Stethoscope Documentation

Transcription

1 Stethoscope Documentation Release Andrew M. White Sep 01, 2017

2

3 Contents: 1 Frontend Prerequisites Installation Running Configuration Testing Building Backend Prerequisites Installation Troubleshooting Configuration Testing Running Login API Nginx Configuration Running Plugins Data Sources Google JAMF LANDESK bitfit Duo Notifications and Feedback Notifications from Elasticsearch Feedback via REST API Logging and Metrics Logging Accesses to Elasticsearch Logging Metrics to Atlas Event Transforms VPN Labeler i

4 4.5 Device Transforms Regular Expression Filter Manufacturer from MAC Address Batch Plugins Incremental Writes to Elasticsearch POSTing a Summary via REST Endpoint Troubleshooting Login Managers OpenID Connect License 25 6 Indices and tables 27 ii

5 Stethoscope is a web application that collects information from existing device data sources (e.g., JAMF or LAN- DESK) on a given user s devices and gives them clear and specific recommendations for securing their systems. An overview is available on the Netflix Tech Blog. Contents: 1

6 2 Contents:

7 CHAPTER 1 Frontend You can run (and develop) the frontend code without running the backend services at all, and rely on the example data files in stethoscope/ui/public/api. We use Facebook s create-react-app scripts for easy, zero-configuration development, testing, and building. If you would like to develop against real data, you can run the backend (locally or in Docker) and proxy API requests to the backend. This is handled automatically by create-react-app, and you can change the proxy address in stethoscope/ui/package.json. Note: For API authentication to work with the proxy, you ll need to generate a token that will be loaded into your development environment. If you have installed the Python dependencies, you can do this with make dev-token. If you have Docker installed, you can do this with make dev-token-docker. Prerequisites To run the frontend directly, without Docker, you ll need recent versions of node (version 6.4+) and npm (included with node). Installation From the project root, run make install-develop-ui. This will install the npm packages, start a development server, and load the site in your default browser. Running After your node dependencies are installed, you can run the development server with make develop-ui. (This is equivalent to running cd stethoscope/ui && npm start.) 3

8 Configuration The frontend can be customized by adding to stethoscope/ui/config.json. These settings are applied after loading stethoscope/ui/config.defaults.json, so you can reference that file for the defaults. You can customize things like the application name, the name of your organization, and your contact address without changing any of the javascript source files. Alternatively, you can provide a JSON string via the REACT_APP_CONFIG environment variable. This is handy if you want to have build-specific overrides, or if you want to add configuration options without forking the main repo. In addition to the values in config.defaults.json, you can set the following: contact slacklink GATrackingId (for Google Analytics tracking) Testing create-react-app includes a script that will automatically watch for changes and rerun relevant tests. You can run this with make test-js-watch. (This is equivalent to running cd stethoscope/ui && npm test.) If you d like to run all tests and exit, run make test-js. Building To build the static assets, you can run make react-build. (This is equivalent to running cd stethoscope/ui && npm build.) This is only necessary if you want to build new static assets for a local Python backend, or if you want to check the gzipped file size of the generated js and css resources. These build files are not checked in to the project. If you would like to build these resources without a local node development environment, you can run make docker-build-ui to generate the files using Docker. (This happens automatically when you run docker-compose up.) 4 Chapter 1. Frontend

9 CHAPTER 2 Backend The backend itself consists of two major components: a login server and the API server. The login server is a Flask application which handles authentication for the user, generating tokens for the browser s use when it hits API endpoints. The API server is a Klein application. Prerequisites The Python-based backend has a few basic prerequisites: A compatible operating system (we develop on OS X and deploy on Ubuntu) CPython 2.7+ or CPython 3.4+ (we develop and deploy with 2.7 but test against 3.4+) FreeTDS (if using the LANDESK plugin). Installation: With Homebrew on Mac: brew install freetds On Debian-based systems: sudo apt-get install freetds-dev Development headers for libffi. Installation: With Homebrew on Mac: brew install libffi On Debian-based systems: sudo apt-get install libffi-dev Installation We recommend using a Python virtualenv. Once you ve set up an environment for Stethoscope, you can install the backend and the bundled plugins easily using our Makefile: make develop 5

