Back to commands

Cybersecurity Triage

Read-only, sensitive output

List authorized_keys Files

You need to find authorized_keys files and their modes.

Command

find /home -path '*/.ssh/authorized_keys' -printf '%m %p\n' 2>/dev/null

Before you run this

System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.

When not to use it: Do not remove keys from this output alone; confirm ownership and active dependencies first.

Expected output

File modes and paths for authorized_keys files.

System impact

Read-only, sensitive output. Nothing changes. The command prints matching files with permissions.

Recovery / rollback: no state is changed.

When to use it

Use during access inventory, server handoff, or after removing a user.

When not to use it

Do not remove keys from this output alone; confirm ownership and active dependencies first.

next steps

Related commands

Cybersecurity Triage Sensitive output

Count authorized_keys by User

authorized_keys is the practical SSH access list.

find /home -path '*/.ssh/authorized_keys' -exec sh -c 'for f do user=$(basename "$(dirname "$(dirname "$f")")"); keys=$(grep -vc "^[[:space:]]*#" "$f"); printf "%s %s %s\n" "$user" "$keys" "$f"; done' sh {} + 2>/dev/null | sort

Cybersecurity Triage Sensitive output

Find SSH Key Users with sudo

The highest-priority access review starts where SSH keys and sudo overlap.

comm -12 <(find /home -path '*/.ssh/authorized_keys' -printf '%h\n' 2>/dev/null | awk -F/ '{print $(NF-1)}' | sort) <(awk -F: '$1=="sudo" {gsub(",","\n",$4); print $4}' /etc/group | sort)

Cybersecurity Triage Sensitive output

Find Loose authorized_keys Modes

SSH key access files should not be looser than intended.

find /home -path '*/.ssh/authorized_keys' -printf '%m %p\n' 2>/dev/null | awk '$1 > 600'

Cybersecurity Triage Sensitive output

Find SSH Keys for nologin Users

A nologin shell does not automatically mean SSH keys are irrelevant.

comm -12 <(awk -F: '$7 !~ /(bash|sh|zsh)$/ {print $1}' /etc/passwd | sort) <(find /home -path '*/.ssh/authorized_keys' -printf '%h\n' 2>/dev/null | awk -F/ '{print $(NF-1)}' | sort)

Cybersecurity Triage Sensitive output

Inventory SSH authorized_keys

authorized_keys files are the practical list of who can use key-based SSH.

find /home -path '*/.ssh/authorized_keys' -exec awk '{print FILENAME, $1, $NF}' {} + 2>/dev/null

Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.

Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.