Create get-authorized-keys (#658)

- Add "Get authorized keys" query to `handbook/queries` - Edit "Get installed ___ software" queries for all platforms to prepare for adding software inventory to the host details API endpoint
2021-04-20 11:45:20 -07:00
parent 8c969316dc
commit bb488607b4
4 changed files with 35 additions and 39 deletions
@@ -4,24 +4,25 @@ Fleet's standard query library includes a growing collection of useful queries f

 ### Queries

- [Detect machines with gatekeeper disabled](./detect-machines-with-gatekeeper-disabled.md)(macOS)
- [Detect presence of authorized SSH keys](./detect-presence-of-authorized-ssh-keys.md)(macOS, Linux)
- [Detect hosts with the firewall disabled](./detect-hosts-with-the-firewall-disabled.md)(macOS)
- [Get installed Chrome extensions](./get-installed-chrome-extensions.md)(macOS, Linux, Windows, FreeBSD)
- [Get installed FreeBSD software](./get-installed-freebsd-software.md)(FreeBSD)
- [Get installed Homebrew packages](./get-installed-homebrew-packages.md)(macOS)
- [Get installed Linux software](./get-installed-linux-software.md)(Linux)
- [Get installed macOS software](./get-installed-macos-software.md)(macOS)
- [Get installed Safari extensions](./get-installed-safari-extensions.md)(macOS)
- [Get installed Windows software](./get-installed-windows-software.md)(Windows)
- [Get laptops with failing batteries](./get-laptops-with-failing-batteries.md)(macOS)
- [Get macOS disk free space percentage](./get-macos-disk-free-space-percentage.md)(macOS)
- [Get System Logins and Logouts](./get-system-logins-and-logouts.md)(macOS)
- [Get wifi status](./get-wifi-status.md)(macOS)
- [Get Windows machines with unencrypted hard disks](./get-windows-machines-with-unencrypted-hard-disks.md)(Windows)
- [Get platform info](./get-platform-info.md)(macOS)
- [Get USB devices](./get-usb-devices.md)(macOS, Linux)
- [Count Apple applications installed](./get-usb-devices.md)(macOS)
+- [Detect machines with gatekeeper disabled](./detect-machines-with-gatekeeper-disabled.md) (macOS)
+- [Detect presence of authorized SSH keys](./detect-presence-of-authorized-ssh-keys.md) (macOS, Linux)
+- [Detect hosts with the firewall disabled](./detect-hosts-with-the-firewall-disabled.md) (macOS)
+- [Get installed Chrome extensions](./get-installed-chrome-extensions.md) (macOS, Linux, Windows, FreeBSD)
+- [Get installed FreeBSD software](./get-installed-freebsd-software.md) (FreeBSD)
+- [Get installed Homebrew packages](./get-installed-homebrew-packages.md) (macOS)
+- [Get installed Linux software](./get-installed-linux-software.md) (Linux)
+- [Get installed macOS software](./get-installed-macos-software.md) (macOS)
+- [Get installed Safari extensions](./get-installed-safari-extensions.md) (macOS)
+- [Get installed Windows software](./get-installed-windows-software.md) (Windows)
+- [Get laptops with failing batteries](./get-laptops-with-failing-batteries.md) (macOS)
+- [Get macOS disk free space percentage](./get-macos-disk-free-space-percentage.md) (macOS)
+- [Get System Logins and Logouts](./get-system-logins-and-logouts.md) (macOS)
+- [Get wifi status](./get-wifi-status.md) (macOS)
+- [Get Windows machines with unencrypted hard disks](./get-windows-machines-with-unencrypted-hard-disks.md) (Windows)
+- [Get platform info](./get-platform-info.md) (macOS)
+- [Get USB devices](./get-usb-devices.md) (macOS, Linux)
+- [Count Apple applications installed](./count-apple-applications-installed.md) (macOS)
+- [Get authorized keys](./get-authorized-keys.md) (macOS, Linux)

 ### Contributors

@@ -0,0 +1,16 @@
+# Get authorizes keys
+
+List authorized_keys for each user on the system.
+
+### Support
+macOS, Linux
+
+### Query
+```sql
+SELECT * FROM users CROSS JOIN authorized_keys USING (uid);
+```
+### Purpose
+Informational
+
+### Remediation
+N/A
@@ -13,7 +13,6 @@ SELECT
  name AS name,
  version AS version,
  'Browser plugin (Chrome)' AS type,
-  '' AS 'architecture',
  'chrome_extensions' AS source
 FROM chrome_extensions
 UNION
@@ -21,7 +20,6 @@ SELECT
  name AS name,
  version AS version,
  'Browser plugin (Firefox)' AS type,
-  '' AS 'architecture',
  'firefox_addons' AS source
 FROM firefox_addons
 UNION
@@ -29,7 +27,6 @@ SELECT
  name AS name,
  version AS version,
  'Package (Atom)' AS type,
-  '' AS 'architecture',
  'atom_packages' AS source
 FROM atom_packages
 UNION
@@ -37,7 +34,6 @@ SELECT
  name AS name,
  version AS version,
  'Package (Python)' AS type,
-  '' AS 'architecture',
  'python_packages' AS source
 FROM python_packages
 UNION
@@ -45,7 +41,6 @@ SELECT
  name AS name,
  version AS version,
  'Package (pkg)' AS type,
-  arch AS 'architecture',
  'pkg_packages' AS source
 FROM pkg_packages;
 ```
@@ -13,8 +13,6 @@ SELECT
  name AS name,
  version AS version,
  'Package (APT)' AS type,
-  architectures AS 'architecture',
-  '' AS 'install_time',
  'apt_sources' AS source
 FROM apt_sources
 UNION
@@ -22,8 +20,6 @@ SELECT
  name AS name,
  version AS version,
  'Package (deb)' AS type,
-  arch AS 'architecture',
-  '' AS 'install_time',
  'deb_packages' AS source
 FROM deb_packages
 UNION
@@ -31,8 +27,6 @@ SELECT
  package AS name,
  version AS version,
  'Package (Portage)' AS type,
-  '' AS 'architecture',
-  '' AS 'install_time',
  'portage_packages' AS source
 FROM portage_packages
 UNION
@@ -40,8 +34,6 @@ SELECT
  name AS name,
  version AS version,
  'Package (RPM)' AS type,
-  arch AS 'architecture',
-  install_time AS 'install_time',
  'rpm_packages' AS source
 FROM rpm_packages
 UNION
@@ -49,8 +41,6 @@ SELECT
  name AS name,
  '' AS version,
  'Package (YUM)' AS type,
-  '' AS 'architecture',
-  '' AS 'install_time',
  'yum_sources' AS source
 FROM yum_sources
 UNION
@@ -58,8 +48,6 @@ SELECT
  name AS name,
  version AS version,
  'Package (NPM)' AS type,
-  '' AS 'architecture',
-  '' AS 'install_time',
  'npm_packages' AS source
 FROM npm_packages
 UNION
@@ -67,8 +55,6 @@ SELECT
  name AS name,
  version AS version,
  'Package (Atom)' AS type,
-  '' AS 'architecture',
-  '' AS 'install_time',
  'atom_packages' AS source
 FROM atom_packages
 UNION
@@ -76,8 +62,6 @@ SELECT
  name AS name,
  version AS version,
  'Package (Python)' AS type,
-  '' AS 'architecture',
-  '' AS 'install_time',
  'python_packages' AS source
 FROM python_packages;
 ```