Cat command output varies unusually in regards to * character

Question

I'm running the following command on a fairly standard Ubuntu 11.04 installation running under vSphere:

sudo cat /home/*/.ssh/authorized_keys

Basically, I am using puppet for ssh key management and wanted to ensure the keys were present. What is unusual about this simple command is that the keys are only shown for two users (the first and third user created on the user if that is relevant) when the * should catch something like 7 or 8 users' homes.

The intriguing part is that, if I run

sudo cat /home/user.name/.ssh/authorized_keys

where user.name is the name of a random user (not one of the two that already show), not only do I get the correct output from cat, but the next time I run

sudo cat /home/*/.ssh/authorized_keys

the output shows 3 key files! Two files for the two users previously shown and a third file that is the user whose key file I just manually looked at.

I can continue to play this "game", and each time I manually specify a user and then run the * command, that previously viewed user shows up in the globbed output. To me, this is unusual behavior, especially for a bog-standard Ubuntu image. Is there something I am missing? Special properties of * expansion or cat?

Edit: Forgot to mention that this behavior "resets" if I leave the ssh session to the server. By that I mean that I can logout and log back in via SSH, and I am back to the starting conditions (only two user accounts are shown with *).

Answer 1

Remember that the command line is parsed and wildcards are replaced BEFORE it is executed.

If you specify the username, then the sudo ... command can see the file because it's accessing it as root.

When you type '*', your USER shell expands that to the paths it can see, well... the paths which allow your current user to search the subdirectories.

You might try enclosing the path string in SINGLE quotes to prevent expansion, I'm not sure that'll work since most unix programs expect the shell to expand wildcards and thus don't perform the globbing action themselves.

EDIT: A thought about how to accomplish your goal of reading the authorized keys files for all the users:

sudo find /home -name "authorized_keys" -exec cat "{}" \; > all_the_data

Maybe crude, but it'll work since you're executing the file search as root, not your user.

I suppose another way:

sudo 'find /home -name "authorized_keys" -print0 | xargs -0 cat' > all_the_data

That one's nicer on the process count, since it accumulates all the filenames and then 'cat's them... but I like the first one, no special quoting required.

The quotes (single or otherwise) around the entire command are required because of the pipe command. both the find and xargs command MUST be executed as root. Yeah, more complicated than the first one.

Answer 2

I don't have a direct explanation for why the globbing is doing what it's doing, but I know how you can rewrite your script to accomplish what you want:

for i in /home/*; do if [ -d "/home/${i}" ]; then sudo cat "/home/${i}/.ssh/authorized_keys"; fi; done

I don't know of any feature of bash that would cause it to glob differently depending on past commands run, so it may either be a bug or a really deeply buried (undocumented) feature. I NEVER use globs for directories; I always use either the find command for a for loop. I don't trust globs to do the right thing with any pattern containing /*/.