About the Unix Dissolvable Agent (Qualys Shell)
Qualys Shell is a small executable that is pushed to a Unix/Linux system during a scan and automatically removed after the last scan of the asset completes. Qualys Shell size is approximately 500KB to 2MB, depending on the target platform, and the time to upload and launch has a negligible impact on the overall scan duration.
The primary purpose of Qualys Shell is to enable secure, efficient file downloads from Unix targets for vulnerability detection and compliance assessments. It provides direct access to configuration files and databases required for comprehensive security analysis.
How does Qualys Shell work?
At scan time, Qualys Shell is uploaded to Unix/Linux devices over the existing SSH connection to collect data, and once the scan is complete, Qualys Shell removes itself completely from target systems. All traces of Qualys Shell are removed automatically when the scan on the host is complete, including removal of the uploaded binary file.
Qualys Shell uses a multiplexed binary transfer protocol within the existing SSH connection to retrieve files from the target and download them to the scanner for analysis. Files are opened natively on the target using system-level file operations and transferred as raw binary data. For SQLite databases, the agent acquires read locks using the SQLite locking protocol to ensure data consistency during retrieval.
Impact of Qualys Shell on Scans
Qualys Shell enhances vulnerability detection and compliance control execution by enabling direct access to configuration files and databases on target systems. It uses a multiplexed binary transfer protocol within the SSH connection to retrieve files from the target and download them to the scanner for analysis. Files are opened natively on the target using system-level file operations and transferred as raw binary data, eliminating encoding overhead.
For SQLite databases, the agent acquires read locks using the SQLite locking protocol (PENDING and SHARED locks on specific byte ranges) to ensure data consistency during retrieval. This is critical for 33 Cloud Agent health compliance controls that must query the agent's configuration database to verify proper deployment and settings. The multiplexed channel architecture allows parallel file downloads to the scanner, reducing overall scan duration when multiple controls or vulnerability checks require file access. Binary files are transferred at native size without encoding, efficiently handling configuration files up to ~4MB.
This direct approach eliminates shell interpretation artifacts, terminal escape sequences, and locale-dependent encoding issues, improving accuracy for controls and vulnerability checks that analyze XML, JSON, YAML, and database files across both VM and PA scans.
Impact of Qualys Shell on Target Systems
Qualys Shell has minimal impact on target systems:
- Disk Usage: Temporary ~500KB-2MB file stored in home directory or
/tmpduring scan only - Process: One lightweight background process runs during the scan
- Network: Uses the existing SSH connection — no additional ports required
- Cleanup: Agent self-deletes after scan completes; any stale files are automatically removed after 6 hours
- Security: Temporary binary has restricted permissions (owner-only access, 0700)
- Performance: Minimal CPU and memory usage
When is Qualys Shell Mandatory?
Qualys Shell is mandatory for Cloud Agent Health Controls - 33 compliance checks that verify Qualys Cloud Agent configuration by querying its SQLite database (Config.db). Without Qualys Shell, these controls will report errors stating "SQLite file downloading requires UMLDA."
It is recommended but optional for other controls and vulnerability checks - The scanner can retrieve configuration files using standard shell commands over SSH when Qualys Shell is not available.
CIDs that require Qualys Shell
| Sr. No. | CID | Title |
| 1 | 18031 | QPC Qualys Cloud Agent - List of manifest types (Unix) |
| 2 | 18033 | QPC Qualys Cloud Agent - Ownership and permissions of manifests (Unix) |
| 3 | 18034 | QPC Qualys Cloud Agent - Ownership and permissions of FIM manifests (Unix) |
| 4 | 18035 | QPC Qualys Cloud Agent - Ownership and permissions of Agent logs (Unix) |
| 5 | 18036 | QPC Qualys Cloud Agent - Status of FIM process on the asset (Unix) |
| 6 | 18037 | QPC Qualys Cloud Agent - Status of FIM Module on the agent (Unix) |
