SSSD-SESSION-RECOR(5)

✨ SSSD-SESSION-RECOR(5) ✨

okay bestie, so this is a page from File Formats and Conventions, and it's all about session recording with SSSD 💅

---

🎀 NAME 🎀

sssd-session-recording — like, how do you even configure session recording with SSSD? this page, that's how 🫶

---

🌸 DESCRIPTION 🌸

so here's the tea: this manual page tells you how to set up sssd(8) to vibe with tlog-rec-session(8), which is part of the tlog package, so you can implement user session recording on text terminals. if you want the full detailed configuration syntax reference, go read the “FILE FORMAT” section of the sssd.conf(5) manual page, no cap 📖✨

SSSD can be set up to enable recording of everything specific users see or type during their sessions on text terminals. like, when users log in on the console, or via SSH, whatever. important tho: SSSD itself doesn't record anything 🙈 — it just makes sure tlog-rec-session is started when the user logs in, so it can record according to its own configuration. middle manager energy fr.

for users with session recording enabled, SSSD replaces the user shell with tlog-rec-session in NSS responses, and adds a variable specifying the original shell to the user environment, upon PAM session setup. so the whole plan is: tlog-rec-session gets started in place of the user shell, and it knows which actual shell to start once it's done setting up the recording. iconic behavior honestly 👑

---

💖 CONFIGURATION OPTIONS 💖

these options are the ones you use to configure the session recording. let's go 🦋

• scope (string) — one of the following strings specifying the scope of session recording:
  • "none" — no users are recorded. everybody's just living their life, unbothered 💀
  • "some" — users/groups specified by the users and groups options are recorded.
  • "all" — all users are recorded. everyone. the whole group chat 📱

Default: "none"

• users (string) — a comma-separated list of users which should have session recording enabled. matches user names as returned by NSS, i.e. after the possible space replacement, case changes, etc.

Default: Empty. matches no users. nobody. not a single soul 🥲

• groups (string) — a comma-separated list of groups, members of which should have session recording enabled. matches group names as returned by NSS, i.e. after the possible space replacement, case changes, etc.

NOTE: using this option (having it set to anything) has a considerable performance cost, because each uncached request for a user requires retrieving and matching the groups the user is member of. so like, bestie, be aware 😭

Default: Empty. matches no groups.

• exclude_users (string) — a comma-separated list of users to be excluded from recording, only applicable with 'scope=all'.

Default: Empty. no users excluded.

• exclude_groups (string) — a comma-separated list of groups, members of which should be excluded from recording. only applicable with 'scope=all'.

NOTE: using this option (having it set to anything) has a considerable performance cost, because each uncached request for a user requires retrieving and matching the groups the user is member of. same warning, same vibe check ⚠️

Default: Empty. no groups excluded.

---

🌈 EXAMPLE 🌈

this little snippet of sssd.conf enables session recording for users "contractor1" and "contractor2", and group "students". she ate 💅

[session_recording]
scope = some
users = contractor1, contractor2
groups = students

---

⭐ SEE ALSO ⭐

sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd-krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-idp(5), sssd-sudo(5), sssd-session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5) sssd-systemtap(5)

---

👑 AUTHORS 👑

the SSSD upstream — https://github.com/SSSD/sssd/ 🫶

---

k that's the whole page bestie, go forth and record those sessions, mwah 💖

this has been SSSD version, dated 07/08/2026 — SSSD-SESSION-RECOR(5), signing off ✨🎀🦋