An authenticated scan is a vulnerability testing measure performed from the vantage of a logged-in user. The quality and depth of an authenticated scan depends on the privileges granted to the authenticated user account. The following table lists the recommended settings for creating a designated account on different operating systems (OSes). See Creating Credentials for information about creating credentials for authenticated scans in USM Anywhere.

Escalation Options for Authenticated Scans by OS

Operating System	Methods and Credentials	Escalation
Linux	SSH Program to securely log into another computer over a network, execute commands in a remote machine, and move files from one machine to another through Secure Copy (SCP). password or private key authentication	sudo, su
Windows	Microsoft Windows username and password through Microsoft Windows Remote Management (WinRM)	None

Requirements for Linux

You must have the following on the Linux host to perform an authenticated scan:

• The OpenSSH server installed
• Network connectivity between the USM Anywhere Sensor and the SSH port on the Linux host

Installing the OpenSSH Server

Refer to your Linux distribution vendor documentation for instructions on how to install and configure the OpenSSH server:

• Red Hat: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/deployment_guide/s2-ssh-configuration-sshd

• Fedora: https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators-guide/infrastructure-services/OpenSSH

• Ubuntu:https://help.ubuntu.com/community/SSH/OpenSSH/Configuring

• Debian: https://wiki.debian.org/SSH

• FreeBSD: https://www.freebsd.org/doc/handbook/openssh.html

Requirements for Windows

For Microsoft Windows hosts, USM Anywhere uses Windows Remote Management (WinRM) to perform authenticated scans. Therefore, you need to have the following items on the Windows machine:

• WinRM version 2.0 or later.

• PowerShell version 5.1 or later. USM Anywhere performs some tests prior to running the authenticated scans to make sure that the scans can succeed. These tests require PowerShell 5.1 or later to be installed on your machine.

• Port 5985 open on your firewall. WinRM listens for HTTP traffic at port 5985 by default. Make sure that your firewall allows incoming connections through this port.

• The Windows Management Instrumentation (WMI) service enabled. WinRM supports WMI classes and operations. It also leverages WMI to collect data about disks, network adapters, services, or processes in your environment.

  Note: Permitting WMI access over the Distributed Component Object Model (DCOM) network is not necessary to perform authenticated scans for USM Anywhere.

In addition, using the Group Policy Editor, go to Computer Configuration\Administrative Templates\Windows Components\Windows Remote Shell, and make these changes:

• Enable Allow Remote Shell Access.
• Set the MaxConcurrentOperationsPerUser parameter to at least 3, ideally 10 or 15.
• Set the MaxMemoryPerShellMB parameter to 1024.

See Microsoft Documentation for more information on WinRM parameters.

Creating a Windows Admin Account

AT&T Cybersecurity recommends that you create a designated admin account solely for the authenticated scans rather than using an established admin account or a guest account. The most important aspect about Windows credentials is that the account used to perform the scans should have privileges to access all required files and registry entries, which in many cases means administrative privileges.

When creating such an account, you must keep in mind the following:

• This account needs to be able to create temporary files and temporary registry values.
• This account must have remote and local logon rights. See Setting Log on Locally and the Security Policy for more information.

• If using Active Directory (AD), assign user rights to either the Remote Management Users group or the Administrators group because only these two groups can log in through WinRM. This authentication uses sAMAccountName, which is limited to 20 characters.

• When configuring network access policy for this account, select Classic: Local Users Authenticate as Themselves.

• If your machine is joined to a domain, a local account won't be able to log in. In this case, you must add a new registry named LocalAccountTokenFilterPolicy:

  Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

  Value Name: LocalAccountTokenFilterPolicy

  Type: DWORD

  Value: 1

See Microsoft Documentation for a better understanding of Windows authentication for remote connections.

Setting Log on Locally and the Security Policy

USM Anywhere enables you to add a WinRM credential. The account you use to log on to the target system must have remote and local logon rights.

To set the local logon rights1 These instructions may vary depending on your Windows version.

1. Select Start > All Programs > Accessories > Run, and then enter gpedit.msc to open the Local Group Policy Editor.

   

2. In the console tree, select Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment.

   

3. Click Allow Log on Locally to open its properties.

   

4. Assign the rights to your user.
5. Click OK.
6. Repeat these steps for Allow log on through Remote Desktop Services.

Enabling Remote Registry on an Asset

USM Anywhere requires that the Windows Remote Registry service is enabled on every asset you intend to scan. While the scan will run without Remote Registry enabled, it will be an incomplete scan as some definitions may not be evaluated.

Enabling Remote Registry on an Asset

1. Open the Control Panel on the asset you intend to scan.

2. Select Administrative Tools.

3. Select Services.

4. Right-click the Remote Registry Service, and then select Properties.

5. Under Startup Type, use the drop-down menu to select Automatic.