Skip to tutorial content
Rate module Not yet rated

Linux and Unix: SSH, sudo and Least Privilege

4 min read
On this page

In this lesson, you will learn:

  • SSH password vs SSH key
  • Why some commands need sudo
  • Least privilege for Linux

🔁 Quick look back: Last time: Windows: WMI and PowerShell Access. You learned how Windows discovery works and what svc-snow-disc needs.

1 The Problem: Root Access Is Too Much, No sudo Is Too Little

Two bad options for the Linux account:

  • Root access: Discovery could change anything.
  • No sudo: some commands fail, and data is missing.

🎯 The problem: Root access is too much, and no sudo is too little.

👉 The fix: Use a normal account with an SSH key and a short sudo list for the commands that need it.

Cards: SSH key, sudo list, least privilege.
Figure 1. How SNWR set up Linux access.

2 Why sudo

Some details, like hardware serial numbers, need extra rights to read. sudo lets a normal user run a named command with those rights.

Key term: SSH key

A pair of files used instead of a password. The private key stays in ServiceNow.

Key term: sudo

Lets a user run a specific command with extra rights.

3 In the credential

  • Type: SSH private key.
  • User: snowdisc.
  • The private key, stored encrypted.
  • sudo is used for the commands that need it.

4 Project Clear View: How We Implemented It

📍 Situation: Priya built snowdisc with the tested sudo list.

🧭 Decision: Create the SSH key credential and test it.

🛠️ Steps we took:

  1. Priya generated the key pair and placed the public key on the servers.
  2. Created SNWR Linux Discovery (SSH private key) on snwrtest.
  3. Tested against snwr-mail-01 and snwr-db-01.
  4. Checked serial numbers came back.

✅ What we verified:

  • Login and all commands worked on RHEL 8 and 9.
  • Serial numbers were returned.

📁 Evidence: SNWR Linux Discovery in the credential register.

5 Quick recap

  • Use an SSH key for Linux, not a password.
  • sudo lets named commands run with extra rights.
  • Keep the sudo list short and read-only.
  • Never use root.

6 Check yourself

Think of your answer first. Then tap to check.

1 Why an SSH key instead of a password? Show answer

Keys are harder to guess and easy to rotate.

2 Why does Discovery need sudo on Linux? Show answer

Some details, like serial numbers, need extra rights to read.

3 Where does the private key live? Show answer

In the ServiceNow credential, stored encrypted.

Nice work! SNWR’s Linux credential works. 🎉
Next up: SNMP v1, v2c and v3 Credentials

Was this lesson helpful?

Have a question or doubt?

Ask here and get help from instructors and fellow learners.

0 / 300

Only logged-in learners can post.