Return
-
Title
Checkaccess Showing Incorrect Data for Service Access Control -
Description
When using service access control policies the following command:vastool user checkaccess USERNAME
Shows that no service access control policies exist with an output similar to the following:[root@HOSTNAME:/etc/opt/quest/vas/access.d]# vastool user checkaccess USERNAME ALLOWED [user=USERNAME] [service=(any)] Access Rule = [Allow Group - OU\GROUP (users.allow)] -
Cause
The incorrect command syntax is being used for checking service access control. -
Resolution
Please use the following command to checkaccess for service access control policies:vastool user checkaccess -s SERVICE_NAME USERNAME
The resulting output should look similar to the following:[root@HOSTNAME:/etc/opt/quest/vas/access.d]# vastool user checkaccess -s sshd USERNAME Access policy denial. User is not authorized to access this host. DENIED (access denied) [user=USERNAME] [service=sshd] Access Rule = [Deny User - OU\GROUP sshd (sshd.deny)]