Back to lessons

Cybersecurity Triage

Risk: safe

Extract SSH AllowUsers Accounts

You need to extract each account named in an AllowUsers directive.

Command

awk '/^AllowUsers/ {for (i = 2; i <= NF; i++) print $i}' etc/ssh/sshd_config

Before you run this

Risk: safe. Do not assume this is the complete access list if AllowGroups, Match blocks, PAM, or cloud-side controls also apply.

Expected output

One SSH AllowUsers account per line.

System impact

Nothing changes. The command reads sshd_config and prints each allowed account on its own line.

Recovery / rollback: no state is changed.

When to use it

Use during account reviews, server handoffs, or when checking whether a user is excluded by SSH allow-list policy.

When not to use it

Do not assume this is the complete access list if AllowGroups, Match blocks, PAM, or cloud-side controls also apply.

Watch this command run

Example output from a temporary Linux lab

This example uses disposable sample files and sanitized output so you can inspect the shape of the result before touching a real system.

demo@lab:~$

$ grep '^AllowUsers' etc/ssh/sshd_config

AllowUsers alice deploy

$ awk '/^AllowUsers/ {for (i = 2; i <= NF; i++) print $i}' etc/ssh/sshd_config

alice
deploy

View reproducible demo details

This page shows the sanitized shell transcript and the setup steps needed to reproduce the example.

Lab setup steps

grep '^AllowUsers' etc/ssh/sshd_config
awk '/^AllowUsers/ {for (i = 2; i <= NF; i++) print $i}' etc/ssh/sshd_config

next steps

Related commands

Cybersecurity Triage Risk: safe

Find SSH Password Auth Exceptions

A global password-auth setting can be changed later by a Match block.

awk '/^Match /{ctx=$0} /^PasswordAuthentication|^AuthenticationMethods|^[[:space:]]+PasswordAuthentication|^[[:space:]]+AuthenticationMethods/ {print (ctx ? ctx : "global") ": " $0}' etc/ssh/sshd_config

Cybersecurity Triage Risk: safe

Find SSH Keys for nologin Users

A nologin shell does not automatically mean SSH keys are irrelevant.

comm -12 <(awk -F: '$7 !~ /(bash|sh|zsh)$/ {print $1}' fixtures/user-access-audit/etc/passwd | sort) <(find fixtures/user-access-audit/home -path '*/.ssh/authorized_keys' -printf '%h\n' | awk -F/ '{print $(NF-1)}' | sort)

Cybersecurity Triage Risk: safe

Find SSH Key Users with sudo

The highest-priority access review starts where SSH keys and sudo overlap.

comm -12 <(find fixtures/user-access-audit/home -path '*/.ssh/authorized_keys' -printf '%h\n' | awk -F/ '{print $(NF-1)}' | sort) <(awk -F: '$1=="sudo" {gsub(",","\n",$4); print $4}' fixtures/user-access-audit/etc/group | sort)

Cybersecurity Triage Risk: safe

Check Key SSH Authentication Settings

SSH policy should be visible before you change it.

grep -nE '^(PasswordAuthentication|PermitRootLogin|PubkeyAuthentication|AllowUsers)' etc/ssh/sshd_config

Cybersecurity Triage Risk: safe

Inventory SSH authorized_keys

authorized_keys files are the practical list of who can use key-based SSH.

find home -path '*/.ssh/authorized_keys' -exec awk '{print FILENAME, $1, $NF}' {} +

Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.