Back to commands

Cybersecurity Triage

Read-only, sensitive output

Review a Breakglass Account

You need to collect account, group, SSH key, and log evidence for a breakglass user from system files.

Command

sudo grep -Rhn 'breakglass' /etc /home /var/log/auth.log 2>/dev/null

Before you run this

System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.

When not to use it: Do not delete emergency access from search results alone; verify business continuity requirements and approval policy.

Expected output

Line-numbered matches showing breakglass records across account files, keys, and logs.

System impact

Read-only, sensitive output. Nothing changes. The command searches system account, access, and log files for the breakglass username.

May require elevated permissions on protected paths or service-owned files.

Recovery / rollback: no state is changed.

When to use it

Use when auditing emergency accounts or checking whether exceptional access was used recently.

When not to use it

Do not delete emergency access from search results alone; verify business continuity requirements and approval policy.

next steps

Related commands

Cybersecurity Triage Sensitive output

Show Successful Logins and sudo Use

Access reviews need both who logged in and who elevated privileges.

grep -E 'Accepted publickey|sudo:' /var/log/auth.log 2>/dev/null

Cybersecurity Triage Sensitive output

Find SSH Key Users with sudo

The highest-priority access review starts where SSH keys and sudo overlap.

comm -12 <(find /home -path '*/.ssh/authorized_keys' -printf '%h\n' 2>/dev/null | awk -F/ '{print $(NF-1)}' | sort) <(awk -F: '$1=="sudo" {gsub(",","\n",$4); print $4}' /etc/group | sort)

Cybersecurity Triage Sensitive output

Summarize sudo Commands by User

Privilege history is easier to review when users and commands are separated.

sed -n 's/.*sudo: *\([^: ]*\).*COMMAND=\(.*\)$/\1 -> \2/p' /var/log/auth.log 2>/dev/null | sort

Cybersecurity Triage Sensitive output

Review sudo Grants

Privilege paths should be visible before you remove or approve access.

awk -F: '$1=="sudo" {print "sudo group: " $4}' /etc/group; sudo grep -RhnE '^[^#].*ALL=' /etc/sudoers /etc/sudoers.d 2>/dev/null

Cybersecurity Triage Sensitive output

Count authorized_keys by User

authorized_keys is the practical SSH access list.

find /home -path '*/.ssh/authorized_keys' -exec sh -c 'for f do user=$(basename "$(dirname "$(dirname "$f")")"); keys=$(grep -vc "^[[:space:]]*#" "$f"); printf "%s %s %s\n" "$user" "$keys" "$f"; done' sh {} + 2>/dev/null | sort

Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.

Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.