{{COMPANY_NAME}} {{PRODUCT_NAME}} can be configured to perform credentialed scans by connecting to devices over one of several protocols and logging in with provided credentials. Both the {{COMPANY_NAME}} Main Console and Subordinate scanners can be configured for scanning.
Regardless of the type of devices being scanned, the {{COMPANY_NAME}} appliance should be configured with a valid DNS server that can provide information on the devices in the environment. Of particular interest is PTR (reverse DNS) records for host IP addresses, which are often provided by Windows domain controllers through the associated DNS servers.
When performing credentialed scans, the Main Console is configured with target IP address ranges which {{PRODUCT_NAME}} uses to first discover live hosts before attempting to authenticate. The discovery phase involves a combination of ICMP traffic (ping, timestamp, etc), DNS requests, and simple TCP port scans to find systems that are responding. TCP discovery scanning targets about 10 common services by default, but this port list can be configured.
Once an IP address is identified as being "alive", authenticated scanning commences. Each credential configured for the scan group is attempted on each IP until one is successful. Port requirements for each operating system's authenticated scans are detailed below.
The following network requirements apply when scanning Windows devices:
SMB or WinRM
To gain access to run scripts on each Windows device, {{PRODUCT_NAME}} must be able to log in via SMB or WinRM (Powershell Remoting). For SMB scans, most customers leverage WMI capabilities, but other SMB options are available. SMB scanning requires that {{PRODUCT_NAME}} can reach port TCP/445 on each device. WinRM scanning requires that {{PRODUCT_NAME}} can connect to either TCP/5985 or TCP/5986.
LDAP or LDAPS
When scanning domain controllers, {{PRODUCT_NAME}} connects to and obtains information from LDAP services which reside on either TCP/389 (LDAP) or TCP/636 (LDAPS). Note that in the case of port 389 communications, scans require that StartTLS is enabled with a configured certificate so that the authentication step and data transfer are encrypted.
The following network requirements apply when scanning *BSD, Linux, and MacOS devices:
SSH
{{PRODUCT_NAME}} must be able to connect to SSH services running on these devices. By default, {{COMPANY_NAME}} connects to TCP/22, but may be configured to access SSH on alternative ports.
Accepted SSH private key formats: RSA, ECDSA, ED-25519