1.1查看passwd文件中的行号:
查看文档/etc/passwd第六行内容
[root@localhost ~]# vim passwd
1 root:x:0:0:root:/root:/bin/bash
2 bin:x:1:1:bin:/bin:/sbin/nologin
3 daemon:x:2:2:daemon:/sbin:/sbin/nologin
4 adm:x:3:4:adm:/var/adm:/sbin/nologin
5 lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
6 sync:x:5:0:sync:/sbin:/bin/sync
7 shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
8 halt:x:7:0:halt:/sbin:/sbin/halt
9 mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
10 operator:x:11:0:operator:/root:/sbin/nologin
11 games:x:12:100:games:/usr/games:/sbin/nologin
12 ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
13 nobody:x:65534:65534:Kernel Overflow User:/:/sbin/nologin
14 dbus:x:81:81:System message bus:/:/sbin/nologin
15 systemd-coredump:x:999:997:systemd Core Dumper:/:/sbin/nologin
16 systemd-resolve:x:193:193:systemd Resolver:/:/sbin/nologin
17 tss:x:59:59:Account used for TPM access:/dev/null:/sbin/nologin
18 polkitd:x:998:996:User for polkitd:/:/sbin/nologin
19 geoclue:x:997:995:User for geoclue:/var/lib/geoclue:/sbin/nologin
20 rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
21 pipewire:x:996:992:PipeWire System Daemon:/var/run/pipewire:/sbin/nologin
22 pulse:x:171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
23 qemu:x:107:107:qemu user:/:/sbin/nologin
24 clevis:x:995:989:Clevis Decryption Framework unprivileged user:/var/cache/clevis:/sbin/nol ogin
25 usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
26 unbound:x:994:988:Unbound DNS resolver:/etc/unbound:/sbin/nologin
27 gluster:x:993:987:GlusterFS daemons:/run/gluster:/sbin/nologin
28 rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
29 avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
:set nu
[root@localhost ~]# cat /etc/passwd | head -6 | tail -n -1
sync:x:5:0:sync:/sbin:/bin/sync
1.2:查看/etc/selinux/config以SELINUX开头的行
[root@localhost ~]# cat /etc/selinux/config | grep ^SELINUX
SELINUX=enforcing
SELINUXTYPE=targeted
1.3:查找/etc/ssh/sshd_config以no结尾的行
[root@localhost ~]# cat /etc//ssh/sshd_config | grep -w no$
#HostbasedAuthentication no
#IgnoreUserKnownHosts no
#PermitEmptyPasswords no
ChallengeResponseAuthentication no
#KerberosAuthentication no
#KerberosGetAFSToken no
GSSAPICleanupCredentials no
#GSSAPIKeyExchange no
#GSSAPIEnablek5users no
#GatewayPorts no
PrintMotd no
#PermitUserEnvironment no
#UseDNS no
#PermitTunnel no
# X11Forwarding no
# AllowTcpForwarding no
# PermitTTY no
1.4:过滤/etc/ssh/sshd config 包含数字的行
[root@localhost ~]# cat /etc/ssh/sshd_config | grep [0-9]
# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
# sshd_config(5) for more information.
#Port 22
#ListenAddress 0.0.0.0
HostKey /etc/ssh/ssh_host_ed25519_key
# Please, check manual pages for update-crypto-policies(8) and sshd_config(5).
#LoginGraceTime 2m
#MaxAuthTries 6
#MaxSessions 10
# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
#GSSAPIEnablek5users no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#ClientAliveInterval 0
#ClientAliveCountMax 3
#MaxStartups 10:30:100
# X11Forwarding no
2:查看/etc/passwd文件以":"为分隔符的第一列内容,并按字母逆序排序写入/username文件统计/etc/passwd文件一共有几行,只把行数显示
[root@localhost ~]# cat /etc/passwd | cut -d : -f 1 | sort -rn | tee /etc/username
zhangfei
usbmuxd
unbound
tss
tcpdump
systemd-resolve
systemd-coredump
sync
sssd
sshd
shutdown
setroubleshoot
saslauth
rtkit
rpcuser
rpc
root
radvd
qemu
pulse
polkitd
pipewire
operator
nobody
mail
lp
liwu
libstoragemgmt
halt
gnome-initial-setup
gluster
geoclue
gdm
games
ftp
flatpak
dnsmasq
dbus
daemon
colord
cockpit-wsinstance
cockpit-ws
clevis
chrony
bin
avahi
admin
adm
add
3.: 统计系统执行频率最高的前十个命令;
[root@localhost ~]# history | tr -s " " " " | cut -d " " -f 3 | sort | uniq -c | sort -n| tail -10 | tr -s " " " " | cut -d " " -f 3
su
tail
id
useradd
vim
history
ll
hash
usermod
cat