2

I ran into this problem multiple times now.

You have to log into a server you don't know and have to find where an application is installed and where its config files are.

I know that most application configs are in /etc/... e.g. /etc/nagios/nrpe.cfg

But knowing is not reliable. How can I find them guaranteed?

And what is a good way to inspect and study the configs? Most applications allow for other files to be included so the configuration can be split into multiple files which takes ages to write down all the files' locations and look at all of them individually which gets even worse if the structure is cascading.

Patrick Mevzek
  • 3,180
Vulkanodox
  • 21
  • 1
    Welcome on U&L! A good number of man pages have a FILES section, which usually includes the list of paths/descriptions of the relevant configuration files. Are you specifically thinking about poorly documented applications? – fra-san May 04 '21 at 19:56
  • many do not list anything... and then many do not have a man page either – Vulkanodox May 06 '21 at 10:10

3 Answers3

2

Here's a universal method for Linux. Install strace and do this:

sudo strace -e file -fF -o /tmp/application.log application

You can then examine /tmp/application.log and see all the open files. If the app uses files from /etc you can grep /etc /tmp/application.log.

The use of sudo above is required only for system-wide daemons/services.

Artem S. Tashkinov
  • 29,025
  • This requires you to actually RUN this untrusted application. If it does its "Bad Things" on 1st execution... – waltinator May 04 '21 at 19:43
  • -F is deprecated. From the man page: 
    compatibility only and may be removed in  future  releases.
Usage  of  multiple instances of -F option is still equiva‐
lent to a single -f, and it is ignored at all if used along
with one or more instances of -f option.```
    – Jonas Stein Feb 11 '23 at 14:54
  • @JonasStein there's no harm in specifying it and it will work for e.g. CentOS 6 users. You're welcome to edit the answer if you absolutely feel like -F must be removed. Some answers here are now more than a decade old thus they are bound to become outdated. Software changes fast. – Artem S. Tashkinov Feb 11 '23 at 17:43
2

What you can do is list the content of the software package. Most configuration file(s) on Linux are in /etc/. So you can do something like this:

On Arch Linux:

pkgfile <package name> | grep etc

For an AUR package, you do a tar of the built TAR file, e.g.

tar tvf ~/.cache/yay/<package name>/<package name and version>.tar.xz | grep etc

On Debian / Ubuntu / Linux Mint:

apt-file <package name> | grep etc

And you can find similar CLI command for other Linux distributions.

And as an added bonus, you know exactly where all files are installed for a given package.

Meesha
  • 124
  • 1
  • It's arch specific 2) it will not work for any software installed outside of arch ports 3) the debian advice will fail to work if configuration files are not stored in /etc and there are applications/daemons/services which uses file from /usr, /opt, /usr/local or even /var.
    • – Artem S. Tashkinov May 05 '21 at 00:01
  • Well, I gave the answer as an example. You can "grep config" instead of "grep etc". And I am not going to list all similar commands for other Linux distributions. If you know, you can add similar command for RedHat or Slack, for example. – Meesha May 05 '21 at 07:51
  • OMG!! apt-file is the missing package file locator I've been searching for! It even does reverse search (find package from file: https://wiki.debian.org/apt-file). IMO, this should be installed default on any *nix system, as compared to Windows where all files are in a single directory. Unfortunately, it doesnt work for Snaps, but there is a wish list for that: https://askubuntu.com/questions/1257724/how-to-search-all-snap-packages-for-filename ..actually, dpkg --listfiles <pkg> or dpkg -S <file> does both these and also works on Snaps. – alchemy Mar 18 '23 at 22:37
  • One caveat is neither of these show the user conf files, officially supposed to be located in ~/.config or ~/.local/.. per Freedesktop standardization, but end up in places like ~/.mozilla, ~.vimrc, etc.. – alchemy Mar 18 '23 at 22:46