CLI Reference

Last modified on April 16, 2025

This article provides an overview of the command line interface (CLI) utility. It covers how to test the client’s configuration and explains some commonly used CLI commands. Although it doesn’t comprehensively cover each command available, it gives you a general idea of the flexibility and power available at your fingertips from the CLI.

Client Configuration Confirmation

As a reminder, to verify the client is working, type the following:

sdm --version

This should output something similar to the following:

sdm version xx.yy.z (99a5d1a71d4eccaf171449e33bc0826132b05165 #503)

If the output is not like this, you should revisit the installation guide for whichever operating system your local machine uses (Linux, macOS, or Windows) for details on installation and setup.

Login and Logout

Example:

$ sdm login
App Domain [app.strongdm.com]:
Email address or User ID: example@strongdm.com
Please complete logging in at: https://app.strongdm.com/auth/XXXXXXXXXX
authentication successful
$ sdm logout

The StrongDM control plane is available in multiple regions for organizations who wish to house their StrongDM instance in a different geographic location than the default (US). Switching to a non-default region when using the CLI is sometimes done by setting an environment variable (SDM_APP_DOMAIN).

If you do not have an environment variable set to indicate your region, the Region field is presented. You may simply accept the default value app.strongdm.com by hitting Enter, or answer the prompt to choose which control plane you intend to log in to and use, such as app.eu.strongdm.com. Note that this refers to the region your StrongDM organization is hosted in, not your particular geographic location.

If your organization uses SSO, you are redirected to complete authentication via the web. The CLI will attempt to open the provided URL in your browser, or you can visit the URL directly.

Lock and Unlock the Client

If you have MFA enabled in your organization, you can manually lock and unlock the client from the CLI.

Example:

$ sdm lock
locked
$ sdm unlock
awaiting confirmation...
unlocked

When in awaiting confirmation... state you will receive an MFA push to complete the unlock process.

Check the Status of Resources

Example:

$ sdm status
     DATASOURCE NAME           STATUS            PORT      TYPE
     ! mysql 5.6.39            not connected     13311     mysql
     !jsonb-test               not connected     15438     aurora-postgres
     Cache01                   not connected     16379     redis
     CacheM01                  not connected     21211     memcached
     Inventory DB (Heroku)     not connected     15434     postgres
     Marketing DB RW           not connected     15435     postgres
     MySQL 5.6                 not connected     13310     mysql
     Pricing DB RO             not connected     13306     mysql
     Users Profile DB RO       not connected     15436     postgres

     SERVER                    STATUS            PORT      TYPE
     RDP prod server           not connected     13389     rdp
     prod01 sudo               not connected     62609     ssh
     prod02                    not connected     62524     ssh

Connect/Disconnect

Example:

$ sdm connect Marketing
connect successful
$ sdm status
     DATASOURCE NAME           STATUS            PORT      TYPE
     ! mysql 5.6.39            not connected     13311     mysql
     !jsonb-test               not connected     15438     aurora-postgres
     Cache01                   not connected     16379     redis
     CacheM01                  not connected     21211     memcached
     Inventory DB (Heroku)     not connected     15434     postgres
     Marketing DB RW           connected         15435     postgres
     MySQL 5.6                 not connected     13310     mysql
     Pricing DB RO             not connected     13306     mysql
     Users Profile DB RO       not connected     15436     postgres

     SERVER                    STATUS            PORT      TYPE
     RDP prod server           not connected     13389     rdp
     prod01 sudo               not connected     62609     ssh
     prod02                    not connected     62524     ssh
$ psql -h localhost -p 15435 -c 'select 42;'
?column?
----------
     42
(1 row)
$ sdm disconnect Marketing
disconnect successful

Connect to SSH

As described in the SSH connection guide there are several ways to connect to SSH servers. The easiest way is to use the sdm ssh aliases. Using this method it is not necessary to run sdm connect before opening the SSH connection.

Example:

$ alias|grep sdm
scp='scp -S'\''/usr/local/bin/sdm'\'' -osdmSCP'
ssh='/usr/local/bin/sdm ssh wrapped-run'
$ ssh prod02
Last login: Wed Mar 13 14:23:01 2019 from ip-xx-xx-xx-xx.us-west-2.compute.internal

     __|  __|_  )
     _|  (     /   Amazon Linux 2 AMI
     ___|\___|___|

https://aws.amazon.com/amazon-linux-2/
[ops@ip-xx-xx-xx-xx ~]$ exit
logout
Connection to 127.0.0.1 closed.

Export User Activity Logs

In order to export user activity logs, run the following command with the start date for the logs you’re retrieving:

sdm audit activities --from YYYY-MM-DD

Example:

sdm audit activities --from 2024-04-26

Date/Time format

Our system can parse the date (year, month, day) and time (hours, minutes, seconds) in a variety of formats. Examples of some accepted formats include the following:

  • 2024-01-01 00:00:00 UTC
  • 2024/01/01
  • 01 January 2024 00:00

An error message is returned if you are not using a valid format: Could not find format and will need to structure your date in a different way.

Output format

By default, the results of the command are in CSV format. If you want to change the output to JSON, you may add the -j flag.

Example:

sdm audit activities -j --from 2024-04-26

The default output is stdout; however, if you want the output to go to a file, you may use the -o flag. When using the -o flag, note that the flag must be the last flag invoked, followed by the name of the file you wish to create. Run the command from the directory where you want the file saved.

Example:

sdm audit activities --from 2024-04-26 -o example_logs_file.txt

The sdm Directory

By default, logs are written to ~/.sdm/sdm.log for both clients and relays.

There are also several authentication-related files in this directory. The *.key files serve as the private keys, which authenticate you and your machine.

CLI String Syntax

Most command-line interpreters use spaces to separate commands and their arguments. In general, when entering any string value that includes spaces, such as a multi-word name or a sentence, you’ll want to encapsulate the value in quotes (either single ' or double " depending on your setup).

For example, when adding a resource and giving it a name that has spaces in it, the name is enclosed in quotes (for example, sdm admin servers create ssh-cert --name="Cert Based SSH Server"). Similarly, if using the sdm access to CLI command to request access to a resource and provide some text explaining why you want access, the reason value needs to be a string enclosed in quotes in order to be passed to the system (for example, sdm access to postgres1 --reason 'Here is my full reason').

Without quotes, any text following a space is treated as a new argument, and only the first word of a multi-word string is treated as the value. This is a widely adopted syntax in most interpreters on macOS, Linux, and Windows.

Additional Information

You can find resources and information about the following StrongDM topics in this section: