Linux Unauthorized Admins Script

#!/bin/bash

# This resource is provided as a convenience for Level users. We cannot 
# guarantee it will work in all environments. Please test before deploying 
# to your production environment. We welcome contributions to our community 
# library

# Level Library
# https://level.io/library/script-linux-unauthorized-admins

#!/bin/bash

# Define authorized admins
AUTHORIZED_ADMINS="{{cf_authorized_admins}}"

# Define detected admins
# Get all users in the 'sudo' group (local admins)
admins=$(getent group sudo | cut -d: -f4 | tr ',' '\n')
active_admins=()

for admin in $admins; do
    if [[ -n "$admin" ]]; then
        # Check if the account is expired
        exp_date=$(sudo chage -l "$admin" | grep "Account expires" | awk -F': ' '{print $2}')
        if [[ "$exp_date" == "never" || "$exp_date" == "" ]]; then
            # Check if the account is locked
            status=$(sudo passwd -S "$admin" | awk '{print $2}')
            if [[ "$status" != "L" ]]; then
                active_admins+=("$admin")
            fi
        fi
    fi
done

# Convert array to comma-separated string
DETECTED_ADMINS=$(IFS=','; echo "${active_admins[*]}")

# Convert lists to arrays (lowercase for case-insensitive comparison)
IFS=',' read -r -a detectedArray <<< "$(echo "$DETECTED_ADMINS" | tr '[:upper:]' '[:lower:]' | sed 's/, */,/g')"
IFS=',' read -r -a authorizedArray <<< "$(echo "$AUTHORIZED_ADMINS" | tr '[:upper:]' '[:lower:]' | sed 's/, */,/g')"

# Find unauthorized admins
unauthorizedAdmins=()
for detected in "${detectedArray[@]}"; do
    found=false
    for authorized in "${authorizedArray[@]}"; do
        if [[ "$detected" == "$authorized" ]]; then
            found=true
            break
        fi
    done
    if [[ "$found" == false ]]; then
        unauthorizedAdmins+=("$detected")
    fi
done

# Join unauthorized admins into a comma-separated string
unauthorizedString=$(IFS=,; echo "${unauthorizedAdmins[*]}")

# Output unauthorized admins or success message
if [[ ${#unauthorizedAdmins[@]} -gt 0 ]]; then
    echo "$unauthorizedString"
    exit 1
else
    echo "No unauthorized admins detected."
    exit 0
fi