SSH (Legacy) Integration

To configure SSH integration:

  1. Log in to Tenable Vulnerability Management.
  2. Click Scans.
  3. Click + New Scan.

  4. Select a Scan Template.

    The scan configuration page appears.

  1. In the Name box, type a name for the scan.

  2. In the Targets box, type an IP address, hostname, or range of IP addresses.
  3. (Optional) Add a description, folder location, scanner location, and specify target groups.
  1. Click the Credentials tab.

    The Credentials options appear.

  2. In the Select a Credential menu, select the Host drop-down.
  3. Select SSH.

    The CyberArk field options appear.

  4. Configure each field for SSH authentication.

    Option Description Required

    Username

    The username of the target system.

    yes

    CyberArk AIM Service URL

    The URL for the CyberArk AIM web service. By default, Tenable VM for CyberArk uses /AIMWebservice/v1.1/AIM.asmx.

    no

    Central Credential Provider Host

    The CyberArk Central Credential Provider IP/DNS address.

    yes

    Central Credential Provider Port

    The port on which the CyberArk Central Credential Provider is listening.

    yes

    Central Credential Provider Username

    The username of the vault, if the CyberArk Central Credential Provider is configured to use basic authentication.

    no

    Central Credential Provider Password

    The password of the vault, if the CyberArk Central Credential Provider is configured to use basic authentication.

    no

    Safe

    The safe on the CyberArk Central Credential Provider server that contained the authentication information that you want to retrieve.

    yes

    CyberArk Client Certificate The file that contains the PEM certificate used to communicate with the CyberArk host.

    no

    CyberArk Client Certificate Private Key The file that contains the PEM private key for the client certificate.

    no

    CyberArk Client Certificate Private Key Passphrase The passphrase for the private key, if required.

    no

    AppId

    The AppId that has been allocated permissions on the CyberArk Central Credential Provider to retrieve the target password.

    yes

    Folder

    The folder on the CyberArk Central Credential Provider server that contains the authentication information that you want to retrieve.

    yes

    PolicyId

    The PolicyID assigned to the credentials that you want to retrieve from the CyberArk Central Credential Provider.

    no

    Use SSL

    If CyberArk Central Credential Provider is configured to support SSL through IIS check for secure communication.

    no

    Verify SSL Certificate

    If CyberArk Central Credential Provider is configured to support SSL through IIS and you want to validate the certificate check this. Refer to custom_CA.inc documentation for how to use self-signed certificates.

    no

    CyberArk Account Details Name The unique name of the credential you want to retrieve from CyberArk.

    no

    CyberArk Address The domain for the user account.

    no

    CyberArk elevate privileges with The privilege escalation method you want to use to increase users' privileges after initial authentication. Your selection determines the specific options you must configure.

    no

    Custom password prompt The password prompt used by the target host. Only use this setting when an interactive SSH session fails due to Tenable VM for CyberArk receiving an unrecognized password prompt on the target host's interactive SSH shell.

    no

    Caution: Tenable strongly recommends encrypting communication between your on-site scanner and the CyberArk AIM gateway using HTTPS and/or client certificates. For information on securing the connection, refer to the Tenable Vulnerability Management User Guide and the Central Credential Provider Implementation Guide located at cyberark.com (login required).

  1. Click Save.

Verification

  1. To verify the integration is working, click the launch button (highlighted below) to initiate an on-demand scan.

  2. Once the scan has completed, select the completed scan and look for Plugin ID 12634, which validates that authentication was successful. If the authentication is not successful, refer to the Debugging CyberArk Issues section of this document.