Chapter 3. Establish authentication credentials to enable network scans

Define network sources to identify the hosts, Internet Protocol (IP) addresses, and IP ranges that Discovery scans across your network.

Create network credentials to authenticate Discovery scans against remote systems in your network by using Secure Shell (SSH)-based authentication.

To run a scan, you must configure data for two basic structures: sources and credentials. The type of source that you are going to inspect during the scan determines the type of data that is required for both source and credential configuration.

A source contains a single asset or a set of multiple assets that are to be inspected during the scan. You can configure any of the following types of sources:

When you are working with network sources, you determine how many individual assets you should group within a single source. Currently, you can add multiple assets to a source only for network sources. The following list contains some of the other factors that you should consider when you are adding sources:

A credential contains data such as the username and password or SSH key of a user with sufficient authority to run the scan on all or part of the assets in that source. As with sources, credentials are configured as the network, vCenter, satellite, OpenShift, Red Hat Ansible Automation Platform, or RHACS type. A network source might require multiple network credentials to access all assets in a broad IP range. Conversely, a vCenter or satellite source typically uses a single credential to access a particular system management solution server. An OpenShift, Red Hat Ansible Automation Platform, or RHACS source uses a single credential to access a single cluster.

You can add new sources from the Sources view and you can add new credentials from the Credentials view. You can also add new or select previously existing credentials during source creation. It is during source creation that you associate a credential directly with a source.

Because sources and credentials must have matching types, any credential that you add during source creation shares the same type as the source. If you want to use an existing credential during source creation, the list of available credentials contains only credentials of the same type. For example, during network source creation, only network credentials are available for selection.

Network scans use Secure Shell (SSH) through Red Hat Ansible Automation Platform to inspect remote systems. Configure network credentials with either a username and password or a username and SSH keyfile pair, optionally including a passphrase.

Also during network credential configuration, you can enable a become method. The become method is used during a scan to elevate privileges. These elevated privileges are needed to run commands and obtain data on the systems that you are scanning.

During network scans, Discovery runs commands on remote systems using the credentials you provide. Some commands require elevated privileges through sudo to gather complete facts for your report.

Although it is possible to run a scan for a network source without elevated privileges, the results of that scan are incomplete. The incomplete results from the network scan affect the quality of the generated report for the scan.

The following information lists the commands that Discovery runs on remote hosts during a network scan. It includes the basic commands that can run without elevated privileges. It also lists the commands that must run with elevated privileges to gather the most accurate and complete information for the report.