Find SSH Key Users with sudo

You need to identify users who both have authorized_keys files and appear in the sudo group.

Command

comm -12 <(find fixtures/user-access-audit/home -path '*/.ssh/authorized_keys' -printf '%h\n' | awk -F/ '{print $(NF-1)}' | sort) <(awk -F: '$1=="sudo" {gsub(",","\n",$4); print $4}' fixtures/user-access-audit/etc/group | sort)

Before you run this

System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.

When not to use it: Do not treat this as the only privilege path; direct sudoers rules and other privileged groups can matter too.

Expected output

Usernames present in both the authorized_keys owner list and the sudo group.

System impact

Read-only, sensitive output. Nothing changes. The command compares fixture-local SSH key owners with sudo group members.

May require elevated permissions on protected paths or service-owned files.

Recovery / rollback: no state is changed.

When to use it

Use during access reviews to prioritize accounts that can log in by key and elevate privileges.

When not to use it

Do not treat this as the only privilege path; direct sudoers rules and other privileged groups can matter too.

Explanation-only example

Illustrated output, not a live lab run

This example is intentionally illustrative. It shows the command shape without killing real processes or changing your machine.

demo@lab:~$

$ find sample-files/user-access-audit/users -path '*/ssh-keys/authorized_keys' -printf '%h\n' | awk -F/ '{print $(NF-1)}' | sort

alex
breakglass
deploy
reports

$ comm -12 <(find sample-files/user-access-audit/users -path '*/ssh-keys/authorized_keys' -printf '%h\n' | awk -F/ '{print $(NF-1)}' | sort) <(awk -F: '$1=="sudo" {gsub(",","\n",$4); print $4}' sample-files/user-access-audit/etc/group | sort)

alex
breakglass

View commands shown

These are the commands shown in the sanitized transcript.