osquery-1/specs/posix/ssh_keys.table
2016-09-13 20:37:31 -07:00

15 lines
492 B
Plaintext

table_name("user_ssh_keys")
description("Returns the private keys in the users ~/.ssh directory and whether or not they are encrypted")
schema([
Column("uid", BIGINT, "The local user that owns the key file",
additional=True),
Column("path", TEXT, "Path to key file"),
Column("encrypted", INTEGER, "1 if key is encrypted, 0 otherwise"),
ForeignKey(column="uid", table="users"),
])
implementation("user_ssh_keys@getUserSshKeys")
fuzz_paths([
"/home",
"/Users",
])