SSH (Legacy) Privilege Escalation Integration
To configure SSH integration:
- Log in to Tenable.sc.
In the top navigation bar, click Scanning.
A menu appears.
The Credentials page appears.
In the SSH section, click CyberArk Vault.
The Add Credential page appears.
In the CyberArk Vault Credentials section, click Privilege Escalation.
The Privilege Escalation options appear.
Option Description Required
The username of the target system.
CyberArk AIM Service URL
The URL for the CyberArk AIM web service. By default, Tenable Vulnerability Management uses /AIMWebservice/v1.1/AIM.asmx.
Central Credential Provider Host
The CyberArk Central Credential Provider IP/DNS address.
Central Credential Provider Port
The port on which the CyberArk Central Credential Provider is listening.
Central Credential Provider Username
The username of the vault, if the CyberArk Central Credential Provider is configured to use basic authentication.
Central Credential Provider Password
The password of the vault, if the CyberArk Central Credential Provider is configured to use basic authentication.
The safe on the CyberArk Central Credential Provider server that contained the authentication information that you want to retrieve.
CyberArk Client Certificate The file that contains the PEM certificate used to communicate with the CyberArk host.
CyberArk Client Certificate Private Key The file that contains the PEM private key for the client certificate.
CyberArk Client Certificate Private Key Passphrase The passphrase for the private key, if required.
The AppId that has been allocated permissions on the CyberArk Central Credential Provider to retrieve the target password.
The folder on the CyberArk Central Credential Provider server that contains the authentication information that you want to retrieve.
The PolicyID assigned to the credentials that you want to retrieve from the CyberArk Central Credential Provider.
If CyberArk Central Credential Provider is configured to support SSL through IIS check for secure communication.
Verify SSL Certificate
If CyberArk Central Credential Provider is configured to support SSL through IIS and you want to validate the certificate check this. Refer to custom_CA.inc documentation for how to use self-signed certificates.
CyberArk Account Details Name The unique name of the credential you want to retrieve from CyberArk.
CyberArk Address The domain for the user account.
CyberArk elevate privileges with The privilege escalation method you want to use to increase users' privileges after initial authentication. Your selection determines the specific options you must configure. For more information, see Privilege Escalation.
Custom password prompt The password prompt used by the target host. Only use this setting when an interactive SSH session fails due to Tenable Vulnerability Management receiving an unrecognized password prompt on the target host's interactive SSH shell.
Note: Multiple options for Privilege Escalation are supported, including su, su+sudo and sudo. If sudo is selected, additional fields for sudo user, CyberArk Account Details Name and Location of sudo (directory) are provided and can be completed to support authentication and privilege escalation through CyberArk. See the Tenable.sc User Guide for additional information about the supported privilege escalation types and their accompanying fields.
Configure each field for SSH authentication. See Tenable.sc User Guide to get detailed descriptions for each option.
- Click Submit.
- Next, follow the steps for Add the Credential to the Scan.