--- sourceDocument: Yokohama IT Operations Management sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management Release : - yokohama ft:locale : - en-US ft:publication_title : - Yokohama IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Privileged SSH commands for probe-based discovery # Privileged SSH commands for probe-based discovery {#ariaid-title1} * Release version: Yokohama * * Updated January 30, 2025 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Privileged SSH commands for probe-based discovery This content details the privileged SSH commands used by ServiceNow Discovery probes during horizontal discovery, which require elevated privileges to execute on target systems. It emphasizes the need for proper configuration of sudo permissions to allow these commands to run without passwords, facilitating smooth discovery without manual intervention. Show full answer Show less It also highlights security considerations, such as the MID Server's lack of SSH host key validation, recommending the exclusive use of SSH keys or certificates for authentication and limiting sensitive data exchange. The configuration of NOPASSWD in sudoers is essential for these elevated commands. ## Key Details for ServiceNow Customers * **User Context:** Commands assume a user named `disco`; customers must substitute their actual user and verify command paths match their systems. * **Sudo Configuration:** Because sudo commands do not work with private key credentials directly (no password prompt), the `NOPASSWD` option must be added for specific commands in the sudoers file to enable passwordless elevated access. * **Security Note:** MID Servers do not validate SSH host keys, so customers should avoid transmitting sensitive credentials over these SSH sessions and rely on SSH key authentication only. ## Privileged Commands by Operating System The document provides categorized lists of critical privileged commands along with example sudoers entries for different operating systems: * **HP-UX:** `adb` for CPU speed and memory information. * **Linux:** Commands like `dmidecode` (hardware info including motherboard serial), `fdisk` (disk and size info), and `multipath` (MPIO device mappings). * **Linux and Solaris:** `dmsetup` for low-level volume inspection. * **All UNIX versions:** `lsof`, `netstat`, `ss` for process and network connection details; `oratab` to locate Oracle Home and pfile. * **Solaris-specific:** Commands such as `iscsiadm` (iSCSI IQNs), `fcinfo` (WWPNs), `prtvtoc` (disk partition info), `ps` and `pgrep` for process information, and `pfiles` for socket-related data. Special instructions include installing the `ucb` utility on Solaris 11 due to the deprecated use of `/usr/ucb/ps` which Discovery requires. ## Practical Implications * By configuring sudoers with appropriate NOPASSWD privileges for these commands, ServiceNow Discovery probes can run necessary elevated commands seamlessly during discovery. * This setup enables comprehensive hardware, process, network, and storage discovery across various UNIX and Linux platforms. * Ensuring correct command paths and user permissions tailored to your environment is critical for successful discovery execution. * Awareness of MID Server security limitations guides customers to secure their SSH configurations and minimize risk. These tables display the SSH commands run by Discovery probes during horizontal discovery. These SSH commands require elevated privileges to run. ## Operating system commands requiring elevated rights {#discovery-ssh-command-require-priv__section_of3_xh3_ytb} These examples assume that the user name is Disco. Substitute the actual user name and verify that the paths for the commands match the paths on the system. Note: Sudo commands don't work with private key credentials, because there's no password to supply to the sudo command. A solution is to add the NOPASSWD option to the sudo configuration. For example, you might enter: `disco ALL=(root) NOPASSWD:/usr/sbin/dmidecode,/usr/sbin/lsof,/sbin/ifconfig`. For information on commands that don't require elevated rights, see [Non-privileged SSH commands during probe-based discovery](https://servicenow-prod.fluidtopics.net/2r4DfPWh_GyitJ0xhfbELg "These tables display the SSH commands run by Discovery probes on target devices during horizontal discovery. These SSH commands don’t require elevated privileges to run."). For information on commands used by Service Mapping during the top-down discovery, see [Service Mapping commands requiring a privileged user](https://servicenow-prod.fluidtopics.net/KmX~uDsV3RoqnUbrW~2SFA "Service Mapping uses commands requiring elevated rights to discover and map Unix-based hosts in your organization. In addition to configuring necessary credentials, configure