Introduction

The Filesystem Scanner Plugin discovers cryptographic assets (certificates, keys, and keystores) stored on remote Linux systems by connecting via SSH. It recursively scans specified directories, identifies all cryptographic assets, and extracts comprehensive metadata for inventory and compliance purposes.

This plugin is useful for organizations that: - Maintain cryptographic assets across multiple Linux servers - Need to inventory certificates, keys, and keystores distributed in custom locations - Must track certificate expiration, key algorithms, and file ownership across their infrastructure - Run compliance or security audits requiring a complete picture of cryptographic assets

The plugin connects to target systems using SSH (password or key-based authentication), scans specified directories recursively, and returns all discovered assets with rich metadata including ownership, permissions, algorithms, and timestamps.

Features

• Cryptographic Asset Discovery: Finds 25+ file types including PEM certificates, SSH keys, Java keystores, PKCS#12 containers, GnuPG keyrings, and NSS databases
• Flexible SSH Authentication: Supports both password-based and private key authentication
• Recursive Directory Scanning: Scans specified directories with configurable depth limits (1-20 levels)
• Rich Metadata Extraction: File ownership, permissions, modification times, encryption status, algorithm detection
• Smart Path Optimization: Automatic deduplication prevents redundant scanning of overlapping paths
• Resilient Retry Logic: Automatic recovery from transient SSH failures with exponential backoff (3 attempts, 500ms delay)
• Contextual Error Handling: Detailed error messages with diagnostic information for troubleshooting