10 Troubleshooting Python and pyenv If installing on OSX for Python or using pyenv, you may encounter an error (ld: file not found: python.exe; see this issue) while installing Twisted. The workaround is to build a wheel for Twisted under 2.7.8, then install the wheel into the environment: pyenv install pyenv virtualenv stethoscope pyenv install pyenv shell pip wheel --wheel-dir=$tmpdir/wheelhouse Twisted pyenv shell stethoscope pip install --no-index --find-links=$tmpdir/wheelhouse Twisted Errors installing pymssql If you encounter a compilation error installing pymssql, you may need to revert to an older version of FreeTDS via: brew unlink freetds brew install homebrew/versions/freetds091 pip install pymssql Configuration Configuration for the login and API servers is separate, but share the same pattern (a series of.py files loaded via Flask s configuration mechanism). In order (last file taking precedence), the configurations are loaded from: 1. The defaults.py file from the package s directory (e.g., stethoscope/login/defaults.py). 2. An instance config.py file (in the Flask instance subdirectory, which can be changed using STETHOSCOPE_API_INSTANCE_PATH and STETHOSCOPE_LOGIN_INSTANCE_PATH). 3. A file specified by the STETHOSCOPE_API_CONFIG or STETHOSCOPE_LOGIN_CONFIG environment variables. Examples of these are in the config/login and config/api subdirectories. The minimum configuration file needs define only two variables: SECRET_KEY and JWT_SECRET_KEY (see the included instance/config.py file for details). Testing The basic tests can be run via the Makefile: make test Alternatively, to test against multiple versions of Python, first install tox, then run: make tox 6 Chapter 2. Backend

11 Running The backend has two processes which generally need to be running simultaneously: the login server and the API server. Login stethoscope-login runserver -p 5002 API twistd -n web -p class=stethoscope.api.resource.resource 2.5. Running 7

12 8 Chapter 2. Backend

13 CHAPTER 3 Nginx Configuration For Nginx, the supplied nginx.conf sets up the appropriate configuration for running locally out of the repository directory. Essentially, requests for static files are handled by Nginx, requests for non-api endpoints are proxied to port 5002 (to be handled by the login server), and requests for API endpoints are proxied to port 5001 (to be handled by the API server). Running nginx -c nginx.conf -p $(pwd) 9

14 10 Chapter 3. Nginx

15 CHAPTER 4 Plugins Plugins provide much of the functionality of Stethoscope and make it easy to add new functionality for your environment and to pick-and-choose what data sources, outputs, etc. make sense for your organization. Configuration for each plugin is provided in your instance/config.py file by defining a top-level PLUGINS dictionary. Each key in the dictionary must be the name of a plugin (as given in setup.py, e.g., es_notifications) and the corresponding value must itself be a dictionary with keys and values as described in the sections below for each individual plugin. For example, your config.py might contain: PLUGINS = { 'bitfit': { 'BITFIT_API_TOKEN': '...', 'BITFIT_BASE_URL': ' }, } The above example configures only the bitfit plugin. Note: Login managers plugins are configured differently; see Login Managers for more details. Note: Many plugins involve communicating with external servers. Each of these respects an optional TIMEOUT configuration variable which controls the timeout for these external connections. If not set for a particular plugin, the top-level configuration variable DEFAULT_TIMEOUT is used. If this is not set, no timeout will be enforced. Data Sources Google Google provides: 11

16 Detailed device information on ChromeOS, Android and ios devices via their mobile management services. Account information. Credentials There are a few steps required to set up API access to Google for your domain. 1. Use the setup tool to create a Google API Console project and enable Admin SDK access for that project. At the Add credentials to your project stage, click the link for service account then create service account. Check the boxes for Furnish a new private key and Enable G Suite Domain-wide Delegation. Download the service account s credentials as a JSON file; this is what will be used as the content for GOOGLE_API_SECRETS below. 2. You should now see row in the table under Service accounts for the newly-created service account. Click the corresponding View Client ID link and record the numeric client ID from the subsequent dialog. 3. Follow the instructions here to authorize the service account for the specific APIs needed. Stethoscope s defaults are in GOOGLE_API_SCOPES below. 4. You will also need a user account (see GOOGLE_API_USERNAME, below) in your G Suite domain which has API access to the Admin SDK. This can be granted via the normal G Suite Admin Console. Configuration GOOGLE_API_SECRETS: Service account credentials for Google. GOOGLE_API_USERNAME: Name of the account on whose behalf the service account in GOOGLE_API_SECRETS will act. This account must have permissions to access the APIs from which you re gathering data; currently, this is just the Admin SDK. GOOGLE_API_SCOPES: List of scopes required (depends on what information you re using from Google). The list in the example below covers the scopes we use. Example 'google' : { 'GOOGLE_API_SECRETS': { "client_id": "<redacted>", "private_key": "-----BEGIN PRIVATE KEY-----<redacted>-----END PRIVATE KEY-----\n", "token_uri": " "client_ ": "<redacted>", "client_x509_cert_url": "<redacted>", "private_key_id": "<redacted>", "type": "service_account", "auth_uri": " "auth_provider_x509_cert_url": " "project_id": "<redacted>" }, 'GOOGLE_API_USERNAME': "my-service-account@example.com", 'GOOGLE_API_SCOPES': [ " " " " " 12 Chapter 4. Plugins