servers in your organization to allow Service Mapping to run these commands with elevated rights.") and [Service Mapping commands not requiring a privileged user](https://servicenow-prod.fluidtopics.net/PWerd39b5nEL~pJPadH4lQ "Most of commands utilized by Service Mapping for discovery and mapping do not require elevated rights."). ## SSH key not validated {#discovery-ssh-command-require-priv__section_ldx_lhc_w2c} When the MID Server connects to a system, the MID Server doesn't perform host key validation against that system and so treats it as untrusted. If an attacker performs a man-in-the-middle attack and redirects the traffic to a malicious SSH service, the attacker can intercept or modify any data sent over the connection. Therefore, limit any sensitive information exchanged between the MID Server and the target SSH server. Only use keys or certificates for SSH authentication, and avoid sending system credentials. Configure NOPASSWD in the sudoers file for the required privileged commands. {#discovery-ssh-command-require-priv__table_fsp_m5r_52c__entry__2} | Command | Purpose | |-|-| | adb | Gathers CPU speed and memory. /etc/sudoers line example: `Disco ALL=(root) /usr/bin/adb` | [Table 1. HP-UX] {#discovery-ssh-command-require-priv__table_fsp_m5r_52c} {#discovery-ssh-command-require-priv__table_t32_t5r_52c__entry__2} | Command | Purpose | |-|-| | dmidecode | Gathers several pieces of information about the hardware, including the serial number embedded within the motherboard. /etc/sudoers line example: `Disco ALL=(root) /sbin/dmidecode` | | fdisk | Gathers the disks and size information on the system. /etc/sudoers line example: `Disco ALL=(root) /usr/bin/fdisk -l` | | multipath | Gathers device mappings for MultiPath Input Output (MPIO). /etc/sudoers line example: `Disco ALL=(root) /usr/bin/multipath -ll` | [Table 2. All Linux] {#discovery-ssh-command-require-priv__table_t32_t5r_52c} {#discovery-ssh-command-require-priv__table_fjp_z5r_52c__entry__2} | Command | Purpose | |-|-| | dmsetup | Examines a low-level volume. /etc/sudoers line example * `Disco ALL=(root) /usr/bin/dmsetup table *` * `Disco ALL=(root) /usr/bin/dmsetup ls` {#discovery-ssh-command-require-priv__ul_pnb_1vr_52c} | [Table 3. Linux and Solaris] {#discovery-ssh-command-require-priv__table_fjp_z5r_52c} {#discovery-ssh-command-require-priv__table_sqb_fvr_52c__entry__2} | Command | Purpose | |-|-| | lsof | Determines the relationship between processes and the connections being made to the system. /etc/sudoers line example: `Disco ALL=(root) /sbin/lsof` | | oratab | Grants read access to the oratab file for locating the Oracle Home and pfile. | | netstat | Determines the relationship between processes and the connections being made to the system. /etc/sudoers line example: `Disco ALL=(root) /bin/netstat` | | ss | Determines the relationship between processes and the connections being made to the system. /etc/sudoers line example: `Disco ALL=(root) /sbin/ss` | [Table 4. All UNIX versions] {#discovery-ssh-command-require-priv__table_sqb_fvr_52c} {#discovery-ssh-command-require-priv__table_kzq_jvr_52c__entry__2} | Command | Purpose | |-|-| | iscsiadm | Gets iSCSI qualified names (IQNs). /etc/sudoers line example: `${sudo:iscsiadm list target -S}` | | fcinfo | Gets World Wide Port Names (WWPNs) for ports. /etc/sudoers line example: `${sudo:fcinfo remote-port -sl -p $port}` | | prtvtoc | Reports information about disk partitions. /etc/sudoers line example: `Disco ALL=(root) /usr/bin/prtvtoc` | | /usr/bin/ps | Lists running process. As an alternative to running with root access, add a proc_owner role.sola. /etc/sudoers line example: `Disco ALL=(root) /usr/bin/ps` | | /usr/ucb/ps | Lists running process. As an alternative to running with root access, add a proc_owner role. The use of the `/usr/ucb/ps` command is deprecated as of Solaris 11. Because Discovery requires the use of this command for all Solaris versions, you must install the ucb utility manually on Solaris 11 systems. For instructions, see [KB0564262](https://support.servicenow.com/kb_view.do?sysparm_article=KB0564262). /etc/sudoers line example: `Disco ALL=(root) /usr/ucb/ps` | | pgrep | Gets list of process IDs (PIDs) with socket information. /etc/sudoers line example: `Disco ALL=(root) /usr/bin/pgrep` | | pfiles | For each PID, gets and processes the output for S_IFSOCK. /etc/sudoers line example: `Disco ALL=(root) /usr/bin/pfiles` | [Table 5. Solaris] {#discovery-ssh-command-require-priv__table_kzq_jvr_52c} **Related concepts** * [Discovery commands for probes and patterns](https://servicenow-prod.fluidtopics.net/ATbmi05od6rcXEGKXzCwZw "Discovery commands are used for both probe and pattern-based discovery to access configuration items (CIs) in your environment.")