Collector security
The collector only reads, keeps the SSH key in memory, and needs sudo for one command with exact arguments.
Read only, and nothing installed
The collector installs nothing on the target hosts. It runs one fixed script over SSH, and the script only reads. The script is in the collector binary, so the server cannot change it. A person with access to the server cannot run a command on your servers through the collector.
The SSH keys
The collector gets the private key of a VLAN from the server at the start of each scan. It keeps the key in memory only, and never writes it to disk. The key is lost when the scan ends.
The configuration file has the collector token, and that token can read the keys of all VLANs. Protect the collector machine and the file. Make one token for each collector machine.
The sudoers line
The recommended line lets the SSH user run only one command, with exact arguments:
shellgraph ALL=(root) NOPASSWD: /usr/sbin/ss -tanpH
ss -tanpH shows the TCP sockets with their processes. It does not change anything.
Do not add a wildcard (*) to the line. In sudoers, a wildcard can match spaces. Then the user can add more arguments, and with some arguments a command can write files or start a shell. With exact arguments, the user can run only the line that you allowed.
Without the sudoers line, the collector still works. The host gets the status partial, and the services of other users show as unknown:<port>.
The process command lines
Command lines can contain passwords, for example --password=.... The collector reads them only to tell two processes with the same name apart. It sends a short hash, never the command line. The report and the logs never contain a command line.