Back to commands

Cybersecurity Triage

Read-only, sensitive output

Extract SSH AllowUsers Accounts

You need to extract each account named in an AllowUsers directive.

Command

awk '/^AllowUsers/ {for (i = 2; i <= NF; i++) print $i}' etc/ssh/sshd_config

Before you run this

System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.

When not to use it: Do not assume this is the complete access list if AllowGroups, Match blocks, PAM, or cloud-side controls also apply.

Expected output

One SSH AllowUsers account per line.

System impact

Read-only, sensitive output. Nothing changes. The command reads sshd_config and prints each allowed account on its own line.

Recovery / rollback: no state is changed.

When to use it

Use during account reviews, server handoffs, or when checking whether a user is excluded by SSH allow-list policy.

When not to use it

Do not assume this is the complete access list if AllowGroups, Match blocks, PAM, or cloud-side controls also apply.

Watch this command run

Command transcript

This sanitized transcript shows the commands and output shape without exposing host details.

demo@lab:~$

$ grep '^AllowUsers' etc/ssh/sshd_config

AllowUsers alice deploy

$ awk '/^AllowUsers/ {for (i = 2; i <= NF; i++) print $i}' etc/ssh/sshd_config

alice
deploy

View commands shown

These are the commands shown in the sanitized transcript.

Commands shown

grep '^AllowUsers' etc/ssh/sshd_config
awk '/^AllowUsers/ {for (i = 2; i <= NF; i++) print $i}' etc/ssh/sshd_config

next steps

Related commands

Cybersecurity Triage Sensitive output

Find SSH Password Auth Exceptions

A global password-auth setting can be changed later by a Match block.

awk '/^Match /{ctx=$0} /^PasswordAuthentication|^AuthenticationMethods|^[[:space:]]+PasswordAuthentication|^[[:space:]]+AuthenticationMethods/ {print (ctx ? ctx : "global") ": " $0}' etc/ssh/sshd_config

Cybersecurity Triage Sensitive output

Find SSH Keys for nologin Users

A nologin shell does not automatically mean SSH keys are irrelevant.

comm -12 <(awk -F: '$7 !~ /(bash|sh|zsh)$/ {print $1}' fixtures/user-access-audit/etc/passwd | sort) <(find fixtures/user-access-audit/home -path '*/.ssh/authorized_keys' -printf '%h\n' | awk -F/ '{print $(NF-1)}' | sort)

Cybersecurity Triage Sensitive output

Find SSH Key Users with sudo

The highest-priority access review starts where SSH keys and sudo overlap.

comm -12 <(find fixtures/user-access-audit/home -path '*/.ssh/authorized_keys' -printf '%h\n' | awk -F/ '{print $(NF-1)}' | sort) <(awk -F: '$1=="sudo" {gsub(",","\n",$4); print $4}' fixtures/user-access-audit/etc/group | sort)

Cybersecurity Triage Sensitive output

Check Key SSH Authentication Settings

SSH policy should be visible before you change it.

grep -nE '^(PasswordAuthentication|PermitRootLogin|PubkeyAuthentication|AllowUsers)' etc/ssh/sshd_config

Cybersecurity Triage Sensitive output

Inventory SSH authorized_keys

authorized_keys files are the practical list of who can use key-based SSH.

find home -path '*/.ssh/authorized_keys' -exec awk '{print FILENAME, $1, $NF}' {} +

Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.