Skip to main content

Linux

Description

The Linux connector connects to a server via SSH and reads local user accounts, group memberships, sudo privileges, running services, and scheduled tasks. It supports any Linux distribution that provides standard POSIX interfaces and OpenSSH.

System Type Classification

FieldValue
System TypeServer
Default Scan Priority200

Version Support

OrbisID EditionSupported
CommunityYes
ProYes
EnterpriseYes

Linux scanning is available in all editions.

Supported Protocols

ProtocolPortNotes
SSH22 TCPConfigurable; must be accessible from OrbisID or the On-Premise Agent

What OrbisID Discovers

DataSource
Local user accounts/etc/passwd
Group memberships/etc/group
Sudo privileges/etc/sudoers, /etc/sudoers.d/*
Running systemd servicessystemctl list-units --type=service
Cron jobs/etc/cron*, /var/spool/cron/
Account status (locked/unlocked)/etc/shadow password field

Connection Requirements

Credential Requirements

The credential must be a local or domain account that can authenticate via SSH.

Minimum permissions required:

ResourcePermission
/etc/passwdRead
/etc/groupRead
/etc/shadowRead (for account status)
/etc/sudoers and /etc/sudoers.d/Read
systemctl outputExecute (non-root users can read service status)
/var/spool/cron/Read (for per-user cron jobs)

Recommended approach: Create a dedicated service account with read-only access to the above files. Adding the account to the sudo group is not required if the files are readable by the account directly.

For sudo file parsing, the account needs read access to /etc/sudoers (typically root-readable only). Use one of:

  • Run the scanner as root (not recommended)
  • Grant the service account sudo access to cat /etc/sudoers only
  • Use an Access Control List (ACL): setfacl -m u:orbisid-scanner:r /etc/sudoers

Network Requirements

RequirementDetail
SSH port accessiblePort 22 (or custom port) must be reachable from OrbisID or the On-Premise Agent
SSH key or passwordBoth authentication methods are supported

Configuration Steps

  1. Navigate to Systems in the sidebar
  2. Click Add System
  3. Fill in the fields:
FieldValue
NameDescriptive name (e.g., web-server-01)
Hostname / IPSSH-accessible hostname or IP
Port22 (or custom SSH port)
OS TypeLinux
System TypeServer
CredentialSSH credential (username + password or SSH key)
  1. Click Test Connection to verify SSH access
  2. Click Save
SSH Keys

SSH key authentication is more secure than password-based authentication. Store the private key as an OrbisID credential and use the matching public key on the target server's ~/.ssh/authorized_keys.

Troubleshooting

SymptomLikely CauseResolution
Connection test fails with Connection refusedSSH not running or port blockedVerify sshd is running and the port is accessible
Connection test fails with Authentication failedWrong credentialsVerify username, password, or SSH key
No sudo entries discoveredScanner cannot read /etc/sudoersGrant read permission via ACL or adjust scanner account permissions
No service datasystemctl not availableConfirm the system uses systemd; older init-based systems return empty service data
Scan succeeds but accounts seem incompleteNon-standard /etc/passwd or LDAP-integrated usersLDAP/SSSD users are not currently discovered via the Linux scanner