 xdg xinetd.d xml yum 2013
14、查找/etc目錄下大于1M，且類型為普通文件的所有文件；
[root@localhost etc]# find /etc -type f -size +1M -ls 925752 7068 -rw-r--r-- 1 root root 7234873 Jun 26 16:17 /etc/selinux/targeted/modules/active/policy.kern 926031 7068 -rw-r--r-- 1 root root 7234873 Jun 26 16:17 /etc/selinux/targeted/policy/policy.24 924656 1976 -rw-r--r-- 1 root root 2020884 Jun 26 16:10 /etc/gconf/gconf.xml.defaults/%gconf-tree.xml
15、查找/etc/init.d/目錄下，所有用戶都有執行權限，且其它用戶有寫權限的文件；
[root@localhost etc]# ll /etc/init.d/ | grep "^...x..x.wx"
16、查找/usr目錄下不屬于root、bin或hadoop的文件；
[root@localhost ~]# find /usr/ -not \( -user root -o -user bin -o -user hadoop \) -ls 267966 4 drwxrwxr-x 2 weblogic weblogic 4096 Aug 7 03:13 /usr/test 289857 8 -rwsr-xr-x 1 abrt abrt 6676 Feb 22 2013 /usr/libexec/abrt-action-install-debuginfo-to-abrt-cache
17、查找/etc/目錄下至少有一類用戶沒有寫權限的文件；
[root@localhost ~]# find /etc/ -not -perm 222 -ls | head -n 10 917506 12 drwxr-xr-x 102 root root 12288 Aug 7 03:09 /etc/ 924864 4 drwxr-xr-x 3 root root 4096 Jun 26 16:10 /etc/scl 924866 4 drwxr-xr-x 2 root root 4096 Feb 21 2013 /etc/scl/prefixes 924719 4 -rw-r--r-- 1 root root 1314 Aug 6 02:52 /etc/tpvmlp.conf 917823 4 drwxr-xr-x 2 root root 4096 Jun 26 16:17 /etc/pulse 918306 8 -rw-r--r-- 1 root root 4771 Nov 22 2009 /etc/pulse/default.pa.BeforeVMwareToolsInstall 918226 4 -rw-r--r-- 1 root root 2134 Nov 22 2009 /etc/pulse/daemon.conf 917824 4 -rw-r--r-- 1 root root 1184 Jul 11 2012 /etc/pulse/client.conf 918813 8 -rw-r--r-- 1 root root 4780 Jun 26 16:17 /etc/pulse/default.pa 918307 4 -rw-r--r-- 1 root root 1978 Jul 11 2012 /etc/pulse/system.pa
18、查找/etc目錄下最近一周內其內容被修改過，且不屬于root或hadoop的文件；
[root@localhost ~]# find /etc -mtime -7 -not \( -user root -a -user hadoop \) -ls 917506 12 drwxr-xr-x 102 root root 12288 Aug 7 03:09 /etc 924719 4 -rw-r--r-- 1 root root 1314 Aug 6 02:52 /etc/tpvmlp.conf 917661 4 -rw------- 1 root root 1017 Aug 6 23:46 /etc/group- 927360 4 -rw-r--r-- 1 root root 403 Aug 6 04:44 /etc/mtab 917665 4 -rw-r--r-- 1 root root 1944 Aug 6 23:46 /etc/passwd- 917539 4 -rw------- 1 root root 812 Aug 6 23:46 /etc/gshadow- 917547 4 ---------- 1 root root 1121 Aug 6 23:46 /etc/shadow- 918106 4 -rw-r--r-- 1 root root 45 Aug 6 02:49 /etc/adjtime 927364 4 -rw-r--r-- 1 root root 1025 Aug 7 03:09 /etc/group 927358 4 -rw-r--r-- 1 root root 881 Aug 6 04:44 /etc/fstab 927366 4 ---------- 1 root root 1150 Aug 6 23:46 /etc/shadow 917614 4 drwxr-xr-x 10 root root 4096 Aug 6 23:32 /etc/rc.d 917628 4 drwxr-xr-x 2 root root 4096 Aug 6 02:52 /etc/rc.d/rc5.d 917517 0 lrwxrwxrwx 1 root root 16 Aug 6 02:52 /etc/rc.d/rc5.d/S11auditd -> ../init.d/auditd 927359 20 -rwxr-xr-x 1 root root 19473 Aug 6 23:32 /etc/rc.d/rc.sysinit 927365 4 -rw-r--r-- 1 root root 1987 Aug 6 23:46 /etc/passwd 927363 4 ---------- 1 root root 820 Aug 7 03:09 /etc/gshadow 918241 4 drwxr-xr-x 5 root lp 4096 Aug 6 02:52 /etc/cups 917522 4 -rw------- 1 root lp 2004 Aug 6 02:52 /etc/cups/printers.conf 918140 4 -rw------- 1 root lp 128 Aug 6 02:52 /etc/cups/classes.conf 918242 4 -rw------- 1 root lp 128 Aug 5 18:34 /etc/cups/classes.conf.O 917932 4 -rw------- 1 root lp 2004 Aug 5 18:34 /etc/cups/printers.conf.O 917548 4 -rw-r--r-- 1 root root 763 Aug 6 02:52 /etc/printcap 924810 4 -rw-r--r-- 1 root root 49 Aug 6 02:52 /etc/resolv.conf 927353 248 -rw-r--r-- 1 root root 253231 Aug 5 19:36 /etc/prelink.cache
原創文章，作者：liliangming，如若轉載，請注明出處：http://www.www58058.com/30553
寫的很好，排版也很棒，加油，9 10 都不對，13 15也不對