osquery-1/specs/posix/user_ssh_keys.table
2017-05-25 12:43:58 -07:00

15 lines
505 B
Plaintext

table_name("user_ssh_keys")
description("Returns the private keys in the users ~/.ssh directory and whether or not they are encrypted.")
schema([
Column("uid", BIGINT, "The local user that owns the key file",
additional=True),
Column("path", TEXT, "Path to key file", index=True),
Column("encrypted", INTEGER, "1 if key is encrypted, 0 otherwise"),
ForeignKey(column="uid", table="users"),
])
implementation("user_ssh_keys@getUserSshKeys")
fuzz_paths([
"/home",
"/Users",
])