golden hour

/opt/osquery/share/osquery/lenses

File/Folder	Size	Actions
COPYING	25.91 KB
access.aug	3.58 KB
activemq_conf.aug	1.47 KB
activemq_xml.aug	864 B
afs_cellalias.aug	1.56 KB
aliases.aug	2.18 KB
anaconda.aug	775 B
anacron.aug	2.49 KB
approx.aug	1.26 KB
apt_update_manager.aug	1.11 KB
aptcacherngsecurity.aug	726 B
aptconf.aug	3.9 KB
aptpreferences.aug	1.79 KB
aptsources.aug	1.98 KB
authorized_keys.aug	1.84 KB
automaster.aug	3.31 KB
automounter.aug	4.05 KB
avahi.aug	1.38 KB
backuppchosts.aug	1014 B
bbhosts.aug	4.24 KB
bootconf.aug	3.65 KB
build.aug	16.65 KB
cachefilesd.aug	2 KB
carbon.aug	1.54 KB
ceph.aug	719 B
cgconfig.aug	3.37 KB
cgrules.aug	2.38 KB
channels.aug	3.84 KB
chrony.aug	12.87 KB
clamav.aug	1.53 KB
cobblermodules.aug	398 B
cobblersettings.aug	2.24 KB
collectd.aug	869 B
cpanel.aug	824 B
cron.aug	4.05 KB
cron_user.aug	1.26 KB
crypttab.aug	3.01 KB
csv.aug	1.18 KB
cups.aug	459 B
cyrus_imapd.aug	1.51 KB
darkice.aug	773 B
debctrl.aug	3.61 KB
desktop.aug	1.39 KB
devfsrules.aug	619 B
device_map.aug	620 B
dhclient.aug	6.69 KB
dhcpd.aug	20.88 KB
dns_zone.aug	2.89 KB
dnsmasq.aug	2.16 KB
dovecot.aug	3.98 KB
dpkg.aug	2.78 KB
dput.aug	2.16 KB
erlang.aug	4.33 KB
ethers.aug	663 B
exports.aug	2.37 KB
fai_diskconfig.aug	9.28 KB
fonts.aug	819 B
fstab.aug	1.23 KB
fuse.aug	871 B
gdm.aug	1.8 KB
getcap.aug	1.57 KB
group.aug	1.66 KB
grub.aug	11.04 KB
grubenv.aug	508 B
gshadow.aug	2.19 KB
gtkbookmarks.aug	855 B
host_conf.aug	1.9 KB
hostname.aug	435 B
hosts.aug	485 B
hosts_access.aug	4.32 KB
htpasswd.aug	1.02 KB
httpd.aug	7.35 KB
inetd.aug	6.22 KB
inifile.aug	15.49 KB
inittab.aug	780 B
inputrc.aug	1.62 KB
interfaces.aug	4.62 KB
iproute2.aug	323 B
iptables.aug	2.64 KB
iscsid.aug	684 B
jaas.aug	1.57 KB
jettyrealm.aug	1.52 KB
jmxaccess.aug	1.35 KB
jmxpassword.aug	1.34 KB
json.aug	2.15 KB
kdump.aug	2.91 KB
keepalived.aug	10.7 KB
known_hosts.aug	1.93 KB
koji.aug	898 B
krb5.aug	6.16 KB
ldif.aug	7.65 KB
ldso.aug	1.06 KB
lightdm.aug	1.75 KB
limits.aug	2.02 KB
login_defs.aug	615 B
logrotate.aug	4.22 KB
logwatch.aug	1.44 KB
lokkit.aug	2.16 KB
lvm.aug	2.03 KB
mailscanner.aug	1.66 KB
mailscanner_rules.aug	2.84 KB
masterpasswd.aug	4.36 KB
mcollective.aug	1.09 KB
mdadm_conf.aug	10.05 KB
memcached.aug	1.24 KB
mke2fs.aug	4.67 KB
modprobe.aug	3.34 KB
modules.aug	741 B
modules_conf.aug	1.04 KB
mongodbserver.aug	1.17 KB
monit.aug	2.13 KB
