Add an Endpoint
You add a Linux server through an SSH gateway. There is no script to run and no agent to install. The gateway logs in with an existing sudo account and sets the machine up for you.
Before you start, you need:
- a gateway that is Online (see Gateways and Onboard a Gateway),
- a network path from that gateway to the server, and
- a sudo account on the server, with its password or private key.
Open Targets → Endpoints and click Add endpoint. Choose Linux server (via SSH gateway). This is the default.
The Add Endpoint dialog has three screens: Endpoint, Set up the machine and Verify.
1. Endpoint
| Field | What to enter |
|---|---|
| Name | A name for the server, for example web-01.prod |
| Address | The address the gateway uses to reach it, for example 10.0.0.4 |
| Gateway | The gateway that will reach this server |
| Sudo username | An existing account on the server that can use sudo, for example ubuntu |
| Authenticate with | Password or Private key, then the credential itself |
| Description | Optional |
root can only be used with a private key. Private keys with a passphrase are not supported.
The sudo account and its credential are stored in the vault.
2. Set Up the Machine
The gateway logs in as the sudo account and:
- installs the AuthNull service account,
- creates the keys directory and installs the helper, and
- runs the first account scan. The accounts it finds appear under Local Users.
Every password that exists on the machine is then replaced with a random one and stored in the vault. From then on it is rotated every 30 days. See Passwords.
The sudo (admin) account is never rotated. The gateway needs it to manage the machine, so its credential stays as you entered it.
You can close the dialog at any point. The work carries on in the background.
3. Verify
The last screen shows that the endpoint is set up.
With no matching policy, sessions to this host are refused. Adding an endpoint grants nobody access.
The final button opens Policies with a new policy already filled in with this host and its gateway.
Next Steps
- Policies: decide who may connect.
- Local Users: see the accounts the scan found.
- Endpoint Actions: rescan, change the gateway or the admin credential, or decommission.