12/10/2019, 2:29 PM
Hello, I am trying to get all the authorized_keys in a linux host using osquery. It seems to me that osquery will only return the authorized keys of the user it runs as. Is there any way around that?
2:52 PM
I found the answer searching for 'authorized_keys' in general channel 🙂
2:53 PM
SELECT users.uid, authorized_keys.* FROM users JOIN authorized_keys ON users.uid == authorized_keys.uid;
Just for future reference