text: A question on behalf of those who are leveragin... | Qualys Community
  A question on behalf of those who are leveraging Authentication Vaults
  Question asked by psaux on Feb 4, 2015
  Latest reply on Feb 5, 2015 by Lino Lopez-Luna
  We are utilizing the Cyber-Ark PIM Suite as our authentication vault for our authentication records. Question being why must we manually add IP's for Unix Authentication records but not for Windows? My assumption is that it has to do with utilizing active directory in Windows auth records. If that is the case, is there a way to have the Unix auth record behave in a proactive way so the process of adding IP's isn't so manual?
  Lino Lopez-Luna Feb 6, 2015 8:48 AM
  "Why must we manually add IP's for Unix Authentication records but not for Windows?"
  That is a great question! It has to do with the level of integration your organization has decided to enforce for *NIX systems. By integration I mean Active Directory. This is an Identity and Access management decision that often stalls the dynamic, automated nature of Qualys, affecting VM team operators to use and maintain individual authentication records in contrast to mass scale automation capabilities available for Windows or AD integrated systems.
  While integration is not an easy task, is a necessary effort to maintain continuous monitoring and awareness of the health state of your network systems but also translates into: significant savings, an effective use of the time for your VM team headcount to focus on enhancing and fine tune detection and remediation processes.
  Here is a link to a comprehensive article written by Gil Kirkpatrick on Linux authentication to AD, from the TechNet Library: https://technet.microsoft.com/en-us/magazine/2008.12.linux.aspx
  It will help you understand what entails and how to propose this decision to your organization.
  In-house or third party integration product? That will depend on: Size, budget, management and your organizations appetite for security.
  Once all your assets are under a unified authentication architecture then the use of service accounts, managed by a third party broker, will enable your team efforts to automate in mass scale discovery and vulnerability detection tasks in your organization.
  Visibility: IT Security988 Views
  Last modified on Feb 4, 2015 7:04 AM
  Jeff Leggett Feb 4, 2015 8:18 AM
  Exactly Domain Authentication takes out the need for managing the IP's. The only solution I am aware of around that know is to use one of the products on the market that lets you manage *IX via AD, like Active Directory Bridging & Authentication | Linux, UNIX, Mac or Group Policy for Linux and UNIX.