Skip to main content
Linux/Unix discovery finds the local accounts on your Linux and Unix hosts, so you can import them into PAM as SSH accounts. For how discovery works across every source type, see Discovery. You give the source a list of hosts and one or more SSH accounts to sign in with. Infisical connects to each host over SSH through a Gateway.
  1. Infisical expands each CIDR range into its hosts
  2. For each host, Infisical first tries the SSH account whose host matches, then tries the other accounts until one signs in
  3. Infisical reads the host’s accounts from /etc/passwd and stages each account that has a login shell as an SSH account for that host
If root exists on two hosts, Infisical stages two separate accounts. If no account can sign in to a host, the scan reports the host and continues with the others.

​
Prerequisites

  • A Gateway that can reach the hosts you want to scan
  • One or more SSH accounts that can sign in to those hosts, using a password, a private key, or a certificate
  • The Product Admin role in PAM
  • The Connector, Operator, or Admin role on those SSH accounts (Operator or Admin for an account that uses a password)
To scan many hosts, use one SSH account whose key or certificate authority every host trusts.
If an SSH account uses a password, Infisical sends the password to every host that the source scans, including hosts in a CIDR range that you don’t control. Use a key or certificate account for scanning.

​
Step 1: Create a source

1
Go to Privileged Access Management > Discovery and select Add Source.
2
Select Linux/Unix, then select Next.
3
Configure the source:Infisical connects to each host on the port of the SSH account it signs in with.
4
Select Add Source.

​
Step 2: Run a scan

On the Discovery Sources table, select the options menu on the source’s row, then select Scan Now. A source can run one scan at a time. The scan stages only accounts that can sign in. It skips accounts whose shell is nologin, false, or another shell that doesn’t allow a login, which leaves out most system and daemon accounts.

​
Step 3: Import accounts

1
On the Discovery Sources table, select the source.
2
On the Staged Accounts tab, select the accounts you want, then select Import Accounts.
3
Select a Destination Folder and an SSH Template, then select Import.
4
Go to Privileged Access Management > Accounts. For each imported account, open the options menu on its row, select Configure, and enter its credential on the Configuration tab. The scan doesn’t read credentials, so you can’t connect to an imported account until you enter its credential.
Your Unix accounts are in PAM. Anyone with access to the destination folder can launch sessions on them, and each scan of the source stages any new accounts it finds.