ssh
| Arg | Description | Type |
|---|---|---|
| secret | The name of a secret to use. | string |
| username | The username to use to log into the remote system. | string |
| password | The password to use to log into the remote system. | string |
| private_key | A private key to use to log into the remote system instead of a password. | string |
| hostname | The hostname to log into. | string |
| hostkey | A base64 encoded host key. If specified we reject connections that do not present this host key. | string |
Required permissions: NETWORK
Description
Access a remote system’s filesystem via SSH/SFTP.
This accessor allows accessing remote systems via SFTP/SSH. This is
useful for being able to search remote systems where it is not
possible to run a Velociraptor client directly on the endpoint. For
example, on embedded edge devices such as routers/firewalls/VPN
servers etc.
To use this accessor you will need to provide credentials via the SSH_CONFIG scope variable:
LET SSH_CONFIG <= dict(hostname='localhost:22',
username='mic',
private_key=read_file(filename='/home/user/.ssh/id_rsa'))
SELECT OSPath FROM glob(accessor="ssh", globs="/*")Notes
- hostname must have a port after the column.
- You can provide a password instead of a private key via the
password parameter to the
SSH_CONFIG - The private_key parameter must contain an unencrypted PEM encoded SSH private key pair.
- The hostkey parameter is a base64 encoded SSH host key. When it is specified, connections to a remote system that does not present that exact host key are rejected. When it is not specified, the host key presented by the remote system is written to the query log instead. A hostkey provided by the secret takes precedence over the hostkey parameter.
It is more convenient to use the secrets support in 0.72 to manage these credentials.