Bill Mercer wrote:
I doubt this is possible, and I personally would not want such an option, because it's likely to cause major chaos in a lot of environments. There's a request to allow manual merging.
I believe your best option will be to update your scanning targets or scanning credentials to exclude these windows machines.
Out of curiosity, what is the reason for implementing openssh on windows clients instead of using existing remote management tools? Seems like an unnecessary extra risk to me.
Updating the scanning targets could work, but we have a myriad of devices across the org so it isn't really an option for us to omit certain credentials since we do a lot of scanning by IP range.
Also, we are using SSH with public key auth and Kerberos via gssapi as opposed to options like WinRM and psexec which are commonly targeted by malicious threats. So as long as your AD user is authorized via private key, it's as simple as doing an "ssh -K [hostname]"