|(One intermediate revision by one user not shown)|
Latest revision as of 17:20, 25 August 2012
Found in /bin/cat, when cat is given a file as an argument, it will print out the file contents to your console, or it can be redirected to another file or process.
samizdata# cat /etc/fstab # Device Mountpoint FStype Options Dump Pass# /dev/da0b none swap sw 0 0 /dev/da1b none swap sw 0 0 /dev/da0a / ufs rw 1 1 /dev/da0d /tmp ufs rw 2 2 /dev/da1e /usr ufs rw 2 2 /dev/da1d /var ufs rw 2 2 /dev/cd0 /cdrom cd9660 ro,noauto 0 0
Related commands are zcat (aka gzcat) and bzcat, for use with gzipped and bzipped archives, respectively. Very useful for easily reading rotated, compressed logfiles - for example, let's say I'm tracking down some jackass that keeps trying to find a way into my server, and I want to look at one of the older sections of my auth log:
ph34r# bzcat auth.log.0.bz2 | grep Illegal Oct 19 20:47:47 ph34r sshd: Illegal user adam from 22.214.171.124 Oct 19 20:47:49 ph34r sshd: Illegal user alan from 126.96.36.199 Oct 19 20:47:52 ph34r sshd: Illegal user frank from 188.8.131.52 Oct 19 20:47:54 ph34r sshd: Illegal user george from 184.108.40.206 Oct 19 20:47:56 ph34r sshd: Illegal user henry from 220.127.116.11 Oct 19 20:47:59 ph34r sshd: Illegal user john from 18.104.22.168 Oct 19 20:48:14 ph34r sshd: Illegal user test from 22.214.171.124
Without having to muck around with multiple steps or temporary files or any of that business, I told my server to load up the bzip archive of the last section of my auth log, decompress it, and send the results to grep so that I'd only see the entries related to "Illegal" users. And voila - I can see that the idiot at the APNIC address 126.96.36.199 is trying a dictionary-style username attack on my server.