multipath.aug	4.21 KB
mysql.aug	1.95 KB
nagioscfg.aug	2.09 KB
nagiosobjects.aug	1.57 KB
netmasks.aug	1.69 KB
networkmanager.aug	2 KB
networks.aug	1.09 KB
nginx.aug	3.65 KB
nrpe.aug	1.75 KB
nslcd.aug	9.87 KB
nsswitch.aug	2.33 KB
ntp.aug	5.29 KB
ntpd.aug	4.75 KB
odbc.aug	1.42 KB
opendkim.aug	3.08 KB
openshift_config.aug	2.46 KB
openshift_http.aug	1.03 KB
openshift_quickstarts.aug	1.02 KB
openvpn.aug	22.28 KB
oz.aug	1.35 KB
pagekite.aug	2.6 KB
pam.aug	2.58 KB
pamconf.aug	1.23 KB
passwd.aug	3.52 KB
pbuilder.aug	638 B
pg_hba.aug	2.97 KB
pgbouncer.aug	1.43 KB
php.aug	2.34 KB
phpvars.aug	3.85 KB
postfix_access.aug	771 B
postfix_main.aug	1.52 KB
postfix_master.aug	1.9 KB
postfix_passwordmap.aug	1.28 KB
postfix_sasl_smtpd.aug	697 B
postfix_transport.aug	1.48 KB
postfix_virtual.aug	1.32 KB
postgresql.aug	2.1 KB
properties.aug	2.3 KB
protocols.aug	1.05 KB
puppet.aug	1.52 KB
puppet_auth.aug	1.95 KB
puppetfile.aug	2.27 KB
puppetfileserver.aug	3.12 KB
pylonspaste.aug	2.3 KB
pythonpaste.aug	1.99 KB
qpid.aug	670 B
quote.aug	6.71 KB
rabbitmq.aug	4.69 KB
radicale.aug	1.48 KB
rancid.aug	927 B
redis.aug	4.96 KB
reprepro_uploaders.aug	5.47 KB
resolv.aug	3.87 KB
rhsm.aug	1.1 KB
rmt.aug	788 B
rsyncd.aug	1.97 KB
rsyslog.aug	3.17 KB
rtadvd.aug	854 B
rx.aug	4.06 KB
samba.aug	1.71 KB
schroot.aug	1.79 KB
securetty.aug	450 B
semanage.aug	859 B
sep.aug	1.28 KB
services.aug	2.82 KB
shadow.aug	2.35 KB
shells.aug	745 B
shellvars.aug	11.97 KB
shellvars_list.aug	1.74 KB
simplelines.aug	1.13 KB
simplevars.aug	1.34 KB
sip_conf.aug	1.61 KB
slapd.aug	5.2 KB
smbusers.aug	781 B
solaris_system.aug	3.15 KB
soma.aug	1.14 KB
spacevars.aug	1.42 KB
splunk.aug	1.64 KB
squid.aug	15.95 KB
ssh.aug	3.91 KB
sshd.aug	4.01 KB
sssd.aug	861 B
star.aug	941 B
strongswan.aug	1.63 KB
stunnel.aug	2.21 KB
subversion.aug	2.75 KB
sudoers.aug	20.03 KB
sysconfig.aug	2.49 KB
sysconfig_route.aug	2.55 KB
sysctl.aug	923 B
syslog.aug	7.33 KB
systemd.aug	5.88 KB
termcap.aug	1.03 KB
thttpd.aug	1.31 KB
tmpfiles.aug	3.03 KB
toml.aug	4.06 KB
trapperkeeper.aug	4.01 KB
tuned.aug	387 B
up2date.aug	2.21 KB
updatedb.aug	1.13 KB
util.aug	4.85 KB
vfstab.aug	1.71 KB
vmware_config.aug	702 B
vsftpd.aug	2.72 KB
webmin.aug	1.23 KB
wine.aug	1.92 KB
xendconfsxp.aug	1.07 KB
xinetd.aug	4.02 KB
xml.aug	6.33 KB
xorg.aug	10.43 KB
xymon.aug	2.26 KB
xymon_alerting.aug	6.11 KB
yaml.aug	1.54 KB
yum.aug	2.19 KB

