How do I manage multiple authentication credentials in a scan profile?

This article describes how to add, reuse, edit, and remove authentication credentials for Linux/Unix and Windows within a scan profile. A single profile can hold multiple credentials for the same operating system, so you can cover assets with different authentication requirements without maintaining separate profiles.

Add a new credential

1. Log in to Security Center.
2. In the main navigation bar, click Assessments > Profiles.
3. Create a new network scan profile, or select an existing one to edit. 
4. In the profile menu, click Authentication. 
5. Under Linux/Unix auth or Windows auth, click Add credentials.
6. Click New to create a credential, or select an existing authentication record to reuse it.
7. Enter a Record name to identify the credential.
8. Enter the Port to be used for authentication. Otherwise, the standard port 22 is used for Linux/Unix. 
9. Select an Authentication method:
   • Password. Requires password authentication to be turned on for the SSH service.
   • Private key. Requires an SSH-authorized RSA private key.
   • BeyondTrust PasswordSafe. Retrieves credentials directly from your BeyondTrust integration.
10. Enter the credentials required for the method you selected.
11. Click Save changes.
12. Done!

Edit or discard changes to a credential

1. Open the scan profile and click Authentication.
2. Select the credential record you want to edit.
3. Update the fields as needed.
4. Click Save changes to apply the update, or Discard changes to cancel.

Remove a credential

1. Open the scan profile and click Authentication.
2. Select the credential record you want to remove.
3. Click Delete permanently.

How many times is each credential tried?

Each credential in the scan profile is tried once per host. All credentials are tried on every host, even after one of them works. The scan then uses the credential with the highest access level for the rest of the scan.

If none of the credentials work on a host, the scan tries one of them again. This makes sure the failed login shows up in the scan results, along with all the usernames that were tried.

How does the scan choose which credential to use?

When more than one credential works on a host, the scan uses the one with the most access, in this order:

Linux and Unix (SSH)

1. Root access.
2. A user in the sudo group.
3. Any user that can log in.

Windows (SMB)

1. Access to the admin share (ADMIN$).
2. Access to the remote registry.
3. Any user that can log in.

Can I set the order of the credentials?

No. The order of the credentials in the scan profile doesn’t decide which one is used. Order only matters when two working credentials have the same access level. In that case, the scan uses one of them.