Find SSH Key Users with sudo

You need to identify users who both have authorized_keys files and appear in the sudo group.

Command

comm -12 <(find fixtures/user-access-audit/home -path '*/.ssh/authorized_keys' -printf '%h\n' | awk -F/ '{print $(NF-1)}' | sort) <(awk -F: '$1=="sudo" {gsub(",","\n",$4); print $4}' fixtures/user-access-audit/etc/group | sort)

Before you run this

Risk: safe. Do not treat this as the only privilege path; direct sudoers rules and other privileged groups can matter too.

Expected output

Usernames present in both the authorized_keys owner list and the sudo group.

System impact

Nothing changes. The command compares fixture-local SSH key owners with sudo group members.

Recovery / rollback: no state is changed.

When to use it

Use during access reviews to prioritize accounts that can log in by key and elevate privileges.

When not to use it

Do not treat this as the only privilege path; direct sudoers rules and other privileged groups can matter too.

Watch this command run

Example output from a temporary Linux lab

This example uses disposable sample files and sanitized output so you can inspect the shape of the result before touching a real system.

demo@lab:~$

$ find sample-files/user-access-audit/users -path '*/ssh-keys/authorized_keys' -printf '%h\n' | awk -F/ '{print $(NF-1)}' | sort

alex
breakglass
deploy
reports

$ comm -12 <(find sample-files/user-access-audit/users -path '*/ssh-keys/authorized_keys' -printf '%h\n' | awk -F/ '{print $(NF-1)}' | sort) <(awk -F: '$1=="sudo" {gsub(",","\n",$4); print $4}' sample-files/user-access-audit/etc/group | sort)

alex
breakglass

View reproducible demo details

This page shows the sanitized shell transcript and the setup steps needed to reproduce the example.