'\" t
.\"     Title: sssd
.\"    Author: The SSSD upstream - https://github.com/SSSD/sssd/
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
.\"      Date: 07/08/2026
.\"    Manual: SSSD Manual pages
.\"    Source: SSSD
.\"  Language: English
.\"
.TH "SSSD" "8" "07/08/2026" "SSSD" "SSSD Manual pages"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" http://bugs.debian.org/507673
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
sssd \- System Security Services Daemon
.SH "SYNOPSIS"
.HP \w'\fBsssd\fR\ 'u
\fBsssd\fR [\fIoptions\fR]
.SH "DESCRIPTION"
.PP
\fBSSSD\fR
provides a set of daemons to manage access to remote directories and authentication mechanisms\&. It provides an NSS and PAM interface toward the system and a pluggable backend system to connect to multiple different account sources as well as D\-Bus interface\&. It is also the basis to provide client auditing and policy services for projects like FreeIPA\&. It provides a more robust database to store local users as well as extended user data\&.
.SH "OPTIONS"
.PP
\fB\-d\fR,\fB\-\-debug\-level\fR \fILEVEL\fR
.RS 4
SSSD supports two representations for specifying the debug level\&. The simplest is to specify a decimal value from 0\-9, which represents enabling that level and all lower\-level debug messages\&. The more comprehensive option is to specify a hexadecimal bitmask to enable or disable specific levels (such as if you wish to suppress a level)\&.
.sp
Please note that each SSSD service logs into its own log file\&. Also please note that enabling
\(lqdebug_level\(rq
in the
\(lq[sssd]\(rq
section only enables debugging just for the sssd process itself, not for the responder or provider processes\&. The
\(lqdebug_level\(rq
parameter should be added to all sections that you wish to produce debug logs from\&.
.sp
In addition to changing the log level in the config file using the
\(lqdebug_level\(rq
parameter, which is persistent, but requires SSSD restart, it is also possible to change the debug level on the fly using the
\fBsss_debuglevel\fR(8)
tool\&.
.sp
Currently supported debug levels:
.sp
\fI0\fR,
\fI0x0010\fR: Fatal failures\&. Anything that would prevent SSSD from starting up or causes it to cease running\&.
.sp
\fI1\fR,
\fI0x0020\fR: Critical failures\&. An error that doesn\*(Aqt kill SSSD, but one that indicates that at least one major feature is not going to work properly\&.
.sp
\fI2\fR,
\fI0x0040\fR: Serious failures\&. An error announcing that a particular request or operation has failed\&.
.sp
\fI3\fR,
\fI0x0080\fR: Minor failures\&. These are the errors that would percolate down to cause the operation failure of 2\&.
.sp
\fI4\fR,
\fI0x0100\fR: Configuration settings\&.
.sp
\fI5\fR,
\fI0x0200\fR: Function data\&.
.sp
\fI6\fR,
\fI0x0400\fR: Trace messages for operation functions\&.
.sp
\fI7\fR,
\fI0x1000\fR: Trace messages for internal control functions\&.
.sp
\fI8\fR,
\fI0x2000\fR: Contents of function\-internal variables that may be interesting\&.
.sp
\fI9\fR,
\fI0x4000\fR: Extremely low\-level tracing information\&.
.sp
\fI9\fR,
\fI0x20000\fR: Performance and statistical data, please note that due to the way requests are processed internally the logged execution time of a request might be longer than it actually was\&.
.sp
\fI10\fR,
\fI0x10000\fR: Even more low\-level libldb tracing information\&. Almost never really required\&.
.sp
To log required bitmask debug levels, simply add their numbers together as shown in following examples:
.sp
\fIExample\fR: To log fatal failures, critical failures, serious failures and function data use 0x0270\&.
.sp
\fIExample\fR: To log fatal failures, configuration settings, function data, trace messages for internal control functions use 0x1310\&.
.sp
\fINote\fR: The bitmask format of debug levels was introduced in 1\&.7\&.0\&.
.sp
\fIDefault\fR: 0x0070 (i\&.e\&. fatal, critical and serious failures; corresponds to setting 2 in decimal notation)
.RE
.PP
\fB\-\-debug\-timestamps=\fR\fImode\fR
.RS 4
\fI1\fR: Add a timestamp to the debug messages
.sp
\fI0\fR: Disable timestamp in the debug messages
.sp
Default: 1
.RE
.PP
\fB\-\-debug\-microseconds=\fR\fImode\fR
.RS 4
\fI1\fR: Add microseconds to the timestamp in debug messages
.sp
\fI0\fR: Disable microseconds in timestamp
.sp
Default: 0
.RE
.PP
\fB\-\-logger=\fR\fIvalue\fR
.RS 4
Location where SSSD will send log messages\&.
