Cybersecurity Triage
Read-only, sensitive outputList SSH Allow and Deny Rules
You need to find SSH allow-list and deny-list directives across the main config and include files.
Command
grep -RhnE '^(AllowUsers|AllowGroups|DenyUsers|DenyGroups|Match )' etc/sshBefore you run this
System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.
When not to use it: Do not remove allow or deny rules from this output alone; confirm group membership, Match context, and operational ownership first.
Expected output
Line-numbered SSH access directives from sshd_config and included files.
System impact
Read-only, sensitive output. Nothing changes. The command searches system SSH config files and prints matching access directives with file and line numbers.
Recovery / rollback: no state is changed.
When to use it
Use during access reviews, server handoffs, or when a user can authenticate but still cannot open an SSH session.
When not to use it
Do not remove allow or deny rules from this output alone; confirm group membership, Match context, and operational ownership first.
next steps
Related commands
Show SSH Auth Policy Order
The order of Include, Match, and authentication directives changes how SSH policy reads.
grep -nE '^(Include|Match |PubkeyAuthentication|PasswordAuthentication|AuthenticationMethods|[[:space:]]+(PasswordAuthentication|AuthenticationMethods))' etc/ssh/sshd_config
Check Key SSH Authentication Settings
SSH policy should be visible before you change it.
grep -nE '^(PasswordAuthentication|PermitRootLogin|PubkeyAuthentication|AllowUsers)' etc/ssh/sshd_config
Find SSH Password Auth Exceptions
A global password-auth setting can be changed later by a Match block.
awk '/^Match /{ctx=$0} /^PasswordAuthentication|^AuthenticationMethods|^[[:space:]]+PasswordAuthentication|^[[:space:]]+AuthenticationMethods/ {print (ctx ? ctx : "global") ": " $0}' etc/ssh/sshd_config
Extract SSH AllowUsers Accounts
AllowUsers turns SSH access into an explicit account list.
awk '/^AllowUsers/ {for (i = 2; i <= NF; i++) print $i}' etc/ssh/sshd_config
Review sudo Grants
Privilege paths should be visible before you remove or approve access.
awk -F: '$1=="sudo" {print "sudo group: " $4}' /etc/group; sudo grep -RhnE '^[^#].*ALL=' /etc/sudoers /etc/sudoers.d 2>/dev/null
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.