Machine scanning system with distributed credential storage

1. A system, comprising:

one or more hardware processors with associated memory that implement a group of machine scanner nodes that implement a machine scanning system, including a first machine scanner node configured to:

determine that a credential is needed to access a machine to perform a scan of the machine;

determine, based on a credential storage metadata, that the credential is stored in a plurality of portions distributed across multiple machine scanner nodes in the group, including a first portion stored at the first machine scanner node and a second portion stored at a second machine scanner node;

obtain the second portion from the second machine scanner node;

reconstruct the credential using the first portion and the second portion; and

access the machine using the credential to perform the scan of the machine.

2. The system of claim 1 , wherein the group includes at least one machine scanner node that is configured as a storage manager node configured to:

receive the credential and determine that the credential is to be partitioned and distributed among multiple machine scanner nodes in the group;

partition the credential into the plurality of portions including the first and second portions;

assign individual ones of the portions to respective ones of the machine scanner nodes in the group;

send the portions to their assigned machine scanner nodes to be stored by the assigned machine scanner nodes;

update the credential storage metadata to indicate the assigned machine scanner nodes for individual ones of the portions; and

send the credential storage metadata to the assigned machine scanner nodes.

3. The system of claim 2 , wherein:

the storage manager node is configured to compute a checksum of the credential and include the checksum in the credential storage metadata; and

the first machine scanner node is configured to verify the credential after the reconstruction using the checksum.

4. The system of claim 2 , wherein the machine scanning system implements a user console configured to:

receive the credential via a user interface;

select a machine scanner node from the group to act as the storage manage node; and

provide the credential to the storage manager node to be partitioned.

5. The system of claim 2 ,

wherein the credential is stored in a byte array that includes a list of multiple credentials; and

wherein to perform said partition the credential into the plurality of portions, the storage manager node is configured to create a plurality of sub-arrays of non-contiguous bytes from the byte array.

6. The system of claim 5 , wherein the storage manager node is configured to:

create the plurality of sub-arrays to include random bytes from the byte array, wherein the random bytes are selected using a random seed; and

distribute the random seed to the machine scanner nodes in the group.

7. The system of claim 1 , wherein:

the second machine scanner node is configured to encrypt and store the second portion of the credential in an encrypted form; and

the first machine scanner node is configured to decrypt the second portion after obtaining the second portion; and

the encryption and decryption are performed using a pair of asymmetric keys.

8. A method, performed by one or more hardware processors with associated memory that implement a machine scanning system, the method comprising:

maintaining a group of machine scanner nodes; and

performing, by a first machine scanner node in the group:

determining that a credential is needed to access a machine to perform a scan of the machine:

determining, based on a credential storage metadata, that the credential is stored in a plurality of portions distributed across multiple machine scanner nodes in the group, including a first portion stored at the first machine scanner node and a second portion stored at a second machine scanner node;

obtaining the second portion from the second machine scanner node;

reconstructing the credential using the first portion and the second portion; and

accessing the machine using the credential to perform the scan of the machine.

9. The method of claim 8 ,

wherein the group includes at least one machine scanner node that is configured as a storage manager node, and

the method further comprising performing, by the storage manager node:

receiving the credential and determining that the credential is to be partitioned and distributed among multiple machine scanner nodes in the group;

partitioning the credential into the plurality of portions including the first and second portions;

assigning individual ones of the portions to respective ones of the machine scanner nodes in the group;

sending the portions to their assigned machine scanner nodes to be stored by the assigned machine scanner nodes;

updating the credential storage metadata to indicate the assigned machine scanner nodes for individual ones of the portions; and

sending the credential storage metadata to the assigned machine scanner nodes.

10. The method of claim 9 , wherein:

the credential comprises a user identifier and a password; and

the partitioning of the credential includes separating the user identifier and password into distinct portions.

11. The method of claim 9 , wherein the partitioning of the credential generates a number of portions that is equal to a number of machine scanner nodes in the group.

12. The method of claim 9 , wherein the assigning of the portions is performed so that no machine scanner node in the group is assigned more than one of the plurality of portions.

13. The method of claim 9 , wherein the assigning of the portions is performed so that each of the plurality of portions is assigned redundantly at least two of the machine scanner nodes.

14. The method of claim 9 , further comprising:

receiving, via a configuration interface, configuration information specifying a security or availability criterion for storing the credential; and

determining, by the storage manager node, a number of portions of the credential to generate for the partitioning according to the configuration information.

15. The method of claim 8 , further comprising performing, by the machine scanning system:

periodically repartitioning the credential and reassigning portions of the credential to machine scanner nodes in the group.

16. The method of claim 8 , further comprising performing, by the machine scanning system:

detecting a change in node membership of the group, and

in response:

selecting a new storage manager node; and

causing the new storage manager node to repartition and reassign portions of the credential to machine scanner nodes in the group.

17. One or more non-transitory computer-accessible storage media storing program instructions that when executed on or across one or more processors implement at least a portion of a machine scanning system, wherein the machine scanning system implements a group of machine scanner nodes that includes a storage manager node, and the program instructions when executed on or across one or more processors of the storage manage node causes the storage manager node to:

receive a credential to perform a scan of a machine and to determine that the credential is to be partitioned and distributed among multiple machine scanner nodes in the group;

partition the credential into a plurality of portions;

assign individual ones of the portions to respective ones of the machine scanner nodes in the group;

send the portions to their assigned machine scanner nodes to be stored by the assigned machine scanner nodes;

update a credential storage metadata to indicate the assigned machine scanner nodes for individual ones of the portions; and

send the credential storage metadata to the assigned machine scanner nodes.

18. The one or more non-transitory computer-accessible storage media of claim 17 , wherein the program instructions when executed on or across the one or more processors cause the storage manager node to encrypt the portions before sending the portions to their assigned machine scanner nodes.

19. The one or more non-transitory computer-accessible storage media of claim 17 , wherein:

the credential is stored in a byte array; and

to partition the credential into portions, the program instructions when executed on or across the one or more processors cause the storage manager node to create a plurality of sub-arrays of non-contiguous bytes from the byte array.

20. The one or more non-transitory computer-accessible storage media of claim 17 , wherein the program instructions when executed on or across the one or more processors cause the storage manager node to assign the portions so that each of the plurality of portions is assigned redundantly to at least two of the machine scanner nodes.