Skip to content
DeviceQuest DeviceQuest DeviceQuest Docs User Documentation

Documentation

Scan credentials

Store the logins that scanners and cloud connectors use, see where each one is used, and rotate or remove them.

Overview

Scan credentials hold the accounts, keys and community strings that DeviceQuest uses to log in to your devices, hypervisors and cloud accounts. Secrets are encrypted at rest in the control-plane vault, and after you save them the page shows only their metadata. Use the Credentials tab of Scanning to add credentials, change them, and see which schedules and cloud connectors depend on them.

Screen tour

  1. Search credentials…: filters by name.
  2. Type: a menu that filters by credential type. Each type shows how many credentials you have of it.
  3. Select: tick one or more credentials to act on them together. The header checkbox selects every credential in the list.
  4. Delete selected: deletes all selected credentials after you confirm. The bar also shows how many are selected.
  5. Used by: how many schedules and cloud connectors use the credential, for example 1 schedule or 1 schedule · 2 cloud connectors. Hover to see the schedule names. Unused means nothing references it.
  6. Edit and Delete: change or remove one credential.

Each row also shows the credential Name with its ID (click the copy icon to copy the ID), the Type, when it was Created, and its Status: Active or Inactive. The toolbar reminds you that Secrets are never displayed after creation.

Create a credential

  1. On the Credentials tab, click New Credential.
  2. Enter a Display name, for example Production SNMP v2c. Schedules and results show this name.
  3. Under Type, choose the credential type. The type is fixed once the credential is created.
  4. Fill in the fields for that type. See Credential types.
  5. Click Create credential.

The new credential appears in the list as Active and Unused until a schedule or cloud connector uses it.

Credential types

DeviceQuest has two groups of credential types. Host types log in to devices and hypervisors during scans. Cloud types let cloud connectors read your cloud accounts.

TypeGroupUsed byDefault port
SNMPHostSNMP scans of network devices161
SSHHostSSH scans of Linux, Unix and BSD hosts22
WMIHostWMI scans of Windows hosts, over WinRM5985
VMwareHostVMware vCenter and ESXi scans443
ProxmoxHostProxmox (hypervisor) scans8006
AWSCloudAWS cloud connectors—
AzureCloudAzure cloud connectors—
GCPCloudGCP cloud connectors—

Every host type also has a Port field. Leave it empty to use the default port above, or enter a port between 1 and 65535 for services on a non-standard port.

SNMP

  1. Display name: the name shown in schedules and results.
  2. Type: the credential type. Use the arrow keys to move between types.
  3. Community string: the shared SNMP v2c secret, for example the read-only community configured on your switches. Click the eye icon to show or hide it while typing.
  4. Port: the SNMP UDP port. Default 161.

SNMP credentials work with SNMP v2c and SNMP v3:

  • SNMP v2c uses the Community string.
  • SNMP v3 uses a user-based login instead of a community string. Choose version 3 and enter:
    • the SNMP v3 user name,
    • the security level: no authentication and no privacy, authentication only, or authentication and privacy,
    • the authentication protocol (MD5, SHA, SHA-224, SHA-256, SHA-384 or SHA-512) and authentication password,
    • the privacy protocol (DES, AES-128, AES-192 or AES-256) and privacy password.

Use read-only access. The scanner only reads system, interface, host-resource and inventory information.

SSH

  1. Username: the account the scanner logs in as. Required.
  2. Password: the account password. Leave it empty when you log in with a key.
  3. SSH key path: the path, on the scanning host, of a private key file, for example /keys/scanner_ed25519.
  4. Port: the SSH port. Default 22.

Use a dedicated, non-root account that can read system information and list installed packages and services.

WMI

WMI credentials have the same fields as SSH, without SSH key path: Username, Password and Port (default 5985, or 5986 for WinRM over HTTPS). The account needs remote WMI and WinRM access on the target, which local administrators have by default.

