Skip to main content
Not available in SaaS.
Account Discovery uses SSH to find Linux accounts when running Linux Discovery rules, and to onboard them afterward. This page configures and troubleshoots those SSH connections. The Linux scanner can discover (as set in the rule): all accounts (privileged, service, and application), only privileged accounts (manually created non-daemon accounts and root), and — in either case — accounts with public SSH keys.

​
Configuration keys

As of the version introducing Account Discovery Settings, these keys are configured in the Management Tool instead — the config-file keys below are removed on upgrade and no longer take effect. The table below is kept for reference on older versions.
Add or change these in EkranServer.Settings.config, found in C:\Program Files\Ekran System\Ekran System\Server on the Application Server host.

​
General prerequisites

For Linux connections using either passwords or SSH keys:
1

Confirm sudo permissions

Check the account used for scanning/onboarding has sudo:
Output root means it has sudo permissions.
You can scan accounts without sudo, but you cannot scan accounts with public SSH keys, or onboard any account type, without sudo.
2

Check the connection timeout

Confirm the timeout in EkranServer.Settings.config (the LinuxConnectionTimeoutSeconds key, default 20s). To increase it on the Application Server host, raise that value and set Max SYN Retransmissions to 8 (~2 minutes):
3

Confirm the Sudo service

Check that the Sudo service is installed on the target computer.
4

Exclude scanning user from secondary auth

If the scanning/onboarding account has Secondary User Authentication enabled on its Linux Client, add its username to Exclude from secondary authentication on the Configuration page’s Authentication Options tab.
5

Confirm Bash is installed

Empty output means Bash isn’t installed for that user.

​
Using passwords for SSH connections

Open the sshd config and ensure password authentication is on:
Set PasswordAuthentication to yes, then reload SSH:

​
Using public SSH keys for SSH connections

1

Enable public key authentication

In /etc/ssh/sshd_config, set PubkeyAuthentication to yes, then sudo systemctl reload ssh.
2

Configure passwordless sudo

Create a sudoers file for the user:
Add this line (replace {username}):
Test it:
If configured correctly, you switch to root without a password prompt.
3

Confirm the authorized_keys location

Check the SSH keys are at {username}/.ssh/authorized_keys on the target.

​
Troubleshooting

Application Server logs can be downloaded from the Management Tool or found in C:\Program Files\Ekran System\Ekran System\ServerLogs.
The target is offline, or the timeout is too low. Turn the computer on, or increase LinuxScanningConnectionTimeoutSeconds in the config file.
Wrong password, wrong/non-existent username, or wrong private key. Verify the credentials and test the connection over SSH, and confirm your public key is at /home/{username}/.ssh/authorized_keys.
The sshd service is offline/uninstalled, the SSH port is firewalled, the host is offline, or the timeout is too low. Install the OpenSSH client (sudo apt-get install openssh-client), start sshd (sudo systemctl start sshd after checking systemctl status sshd), add the Application Server host to the target’s TrustedHosts, and allow the LinuxScanningPort in the firewall (sudo ufw enable {port}/tcp).
The target can’t be reached by hostname. On the Application Server host, edit C:\Windows\System32\drivers\etc\hosts (open Notepad as administrator, set Files of type to All Files) and add a line like 127.0.0.1 domain.local, then save.
Connecting with a public key but passwordless sudo isn’t set up. Create the sudoers file (sudo visudo -f /etc/sudoers.d/{username}), add {username} ALL=(ALL) NOPASSWD: ALL, and verify with sudo -i.
  • Error executing an ssh command — make sure the sudo utility is installed on the computer.
  • Incorrect SSH key format / wrong passphrase — confirm you can connect to the secret with the uploaded private key via the Connection Manager.
  • Connection failed for an unknown reason (for example, ProxyException) — verify credentials and test over SSH.
  • Bash is not installed — verify Bash for the connecting user (command -v bash), install it if missing (needs sudo), or add standard paths to PATH and ~/.profile if installed but not found.

Account Discovery

Create and run Linux Discovery rules.

WMI & PowerShell scanning

The equivalent setup for Windows Computer Discovery.