Cybersecurity Triage

Review sudo Grants

You need a compact view of sudo group membership and sudoers rules from fixture-local stubs.

Command

awk -F: '$1=="sudo" {print "sudo group: " $4}' fixtures/user-access-audit/etc/group; grep -RhnE '^[^#].*ALL=' fixtures/user-access-audit/etc/sudoers fixtures/user-access-audit/etc/sudoers.d

What changed

Nothing changes. The command reads fixture-local group and sudoers stubs and prints privilege grants.

Danger

safe

When to use it

Use when auditing who can elevate privileges or when preparing to remove stale access.

When not to use it

Do not edit sudoers based only on this summary; validate syntax and account ownership on real systems.

Undo or recovery

No undo needed because this command is read-only.

Expected output

sudo group members followed by uncommented sudoers lines that grant privileges.

demo script

Disposable terminal steps

cat fixtures/user-access-audit/etc/group fixtures/user-access-audit/etc/sudoers fixtures/user-access-audit/etc/sudoers.d/app-deploy
awk -F: '$1=="sudo" {print "sudo group: " $4}' fixtures/user-access-audit/etc/group; grep -RhnE '^[^#].*ALL=' fixtures/user-access-audit/etc/sudoers fixtures/user-access-audit/etc/sudoers.d

Terminal transcript Demo JSON

simulated output

What it looks like

disposable vessel

::fixture-ready::
$ cat fixtures/user-access-audit/etc/group fixtures/user-access-audit/etc/sudoers fixtures/user-access-audit/etc/sudoers.d/app-deploy
root:x:0:
daemon:x:1:
www-data:x:33:
alex:x:1000:
deploy:x:1001:
reports:x:1002:
breakglass:x:1003:
backup:x:1004:
sudo:x:27:alex,breakglass
docker:x:998:deploy
adm:x:4:alex
Defaults env_reset
root ALL=(ALL:ALL) ALL
%sudo ALL=(ALL:ALL) ALL
deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart app.service
# app deploy automation
deploy ALL=(root) NOPASSWD: /usr/bin/journalctl -u app.service, /usr/bin/systemctl reload nginx
::exit-code::0
$ awk -F: '$1=="sudo" {print "sudo group: " $4}' fixtures/user-access-audit/etc/group; grep -RhnE '^[^#].*ALL=' fixtures/user-access-audit/etc/sudoers fixtures/user-access-audit/etc/sudoers.d
sudo group: alex,breakglass
2:root ALL=(ALL:ALL) ALL
3:%sudo ALL=(ALL:ALL) ALL
4:deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart app.service
2:deploy ALL=(root) NOPASSWD: /usr/bin/journalctl -u app.service, /usr/bin/systemctl reload nginx
::exit-code::0

YouTube Short

Review sudo paths.

Sudo access can come from groups or direct rules. Print both before approving, removing, or narrowing privilege.

experiments

A/B tests to run

Metric: save_rate

A: Privilege paths should be explicit.

B: Groups and sudoers both matter.