17 } ], JAMF JAMF provides detailed device information on OS X systems. Configuration The JAMF plugin requires the following configuration variables: JAMF_API_USERNAME: Username for interacting with JAMF s API. JAMF_API_PASSWORD: Password for interacting with JAMF s API. JAMF_API_HOSTADDR: JAMF API URL (probably ends with JSSResource). Example 'jamf': { 'JAMF_API_USERNAME': "...", 'JAMF_API_PASSWORD': "...", 'JAMF_API_HOSTADDR': " } Extension Attributes JAMF does not provide enough information out-of-the-box for us to determine the status of all the default security practices. However, we can define Extension Attributes in JAMF to gather the needed information. These scripts are available in docs/jamf_extension_attributes/. Auto-Update We use six extension attributes to gather information about the auto-update settings on OSX. 1 Auto Check For Updates Enabled: This attribute covers the Automatically check for updates setting. #!/bin/bash Listing 4.1: jamf_extension_attributes/1-auto_check_for_updates.sh autocheck=`defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticCheckEnabled` if [ ${autocheck} = 1 ]; then echo "<result>true</result>" elif [ ${autocheck} = 0 ]; then echo "<result>false</result>" else echo "<result>unknown Status</result>" fi 4.1. Data Sources 13

18 exit 0 2 Get New Updates in Background Enabled: Reflects the Download newly available updates in background setting. #!/bin/bash Listing 4.2: jamf_extension_attributes/2-get_new_updates_in_background.sh autodownload=`defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticDownload` if [ ${autodownload} = 1 ]; then echo "<result>true</result>" elif [ ${autodownload} = 0 ]; then echo "<result>false</result>" else echo "<result>unknown Status</result>" fi exit 0 3 Install App Updates Enabled: Covers the Install app updates setting. #!/bin/bash Listing 4.3: jamf_extension_attributes/3-install_app_updates.sh autoupdate=`defaults read /Library/Preferences/com.apple.commerce.plist AutoUpdate` if [ ${autoupdate} = 1 ]; then echo "<result>true</result>" elif [ ${autoupdate} = 0 ]; then echo "<result>false</result>" else echo "<result>unknown Status</result>" fi exit 0 4 Install OS X Updates Enabled: Reflects the Install OS X updates setting. #!/bin/bash Listing 4.4: jamf_extension_attributes/4-install_os_x_updates.sh updaterestart=`defaults read /Library/Preferences/com.apple.commerce.plist AutoUpdateRestartRequired` if [ ${updaterestart} = 1 ]; then echo "<result>true</result>" elif [ ${updaterestart} = 0 ]; then echo "<result>false</result>" else echo "<result>unknown Status</result>" fi exit 0 14 Chapter 4. Plugins

