Cybersecurity Triage
Read-only, can be slowFind Loose Private Key Permissions
You need to find private-key-looking files with modes broader than 600.
Command
find /home -type f -name 'id_*' -printf '%m %p\n' 2>/dev/null | awk '$1 > 600'Before you run this
System impact: Read-only. Can create load on large logs, directories, filesystems, or process tables.
When not to use it: Do not assume every id_* file is a real private key; inspect carefully before changing or deleting.
Expected output
Mode and path for private-key-looking files with loose permissions.
System impact
Read-only, can be slow. Nothing changes. The command prints key-looking files whose numeric mode is greater than 600.
Scope this to the smallest useful path or service on busy systems.
Recovery / rollback: no state is changed.
When to use it
Use during server access audits or after provisioning SSH credentials.
When not to use it
Do not assume every id_* file is a real private key; inspect carefully before changing or deleting.
next steps
Related commands
Find Loose authorized_keys Modes
SSH key access files should not be looser than intended.
find /home -path '*/.ssh/authorized_keys' -printf '%m %p\n' 2>/dev/null | awk '$1 > 600'
Find SSH Keys for nologin Users
A nologin shell does not automatically mean SSH keys are irrelevant.
comm -12 <(awk -F: '$7 !~ /(bash|sh|zsh)$/ {print $1}' /etc/passwd | sort) <(find /home -path '*/.ssh/authorized_keys' -printf '%h\n' 2>/dev/null | awk -F/ '{print $(NF-1)}' | sort)
Find SSH Key Users with sudo
The highest-priority access review starts where SSH keys and sudo overlap.
comm -12 <(find /home -path '*/.ssh/authorized_keys' -printf '%h\n' 2>/dev/null | awk -F/ '{print $(NF-1)}' | sort) <(awk -F: '$1=="sudo" {gsub(",","\n",$4); print $4}' /etc/group | sort)
Find Config Files with Execute Bits
Config files do not usually need to be executable.
find /srv/www/example -type f -perm /111 \( -path '*/config/*' -o -name '*.env' -o -name '*.conf' \) -printf '%M %u:%g %p\n' 2>/dev/null | sort
Inventory SSH authorized_keys
authorized_keys files are the practical list of who can use key-based SSH.
find /home -path '*/.ssh/authorized_keys' -exec awk '{print FILENAME, $1, $NF}' {} + 2>/dev/null
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.