# Exposure

> Find the ways into your machines that bypass Ironchip: unknown SSH keys, sessions opened outside it, passwordless sudo and open remote access services.

URL: https://docs.ironchip.com/en/pam/administracion/exposicion/

This page explains exposure: the ways into a machine that do not go through Ironchip, as its agent sees them. Use it to close the back doors that would make access control useless. It is for whoever administers the machines.

## Requirements

The [agent](https://docs.ironchip.com/en/pam/administracion/agente/) (osquery) installed on the machine. The agent checks the machine every few minutes.

## View exposure

Go to **PAM > Hosts > Exposure** to see every machine, or open the **Exposure** tab on a resource's page. The **Targets** list also flags high and medium findings.

[Image: Exposure page with each machine, the severity, the finding and when it was checked]

## What it looks for

| Severity   | Finding                                                                                                                  | Systems         | What to do                                                                                   |
| ---------- | ------------------------------------------------------------------------------------------------------------------------ | --------------- | -------------------------------------------------------------------------------------------- |
| **High**   | An account accepts an SSH key that is not the broker's                                                                   | Linux and macOS | Remove the key from `authorized_keys`, or verify it if it belongs to an automated process.   |
| **High**   | Someone is signed in while nobody is connected through Ironchip, or is signed in with an account other than the broker's | All             | Find out who it is and how they got in.                                                      |
| **Medium** | Someone can run `sudo` without a password                                                                                | Linux and macOS | If the machine has the enforcer, it drops to **Info**: Ironchip still decides every command. |
| **Info**   | Who can become root                                                                                                      | Linux and macOS | Check that they are the expected accounts.                                                   |
| **Info**   | How many local administrators there are                                                                                  | All             | Check that they are the expected ones.                                                       |
| **Info**   | A program accepts SSH, RDP, VNC or WinRM on all addresses                                                                | All             | If a firewall only lets the broker in, there is no risk, but the agent cannot see that.      |

The list also shows the machines without an agent (**No agent**), the ones that have not responded yet (**Waiting for the agent**) and the ones with nothing found (**Nothing found**).

## More information

- [Accounts](https://docs.ironchip.com/en/pam/administracion/cuentas/): the account inventory of each machine.
- [Agent on the machines](https://docs.ironchip.com/en/pam/administracion/agente/)