Cybersecurity Triage
Read-only, sensitive outputSummarize sudo Commands by User
You need to extract sudo users and command paths from auth log lines.
Command
sed -n 's/.*sudo: *\([^: ]*\).*COMMAND=\(.*\)$/\1 -> \2/p' /var/log/auth.log 2>/dev/null | sortBefore you run this
System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.
When not to use it: Do not assume this covers every privileged action; rotated logs, journal data, and direct root sessions may add context.
Expected output
A sorted list of sudo users mapped to the commands they ran.
System impact
Read-only, sensitive output. Nothing changes. The command filters sudo log lines and extracts the acting user plus command.
May require elevated permissions on protected paths or service-owned files.
Recovery / rollback: no state is changed.
When to use it
Use during access reviews, incident triage, or post-change checks when privilege use matters.
When not to use it
Do not assume this covers every privileged action; rotated logs, journal data, and direct root sessions may add context.
next steps
Related commands
Show Successful Logins and sudo Use
Access reviews need both who logged in and who elevated privileges.
grep -E 'Accepted publickey|sudo:' /var/log/auth.log 2>/dev/null
Review a Breakglass Account
Emergency accounts should be easy to find and hard to ignore.
sudo grep -Rhn 'breakglass' /etc /home /var/log/auth.log 2>/dev/null
Redact Secret-Looking Log Lines
Incident notes should not copy secrets forward.
grep -RInEi '(password|token|secret|authorization)' /var/log/app /var/log/deploy.log 2>/dev/null | sed -E 's/((password|token|secret)[[:space:]]*[:=])[[:alnum:]_.-]+/\1REDACTED/Ig; s/([Aa]uthorization[[:space:]]*:[[:space:]]*[Bb]earer[[:space:]]+)[[:alnum:]_.-]+/\1REDACTED/g'
Find SSH Key Users with sudo
The highest-priority access review starts where SSH keys and sudo overlap.
comm -12 <(find /home -path '*/.ssh/authorized_keys' -printf '%h\n' 2>/dev/null | awk -F/ '{print $(NF-1)}' | sort) <(awk -F: '$1=="sudo" {gsub(",","\n",$4); print $4}' /etc/group | sort)
Count authorized_keys by User
authorized_keys is the practical SSH access list.
find /home -path '*/.ssh/authorized_keys' -exec sh -c 'for f do user=$(basename "$(dirname "$(dirname "$f")")"); keys=$(grep -vc "^[[:space:]]*#" "$f"); printf "%s %s %s\n" "$user" "$keys" "$f"; done' sh {} + 2>/dev/null | sort
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.