Cybersecurity Triage
Read-only, sensitive outputReview sudo Grants
You need a compact view of sudo group membership and sudoers rules from system files.
Command
awk -F: '$1=="sudo" {print "sudo group: " $4}' /etc/group; sudo grep -RhnE '^[^#].*ALL=' /etc/sudoers /etc/sudoers.d 2>/dev/nullBefore you run this
System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.
When not to use it: Do not edit sudoers based only on this summary; validate syntax and account ownership on real systems.
Expected output
sudo group members followed by uncommented sudoers lines that grant privileges.
System impact
Read-only, sensitive output. Nothing changes. The command reads system group and sudoers files and prints privilege grants.
May require elevated permissions on protected paths or service-owned files.
Recovery / rollback: no state is changed.
When to use it
Use when auditing who can elevate privileges or when preparing to remove stale access.
When not to use it
Do not edit sudoers based only on this summary; validate syntax and account ownership on real systems.
next steps
Related commands
Find SSH Key Users with sudo
The highest-priority access review starts where SSH keys and sudo overlap.
comm -12 <(find /home -path '*/.ssh/authorized_keys' -printf '%h\n' 2>/dev/null | awk -F/ '{print $(NF-1)}' | sort) <(awk -F: '$1=="sudo" {gsub(",","\n",$4); print $4}' /etc/group | sort)
List Privileged Group Members
Group membership can grant more access than the username suggests.
awk -F: '$1 ~ /^(sudo|adm|docker)$/ && $4 != "" {print $1 ": " $4}' /etc/group
Review a Breakglass Account
Emergency accounts should be easy to find and hard to ignore.
sudo grep -Rhn 'breakglass' /etc /home /var/log/auth.log 2>/dev/null
Find SSH Keys for nologin Users
A nologin shell does not automatically mean SSH keys are irrelevant.
comm -12 <(awk -F: '$7 !~ /(bash|sh|zsh)$/ {print $1}' /etc/passwd | sort) <(find /home -path '*/.ssh/authorized_keys' -printf '%h\n' 2>/dev/null | awk -F/ '{print $(NF-1)}' | sort)
Show Successful Logins and sudo Use
Access reviews need both who logged in and who elevated privileges.
grep -E 'Accepted publickey|sudo:' /var/log/auth.log 2>/dev/null
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.