Red Hat Summit Red Hat SummitSupportConsoleDéveloppeursCommencer un essaiContact

Ce contenu n'est pas disponible dans la langue sélectionnée.

Chapter 8. Reporting on user access on hosts using SSSD

The Security System Services Daemon (SSSD) tracks user access rights across network clients. Use the sssctl command-line tool to generate detailed access control reports and audit user data for security compliance.

8.1. Prerequisites
Copier lien

  • SSSD packages are installed in your network environment

8.2. The sssctl command
Copier lien

The sssctl utility provides a unified interface for monitoring the Security System Services Daemon (SSSD) status. Use this tool to manage caches, review logs, and audit domain states or user authentication access.

You can use the sssctl utility to gather information about:

  • Domain state
  • Client user authentication
  • User access on clients of a particular domain
  • Information about cached content

With the sssctl tool, you can:

  • Manage the SSSD cache
  • Manage logs
  • Check configuration files
Note

The sssctl tool replaces sss_cache and sss_debuglevel tools.

8.3. Generating access control reports using sssctl
Copier lien

The Security System Services Daemon (SSSD) enforces login permissions on the local machine. Generating an access control report lists the specific rules currently applied to the host, helping you to verify active security policies.

Note

The access report is not accurate because the tool does not track users locked out by the Key Distribution Center (KDC).

Prerequisites

  • You must be logged in with administrator privileges.

Procedure

  • To generate an access control report, run the following command, replacing <domain_name>: 

    [root@client1 ~]# sssctl access-report <domain_name>
     
    1 rule cached

Rule name: example.user
	Member users: example.user
	Member services: sshd

8.4. Displaying user authorization details using sssctl
Copier lien

The sssctl user-checks command validates specific user permissions against PAM services. Run this diagnostic tool to troubleshoot login failures and view data from the Name Service Switch (NSS) or InfoPipe responder.

Run sssctl user-checks <user_name> to display user data available from Name Service Switch (NSS) and the InfoPipe responder for the D-Bus interface. The output shows whether the user is authorized to log in using the system-auth Pluggable Authentication Module (PAM) service.

The command has two options:

  • -a for a PAM action
  • -s for a PAM service

If you do not specify -a and -s options, the sssctl tool uses default options: -a acct -s system-auth.

Prerequisites

  • You must be logged in with administrator privileges.

Procedure

  • To display user data for a particular user, enter: 

    [root@client1 ~]# sssctl user-checks -a acct -s sshd <user_name>
     
    user: example.user
action: acct
service: sshd
...
Red Hat logoGithubredditYoutubeTwitter

Apprendre

Essayez, achetez et vendez

Communautés

À propos de la documentation Red Hat

Nous aidons les utilisateurs de Red Hat à innover et à atteindre leurs objectifs grâce à nos produits et services avec un contenu auquel ils peuvent faire confiance. Découvrez nos récentes mises à jour.

Rendre l’open source plus inclusif

Red Hat s'engage à remplacer le langage problématique dans notre code, notre documentation et nos propriétés Web. Pour plus de détails, consultez le Blog Red Hat.

À propos de Red Hat

Nous proposons des solutions renforcées qui facilitent le travail des entreprises sur plusieurs plates-formes et environnements, du centre de données central à la périphérie du réseau.

Theme

© 2026 Red HatRetour au début