Optional features
Privilege escalation
Privilege escalation can be configured to work with the Azure Key Vault integration within the SSH credential type.
You can add privilege escalation while configuring an SSH credentialed scan with the Azure Key Vault integration using the Elevate Privileges with field option, which lets you select the privilege account type used to gain elevated access to the target machine.
The available privilege account types are:
-
Nothing (the default)
-
.k5login
-
Cisco 'enable'
-
Dzdo
-
Pbrun
-
Su
-
su+sudo
-
sudo
-
Checkpoint Gaia 'expert'
Each escalation type can be configured with the additional fields below. When Escalation Credential ID is supplied, the integration performs one extra Key Vault GET request to fetch that secret and uses its password field as the sudo/su password. If Escalation Credential ID is left blank, the password from the primary Key Vault secret is reused as the escalation password.
For the sudo escalation type specifically, the standard sudo prompt expects the invoking user's own password rather than a separate root-account password. In that case, leave Escalation Credential ID blank so the integration reuses the primary Key Vault secret's password (which corresponds to the account identified by Username) as the sudo password — no additional Key Vault lookup is performed.
| Option | Description | Required |
|---|---|---|
| Escalation Credential ID | The name of the Azure Key Vault secret that contains the escalation account credentials. The password field of that secret becomes the sudo/su password.
Configurable within: .k5login, Cisco enable, dzdo, pbrun, su, su+sudo, sudo, Checkpoint Gaia expert. |
Yes |
| Escalation Account Name | The username for the account with elevated privileges. When left blank, the username retrieved from the primary Key Vault secret is used.
Configurable within: .k5login, Cisco enable, dzdo, pbrun, su, sudo, su+sudo, Checkpoint Gaia expert. |
No |
| Location of [account type] (directory) | The directory path for the escalation binary (for example /usr/bin for sudo). Configurable within: dzdo, pbrun, su, su+sudo, sudo. | No |