.sp
\fIstderr\fR: Redirect debug messages to standard error output\&.
.sp
\fIfiles\fR: Redirect debug messages to the log files\&. By default, the log files are stored in
/var/log/sssd
and there are separate log files for every SSSD service and domain\&.
.sp
\fIjournald\fR: Redirect debug messages to systemd\-journald
.sp
Default: not set (fall back to journald if available, otherwise to stderr)
.RE
.PP
\fB\-D\fR,\fB\-\-daemon\fR
.RS 4
Become a daemon after starting up\&.
.RE
.PP
\fB\-i\fR,\fB\-\-interactive\fR
.RS 4
Run in the foreground, don\*(Aqt become a daemon\&.
.RE
.PP
\fB\-c\fR,\fB\-\-config\fR
.RS 4
Specify a non\-default config file\&. The default is
/etc/sssd/sssd\&.conf\&. For reference on the config file syntax and options, consult the
\fBsssd.conf\fR(5)
manual page\&.
.RE
.PP
\fB\-?\fR,\fB\-\-help\fR
.RS 4
Display help message and exit\&.
.RE
.PP
\fB\-\-version\fR
.RS 4
Print version number and exit\&.
.RE
.SH "SIGNALS"
.PP
SIGTERM/SIGINT
.RS 4
Informs the SSSD to gracefully terminate all of its child processes and then shut down the monitor\&.
.RE
.PP
SIGHUP
.RS 4
Tells the SSSD to stop writing to its current debug file descriptors and to close and reopen them\&. This is meant to facilitate log rolling with programs like logrotate\&.
.RE
.PP
SIGUSR1
.RS 4
Tells the SSSD to simulate offline operation for the duration of the
\(lqoffline_timeout\(rq
parameter\&. This is useful for testing\&. The signal can be sent to either the sssd process or any sssd_be process directly\&.
.RE
.PP
SIGUSR2
.RS 4
Tells the SSSD to go online immediately\&. This is useful for testing\&. The signal can be sent to either the sssd process or any sssd_be process directly\&.
.RE
.PP
SIGRTMIN+1
.RS 4
Tells the SSSD to reschedule the periodic tasks\&. The internal watchdog sends this signal to the providers when a clock shift is detected although it can be sent to any sssd_be process directly\&.
.RE
.SH "EXIT STATUS"
.PP
0
.RS 4
SSSD was shutdown gracefully\&.
.RE
.PP
1
.RS 4
Bad configuration or command line option\&.
.RE
.PP
2
.RS 4
Memory allocation error\&.
.RE
.PP
6
.RS 4
SSSD is already running\&.
.RE
.PP
Other codes
.RS 4
Other codes denote different errors, most probably about missing required access rights\&. See SSSD and system logs for details\&.
.RE
.SH "NOTES"
.PP
If the environment variable SSS_NSS_USE_MEMCACHE is set to "NO", client applications will not use the fast in\-memory cache\&.
.PP
If the environment variable SSS_LOCKFREE is set to "NO", requests from multiple threads of a single application will be serialized\&.
.SH "SEE ALSO"
.PP
\fBsssd\fR(8),
\fBsssd.conf\fR(5),
\fBsssd-ldap\fR(5),
\fBsssd-ldap-attributes\fR(5),
\fBsssd-krb5\fR(5),
\fBsssd-simple\fR(5),
\fBsssd-ipa\fR(5),
\fBsssd-ad\fR(5),
\fBsssd-idp\fR(5),
\fBsssd-sudo\fR(5),
\fBsssd-session-recording\fR(5),
\fBsss_cache\fR(8),
\fBsss_debuglevel\fR(8),
\fBsss_obfuscate\fR(8),
\fBsss_seed\fR(8),
\fBsssd_krb5_locator_plugin\fR(8),
\fBsss_ssh_authorizedkeys\fR(1), \fBsss_ssh_knownhosts\fR(1),
\fBsssd-ifp\fR(5),
\fBpam_sss\fR(8)\&.
\fBsss_rpcidmapd\fR(5)
\fBsssd-systemtap\fR(5)
.SH "AUTHORS"
.PP
\fBThe SSSD upstream \- https://github\&.com/SSSD/sssd/\fR