19 5 Install Security Updates Enabled: Reflects the Install security updates setting. #!/bin/bash Listing 4.5: jamf_extension_attributes/5-install_security_updates.sh criticalupdate=`defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist CriticalUpdateInstall` if [ ${criticalupdate} = 1 ]; then echo "<result>true</result>" elif [ ${criticalupdate} = 0 ]; then echo "<result>false</result>" else echo "<result>unknown Status</result>" fi exit 0 6 Install System Data Files Enabled: Reflects the Install system data files setting. #!/bin/bash Listing 4.6: jamf_extension_attributes/6-install_system_data_files.sh configdata=`defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist ConfigDataInstall` if [ ${configdata} = 1 ]; then echo "<result>true</result>" elif [ ${configdata} = 0 ]; then echo "<result>false</result>" else echo "<result>unknown Status</result>" fi exit 0 Firewall The Firewall Status extension attribute can be gathered using the following script: Listing 4.7: jamf_extension_attributes/firewall_status.sh #!/bin/bash fwresult=`/usr/bin/defaults read /Library/Preferences/com.apple.alf globalstate` echo "<result>$fwresult</result>" Remote Login The Remote Login extension attribute can be gathered using the following script: 4.1. Data Sources 15

20 Listing 4.8: jamf_extension_attributes/remote_login.sh #!/bin/sh echo "<result>`/usr/sbin/systemsetup -getremotelogin awk '{print $3}'`</result>" Screenlock The Screen Saver Lock Enabled extension attribute can be gathered using the following script: Listing 4.9: jamf_extension_attributes/screen_saver_lock.sh #!/bin/sh lastuser=`defaults read /Library/Preferences/com.apple.loginwindow lastusername` passwordstatus=`defaults read /Users/$lastUser/Library/Preferences/com.apple. screensaver askforpassword` if [ "$passwordstatus" == "0" ]; then echo "<result>disabled</result>" else echo "<result>enabled</result>" fi Wireless MAC Address By default, JAMF only stores two MAC addresses for each device. However, some systems (e.g., Mac Pros) can have additional MAC addresses. Since we use the wireless MAC address to tie users to devices, we collect it with an additional extension attribute (Wireless Mac Address): #!/bin/sh Listing 4.10: jamf_extension_attributes/wireless_mac_address.sh wifiport=`networksetup -listallhardwareports awk '/Hardware Port: Wi-Fi/,/Ethernet/ ' awk 'NR==2' cut -d " " -f 2` macaddy=`networksetup -getmacaddress $wifiport awk {'print $3'}` echo "<result>$macaddy</result>" LANDESK LANDESK provides detailed device information for Windows systems. Configuration Our LANDESK plugin communicates directly with the LANDESK MSSQL server. It requires the following configuration variables: LANDESK_SQL_HOSTNAME LANDESK_SQL_HOSTPORT LANDESK_SQL_USERNAME 16 Chapter 4. Plugins

21 LANDESK_SQL_PASSWORD LANDESK_SQL_DATABASE Example 'landesk': { 'LANDESK_SQL_HOSTNAME': '...', 'LANDESK_SQL_HOSTPORT': 1433, 'LANDESK_SQL_USERNAME': '...', 'LANDESK_SQL_PASSWORD': '...', 'LANDESK_SQL_DATABASE': '...', }, bitfit bitfit provides ownership attribution for devices. Configuration BITFIT_API_TOKEN: API token from bitfit. BITFIT_BASE_URL: URL for bitfit s API (e.g., Example 'bitfit': { 'BITFIT_API_TOKEN': '...', 'BITFIT_BASE_URL': ' }, Duo Duo provides authentication logs. Warning: Work in Progress The duo plugin currently suffers from a major issue which makes it unsuitable for production use at this time. In particular, Duo s API does not provide a method for retrieving only a single user s authentication logs and the frequency of API requests allowed by Duo s API is severely limited. Therefore, some method of caching authentication logs or storing them externally is required. However, this has not yet been implemented in Stethoscope. Configuration The duo plugin requires the following: DUO_INTEGRATION_KEY: The integration key from Duo. DUO_SECRET_KEY: The secret key for the integration from Duo Data Sources 17

