13 Bash One-Liners Every DevSecOps Engineer Should Know

copy, paste, and tweak them to fit your environment

1. Find Suspicious Login Attempts

grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr | head

• Scans authentication logs for failed SSH logins.
• Extracts IP addresses, counts how many times each one failed.
• Prints the worst offenders.

Instant brute-force attack detection. You’ll know which IP to block with fail2ban or firewall rules.

2. Check Which Users Have sudo Access

getent group sudo | cut -d: -f4 | tr ',' '\n'

• Lists all users with sudo privileges.

Least privilege is a DevSecOps mantra. This shows you if too many people have root-level access.

3. Find World-Writable Files (Security Risk)

find / -type f -perm -0002 -exec ls -l {} \; 2>/dev/null

Searches the filesystem for files writable by anyone.

Misconfigured permissions can open the door for privilege escalation.

4. Detect Listening Network Ports

ss -tulnp | awk '{print $1,$5,$7}' | column -t

Lists open TCP/UDP ports with associated processes.

Quick way to see if you’ve accidentally exposed a service to the world.

5. Spot Processes Running as Root

ps -eo user,comm | awk '$1 == "root" {print $0}'

Lists all processes owned by root.

Not everything should run as root especially containers or apps.

6. Check File Integrity with SHA-256

find /etc -type f -exec sha256sum {} \; 2>/dev/null | sort -k 2 > /var/tmp/etc-hash.txt

Later, compare with:

sha256sum -c /var/tmp/etc-hash.txt 2>/dev/null

• Generates hashes of “/etc” files.
• Later checks for changes.

Lightweight file integrity monitoring without external tools. SHA-256 is more secure than MD5.

7. Hunt for Secrets in Your Repo

grep -r --exclude-dir=.git "AWS_SECRET_ACCESS_KEY" .

Recursively searches your repo for exposed secrets. Quick win before commits or PRs.

Accidentally committing secrets happens more often than we like. This quick scan can save you from leaks.

8. Verify Running Docker Containers with Privileges

docker ps -q | xargs -r docker inspect --format '{{.Name}}: Privileged={{.HostConfig.Privileged}}'

Lists running containers and shows whether they’re privileged.

Privileged containers bypass many security boundaries — avoid them unless absolutely necessary.

9. Find SUID/SGID Binaries

find / -perm /6000 -type f -exec ls -l {} \; 2>/dev/null

Lists files with SUID/SGID bits set (run with elevated privileges).

10. Check for Expiring SSL Certificates

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | \
openssl x509 -noout -dates

Connects to a domain, retrieves SSL cert, and shows expiry dates.

No more surprise “expired cert” outages.

11. Monitor Real-Time SSH Failures

tail -F /var/log/auth.log | grep --line-buffered "Failed password"

Streams failed SSH login attempts as they happen.

Instant visibility without needing SIEM or centralized logging.

12. Detect Accounts with Empty Passwords

awk -F: '($2==""){print $1}' /etc/shadow

Scans /etc/shadow for accounts without passwords.

Empty passwords = instant compromise.

13. Safe Targeted Vulnerability Scan (nmap)

nmap --script vuln -p 22,80,443 127.0.0.1

Runs selected vulnerability checks against common service ports.

Make sure you only run on prod with clearance.

[embed]13 Advanced Bash One-Liners to Improve Code Readability & Maintainability turn messy automation into something you can trust, extend, and debug with confidencemedium.com

[embed]11 systemctl Commands for Power Users in Production level up your systemd management skillsmedium.com

P.S. If this post helped you, grab my Security Hardening Kit — 22 production-ready Bash scripts. Harden your servers in minutes.