SSH Scanning Reference

This guide provides a reference for the SSH scanner, which discovers and collects detailed information from Linux, Unix, and AIX systems.

Overview

The SSH scanner connects to target systems using the Secure Shell (SSH) protocol to execute a series of commands. It gathers a comprehensive inventory of the system's hardware, software, and configuration without requiring a dedicated agent on the target machine.

Network Requirements

• Port: TCP 22 must be open from the NopeSight Scanner Agent to the target Linux, Unix, or AIX system.
• Protocol: Secure Shell (SSH)

Authentication Requirements

• The scanner requires an SSH user account on the target system.
• Both password-based and SSH key-based authentication methods are supported.
• For security, SSH key-based authentication is recommended.

---

Privilege Requirements

The amount of data collected depends on the privileges of the user account provided. The scanner can operate in two modes:

Basic Discovery (Non-Root User)

A standard, non-privileged user account is sufficient for basic inventory.

• Required Permissions:

  • SSH access to the target system.
  • Read access to standard system directories like /proc, /sys, and /etc.
  • Permission to execute common system commands (hostname, uname, ip, df, ps, etc.).

• Data Collected:

  • System identification (hostname, OS version, kernel)
  • Basic hardware information (CPU model, memory, disk space)
  • Network configuration (IP addresses, network interfaces, active connections)
  • Running processes
  • Installed software packages (dpkg or rpm)
  • User accounts

Enhanced Discovery (Root or Sudo User)

For the most comprehensive data collection, an account with root or sudo privileges is required.

• Required Permissions:

  • All basic permissions.
  • The ability to execute commands as root (either via direct root login or sudo).

• Additional Data Collected with Privileged Access:

  • Detailed Hardware Information: Full hardware details from dmidecode, including BIOS, memory modules, and processor specifications.
  • Storage Health: Disk health and SMART data from tools like smartctl.
  • Advanced Network Details: Full process-to-connection mapping using lsof.
  • Virtualization Details: Information about Docker containers or other virtualization platforms (virsh).
  • AIX Specifics: Detailed LPAR configuration and Vital Product Data (VPD) for IBM Power systems.

---

Data Collected Summary

The SSH scanner gathers a wide range of information, which is normalized and sent to the CMDB.

Category	Examples	Privileges
System	Hostname, OS Version, Kernel, Manufacturer, Model, Serial Number	Basic (Full detail with Root)
Hardware	CPU Model & Cores, Total Memory, Disk Partitions, PCI Devices	Basic (Full detail with Root)
Network	IP Addresses, MAC Addresses, Default Gateway, Active Connections	Basic
Software	Installed Packages (e.g., from rpm or dpkg), Versions	Basic
Processes	Running Processes, Executable Paths, Owning User	Basic (Full detail with Root)
Users	Local User Accounts, Recent Logins	Basic
Storage	Filesystem Usage, Disk Health (SMART data)	Basic (Health data with Root)
Virtualization	Docker Containers, KVM/libvirt VMs	Root