> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Linux/Unix discovery

> Scan Linux and Unix hosts over SSH for local accounts and import them into PAM.

Linux/Unix discovery finds the local accounts on your Linux and Unix hosts, so you can import them into PAM as [SSH accounts](https://infisical.com/docs/documentation/platform/pam/accounts/ssh). For how discovery works across every source type, see [Discovery](https://infisical.com/docs/documentation/platform/pam/discovery/overview).

You give the source a list of hosts and one or more SSH accounts to sign in with. Infisical connects to each host over SSH through a [Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md).

> [accordion] How a scan works
>
> 1. Infisical expands each CIDR range into its hosts
> 2. For each host, Infisical first tries the SSH account whose host matches, then tries the other accounts until one signs in
> 3. Infisical reads the host's accounts from `/etc/passwd` and stages each account that has a login shell as an SSH account for that host
>
> If `root` exists on two hosts, Infisical stages two separate accounts. If no account can sign in to a host, the scan reports the host and continues with the others.

## Prerequisites

* A [Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md) that can reach the hosts you want to scan
* One or more [SSH accounts](https://infisical.com/docs/documentation/platform/pam/accounts/ssh) that can sign in to those hosts, using a password, a private key, or a certificate
* The [Product Admin role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md#product-membership) in PAM
* The Connector, Operator, or Admin [role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md#folder-and-account-memberships) on those SSH accounts (Operator or Admin for an account that uses a password)

To scan many hosts, use one SSH account whose key or certificate authority every host trusts.

> [!WARNING]
>
> If an SSH account uses a password, Infisical sends the password to every host that the source scans, including hosts in a CIDR range that you don't control. Use a key or certificate account for scanning.

## Step 1: Create a source

**Step 1**

Go to **Privileged Access Management** > **Discovery** and select **Add Source**.

**Step 2**

Select **Linux/Unix**, then select **Next**.

**Step 3**

Configure the source:

| Field | Description |
| - | - |
| **Name** | A name for the source, such as `corp-servers` |
| **Credential Accounts** | The SSH accounts to sign in to the hosts with |
| **Gateway** | The Gateway or Gateway pool to connect through |
| **Scan Schedule** | **Manual**, **Daily**, or **Weekly** (see [scan schedules](https://infisical.com/docs/documentation/platform/pam/discovery/overview#scan-schedules)) |
| **Targets** | IP addresses, IPv4 CIDR ranges, or hostnames to scan, one per line or separated by commas (the Gateway resolves hostnames) |

Infisical connects to each host on the port of the SSH account it signs in with.

**Step 4**

Select **Add Source**.

## Step 2: Run a scan

On the **Discovery Sources** table, select the options menu on the source's row, then select **Scan Now**. A source can run one scan at a time.

The scan stages only accounts that can sign in. It skips accounts whose shell is `nologin`, `false`, or another shell that doesn't allow a login, which leaves out most system and daemon accounts.

## Step 3: Import accounts

**Step 1**

On the **Discovery Sources** table, select the source.

**Step 2**

On the **Staged Accounts** tab, select the accounts you want, then select **Import Accounts**.

**Step 3**

Select a **Destination Folder** and an **SSH Template**, then select **Import**.

**Step 4**

Go to **Privileged Access Management** > **Accounts**. For each imported account, open the options menu on its row, select **Configure**, and enter its credential on the **Configuration** tab. The scan doesn't read credentials, so you can't connect to an imported account until you enter its credential.

> [!TIP]
>
> Your Unix accounts are in PAM. Anyone with access to the destination folder can launch sessions on them, and each scan of the source stages any new accounts it finds.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.