22 DUO_API_HOSTNAME: The hostname for your Duo API server (e.g., api-xxxxxx.duosecurity.com). Values for the above can be found using these instructions. Example 'duo': { 'DUO_INTEGRATION_KEY': '...', 'DUO_SECRET_KEY': '...', 'DUO_API_HOSTNAME': 'api-xxxxxxx.duosecurity.com', }, Notifications and Feedback Stethoscope s UI provides a place for users to view and respond to alerts or notifications. Plugins provide the mechanisms to both retrieve notifications from and write feedback to external data sources. Notifications from Elasticsearch The es_notifications plugin reads notifications (or alerts) for the user from an Elasticsearch cluster so they can be formatted and displayed in the Stethoscope UI. Configuration As with our other Elasticsearch-based plugins, the es_notifications plugin requires the following configuration variables: ELASTICSEARCH_HOSTS: List of host specifiers for the Elasticsearch cluster (e.g., [" example.com:7104"]) ELASTICSEARCH_INDEX: Name of the index to query. ELASTICSEARCH_DOCTYPE: Name of the document type to query. Example 'es_notifications': { 'ELASTICSEARCH_HOSTS': [' 'ELASTICSEARCH_INDEX': 'stethoscope_notifications', 'ELASTICSEARCH_DOCTYPE': 'default', } Feedback via REST API Stethoscope allows users to respond to the displayed alerts in the UI. The restful_feedback plugin tells the Stethoscope API to send this feedback on to another REST API. 18 Chapter 4. Plugins

23 Configuration The only configuration required for the restful_feedback plugin is: URL: The URL to which to POST the feedback JSON. Example 'restful_feedback': { 'URL': ' } Logging and Metrics Logging Accesses to Elasticsearch The es_logger plugin tracks each access of Stethoscope s API and logs the access along with the exact data returned to an Elasticsearch cluster. Configuration ELASTICSEARCH_HOSTS: List of host specifiers for the Elasticsearch cluster (e.g., [" example.com:7104"]) ELASTICSEARCH_INDEX: Name of the index to which to write. ELASTICSEARCH_DOCTYPE: Type of document to write. Example 'es_logger': { 'ELASTICSEARCH_HOSTS': [' 'ELASTICSEARCH_INDEX': 'stethoscope_accesses', 'ELASTICSEARCH_DOCTYPE': 'default', } Logging Metrics to Atlas The atlas plugin demonstrates how one might track errors which arise in the API server and post metrics around those events to an external service. Unfortunately, there is no standard way to ingest data from Python into Atlas, so so this plugin is provided primarily as an example to build upon. Configuration The atlas plugin requires: URL: The URL to which to POST metrics Logging and Metrics 19

24 Example 'atlas': { 'URL': ' } Event Transforms One type of plugins takes as input the merged stream of events from the event-providing plugins and applies a transformation to each event if desired. For example, an event-transform plugin might inject geo-data into each event after looking up the IP for the event with a geo-data service. VPN Labeler We provide an example event-transform plugin which tags an event as coming from an IP associated with a given IP range, e.g., that of a corporate VPN. The vpn_labeler plugin requires the following configuration variable: VPN_CIDRS: An iterable of CIDRs, e.g., [" /24"] (The value of this variable is passed directly to netaddr.ipset, so any value accepted by that method will work.) Example 'vpn_labeler': { 'VPN_CIDRS': [ ' /24', ], } Device Transforms Similarly to event transforms, device transforms take as input a list of devices and modify that list and/or its elements in some way. For instance, one might want to filter out virtual machines from one s devices (as below). Regular Expression Filter This transform filters out devices by searching certain fields in each device s data for strings matching those specified in the configuration: Configuration PATTERN_MAP: A dict mapping fields in the device data (e.g., model) to re patterns. Each field is then searched for the corresponding pattern and a device filtered out if the pattern matches the field value. 20 Chapter 4. Plugins

25 Example To filter out common types of virtual machine: 're_filter': { 'PATTERN_MAP': { 'model': '(Virtual Machine VMware amazon HVM domu)', 'serial': '(Parallels VMware)', }, }, This configures the plugin to filter out devices with a model field matching (via re.search()) the pattern (Virtual Machine VMware amazon HVM domu) or a serial field matching the corresponding pattern. Manufacturer from MAC Address This transform attempts to determine a device s manufacturer from its MAC address(es) and injects the manufacturer s name into the device data. The mac_manufacturer plugin has no configuration variables. Batch Plugins Incremental Writes to Elasticsearch The batch_es plugin writes each user s device records to Elasticsearch incrementally (i.e., as they are retrieved by the batch process). Configuration ELASTICSEARCH_HOSTS: List of host specifiers for the Elasticsearch cluster (e.g., [" example.com:7104"]) ELASTICSEARCH_INDEX: Name of the index to which to write. ELASTICSEARCH_DOCTYPE: Type of document to write. Example 'batch_es': { 'ELASTICSEARCH_HOSTS': [' 'ELASTICSEARCH_INDEX': 'stethoscope_devices', 'ELASTICSEARCH_DOCTYPE': 'default', } POSTing a Summary via REST Endpoint The batch_restful_summary plugin collects all of the data from a run of the batch process and POSTs that data to an external server via HTTP(S). URL: The URL to which to POST summary data Batch Plugins 21

