Seeing what files are run at startup (linux)

Question

How do a check what startup scripts are run after I ssh into a machine?

Answer 1

Trace it. I'm not really familiar with the tracing tool on linux, but on Solaris I'd do one of these:

# truss -p `pgrep sshd` -f -t open  

These flags make it attach to the sshd process, also trace child processes, and only trace the open system call. Just ssh in while that puppy is running, and should dump out the name of every file it's opening, as that's one of the arguments to the open system call.

On linux I believe you'd use strace, which I'm sure has its own flags for these things.

There's a pretty good chance you'll need superuser permission to do this. If you don't have it, and want a solution that doesn't require it, you'll need some other technique.

Answer 2

I don't think you can find this out if your admin(root) doesn't want you to. But one thing is guaranteed, the moment you login, your login script is executed, generally, .bash_profile under bash and .profile under most other shells(both at your home directory). Again, your admin can alter what to run on login.

Answer 3

You may try this, if your remote login shell is bash

$ ssh [email protected] /bin/bash -xlic exit

and you'll get something like this

+ for i in '/etc/profile.d/*.sh'
+ '[' -r /etc/profile.d/00functions.sh ']'
+ . /etc/profile.d/00functions.sh
+ for i in '/etc/profile.d/*.sh'
+ '[' -r /etc/profile.d/aliases.sh ']'
+ . /etc/profile.d/aliases.sh
++ :
++ alias 'l=ls -l'
++ alias 'lc=ls -c'
++ alias pg=less
++ alias 'la=ls -la'
+ for i in '/etc/profile.d/*.sh'
+ '[' -r /etc/profile.d/colorls.sh ']'
+ . /etc/profile.d/colorls.sh
++ alias 'll=ls -l'