10.5-directory-info
From radmind
The following listing of directories and files for Mac OS X 10.5 has been compiled from discussions on the Radmind-users mailing list. It is intended as a reference for on-going development of negative transcripts for Mac OS X 10.5.
/Library/Application Support/Apple/ParentalControls/Users/ Items created for all local users. Probably can be actively managed.
/Library/Managed Preferences/ Preferences that come from Workgroup Manager (MCX). Can be managed since they are recreated automatically as needed.
/Library/Preferences/DirectoryServices/ for local use, per system? override with site-specific positive transcripts for specific files? Possibly could be managed with Radmind. Could be harder to manage if binding to AD.
/Library/Preferences/SystemConfiguration/ May want to put the entire directory in the negative transcript and then only add on the few files that do not change or are not machine specific in positive ones. com.apple.Boot.plist may be the only file that is not dynamic or machine specific.
/Library/Preferences/SystemConfiguration/NetworkInterfaces.plist Rebuilt at boot, if missing. Lists available network interfaces (Ethernet, wireless, etc)
/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist Recent Airport networks and other Airport settings. Could be managed on a desktop, but probably not on a mobile laptop.
/Library/Preferences/SystemConfiguration/com.apple.network.identification.plist Stores network information unique for the local computer
/Library/Preferences/SystemConfiguration/com.apple.smb.server.plist Info about local Kerberos realm and a NetBIOSName and Server Description based on the machine name.
/Library/Preferences/SystemConfiguration/preferences.plist Network Locations and config info about all network interfaces
/Library/Preferences/com.apple.SoftwareUpdate.plist Always changing, after every software update run
/Library/Preferences/com.apple.TimeMachine.plist Contains references to files in user accounts - probably items to exclude from Time Machine backups???
/Library/Preferences/com.apple.audio.DeviceSettings.plist Varies per computer, gets crazier if you're on a KVM?
/Library/Preferences/com.apple.audio.SystemSettings.plist New in Leopard?
/Library/Preferences/com.apple.loginwindow.plist Stores the username of the last logged-in user. Also contains settings for autologin, display of login window lists versus fields, login window text, etc. Probably best to manage with Radmind.
/Library/Preferences/com.apple.security.systemidentities.plist Could be machine specific??
/Library/Preferences/com.apple.smb.server.plist Stores SMB/CIFS server info unique for that local computer and network
/Library/Preferences/edu.mit.Kerberos for local use, per system, with Identity Services?
/System/Library/Extensions/Caches/ /System/Library/Extensions/Caches/com.apple.kext.info New location for Extensions cache in 10.5. Replaces /System/Library/Extensions/Extensions.kextcache. Probably best to put the directory in the negative, not the file.
/home used by autofs for home directory mounting
/net used by autofs for host mounting
/private/etc/auto_home Settings for auto_fs
/private/etc/auto_master Settings for auto_fs. If you comment out the entries for /home and /net, then those directories go away and do not need to be in a negative transcript.
/private/var/db/ May want to put the entire directory in the negative transcript and then only add on the few files that do not change or are not machine specific in positive ones.
/private/var/db/CodeEquivalenceCandidates Used by Apple when installing updates to show that the old and new binaries are equivalent?? Seems to not change often.
/private/var/db/CodeEquivalenceDatabase Used by Apple when installing updates to show that the old and new binaries are equivalent?? Dynamically generated??
/private/var/db/DirectoryService/ Directory Services configuration.
/private/var/db/DirectoryService/flatfile.db Dynamically generated??
/private/var/db/PanicReporter Kernel panic reports??
/private/var/db/SystemKey Could be unique per machine
/private/var/db/crls Certificate Revocation LIsts???
/private/var/db/dyld/ Cache files that replace prebinding that occured in previous versions of Mac OS X. Managed automatically by the OS.
/private/var/db/krb5kdc/ Data for the Local Kerberos Distribution Center (LKDC), which is presumably unique on each machine. But what about its non-unique contents, such as the .acl and .conf file?
/private/var/db/krb5dc/kdc.conf autogenerated by KDCSetup??
/private/var/samba/shares/ contains data for samba shares, including per-user items
/private/var/spool/ spool directories for fax, printing (cups), and mail (postfix, etc)
/private/var/agentx/ AgentX snmp protocol. Probably should be in positive.
/private/var/amavis/ anti-virus/antispam mail scanner for Mac OS X Server. Not on normally on clients. Probably should be in positive.
/private/var/at/ at jobs. Probably should be in positive.
/private/var/at/spool Spool location for at jobs. If using at, should probably be in negative.
/private/var/audit/ ????
/private/var/backups/ ????
/private/var/samba/shares/ seems to contain one file per local user? contents created with the user account?
/private/var/virusmails/ Associated with amavis or clamav??
/usr/share/servermanagerd/ Found on Mac OS X 10.5 client. This is the for the Server Manager Daemon for Mac OS X Server. No servermanagerd is on client. Could be removed entirely?
/usr/share/wikid/ Found on Mac OS X 10.5 client. This is the for the Wiki Server Daemon for Mac OS X Server. No wikid is on client. Could be removed entirely?
/usr/X11/var/cache/ font caches and other cached data for X11
