Back to commands

Cybersecurity Triage

Read-only, sensitive output

Count authorized_keys by User

You need to find which home directories have authorized_keys files and how many active key lines each contains.

Command

find /home -path '*/.ssh/authorized_keys' -exec sh -c 'for f do user=$(basename "$(dirname "$(dirname "$f")")"); keys=$(grep -vc "^[[:space:]]*#" "$f"); printf "%s %s %s\n" "$user" "$keys" "$f"; done' sh {} + 2>/dev/null | sort

Before you run this

System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.

When not to use it: Do not remove keys just because they exist; confirm owner, source system, and current dependency first.

Expected output

Usernames, active key counts, and authorized_keys file paths.

System impact

Read-only, sensitive output. Nothing changes. The command reads system authorized_keys files and counts non-comment lines.

Recovery / rollback: no state is changed.

When to use it

Use during SSH access inventory, offboarding, or server handoff when keys may outlive account ownership.

When not to use it

Do not remove keys just because they exist; confirm owner, source system, and current dependency first.

next steps

Related commands

Cybersecurity Triage Sensitive output

Find SSH Key Users with sudo

The highest-priority access review starts where SSH keys and sudo overlap.

comm -12 <(find /home -path '*/.ssh/authorized_keys' -printf '%h\n' 2>/dev/null | awk -F/ '{print $(NF-1)}' | sort) <(awk -F: '$1=="sudo" {gsub(",","\n",$4); print $4}' /etc/group | sort)

Cybersecurity Triage Sensitive output

Find SSH Keys for nologin Users

A nologin shell does not automatically mean SSH keys are irrelevant.

comm -12 <(awk -F: '$7 !~ /(bash|sh|zsh)$/ {print $1}' /etc/passwd | sort) <(find /home -path '*/.ssh/authorized_keys' -printf '%h\n' 2>/dev/null | awk -F/ '{print $(NF-1)}' | sort)

Cybersecurity Triage Sensitive output

Summarize SSH Authorized Key Types

Key inventory gets more useful when old key types stand out.

find /home -path '*/.ssh/authorized_keys' -exec awk '{print $1}' {} + 2>/dev/null | sort | uniq -c | sort -nr

Cybersecurity Triage Sensitive output

List authorized_keys Files

Authorized keys are the server's practical access list.

find /home -path '*/.ssh/authorized_keys' -printf '%m %p\n' 2>/dev/null

Cybersecurity Triage Sensitive output

Inventory SSH authorized_keys

authorized_keys files are the practical list of who can use key-based SSH.

find /home -path '*/.ssh/authorized_keys' -exec awk '{print FILENAME, $1, $NF}' {} + 2>/dev/null

Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.

Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.