Configure ARCON Integration for Tenable Security Center

The ARCON PAM integration exists as an authentication method within the supported credential types in Tenable scans.

Required Permissions

The ARCON API user configured in the scan policy must have permission to retrieve credentials for the target accounts in ARCON. Refer to the ARCON product documentation for the specific roles and permissions required to authorize API-based credential checkout.

Scan Configuration — SSH, Windows, VMware vCenter, or Database

Complete the following steps to configure Tenable Security Center with ARCON.

  1. Log in to your Tenable Security Center user interface.

  2. In the left navigation pane, click Scans.

    A menu appears.

  3. Click Credentials.

    The Credentials page appears.

  4. Click +Add at the top of the page.

    The Add Credential page appears.

  5. In the Windows and SSH sections, select ARCON. For VMware, Nutanix, or Database, select the relevant credential type and set the Authentication Method to ARCON.

  6. In the Name box, type a name for the credential.

  7. (Optional) Add a description and tag.

  8. Configure the following options:

    Option Description Required
    Arcon Host The hostname or IP address of the ARCON PAM server. Yes
    Arcon Port The port on which the ARCON API communicates. Default: 443. Yes
    API User The username for authenticating to the ARCON API. Yes
    API Key The password for the ARCON API user. Yes
    Authentication URL The path portion of the ARCON authentication endpoint (host and port are taken from the fields above). For the Digital Vault API, enter the base path (for example, /dv/api/sdk); the integration appends /GetToken automatically. For the Legacy API, enter the full token path (for example, /arconToken). Consult your ARCON administrator for the correct paths in your deployment. Yes
    Password Engine URL The path portion of the ARCON credential retrieval endpoint (host and port are taken from the fields above). For the Digital Vault API, enter the same base path as the Authentication URL (for example, /dv/api/sdk); the integration appends /GetTargetDevicePassKey automatically. For the Legacy API, enter the base API path (for example, /api); the integration appends /ServicePassword/GetTargetDevicePassKey automatically. Yes
    Checkout Duration The number of hours for which the credential is checked out from ARCON (OpenForHours). Must be a positive integer. Set this value to exceed the total expected duration of the scan to ensure credentials remain valid throughout. The maximum accepted value varies by ARCON deployment — consult your ARCON administrator. Yes
    Kerberos Target Authentication When enabled, uses Kerberos for target authentication. No
    Use SSL When enabled, uses SSL/TLS for communications with the ARCON API. No
    Verify SSL Certificate When enabled, verifies the ARCON server SSL certificate. Requires SSL to be enabled. No

    Privilege Escalation (SSH only):

    Option Description Required
    PAM Elevate privileges with The escalation method (for example, sudo, su). No
    PAM Escalation Username The username of the account in ARCON whose credential is used to authorize privilege escalation (for example, for sudo, this is typically the login account whose password is required). No
    PAM Escalation Account Name The name of the privileged account to escalate to (for example, root). If not set, defaults to the value of PAM Escalation Username. No
    Privilege elevation binary path (directory) The directory path to the sudo binary on the target (for example, /usr/bin). No
    su login The login shell for su-based escalation. No

    Note: Field labels in Tenable Security Center may differ slightly from those in Tenable One Vulnerability Management and Tenable Nessus. Verify field names within the Tenable Security Center user interface.

  9. Click Submit to save the credential.