An access review always asks the same thing: "Who can get root on this box, and did that change since last quarter?"

The first half is easy. The second half means reading /etc/sudoers.d , authorized_keys files and old tickets, and I did not want to do that by hand every time. So I wrote a small tool called sudodrift. This post is about the problem, the commands I use, and where the tool falls short.

What I actually want to know

Three places keep coming up when I look for quiet privilege changes:

sudo. Someone adds a NOPASSWD rule "just for the migration" and it stays for two years.

SSH keys. A new line shows up in ~/.ssh/authorized_keys . Nobody remembers who owns it.

SUID files. A binary gets the setuid bit and now runs as its owner.

You can check each with a one-liner. find / -perm -4000 -type f works. So does grep -r NOPASSWD /etc/sudoers* . The trouble is comparing today with last month.…