| 7 | 21430 | QPC Qualys Cloud Agent - Status of manifest LastEventChangelistUpload - PolicyCompliance (Unix) |
| 8 | 21431 | QPC Qualys Cloud Agent - Status of manifest LastEventScan - PolicyCompliance (Unix) |
| 9 | 21432 | QPC Qualys Cloud Agent - Status of manifest ScanIntervalSeconds (Unix) |
| 10 | 21433 | QPC Qualys Cloud Agent - Status of CPU THROTTLE on the agent (Unix) |
| 11 | 21434 | QPC Qualys Cloud Agent - Status of SUSPENDSELFPATCH on the agent (Unix) |
| 12 | 21436 | QPC Qualys Cloud Agent - Status of IOC ENABLED on the agent (Unix) |
| 13 | 21438 | QPC Qualys Cloud Agent - Status of PATCH ENABLED on the agent (Unix) |
| 14 | 21439 | QPC Qualys Cloud Agent - Status of TRACELEVEL on the agent (Unix) |
| 15 | 21769 | QPC Qualys Cloud Agent - Status of manifest LastEventChangelistUpload - VM (Unix) |
| 16 | 21770 | QPC Qualys Cloud Agent - Status of manifest LastEventScan - VM (Unix) |
| 17 | 21771 | QPC Qualys Cloud Agent - Status of manifest LastEventChangelistUpload - AutoDiscovery (Unix) |
| 18 | 21772 | QPC Qualys Cloud Agent - Status of manifest LastEventScan - AutoDiscovery (Unix) |
| 19 | 21773 | QPC Qualys Cloud Agent - Status of manifest LastEventChangelistUpload - MiddlewarePC (Unix) |
| 20 | 21774 | QPC Qualys Cloud Agent - Status of manifest LastEventScan - MiddlewarePC (Unix) |
| 21 | 21775 | QPC Qualys Cloud Agent - Status of manifest LastEventChangelistUpload - UDC (Unix) |
| 22 | 21776 | QPC Qualys Cloud Agent - Status of manifest LastEventScan - UDC (Unix) |
| 23 | 22157 | QPC Qualys Cloud Agent - Status of CAPI-EventIntervalLastTime on the agent (Unix) |
| 24 | 22158 | QPC Qualys Cloud Agent - Status of CAPI-EventIntervalLastErrorCode on the agent (Unix) |
| 25 | 22159 | QPC Qualys Cloud Agent - Status of CAPI-EventIntervalLastHttpStatus on the agent (Unix) |
| 26 | 22160 | QPC Qualys Cloud Agent - Status of Correlation ENABLED on the agent (Unix) |
| 27 | 22161 | QPC Qualys Cloud Agent - Status of manifest LastEventChangelistUpload - VMPC (Unix) |
| 28 | 22162 | QPC Qualys Cloud Agent - Status of manifest LastEventScan - VMPC (Unix) |
| 29 | 22163 | QPC Qualys Cloud Agent - Status of manifest LastEventChangelistUpload - SCA (Unix) |
| 30 | 22164 | QPC Qualys Cloud Agent - Status of manifest LastEventScan - SCA (Unix) |
| 31 | 22165 | QPC Qualys Cloud Agent - Status of Qualys Agent process on the asset (Unix) |
| 32 | 22166 | QPC Qualys Cloud Agent - Qualys Agent User - ps command (Unix) |
| 33 | 22167 | QPC Qualys Cloud Agent - Status of SudoUser setting in qualys-cloud-agent.conf |
Where is Qualys Shell installed?
Qualys Shell is temporarily stored in one of these directories, depending on the target system configuration:
- Primary:
~/qualys_shell_bin_<random_id>(user's home directory) - Fallback:
/tmp/qualys_shell_bin_<random_id>(if home directory upload fails)
The binary is uploaded with permissions 0700 (owner execute only) and owned by the SSH scan user.
Tell me about secure data transmission
Qualys Shell collects information that is securely transmitted to the scanner appliance using a cryptographically secure protocol. All communication occurs over the existing SSH-encrypted connection. No additional network ports are opened on the target system. The information is encrypted and integrity-protected and is not stored on the scanner appliance except in memory while the information is processed. The information is discarded securely as soon as it is no longer needed.
How to enable Qualys Shell for Unix scans
To enable Qualys Shell for Unix/Linux authenticated scans:
- Navigate to Scans > Authentication > New > Operating Systems > Unix.
- Configure the Record Title and Login Credentials.
- In the left pane, select Qualys Shell.
- Select Enable Qualys Shell. Based on your requirement, select Use syslog.
- If you want Qualys Shell activity logged to the target's syslog, in Log Facility select the required option.
- In the IPs tab, configure the target host IPs.
- Save the authentication record.
Supported Platforms
| Linux | Kernel 2.6 - 4.x | x86 (32-bit), x86_64 (64-bit) |
| FreeBSD | 8 - 11 | x86 (32-bit), x86_64 (64-bit) |
| NetBSD | 5 - 7 | x86 (32-bit), x86_64 (64-bit) |
| OpenBSD | 4.9 - 6.0 | x86 (32-bit), x86_64 (64-bit) |
All binaries are statically linked and require no external library dependencies on the target system.
Additional Resources
About the Dissolvable Agent (Windows)
Understanding the Windows Dissolvable Agent
CIDs that Require the Dissolvable Agent or MLDA (Windows)