Queries/

Get authorized SSH keys

Mike Thomas

Presence of authorized SSH keys may be unusual on laptops. Could be completely normal on servers, but may be worth auditing for unusual keys and/or changes.

To learn more about queries, check this guide.

Query PowerShellNEW BashNEW

SELECT username, authorized_keys. * FROM users CROSS JOIN authorized_keys USING (uid);

echo "username,authorized_key" && find /Users -maxdepth 2 -type f -name "authorized_keys" -exec sh -c 'for f in "$@"; do u=$(basename "$(dirname "$f")"); while IFS= read -r line; do echo "$u,$line"; done < "$f"; done' sh {} +