Salesforce Docs Portal

Prepare Linux and macOS Targets for SSH Discovery

Collect complete Linux, Unix, and macOS inventory data and keep CMDB records current by preparing target systems for Secure Shell (SSH) discovery. Provide a dedicated scanning account, the access required for system and hardware details, and network connectivity from the Discovery Application host before you create the discovery target.

Required Editions

Available in: Lightning Experience
Available in: Enterprise, Performance, and Unlimited Editions with Agentforce IT Service that have Discovery enabled.
User Permissions Needed
To manage Discovery: IT Service Asset Discovery
To prepare a Linux, Unix, or macOS target: Access to manage remote login and user privileges on the target system

Prepare the Discovery Application host before you configure target systems. For more information about Discovery Application host requirements, see Prepare the Discovery Application Host for Agentless Scans.

SSH discovery requires network access from the Discovery Application host to each target. For more information about connectivity and access requirements, see Agentless Discovery Network, Port, and Access Requirements.

The Discovery Application connects to Linux, Unix, and macOS targets by using SSH over TCP port 22. The scan runs commands remotely to collect operating system, hardware, software, network, and configuration data without installing software on the target.

On Linux and Unix targets, SSH discovery collects operating system, kernel, hardware, filesystem, network, user, group, installed package, running process, and connection information. On macOS targets, SSH discovery collects hardware, operating system, application, filesystem, network, process, user, and group information.

  1. Create or identify a dedicated account that can connect to each target by using SSH.
    Configure password-based or SSH key-based authentication according to your organization's security policy.
  2. On each Linux or Unix target, turn on the SSH service and grant the scanning account SSH access.
  3. On each Linux or Unix target, grant the scanning account sudo access for the commands that collect hardware-level details.
    Full root access isn't required. Without elevated access, the scan returns less complete hardware data.
  4. On each macOS target, turn on Remote Login in System Settings, and then grant access to the scanning account.
    In System Settings, go to General | Sharing | Remote Login.
  5. On each macOS target, grant the scanning account access to run system_profiler.
    The macOS probe uses system_profiler to collect hardware, software, and network inventory data.
  6. Allow SSH traffic over TCP port 22 from the Discovery Application host to each target system.
  7. From the Discovery Application host, verify that the scanning account can authenticate to a representative target by using SSH.
    For Linux and Unix targets, verify the required sudo access. For macOS targets, verify access to run system_profiler.

The Linux, Unix, and macOS targets are ready for the Discovery Application to authenticate and run the SSH probe.

Create an SSH discovery credential that uses the prepared account. For more information about discovery credentials, see Create Discovery Credentials for Secure Scanning.

Create the discovery target and select the prepared SSH credential. For more information about discovery targets, see Create a Discovery Target.