Back to commands

Cybersecurity Triage

Read-only, sensitive output

List Privileged Group Members

You need to review accounts listed in privileged groups such as sudo, adm, or docker.

Command

awk -F: '$1 ~ /^(sudo|adm|docker)$/ && $4 != "" {print $1 ": " $4}' /etc/group

Before you run this

System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.

When not to use it: Do not remove group members from this output alone; confirm role ownership, automation, and approval records first.

Expected output

Privileged group names followed by their listed members.

System impact

Read-only, sensitive output. Nothing changes. The command reads a system group file and prints populated privileged groups.

May require elevated permissions on protected paths or service-owned files.

Recovery / rollback: no state is changed.

When to use it

Use during access reviews when group membership may grant root, log, or runtime control.

When not to use it

Do not remove group members from this output alone; confirm role ownership, automation, and approval records first.

Common misread

The sudo group is not the only access path. Docker can grant container control, adm can expose logs, and custom sudoers rules may grant access without group membership. Treat this as an inventory, not a removal list.

awk -F: '$1 ~ /^(sudo|adm|docker)$/ && $4 != "" {print $1 ": " $4}' /etc/group
sudo -l

next steps

Related commands

Cybersecurity Triage Sensitive output

Review sudo Grants

Privilege paths should be visible before you remove or approve access.

awk -F: '$1=="sudo" {print "sudo group: " $4}' /etc/group; sudo grep -RhnE '^[^#].*ALL=' /etc/sudoers /etc/sudoers.d 2>/dev/null

Cybersecurity Triage Sensitive output

Find SSH Key Users with sudo

The highest-priority access review starts where SSH keys and sudo overlap.

comm -12 <(find /home -path '*/.ssh/authorized_keys' -printf '%h\n' 2>/dev/null | awk -F/ '{print $(NF-1)}' | sort) <(awk -F: '$1=="sudo" {gsub(",","\n",$4); print $4}' /etc/group | sort)

Cybersecurity Triage Sensitive output

Find Password-Enabled Accounts

A shell account with an unlocked password hash deserves extra attention.

sudo awk -F: '$2 !~ /^(!|\*)/ {print $1}' /etc/shadow

Cybersecurity Triage Sensitive output

Find SSH Keys for nologin Users

A nologin shell does not automatically mean SSH keys are irrelevant.

comm -12 <(awk -F: '$7 !~ /(bash|sh|zsh)$/ {print $1}' /etc/passwd | sort) <(find /home -path '*/.ssh/authorized_keys' -printf '%h\n' 2>/dev/null | awk -F/ '{print $(NF-1)}' | sort)

Cybersecurity Triage Sensitive output

Extract SSH AllowUsers Accounts

AllowUsers turns SSH access into an explicit account list.

awk '/^AllowUsers/ {for (i = 2; i <= NF; i++) print $i}' etc/ssh/sshd_config

next diagnostic step

Where to go from this command

User not in sudoers hub Use when sudo access is expected but missing.
sudo group members command Inspect sudo group membership directly.

Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.

Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.