Cybersecurity Triage
Read-onlyList Accounts with Login Shells
You need to separate human or interactive accounts from service accounts in a passwd-style file.
Command
awk -F: '$7 ~ /(bash|sh|zsh)$/ {printf "%s %s\n", $1, $7}' /etc/passwdBefore you run this
System impact: Read-only. Low when scoped to the shown target.
When not to use it: Do not disable accounts from this list alone; confirm ownership, automation, and operational purpose first.
Expected output
Usernames and login shells for accounts that can start an interactive shell.
System impact
Read-only. Nothing changes. The command reads a system passwd file and prints accounts with shell-like login programs.
May require elevated permissions on protected paths or service-owned files.
Recovery / rollback: no state is changed.
When to use it
Use during server handoff, user access reviews, and first-response checks before changing accounts.
When not to use it
Do not disable accounts from this list alone; confirm ownership, automation, and operational purpose first.
How to read the account list
A shell-like login program means the account can potentially start an interactive shell. It does not prove the account is active, authorized, or safe to remove. Pair this with group membership, SSH keys, and owner records.
awk -F: '$7 ~ /(bash|sh|zsh)$/ {printf "%s %s\n", $1, $7}' /etc/passwdlastlog | head
next steps
Related commands
Find SSH Keys for nologin Users
A nologin shell does not automatically mean SSH keys are irrelevant.
comm -12 <(awk -F: '$7 !~ /(bash|sh|zsh)$/ {print $1}' /etc/passwd | sort) <(find /home -path '*/.ssh/authorized_keys' -printf '%h\n' 2>/dev/null | awk -F/ '{print $(NF-1)}' | sort)
List Users with Login Shells
Not every local account should be able to log in.
awk -F: '$7 ~ /sh$/ {print $1, $7}' etc/passwd
Find SSH Key Users with sudo
The highest-priority access review starts where SSH keys and sudo overlap.
comm -12 <(find /home -path '*/.ssh/authorized_keys' -printf '%h\n' 2>/dev/null | awk -F/ '{print $(NF-1)}' | sort) <(awk -F: '$1=="sudo" {gsub(",","\n",$4); print $4}' /etc/group | sort)
List Privileged Group Members
Group membership can grant more access than the username suggests.
awk -F: '$1 ~ /^(sudo|adm|docker)$/ && $4 != "" {print $1 ": " $4}' /etc/group
Find Password-Enabled Accounts
A shell account with an unlocked password hash deserves extra attention.
sudo awk -F: '$2 !~ /^(!|\*)/ {print $1}' /etc/shadow
next diagnostic step
Where to go from this command
- User not in sudoers hub Use when account identity and privileged access need to be separated.
- Permission denied hub Use when the account exists but cannot access a path.
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.