2

I ran into this problem multiple times now.

You have to log into a server you don't know and have to find where an application is installed and where its config files are.

I know that most application configs are in /etc/... e.g. /etc/nagios/nrpe.cfg

But knowing is not reliable. How can I find them guaranteed?

And what is a good way to inspect and study the configs? Most applications allow for other files to be included so the configuration can be split into multiple files which takes ages to write down all the files' locations and look at all of them individually which gets even worse if the structure is cascading.

Improve this question
2
  • 1
    Welcome on U&L! A good number of man pages have a FILES section, which usually includes the list of paths/descriptions of the relevant configuration files. Are you specifically thinking about poorly documented applications?
    – fra-san
    May 4, 2021 at 19:56
  • many do not list anything... and then many do not have a man page either
    – Vulkanodox
    May 6, 2021 at 10:10

3 Answers 3

Reset to default
2

Here's a universal method for Linux. Install strace and do this:

sudo strace -e file -fF -o /tmp/application.log application

You can then examine /tmp/application.log and see all the open files. If the app uses files from /etc you can grep /etc /tmp/application.log.

The use of sudo above is required only for system-wide daemons/services.

Improve this answer
3
  • This requires you to actually RUN this untrusted application. If it does its "Bad Things" on 1st execution...
    – waltinator
    May 4, 2021 at 19:43
  • -F is deprecated. From the man page: -F This option is deprecated. It is retained for backward compatibility only and may be removed in future releases. Usage of multiple instances of -F option is still equiva‐ lent to a single -f, and it is ignored at all if used along with one or more instances of -f option.
    – Jonas Stein
    Feb 11 at 14:54
  • @JonasStein there's no harm in specifying it and it will work for e.g. CentOS 6 users. You're welcome to edit the answer if you absolutely feel like -F must be removed. Some answers here are now more than a decade old thus they are bound to become outdated. Software changes fast.
    – Artem S. Tashkinov
    Feb 11 at 17:43
2

What you can do is list the content of the software package. Most configuration file(s) on Linux are in /etc/. So you can do something like this:

On Arch Linux:

pkgfile <package name> | grep etc

For an AUR package, you do a tar of the built TAR file, e.g.

tar tvf ~/.cache/yay/<package name>/<package name and version>.tar.xz | grep etc

On Debian / Ubuntu / Linux Mint:

apt-file <package name> | grep etc

And you can find similar CLI command for other Linux distributions.

And as an added bonus, you know exactly where all files are installed for a given package.

Improve this answer
4
  • 1
    1) It's arch specific 2) it will not work for any software installed outside of arch ports 3) the debian advice will fail to work if configuration files are not stored in /etc and there are applications/daemons/services which uses file from /usr, /opt, /usr/local or even /var.
    – Artem S. Tashkinov
    May 5, 2021 at 0:01
  • Well, I gave the answer as an example. You can "grep config" instead of "grep etc". And I am not going to list all similar commands for other Linux distributions. If you know, you can add similar command for RedHat or Slack, for example.
    – Meesha
    May 5, 2021 at 7:51
  • OMG!! apt-file is the missing package file locator I've been searching for! It even does reverse search (find package from file: wiki.debian.org/apt-file). IMO, this should be installed default on any *nix system, as compared to Windows where all files are in a single directory. Unfortunately, it doesnt work for Snaps, but there is a wish list for that: askubuntu.com/questions/1257724/… ..actually, dpkg --listfiles <pkg> or dpkg -S <file> does both these and also works on Snaps.
    – alchemy
    Mar 18 at 22:37
  • One caveat is neither of these show the user conf files, officially supposed to be located in ~/.config or ~/.local/.. per Freedesktop standardization, but end up in places like ~/.mozilla, ~.vimrc, etc..
    – alchemy
    Mar 18 at 22:46
-1

Each application developer has to choose for herself where configuration files for that application are stored. Is it a per-user config? Is it a system-wide config?

One can find the configuration file - it's contained in the application.

strings $(type -p application)

Read man strings to optimize .

Improve this answer
6
  • 1
    The strings approach is destinged to fail if the app concatenates strings or does anything to compute where its files are. Also, how would you know which strings are the ones which pertain to configuration files and which are not? strace on the other hand always shows the exact opened files and nothing else. Example strings $(which smbd) | grep etc -> returns nothing at all. At the same time strings $(which smbd) | wc -l -> 1281. Good luck with finding what is really used.
    – Artem S. Tashkinov
    May 4, 2021 at 15:51
  • What does which smbd return on your system? Why do you assume configuration files have "etc" in their pathnames? Pipe the output into less, page through, and scan by eye. Non-junk text really stands out.
    – waltinator
    May 4, 2021 at 19:50
  • Why would a FOSS (Free Open Source Software) application obfuscate the location of a configuration file, when we can just read the source?
    – waltinator
    May 4, 2021 at 19:54
  • Which part of strings $(which smbd) | wc -l -> 1281 you haven't noticed? The f it matters what which smbd returns on my system? Again, stop talking crap: strings will not allow you to understand which files are actually used, it takes a huge amount of time to sift through and it's generally a bad piece of advice.
    – Artem S. Tashkinov
    May 4, 2021 at 23:56
  • stat $(which smbd) File: /usr/sbin/smbd Size: 111264 Blocks: 224 IO Block: 4096 regular file Device: 815h/2069d Inode: 812206 Links: 1 Access: (0755/-rwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Context: system_u:object_r:smbd_exec_t:s0 Access: 2021-04-07 19:17:57.000000000 +0000 Modify: 2021-04-07 19:17:57.000000000 +0000 Change: 2021-04-17 11:33:26.181150440 +0000 Birth: 2021-04-17 11:33:26.180150450 +0000
    – Artem S. Tashkinov
    May 4, 2021 at 23:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .