---
schema_version: "1"
id: de6475dcaf234e2aa9a08ef5a3fd9fa6556e6e06f3e4591bd98fd0aa1c06dd63
title: Prepare Linux and macOS Targets for SSH Discovery
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/it_srvcs_discovery_prepare_ssh_targets.md
canonical_url: https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_prepare_ssh_targets.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: d3c9ae02fbd49991be1e3bd55ede60acc0dc3a0181b89e68779a33eb90a6f948
description: Collect complete Linux, Unix, and macOS inventory data and keep CMDB records current by preparing target systems for Secure Shell (SSH) discovery. Provide a dedicated scanning account, the access required for system and hardware details, and network connectivity from the Discovery Application host before you create the discovery target.
products:
  - Service Cloud
  - Agentforce IT Service
release: "264"
---
# Prepare Linux and macOS Targets for SSH Discovery

Collect complete Linux, Unix, and macOS inventory data and keep CMDB records current by preparing target systems for Secure Shell (SSH) discovery. Provide a dedicated scanning account, the access required for system and hardware details, and network connectivity from the Discovery Application host before you create the discovery target.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Performance</strong>, and <strong>Unlimited</strong> Editions with Agentforce IT Service that have Discovery enabled.</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d80335e74">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d80335e74 ">To manage Discovery:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d80335e74 ">IT Service Asset Discovery</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d80335e74 ">To prepare a Linux, Unix, or macOS target:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d80335e74 ">Access to manage remote login and user privileges on the target system</td>

          </tr>
        </tbody>
      </table>

Prepare the Discovery Application host before you configure target systems. For more information about Discovery Application host requirements, see [Prepare the Discovery Application Host for Agentless Scans](https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_prepare_app_host.htm&release=264.0.0&type=5 "Run reliable agentless scans and keep asset data in CMDB current by preparing a Windows host for the Discovery Application. Provide outbound access to Salesforce, protocol-specific access to target systems, and a service account with local administrator access. Verify connectivity so the application can run scan jobs and return results for processing.").

SSH discovery requires network access from the Discovery Application host to each target. For more information about connectivity and access requirements, see [Agentless Discovery Network, Port, and Access Requirements](https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_network_access_requirements.htm&release=264.0.0&type=5 "Improve agentless scan reliability and keep discovered asset data current. Review the connectivity and access requirements for each supported probe before you create discovery targets.").

The Discovery Application connects to Linux, Unix, and macOS targets by using SSH over TCP port 22. The scan runs commands remotely to collect operating system, hardware, software, network, and configuration data without installing software on the target.

On Linux and Unix targets, SSH discovery collects operating system, kernel, hardware, filesystem, network, user, group, installed package, running process, and connection information. On macOS targets, SSH discovery collects hardware, operating system, application, filesystem, network, process, user, and group information.

1. Create or identify a dedicated account that can connect to each target by using SSH.
    
    Configure password-based or SSH key-based authentication according to your organization's security policy.
2. On each Linux or Unix target, turn on the SSH service and grant the scanning account SSH access.
3. On each Linux or Unix target, grant the scanning account sudo access for the commands that collect hardware-level details.
    
    Full root access isn't required. Without elevated access, the scan returns less complete hardware data.
4. On each macOS target, turn on **Remote Login** in **System Settings**, and then grant access to the scanning account.
    
    In System Settings, go to **General** | **Sharing** | **Remote Login**.
5. On each macOS target, grant the scanning account access to run `system_profiler`.
    
    The macOS probe uses `system_profiler` to collect hardware, software, and network inventory data.
6. Allow SSH traffic over TCP port 22 from the Discovery Application host to each target system.
7. From the Discovery Application host, verify that the scanning account can authenticate to a representative target by using SSH.
    
    For Linux and Unix targets, verify the required sudo access. For macOS targets, verify access to run `system_profiler`.

The Linux, Unix, and macOS targets are ready for the Discovery Application to authenticate and run the SSH probe.

Create an SSH discovery credential that uses the prepared account. For more information about discovery credentials, see [Create Discovery Credentials for Secure Scanning](https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_create_cred.htm&release=264.0.0&type=5 "Use discovery credentials to securely connect to systems and collect data during agentless scans. Credentials authenticate access to devices, applications, and cloud environments without manual sign-in. Create and manage credentials for supported types such as Windows, SSH, SNMP, or AWS to ensure accurate and authorized discovery results.").

Create the discovery target and select the prepared SSH credential. For more information about discovery targets, see [Create a Discovery Target](https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_create_target.htm&release=264.0.0&type=5 "Create a discovery target to define where and how agentless discovery scans IT environments. Targets define the systems, IP ranges, and environments included in agentless discovery. Each target also specifies probe types that determine how those systems are scanned. When a target runs, it creates a scan job that collects discovery data and updates asset information in Configuration Management Database (CMDB).").