Privilege Escalation

Some SSH credential types support privilege escalation.

Note: BeyondTrust's PowerBroker (pbrun) and Centrify's DirectAuthorize (dzdo) are proprietary root task delegation methods for Unix and Linux systems.

Tip: Scans run using su+sudo allow the user to scan with a non-privileged account and then switch to a user with sudo privileges on the remote host. This is important for locations where remote privileged login is prohibited.

Note: Scans run using sudo vs. the root user do not always return the same results because of the different environmental variables applied to the sudo user and other subtle differences. For more information, see https://www.sudo.ws/docs/man/sudo.man/.

The following table describes the additional options to configure for privilege escalation.

Option

SSH Types

Description

Escalation Username

Arcon

Kerberos

Password

Public Key

The username for the account with elevated privileges.

Escalation Password

Kerberos

Password

Public Key

The password for the account with elevated privileges.

Escalation Path

Arcon

Kerberos

Password

Public Key

The directory path for the privilege escalation commands.

Escalation Su User

Arcon

CyberArk

Kerberos

Password

Public Key

The username for the account with su privileges.

Escalation Account Name

Arcon

The name parameter for the Arcon account with elevated privileges.

CyberArk Escalation Account Details Name

CyberArk

The name parameter for the CyberArk account with elevated privileges.

Note: The system uses the password associated with the CyberArk account name you provide for all scanned hosts.

Escalation Account

CyberArk

The username for the account with elevated privileges.

Escalation sudo user

CyberArk

The username for the account with sudo privileges.

Location of dzdo (directory)

CyberArk

The directory path for the dzdo command.

Location of pbrun (directory)

CyberArk

The directory path for the pbrun command.

Location of su (directory)

CyberArk

The directory path for the su command.

Location of su and sudo (directory)

CyberArk

The directory path for the su and sudo commands.

Location of sudo (directory)

CyberArk

The directory path for the sudo command.

su login

CyberArk

The username for the account with su privileges.

sudo login

CyberArk

The username for the account with sudo privileges.

Thycotic Escalation Account

Thycotic Secret Server

The name parameter for the Thycotic account with elevated privileges.

Note: The system uses the password associated with the Thycotic account name you provide for all scanned hosts.