Prepare the host and the network

Goal

Prepare, for each Scout probe, a suitable machine and a network that lets it talk to RECON, so the installation succeeds on the first attempt and your security systems do not block the scan.

Video chapters

Prerequisites

• The list of network segments to analyse: you need one probe per VLAN or subnet.
• One Linux machine (physical or virtual) per probe, connected to the segment it will analyse.
• Root or sudo access on that machine.
• The ability to change outbound firewall rules, or the contact details of whoever manages them.

What the probe does on your network

The probe only talks to RECON outbound, but inside your network it produces scan traffic. During a scan it runs:

• ARP and ICMP sweeps to find devices;
• TCP connections to the most common ports, up to 1,000 per host;
• mDNS and NetBIOS queries to learn device names;
• SMB, SSH, HTTP and TLS checks to identify systems and services.

On every internal scan the probe also runs two kinds of active checks:

• Four read-only exploit verification checks, always on and not switchable: Zerologon, ProxyLogon, ProxyShell and SMBGhost. They verify whether a system is exposed in a non-destructive way: they write no data and do not change the state or configuration of the systems they check.
• A default-password test, on by default: the probe tries a short list of well-known credentials on SSH (up to 31 pairs), FTP (up to 11), MySQL, Microsoft SQL Server and PostgreSQL, and uses read-only commands to check whether Redis, MongoDB, Elasticsearch and Memcached answer without authentication. RECON has no switch to turn it off.

Steps

1. Prepare one machine per probe

   A small dedicated virtual machine is enough. The Orizon deployment guide gives a minimum of 1 vCPU, 2 GB of RAM and 8 GB of disk, and recommends 2 vCPUs, 4 GB of RAM and 16 GB of disk. The probe software itself needs little disk space: the headroom matters mostly for RAM during scans.

2. Check the operating system

   You need Linux with systemd on a 64-bit x86 or 64-bit ARM processor. On the machine, run:

   systemctl --version
   uname -m

   Copy

   The first command must print the systemd version; the second must return x86_64 or aarch64. Windows, macOS, distributions without systemd and 32-bit systems are not supported; the deployment guide also rules out Docker and Podman containers.

3. Allow outbound HTTPS to RECON

   In the firewall, allow only outbound HTTPS on port 443 to recon.orizon.one. Nothing inbound is needed: no port forwarding, no public IP, no VPN. Allow the hostname rather than a fixed IP address, because the addresses behind the name can change.

4. Add the probe to your security exceptions

   If you run IDS, IPS or NAC systems, add every probe to their exceptions; otherwise they can block the scan and leave the results incomplete. Do the same for the SSH lockout rules described above.

5. Test the connection to RECON

   From the machine, run:

   curl -I https://recon.orizon.one

   Copy

   The response must start with an HTTP 200 status line, for example HTTP/2 200. If no response comes back, the installer cannot download the probe software.

Result

The machine is ready when:

• systemctl --version shows systemd and uname -m returns x86_64 or aarch64;
• curl -I https://recon.orizon.one answers with HTTP 200;
• the firewall allows only outbound HTTPS to recon.orizon.one;
• the probe is on the exception lists of your IDS, IPS, NAC and SSH lockout rules.

Troubleshooting

• The installer stops with "Linux required", "systemd required" or "Unsupported". The machine is not Linux, has no systemd, or uses an architecture other than x86_64 and ARM64: use a different machine.
• The installer stops with "Root required (use sudo)". Run the install command as root or with sudo.
• curl does not answer or times out. The firewall is usually blocking recon.orizon.one, often because of a rule based on a fixed IP address: allow the hostname instead.
• The scan finds fewer devices than expected. An IDS, IPS or NAC may be blocking the probe, or the network sits behind a router. In the scan the network can show as Throttled, Blocked or Unreachable: allow the probe, or install one on that segment.

Related articles