VMware

  1. Username: the vCenter or ESXi account, for example [email protected]. A read-only role is enough.
  2. Password: the account password.
  3. Port: the vCenter or ESXi HTTPS port. Default 443.
  4. Skip TLS certificate verification: tick only for self-signed ESXi or vCenter certificates. This turns off protection against man-in-the-middle attacks.

When you edit a VMware credential, the stored Skip TLS certificate verification setting is kept unless you change the checkbox.

Proxmox

  1. Proxmox: the credential type for Proxmox VE nodes and clusters.
  2. API token ID: the token ID in the form user@realm!tokenname, for example scanner@pve!devicequest.
  3. API token secret: the token’s secret.
  4. Username: for a username and password login, used in place of an API token.
  5. Password: the password for that login.
  6. Port: the Proxmox VE API port. Default 8006.
  7. Skip TLS certificate verification: tick only for self-signed Proxmox certificates.

A Proxmox credential logs in to the Proxmox VE API of a node or cluster. Enter either:

  • an API token: the token ID in the form user@realm!tokenname, for example scanner@pve!devicequest, and the token secret, or
  • a username and password, for example scanner@pve.

Set the Port when the API listens on a port other than the default 8006. Tick Skip TLS certificate verification only for self-signed Proxmox certificates. Give the account or token the PVEAuditor role, which is read-only.

AWS

  1. Access key ID: the IAM access key ID, for example AKIAIOSFODNN7EXAMPLE.
  2. Secret access key: the matching secret.
  3. Region: the default region the connector queries, for example eu-central-1. Required.
  4. Show secrets: shows or hides the secret fields while you type.

Create the key for a read-only IAM user or role, for example one with the ReadOnlyAccess policy.

Azure

  1. Directory (tenant) ID: your Microsoft Entra directory ID. This is the Azure tenant, which is different from your DeviceQuest tenant.
  2. Client ID: the application (client) ID of the service principal.
  3. Client secret: the service principal’s secret.

Give the service principal the Reader role on the subscriptions to discover.

GCP

  1. Service account JSON: paste the whole service account key file.

Give the service account the Viewer role on the projects to discover.

Edit a credential

  1. Click Edit on the credential’s row.
  2. Change the Display name, the Port or any secret.
  3. Click Save changes.

Secret fields are empty when the modal opens and show Leave blank to keep current. A field you leave empty keeps its stored value, so you can rename a credential or change its port without re-entering the password. To rotate a secret, type the new value. The type is fixed once the credential is created.

Schedules and cloud connectors that use the credential pick up the change from their next run.

Delete credentials

  1. Click Delete on one row, or tick several credentials and click Delete selected.
  2. Read the dialog. It tells you how many schedules and cloud connectors use the credentials:
    • Scans that referenced a deleted credential fall back to another active credential of the same type if one exists. Otherwise they fail with No credential.
    • Cloud connectors that use a deleted credential stop synchronizing until you give them a new credential.
  3. Click Delete credential (or Delete N credentials).

Fields

FieldTypesRules
Display nameAllRequired.
TypeAllRequired. Fixed once the credential is created.
Community stringSNMP v2cRequired on create.
API token ID, API token secretProxmoxUse an API token, or a username and password.
UsernameSSH, WMI, VMware, Proxmox, SNMP v3Required on create, except for Proxmox with an API token.
PasswordSSH, WMI, VMware, ProxmoxOptional for SSH when a key is used.
SSH key pathSSHOptional. Path to a private key on the scanning host.
PortHost typesOptional. 1–65535. Empty uses the default port.
Skip TLS certificate verificationVMware, ProxmoxOptional. Off by default.
Access key ID, Secret access key, RegionAWSAll required on create.
Directory (tenant) ID, Client ID, Client secretAzureAll required on create.
Service account JSONGCPRequired on create.

Keyboard shortcuts

KeyAction
← → ↑ ↓In the Type selector of the modal, choose the previous or next credential type.
↓On the Type filter button, open the filter menu.
↑ / ↓, Home / EndIn the open filter menu, move between types.
Enter / SpaceIn the open filter menu, apply the focused type.
EscClose the filter menu.