Find SSH Keys for nologin Users

You need to spot accounts that have authorized_keys files even though their passwd shell is nologin.

Command

comm -12 <(awk -F: '$7 !~ /(bash|sh|zsh)$/ {print $1}' fixtures/user-access-audit/etc/passwd | sort) <(find fixtures/user-access-audit/home -path '*/.ssh/authorized_keys' -printf '%h\n' | awk -F/ '{print $(NF-1)}' | sort)

Before you run this

Risk: safe. Do not assume every match is exploitable; SSH daemon options, forced commands, and account policy can change behavior.

Expected output

Account names that are nologin in passwd but still have authorized_keys files.

System impact

Nothing changes. The command compares fixture-local passwd accounts with authorized_keys owners.

Recovery / rollback: no state is changed.

When to use it

Use when checking for stale SSH key files after service account changes or offboarding.

When not to use it

Do not assume every match is exploitable; SSH daemon options, forced commands, and account policy can change behavior.

Watch this command run

Example output from a temporary Linux lab

This example uses disposable sample files and sanitized output so you can inspect the shape of the result before touching a real system.

demo@lab:~$

$ awk -F: '{print $1, $7}' sample-files/user-access-audit/etc/passwd | sort

alex /bin/bash
backup /usr/sbin/nologin
breakglass /bin/bash
daemon /usr/sbin/nologin
deploy /bin/bash
reports /usr/sbin/nologin
root /bin/bash
www-data /usr/sbin/nologin

$ comm -12 <(awk -F: '$7 !~ /(bash|sh|zsh)$/ {print $1}' sample-files/user-access-audit/etc/passwd | sort) <(find sample-files/user-access-audit/users -path '*/ssh-keys/authorized_keys' -printf '%h\n' | awk -F/ '{print $(NF-1)}' | sort)

reports

View reproducible demo details

This page shows the sanitized shell transcript and the setup steps needed to reproduce the example.