26 Example 'batch_restful_summary': { 'URL': ' } Troubleshooting Stethoscope includes a script to check connectivity between itself and any configured plugins which support connectivity tests. Running stethoscope-connectivity will attempt to verify network connectivity and, in many cases, successful authentication with all configured plugins. Any errors will be printed on the command-line and debug logs written to connectivity.log. --plugins [<plugin name>]+ Restrict connectivity tests to plugins specified by name (the key used in your config.py). --namespaces [<plugin namespace>]+ Restrict connectivity tests to plugins in one of the given namespaces (as defined in setup.py). Login Managers Stethoscope currently has two options for user login. If you leave LOGIN_MANAGER unset (or set to 'null'), Stethoscope won t require a login and anyone visiting the site will be able to visit anyone else s view. Note: The login manager configuration variables should be defined at the top-level of the configuration file (rather than within the PLUGINS dictionary as with other plugins). OpenID Connect The other option is to set LOGIN_MANAGER to 'oidc' (OpenID Connect), which will allow you to use an OIDC provider (like Google) for user login/identity. Configuration The values for these configuration variables will be determined by your OIDC provider: OIDC_AUTHORIZATION_URL OIDC_TOKEN_URL OIDC_USERINFO_URL OIDC_CLIENT_ID OIDC_CLIENT_SECRET These variables define the OIDC callback endpoint(s) which Stethoscope will expose and must be registered with your OIDC provider. They are used to form the URI to which users are redirected after authenticating to the provider. OIDC_CALLBACK_PATHS: Paths for the callback endpoints at Stethoscope (e.g., ['/auth/oidc', '/ auth/oidc/<string: >']). 22 Chapter 4. Plugins

27 OIDC_CALLBACK_URL: External name/ip of your Stethoscope instance (e.g., stethoscope.example. com, or for local development). OIDC_CALLBACK_PORT: External port on which Stethoscope listens (e.g., 5000 in the default configuration provided). OIDC_CALLBACK_SCHEME: URL scheme (either http or https). Example LOGIN_MANAGER = 'oidc' # from OIDC provider OIDC_AUTHORIZATION_URL = ' OIDC_TOKEN_URL = ' OIDC_USERINFO_URL = ' OIDC_CLIENT_ID = '...' OIDC_CLIENT_SECRET = '...' # local settings for the OIDC callbacks; need to be registered with OIDC provider OIDC_CALLBACK_PATHS = ['/auth/oidc', '/auth/oidc/<string: >'] OIDC_CALLBACK_URL = ' ' OIDC_CALLBACK_PORT = 5000 OIDC_CALLBACK_SCHEME = 'http' More information if using Google is available in Google s OIDC Documentation Login Managers 23

28 24 Chapter 4. Plugins

29 CHAPTER 5 License Copyright 2016, 2017 Netflix, Inc. Licensed under the Apache License, Version 2.0 (the License ); you may not use this file except in compliance with the License. You may obtain a copy of the License at < Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an AS IS BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. 25

30 26 Chapter 5. License

31 CHAPTER 6 Indices and tables genindex modindex search 27

32 28 Chapter 6. Indices and tables

33 Index Symbols namespaces [<plugin namespace>]+ stethoscope-connectivity command line option, 22 plugins [<plugin name>]+ stethoscope-connectivity command line option, 22 E environment variable STETHOSCOPE_API_CONFIG, 6 STETHOSCOPE_API_INSTANCE_PATH, 6 STETHOSCOPE_LOGIN_CONFIG, 6 STETHOSCOPE_LOGIN_INSTANCE_PATH, 6 S stethoscope-connectivity command line option namespaces [<plugin namespace>]+, 22 plugins [<plugin name>]+, 22 STETHOSCOPE_API_CONFIG, 6 STETHOSCOPE_API_INSTANCE_PATH, 6 STETHOSCOPE_LOGIN_CONFIG, 6 STETHOSCOPE_LOGIN_INSTANCE_PATH, 6 29