Edit: inetd.aug

(* inetd.conf lens definition for Augeas
   Auther: Matt Palmer <mpalmer@hezmatt.org>

This program is free software: you can redistribute it and/or modify it
   under the terms of the GNU Lesser General Public License version 2.1 as
   published by the Free Software Foundation.

This program is distributed in the hope that it will be useful, but
   WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General
   Public License for more details.

You should have received a copy of the GNU General Public License along
   with this program.  If not, see <http://www.gnu.org/licenses/>.

This lens parses /etc/inetd.conf.  The current format is based on the
syntax documented in the inetd manpage shipped with Debian's openbsd-inetd
package version 0.20080125-2.  Apologies if your inetd.conf doesn't follow
the same format.

Each top-level entry will have a key being that of the service name (the
first column in the service definition, which is the name or number of the
port that the service should listen on).  The attributes for the service all
sit under that.  In regular Augeas style, the order of the attributes
matter, and attempts to set things in a different order will fail miserably.
The defined attribute names (and the order in which they must appear) are as
follows (with mandatory parameters indicated by [*]):

address -- a sequence of IP addresses or hostnames on which this service
	should listen.

socket[*] -- The type of the socket that will be created (either stream or
	dgram, although the lens doesn't constrain the possibilities here)

protocol[*] -- The socket protocol.  I believe that the usual possibilities
	are "tcp", "udp", or "unix", but no restriction is made on what you
	can actually put here.

sndbuf -- Specify a non-default size for the send buffer of the connection.

rcvbuf -- Specify a non-default size for the receive buffer of the connection.

wait[*] -- Whether to wait for new connections ("wait"), or just terminate
	immediately ("nowait").

max -- The maximum number of times that a service can be invoked in one minute.

user[*] -- The user to run the service as.

group -- A group to set the running service to, rather than the primary
	group of the previously specified user.

command[*] -- What program to run.

arguments -- A sequence of arguments to pass to the command.

In addition to this straightforward tree, inetd has the ability to set
"default" listen addresses; this is a little used feature which nonetheless
comes in handy sometimes.  The key for entries of this type is "address"
, and the subtree should be a sequence of addresses.  "*" can
always be used to return the default behaviour of listening on INADDR_ANY.

module Inetd =
	autoload xfm

(***************************
	 * PRIMITIVES
	 ***************************)

(* Store whitespace *)
	let wsp = del /[ \t]+/ " "
	let sep = del /[ \t]+/ "	"
	let owsp(t:string) = del /[ \t]*/ t

(* It's the end of the line as we know it... doo, doo, dooooo *)
	let eol = Util.eol

(* In the beginning, the earth was without form, and void *)
	let empty = Util.empty

let comment = Util.comment

let del_str = Util.del_str

let address = [ seq "addrseq" . store /([a-zA-Z0-9.-]+|\[[A-Za-z0-9:?*%]+\]|\*)/ ]
	let address_list = ( counter "addrseq" . (address . del_str ",")* . address )

let argument = [ seq "argseq" . store /[^ \t\n]+/ ]
	let argument_list = ( counter "argseq" . [ label "arguments" . (argument . wsp)* . argument ] )

(***************************
	 * ELEMENTS
	 ***************************)

let service (l:string) = ( label l . [label "address" . address_list . del_str ":" ]? . store /[^ \t\n\/:#]+/ )

let socket = [ label "socket" . store /[^ \t\n#]+/ ]

let protocol = ( [ label "protocol" . store /[^ \t\n,#]+/ ]
	                 . [ del_str "," . key /sndbuf/ . del_str "=" . store /[^ \t\n,]+/ ]?
	                 . [ del_str "," . key /rcvbuf/ . del_str "=" . store /[^ \t\n,]+/ ]?
	               )

let wait = ( [ label "wait" . store /(wait|nowait)/ ]
	             . [ del_str "." . label "max" . store /[0-9]+/ ]?
	           )

let usergroup = ( [ label "user" . store /[^ \t\n:.]+/ ]
	                  . [ del /[:.]/ ":" . label "group" . store /[^ \t\n:.]+/ ]?
	                )

let command = ( [ label "command" . store /[^ \t\n]+/ ]
	                . (wsp . argument_list)?
	              )

(***************************
	 * SERVICE LINES
	 ***************************)

let service_line = [ service "service"
	                     . sep
	                     . socket
	                     . sep
	                     . protocol
	                     . sep
	                     . wait
	                     . sep
	                     . usergroup
	                     . sep
	                     . command
	                     . eol
	                   ]

(***************************
	 * RPC LINES
	 ***************************)

let rpc_service = service "rpc_service" . Util.del_str "/"
                        . [ label "version" . store Rx.integer ]

let rpc_endpoint = [ label "endpoint-type" . store Rx.word ]
        let rpc_protocol = Util.del_str "rpc/"
                         . (Build.opt_list
                             [label "protocol" . store /[^ \t\n,#]+/ ]
                             Sep.comma)

let rpc_line = [ rpc_service
	                     . sep
	                     . rpc_endpoint
	                     . sep
	                     . rpc_protocol
	                     . sep
	                     . wait
	                     . sep
	                     . usergroup
	                     . sep
	                     . command
	                     . eol
	                   ]

(***************************
	 * DEFAULT LISTEN ADDRESSES
	 ***************************)

let default_listen_address = [ label "address"
	                               . address_list
	                               . del_str ":"
	                               . eol
	                             ]

(***********************
	 * LENS / FILTER
	 ***********************)

let lns = (comment|empty|service_line|rpc_line|default_listen_address)*

let filter = incl "/etc/inetd.conf"

let xfm = transform lns filter