sed

What it does

sed (stream editor) reads text line by line, runs editing commands on it, and prints the result. With -i it writes the result back into the file. It is the standard tool to change config files in scripts and automation.

The most used command is substitute: s/OLD/NEW/FLAGS. Commands can be limited to line numbers (5, 5,10, $ = last line) or to lines that match a pattern (/regex/).

How to write it

sed [OPTION]... 'SCRIPT' [FILE...]
sed [OPTION]... -e SCRIPT -e SCRIPT [FILE...]
sed [OPTION]... -f SCRIPT-FILE [FILE...]

Options 35

Most used

-i[<suffix>], --in-place[=<suffix>]: Edit the file itself. With a suffix (like -i.bak) keep a backup.
-n, --quiet, --silent: Do not print every line; print only with the p command.
-e script, --expression=script: Add a script (use it several times for several commands).
-E, -r, --regexp-extended: Use extended regular expressions (+ ? {} | () without backslashes).
-f file, --file=file: Read the sed commands from a file.
-s, --separate: Treat several files as separate files (not one stream).
-z, --null-data: Lines end with NUL.
-u, --unbuffered: Flush output often (for live pipes).
-l n, --line-length=n: Line wrap length for the l command.
--follow-symlinks: With -i: edit the file that a link points to.
--posix: Turn off GNU extensions.
--sandbox: Do not allow the e, r and w commands.
--debug: Show how sed runs the script.
--help: Show help.
--version: Show the version.

Commands inside the script

s/old/new/: Replace the first match in each line.
s/old/new/g: Replace all matches in each line.
s/old/new/I: Replace, ignoring case (GNU).
s/old/new/2: Replace only the 2nd match.
d: Delete the line.
p: Print the line (with -n).
a text: Append a line after.
i text: Insert a line before.
c text: Change (replace) the whole line.
y/abc/xyz/: Change characters one by one (like tr).
=: Print the line number.
q: Quit.
r file: Read a file in after the line.
w file: Write the line to a file.

Addresses

5: Line 5.
5, 10: Lines 5 to 10.
$: The last line.
/regex/: Lines that match.
/start/, /end/: From a line that matches start to a line that matches end.
addr!: All lines that do NOT match the address.

Examples 13

$ run as a normal user# run as root (or with sudo)

1Replace text in the output
```
$sed 's/http:/https:/g' links.txt
```
The file does not change; only the output.
2Change a config file in place, with a backup
```
#sed -i.bak 's/^SELINUX=enforcing/SELINUX=permissive/' /etc/selinux/config
```
The old file is kept as config.bak.
3Turn off root login over SSH
```
#sed -i 's/^#\?PermitRootLogin .*/PermitRootLogin no/' /etc/ssh/sshd_config
```
Works if the line is commented out or not. Then systemctl reload sshd.
4Print only some lines
```
$sed -n '10,20p' /etc/services
```
Lines 10 to 20.
5Delete comments and empty lines
```
$sed '/^\s*#/d; /^\s*$/d' /etc/chrony.conf
```
Shows only the active settings.
6Add a line after a match
```
#sed -i '/^\[main\]/a gpgcheck=1' /etc/dnf/dnf.conf
```
Inserts a line under the [main] section.
7Comment out a line
```
#sed -i 's/^pool /#pool /' /etc/chrony.conf
```
Puts # before every line that starts with "pool ".
8Use another separator when the text has slashes
```
$sed 's|/var/www/html|/srv/web|g' site.conf
```
| instead of / keeps it readable.

9Use groups to reorder text

$echo "2026-10-25" | sed -E 's/([0-9]+)-([0-9]+)-([0-9]+)/\3.\2.\1/'
25.10.2026

\1 \2 \3 are the parts in brackets.

10Print the line numbers of matches
```
$sed -n '/Listen/=' /etc/httpd/conf/httpd.conf
```
Like grep -n, only the numbers.
11Delete a line by number
```
$sed -i '3d' ~/.ssh/known_hosts
```
Removes an old host key (line 3), after "REMOTE HOST IDENTIFICATION HAS CHANGED".
12Replace a value in many files
```
$sed -i 's/old-db.example.com/new-db.example.com/g' /etc/myapp/*.conf
```
Check first with grep -l old-db /etc/myapp/*.conf.
13Mask passwords in a log before you share it
```
$sed -E 's/(password=)[^& ]+/\1*****/g' app.log > app-masked.log
```
Never send real secrets in a support ticket.

Watch out

Test without -i first. Then use -i.bak so you can go back.
sed -i replaces the file with a new one (new inode): links and some permissions (and SELinux labels) can change. Check with ls -lZ on system files.
In basic regex, + ? ( ) { } | need a backslash; use -E to avoid that.

Tips to remember

s/a/b/g replace all, -n 'Np' print line N, /x/d delete lines with x, -i.bak edit with backup.

`sed`

What it does

How to write it

Options 35

Commands inside the script

Addresses

Examples 13

1Replace text in the output

2Change a config file in place, with a backup

3Turn off root login over SSH

4Print only some lines

5Delete comments and empty lines

6Add a line after a match

7Comment out a line

8Use another separator when the text has slashes

9Use groups to reorder text

10Print the line numbers of matches

11Delete a line by number

12Replace a value in many files

13Mask passwords in a log before you share it

Watch out

Tips to remember

Full manual

What it does

How to write it

Options 35

Commands inside the script

Addresses

Examples 13

1Replace text in the output

2Change a config file in place, with a backup

3Turn off root login over SSH

4Print only some lines

5Delete comments and empty lines

6Add a line after a match

7Comment out a line

8Use another separator when the text has slashes

9Use groups to reorder text

10Print the line numbers of matches

11Delete a line by number

12Replace a value in many files

13Mask passwords in a log before you share it

Watch out

Tips to remember

Related commands

Used in these lessons

Used in these labs

Full manual

`sed`