pub enum Kind {
Show 20 variants
Crontab,
SystemCrontab,
Anacrontab,
SystemdUnit,
AuthorizedKeys,
RcLocal,
ShellInit,
LdSoPreload,
Sudoers,
AtJob,
InitScript,
Pam,
SshdConfig,
Udev,
XdgAutostart,
ModulesLoad,
Modprobe,
Passwd,
Shadow,
Group,
}Expand description
A kind of file, each read its own way.
Variants§
Crontab
A user’s crontab (var/spool/cron/crontabs/<user>, RHEL’s
var/spool/cron/<user>): a schedule, then the command, run as the
account the file is named after.
SystemCrontab
The system crontabs (etc/crontab, etc/cron.d/*): a schedule, the
account, then the command.
Anacrontab
etc/anacrontab: period, delay, job id and command, run as root.
SystemdUnit
A systemd unit (.service, .timer, .path, .socket) or a
drop-in (<unit>.d/*.conf), system-wide or a user’s.
AuthorizedKeys
.ssh/authorized_keys (and authorized_keys2): keys that may log in
as the account whose home it’s in.
RcLocal
etc/rc.local, etc/rc.d/rc.local, and ESXi’s
etc/rc.local.d/local.sh (kept across reboots, where ESXi rebuilds
most of /etc, which makes it the attackers’ favourite there): run
by root at boot.
ShellInit
Shell start-up files, run when an account logs in or opens a shell:
etc/profile, etc/profile.d/*.sh, etc/bash.bashrc, a home’s
.bashrc, .profile, .zshrc, ….
LdSoPreload
etc/ld.so.preload: libraries loaded into every dynamically linked
program.
Sudoers
etc/sudoers, etc/sudoers.d/*: who may run what as whom.
AtJob
A job at queued (var/spool/cron/atjobs/*, var/spool/at/*,
var/at/jobs/*): commands run once, later, as the account that
queued them.
InitScript
A System V init script (etc/init.d/*, etc/rc.d/init.d/*): run by
root at boot, on systems that still start them.
Pam
PAM’s configuration (etc/pam.d/*, etc/pam.conf): the modules
every login goes through.
SshdConfig
The SSH server’s configuration (etc/ssh/sshd_config,
etc/ssh/sshd_config.d/*).
Udev
udev rules (etc/udev/rules.d/*.rules, usr/lib/udev/rules.d, …):
commands run as root when a matching device appears.
XdgAutostart
XDG autostart entries (etc/xdg/autostart/*.desktop, a home’s
.config/autostart/*.desktop): commands a desktop session starts at
login.
ModulesLoad
Kernel modules loaded at boot (etc/modules, modules-load.d/*).
Modprobe
modprobe’s configuration (modprobe.d/*.conf).
Passwd
etc/passwd: the accounts, their ids and shells.
Shadow
etc/shadow: the state of each account’s password.
Group
etc/group: the groups’ members.