Configure Tenable Security Center for Centrify (SSH)

In Tenable Security Center, you can integrate with Centrify using SSH credentials. Complete the following steps to configure Tenable Security Center with Centrify using SSH.

Required User Role: Standard, Administrator, or System administrator

To integrate Tenable Security Center with Centrify using SSH credentials:

  1. Log in to Tenable Security Center.

  2. Click Scanning > Credentials (administrator users) or Scans > Credentials (organizational users).

    The Credentials page appears.

  3. Click Add.

    The Credential Templates page appears.

  4. In the Miscellaneous, API Gateway, Database, SNMP, SSH, or Windows, or Web Authentication sections, click the tile for the specific method you want to configure.

    The Add Credentials configuration page appears.

  5. In the Name box, type a name for the credentials.
  6. In the Description box, type a description for the credentials.
  7. (Optional) Type or select a Tag. For more information, see Tags in the Tenable Security Center User Guide.

  8. Configure each option for the SSH authentication.

    Option Description
    Centrify Host

    (Required) The Centrify IP address or DNS address.

    Note: If your Centrify installation is in a subdirectory, you must include the subdirectory path. For example, type IP address or hostname/subdirectory path.
    Centrify Port (Required) The port on which Centrify listens. By default, Tenable Security CenterTenable Vulnerability Management uses port 443.
    API User (Required) The API user provided by Centrify.
    API Key (Required) The API key provided by Centrify.
    Tenant (Required) The Centrify tenant associated with the API. By default, Tenable Security CenterTenable Vulnerability Management uses centrify.
    Authentication URL (Required) The URL Tenable Security CenterTenable Vulnerability Management uses to access Centrify. By default, Tenable Security CenterTenable Vulnerability Management uses /Security.
    Password Query URL (Required) The URL Tenable Security CenterTenable Vulnerability Management uses to query the passwords in Centrify. By default, Tenable Security Center uses /RedRock.
    Password Engine URL

    (Required) The URL Tenable Security CenterTenable Vulnerability Management uses to access the passwords in Centrify. By default, Tenable Security CenterTenable Vulnerability Management uses /ServerManage.
    Username (Required) The username to log in to the hosts you want to scan.
    Checkout Duration

    (Required) The length of time, in minutes, that you want to keep credentials checked out in Centrify.

    Configure the Checkout Duration to exceed the typical duration of your Tenable Security Center scans so that password changes do not disrupt your Tenable Security CenterTenable Vulnerability Management scans. If Centrify changes a password during a scan, the scan fails. If a password from a previous scan is still checked out when a new scan begins, the new scan fails.
    Use SSL When enabled, Tenable Security CenterTenable Vulnerability Management uses SSL through IIS for secure communications. You must configure SSL through IIS in Centrify before enabling this option.
    Verify SSL Certificate When enabled, Tenable Security CenterTenable Vulnerability Management validates the SSL certificate. You must configure SSL through IIS in Centrify before enabling this option.

  9. Click Submit.

    Tenable Security Center saves your configuration.

What to do next:

To verify the integration is working:

  1. On the Scans page, click the Launch button to initiate an on-demand scan.

  2. Once the scan completes, select the completed scan and look for Plugin ID 97993 and the corresponding message - It was possible to log into the remote host via SSH using 'password' authentication. This result validates that authentication was successful.