Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/sssd/ticket/2840
Use case:
As an owner of a system I need to know which users have access to a host. I want to run something on the host and get a report who can access it.
The reports must contain information about HBAC but does a SUDO report would also be beneficial. This would allow me to pass audits and make sure that right people have right access to systems and applications.
Idea:
Create a utility that would trigger one time enumeration, populate caches and run a report against the cache. That would actually solve do two problems:
a. Priming of the cache with the full database
b. Actually creating a report based on the cached data
We see several inquiries about this capability in recent days.
(In reply to Mayur from comment #6)
> Hello Team,
>
> Do we have any update on this RFE ?
>
> Regards
>
> Mayur Gupta
Not at this point, it's still a stretch goal for 7.4
Note that the topic of IdM attestation report was split to 3 RFEs:
* Bug 1272214: [RFE] Create a local per system report about who can access that system (attestation) (included SSSD)
* Bug 1491802 - [RFE] Central report who can ran which sudo commands on which systems (attestation) (included in IdM Server)
* Bug 1492993 - [RFE] Central report that will show who can access which systems (attestation) (included in IdM Server)
Proposed user story for this client part:
As an owner of a system I need to know which users have access to a host. I want to run something on the host and get a report who can access it via which means and services.
(In reply to Martin Kosek from comment #22)
> Proposed user story for this client part:
>
> As an owner of a system I need to know which users have access to a host. I
> want to run something on the host and get a report who can access it via
> which means and services.
At the same time, I think it makes much more sense to concentrate on the server-side report at least for 7.5 (if we can still make it..), I think the client-side report has much less value in a centralized environment.
Comment 36Fabiano Fidêncio
2017-11-27 20:50:21 UTC
The correct hashes are ...
- master:
* be804178d5e5fee64be2b080e73f4ce7b0074f76
* c6cf752337f5977ce3753b7113dc1a2342c86319
* 2754a8dcfa937d45b024a2e57419248bfd4c4919
* e737cdfa225e0d455c0e574bcb82c2cc16a17d9d
* 6211a202301e6f61d46cdb2bf0be332a70c7fdea
* 3ee8659bc6a77a78bc6c61b9650a36bd18ea95c8
(In reply to Dan Lavu from comment #38)
> Verified against sssd-1.16.0-11.el7.x86_64.
>
>
> [root@vm-idm-013 db]# sssctl access-report
> Missing option: Specify domain name.
>
> Usage: sssctl access-report DOMAIN [OPTIONS...]
>
> Command options:
>
> Help options:
> -?, --help Show this help message
> --usage Display brief usage message
>
> [root@vm-idm-013 db]# sssctl access-report testrelm.test
> 1 rules cached
>
> Rule name: allow_all
> User category: all
> Service category: all
I hope there will be more cases covered in integration test :-)
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHEA-2018:0929