'Regex for /etc/passwd and /etc/shadow
I have a large collection of files from my enterprise, and I have been tasked to catalog every file that contains a pattern that is similar to the pattern for /etc/passwd or /etc/shadow. Commonly I could do this for every passwd and shadow file in our repository, similar to https://serverfault.com/questions/972572/regex-for-etc-passwd-content but we are finding instances where some of our systems will actually write that information to /etc/passwd or /etc/shadow from another script at boot.
I have tried the command in the above link, modified to look at all text files:
find /store -type f -exec grep -hIE '([^:]*:){6}[^:]*' {} +
Unfortunately this will also match entries such as:
leafp2p_service_0="RouterRemote,0,1,1,1,1,6:135,6:136,6:137,6:138,6:139,6:445,6:548,17:135,17:136,17:137,17:138,17:139,17:445,17:548"
485365 0x767F5 Copyright string: "copyrightGraphWrap{float:left;height:139px;font-family:Arial;font-size: 9pt;color:#b2a79f;margin-left:25px;margin-right:25px;dis"
Is it possible to create a more specific regex definition that is exclusive to the format typically found in /etc/passwd or/etc/shadow?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|