Which files are run when I log into or reboot my machine?

Question

I'm trying to figure out which "script" (really it's probably an "*rc" file) is running a particular command when I reboot my ubuntu machine. I've tried grepping for what is being displayed when I log into the machine after a reboot but I haven't been able to find it.

I know that, for example, the .bash_profile is "sourced" when I log in but what others are run This will help me track down the script/file that's running an old set of commands that I need to update.

Thanks!

here's what happens when i log in:

bos-mp2o6:~ user$ ssh -A X.X.X.X
user@X.X.X.X's password: 
Linux bos-lpwy9 2.6.32-54-generic #116-Ubuntu SMP Tue Nov 12 19:23:22 UTC 2013 x86_64 GNU/Linux
Ubuntu 10.04.4 LTS

Welcome to Ubuntu!
 * Documentation:  https://help.ubuntu.com/

New release 'precise' available.
Run 'do-release-upgrade' to upgrade to it.

Last login: Tue Dec 31 10:53:25 2013 from 172.19.43.138
Agent pid 2117
/home/user/.ssh/internal/2013-07-29: No such file or directory
/home/user/.ssh/deployed/2013-07-29: No such file or directory
Identity added: /home/user/.ssh/external/2013-07-29 (/home/user/.ssh/external/2013-07-29)

if you notice the "Identity added" piece, that's the bit I'm looking for. So I've used the following command (with no luck):

[user@Linux_Desktop:~]$grep_bash 2013-07-29
[user@Linux_Desktop:~]$

Answer 1

This will depend on many things. I am guessing that you don't actually want the files run when the machine reboots (there are MANY) but those run by your shell (e.g. bash) when you log in or open a terminal.

The easiest way to find the relevant command would be to grep through all possible shell startup files, both for login and interactive shells. I have the following function defined in my $HOME/.bashrc:

grep_bash(){
  for f in  ~/.bashrc ~/.profile ~/.bash_profile ~/.bash_login \
        /etc/profile /etc/bash.bashrc /etc/environment; 
  do 
    [ -e $f ] && grep -H "$@" $f; 
  done
}

I can then use it to search those files for a string of interest:

$ grep_bash foo
/home/terdon/.bashrc:echo foo

---

The actual files being read depend on the kind of shell you are running. These are the relevant sections from man bash:

   When  bash is invoked as an interactive login shell, or as a non-inter‐
   active shell with the --login option, it first reads and executes  com‐
   mands  from  the file /etc/profile, if that file exists.  After reading
   that file, it looks for ~/.bash_profile, ~/.bash_login, and ~/.profile,
   in  that order, and reads and executes commands from the first one that
   exists and is readable. 

   When an interactive shell that is not a login shell  is  started,  bash
   reads  and  executes  commands  from /etc/bash.bashrc and ~/.bashrc, if
   these files exist.  This may be inhibited by using the  --norc  option.
   The  --rcfile  file option will force bash to read and execute commands
   from file instead of /etc/bash.bashrc and ~/.bashrc.

In most *nix (the only exception I know of is OSX) the default shell when you open a new terminal is an interactive, non-login shell so ~/.bashrc and company are read.

Finally, you also have /etc/environment which is used to set global environment variables and which should be read by most shells.

---

After discussion with the OP in chat, @derobert helped us figure out that the issue here was caused by /etc/ssh/sshrc.

Answer 2

“Agent pid” is from starting ssh-agent, and “Identity added” is from running ssh-add to load keys into the agent. The bit in the middle is probably a custom script.

If your login shell is bash (the default), it loads the first of the following files that exists: ~/.bash_profile, ~/.bash_login, ~/.profile. Check which one it loads and add set -x at the top, then log in again or run bash --login. This tells bash to print a trace of every command it executes. Look for these messages in the trace, this should tell you what's printing them.

If the messages come before the first trace, then they may be from a global initialization file: /etc/profile, or scripts in /etc/profile.d (or scripts that they call).

If the message isn't shown when you run bash --login, then it comes from something started by the SSH daemon and not from the shell. Check if you've added something unusual to the PAM stack: /etc/pam.d/sshd or the /etc/pam.d/common-* files. If it only happens when you log in with SSH, it could be a command in ~/.ssh/rc or /etc/ssh/sshrc on the server. If it only happens when you log in with a particular SSH key, it could be a command associated with the key in ~/.ssh/authorized_keys on the server.

Answer 3

A simpler solution is to use the find, grep and file commands, combined this way:

  find / -type f -mount -exec sh -c ' file "{}" | grep text 1>/dev/null && grep -l "2013-07-29" "{}" ' \;

First, you find all files, and pass the name of each one to a shell which will first test its filetype and, if found to be of the text type, will try to locate the string 2013-07-29 inside it, spitting out the file name if and only (the option -l) is found.

It's going to be a slow business, go get yourself some coffee in the meantime.