Red Hat Summit Red Hat SummitSupportKonsoleEntwicklerDemo startenKontakt

Dieser Inhalt ist in der von Ihnen ausgewählten Sprache nicht verfügbar.

Chapter 8. Reporting on user access on hosts using SSSD

The Security System Services Daemon (SSSD) tracks which users can or cannot access clients. This chapter describes creating access control reports and displaying user data using the sssctl tool.

Prerequisites

  • SSSD packages are installed in your network environment

8.1. The sssctl command
Link kopieren

sssctl is a command-line tool that provides a unified way to obtain information about the Security System Services Daemon (SSSD) status.

You can use the sssctl utility to gather information about:

  • Domain state
  • Client user authentication
  • User access on clients of a particular domain
  • Information about cached content

With the sssctl tool, you can:

  • Manage the SSSD cache
  • Manage logs
  • Check configuration files
Note

The sssctl tool replaces sss_cache and sss_debuglevel tools.

8.2. Generating access control reports using sssctl
Link kopieren

You can list the access control rules applied to the machine on which you are running the report because SSSD controls which users can log in to the client.

Note

The access report is not accurate because the tool does not track users locked out by the Key Distribution Center (KDC).

Prerequisites

  • You must be logged in with administrator privileges.

Procedure

  • To generate an access control report, run the following command, replacing <domain_name>: 

    [root@client1 ~]# sssctl access-report <domain_name>
1 rule cached

Rule name: example.user
	Member users: example.user
	Member services: sshd

8.3. Displaying user authorization details using sssctl
Link kopieren

Use the sssctl user-checks command to troubleshoot authentication and authorization issues in applications that rely on the System Security Services Daemon (SSSD).

Run sssctl user-checks <user_name> to display user data available from Name Service Switch (NSS) and the InfoPipe responder for the D-Bus interface. The output shows whether the user is authorized to log in using the system-auth Pluggable Authentication Module (PAM) service.

The command has two options:

  • -a for a PAM action
  • -s for a PAM service

If you do not specify -a and -s options, the sssctl tool uses default options: -a acct -s system-auth.

Prerequisites

  • You must be logged in with administrator privileges.

Procedure

  • To display user data for a particular user, enter: 

    [root@client1 ~]# sssctl user-checks -a acct -s sshd <user_name>
user: example.user
action: acct
service: sshd
....
Red Hat logoGithubredditYoutubeTwitter

Lernen

Testen, kaufen und verkaufen

Communitys

Über Red Hat Dokumentation

Wir helfen Red Hat Benutzern, mit unseren Produkten und Diensten innovativ zu sein und ihre Ziele zu erreichen – mit Inhalten, denen sie vertrauen können. Entdecken Sie unsere neuesten Updates.

Mehr Inklusion in Open Source

Red Hat hat sich verpflichtet, problematische Sprache in unserem Code, unserer Dokumentation und unseren Web-Eigenschaften zu ersetzen. Weitere Einzelheiten finden Sie in Red Hat Blog.

Über Red Hat

Wir liefern gehärtete Lösungen, die es Unternehmen leichter machen, plattform- und umgebungsübergreifend zu arbeiten, vom zentralen Rechenzentrum bis zum Netzwerkrand.

Theme

© 2026 Red HatNach oben