How to Manage Linux Boot Scripts: rc.local, init.d, chkconfig & More

Introduction

The article describes common ways Linux servers run programs at boot time and how to discover hidden startup entries that may be added by attackers. It contrasts traditional supervision tools like supervisord or crontab with more stealthy mechanisms.

User‑defined boot scripts

The file /etc/rc.d/rc.local (a symlink to /etc/rc.d/rc.local) is executed automatically during system start‑up. Any commands placed in this file run in the background without needing an ampersand.

Login‑shell scripts

When a user logs in (or uses su -), the shell reads /etc/profile. This file is only executed for login shells, not for non‑login shells, and typically sources additional scripts from /etc/profile.d/ to set environment variables and run initialization commands.

Managing services with chkconfig

To add a custom service to the boot sequence, place the script in /etc/init.d/ (or the symlinked /etc/rc.d/init.d/). The script must support the standard arguments start, stop, restart, etc., and be executable (at least 755 permissions).

Typical script header:

#!/bin/sh</code>
<code>#chkconfig: 35 20 80</code>
<code>#description: http server

After the script is in place, register it with:

chkconfig --add servicename

chkconfig --level 35 servicename on

This adds the service to run‑levels 3, 4, and 5, causing it to start automatically at boot.

Run‑level details

Run‑levels define which services start at which stage. Level 35 is a common choice for custom services; using - as the level list disables automatic start. Only one start or stop script can exist per run‑level for a given service, and switching levels does not restart already running services.

Graphical management with ntsysv (Red Hat only)

Red Hat provides the ntsysv utility, an interactive curses interface that lets administrators enable or disable services for each run‑level using arrow keys and space bar.

Summary of steps

Add custom commands to /etc/rc.d/rc.local for immediate boot execution.

Copy a service script to /etc/rc.d/init.d (or /etc/init.d) and ensure it contains the proper header and is executable.

Register the script with chkconfig --add and enable the desired run‑levels with chkconfig --level 35 servicename on.

Optionally use ntsysv for a menu‑driven configuration.

For scripts that should run after a user logs in with a password, place them in /etc/profile.d/.

Following these practices helps maintain control over what runs at system start‑up and reduces the risk of unnoticed malicious processes.