Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 8. Reporting on user access on hosts using SSSD

The Security System Services Daemon (SSSD) tracks which users can or cannot access clients. This chapter describes creating access control reports and displaying user data using the sssctl tool.

Prerequisites

  • SSSD packages are installed in your network environment

8.1. The sssctl command
Copy link

sssctl is a command-line tool that provides a unified way to obtain information about the Security System Services Daemon (SSSD) status.

You can use the sssctl utility to gather information about:

  • Domain state
  • Client user authentication
  • User access on clients of a particular domain
  • Information about cached content

With the sssctl tool, you can:

  • Manage the SSSD cache
  • Manage logs
  • Check configuration files
Note

The sssctl tool replaces sss_cache and sss_debuglevel tools.

You can list the access control rules applied to the machine on which you are running the report because SSSD controls which users can log in to the client.

Note

The access report is not accurate because the tool does not track users locked out by the Key Distribution Center (KDC).

Prerequisites

  • You must be logged in with administrator privileges.

Procedure

  • To generate an access control report, run the following command, replacing <domain_name>: 

    [root@client1 ~]# sssctl access-report <domain_name>
1 rule cached

Rule name: example.user
	Member users: example.user
	Member services: sshd
    Copy to Clipboard Toggle word wrap

Use the sssctl user-checks command to troubleshoot authentication and authorization issues in applications that rely on the System Security Services Daemon (SSSD).

Run sssctl user-checks <user_name> to display user data available from Name Service Switch (NSS) and the InfoPipe responder for the D-Bus interface. The output shows whether the user is authorized to log in using the system-auth Pluggable Authentication Module (PAM) service.

The command has two options:

  • -a for a PAM action
  • -s for a PAM service

If you do not specify -a and -s options, the sssctl tool uses default options: -a acct -s system-auth.

Prerequisites

  • You must be logged in with administrator privileges.

Procedure

  • To display user data for a particular user, enter: 

    [root@client1 ~]# sssctl user-checks -a acct -s sshd <user_name>
user: example.user
action: acct
service: sshd
....
    Copy to Clipboard Toggle word wrap
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top