256 Technique 37: Evaluating Your Network Security with Nessus

In this technique, we show you how to use Nessus to evaluate your network security. It’s a great tool that’s easy to use, and the time you save by finding security loopholes before the hackers do will definitely justify the time spent investigating your network security.

Getting Up and Running with Nessus

Setting up Nessus is a matter of a few simple steps. Before you can use Nessus, you need to do the following:

1. Satisfy its dependencies by installing the other programs that Nessus needs to run.

2. Compile and install the Nessus files.

3. Create a user identity.

4. Create an SSL certificate to ensure that the

Nessus transactions are all handled securely on your system.

Follow along, and you’ll be up and running in no time!

Installing programs Nessus needs to run

Nessus has a couple of prerequisites — you need to have GTK (the Gimp Toolkit) installed on your system, as well as the sharutils RPM package. If you’ve installed the GNOME desktop environment, GTK is included. If not, you need to install it.

You can install GTK from your distribution media:

1. Open a terminal window and gain superuser privileges with the su command. Then move to the directory containing the RPM packages.

2. Type the following command and press Enter:

# rpm -Uhv gtk2-version.rpm

You also need the sharutils package, which is included with most Linux distributions.

3. To install sharutils, type the following command and press Enter:

# rpm -Uhv sharutils-version.i386

After sharutils installs, you’ve satisfied the dependencies for the Nessus program.

Using Synaptic to download a Nessus RPM package and install the dependencies is a definite timesaver. Check out Technique 19 for information about Synaptic.

Installing Nessus

Now that the program dependencies have been met, you’re ready to download and install Nessus. To download the latest version of Nessus for your system, follow these steps:

1. Open a Web browser and surf to

www.nessus.org/download.html

2. Click the link to the most recent copy of Nessus for UNIX-compatible computers.

You’re taken to a download page.

3. On the download page, scroll down to find The

Easy and Less Dangerous Way section.

4. Click the link to the server nearest to you.

5. When the new window opens, click the link for the nessus-installer.sh file.

6. Save the file to your home directory.

7. When the file is done downloading, close the download manager and the browser window.

You’ve downloaded the files, and now you need to compile and install Nessus. Fortunately, the kind programmers at Nessus have provided a pretty decent setup tool. To install Nessus, follow these steps:

The RPM for GTK installs.

Getting Up and Running with Nessus 257

1. Open a terminal window and give yourself superuser privileges with the su command.

2. Move to your home directory, type the following command, and press Enter:

# sh nessus-install.sh

The Nessus Installation Script opens, as shown in Figure 37-1.

•Figure 37-1: The Nessus Installation Script window.

3.Press Enter to continue.

The installation script begins extracting the archives and setting up shop.

4.When prompted, press Enter to accept the default location for the Nessus installation.

5.Confirm the installation with another press of the Enter key when prompted.

Nessus begins compiling the libraries and configuring the sources for your system. You may see a few warnings go by — don’t worry about them too much — they’re for the authors of the code to watch.

6.When Nessus prompts you to build libraries, answer y.

You see a window confirming that the Nessus installation is finished, as shown in Figure 37-2.

• Figure 37-2: The Nessus Installation: Finished window.

You have only a couple more steps to go before you’re ready to run Nessus. You still need to add a user and create an SSL certificate for the program.

Adding a user to Nessus

In the wrong hands, Nessus can make life miserable for a system administrator. Although most people use Nessus to scan their own networks, Nessus can be used to discover (and, to a small extent, exploit) vulnerabilities in other computers. To minimize the chances that abuse originates from your computer, Nessus keeps its own user database. Before you can use Nessus, you need to add a user and create a password:

1. Enter the following command:

# /usr/local/sbin/nessus-adduser

The Nessus Add User script starts. The questions are fairly simple and quick.

2. The script prompts you for a login. Type your user name and press Enter.

The script prompts you for a means of authentication.

3. Type pass to use password authentication or cert to use certificate authentication.

258 Technique 37: Evaluating Your Network Security with Nessus

4. Press Enter to accept the default (password) and continue.

You’re prompted to enter the login password.

5. Enter a good password (one that’s easy to remember but hard to guess).

You’re prompted to enter a set of rules for the user. Just accept the default (an empty set) and move on to Step 6.

6. Press Ctrl+D to continue.

You’re asked to confirm the entries for the new user — glance through the summary to make sure everything looks correct.

7. Press Enter to continue.

You’re done creating a user in Nessus. The last step in the setup process is creating a certificate. See the next section for details.

Generating a certificate

After you add a user for the Nessus security tool, you need to generate an SSL certificate. The Nessus server sends the SSL certificate to your Nessus client so you know that you’re connected to the real server and not someone impersonating your server for dastardly purposes. (See Technique 45 for more details on how SSL certificates safeguard your system.) To generate the server certificate, follow these steps:

1. Still at the command line, start the Nessus certificate generator by typing the following command and pressing Enter:

# /usr/local/sbin/nessus-mkcert

The answers to the following questions are used to create the security certificate.

First, you’re prompted for the CA certificate lifetime (in days).

2. Press Enter to accept the default of 1460 days, or enter another length of time.

You’re prompted for the server certificate lifetime.

3. Press Enter to accept the default.

4. Enter an appropriate, two-letter country code and press Enter when you’ve decided on a location code.

The default is France.

5. Enter your state or province and press Enter.

6. Enter your city and press Enter.

7. Enter your organization name and press Enter.

The questions are done, and your monitor should be displaying a window confirming that your SSL certificate has been created (see Figure 37-3).

8. Press Enter to exit the nessus-mkcert program and return to the command line.

• Figure 37-3: The new SSL certificate has been created.

Using Nessus to Scan

Your Network

After you download, install, and set up Nessus, add your user account, and create the SSL certificate, you’re ready to scan your network for vulnerabilities. The graphical interface makes Nessus quick to use and fairly intuitive. You’ll be scanning in no time!

Using Nessus to Scan Your Network

259

You need to do the setup and installation only the first time you run Nessus. After that, you just start the daemon and the user interface each time you want to scan your system.

Starting the daemon and the interface

Nessus is a client/server program. Before you can scan other machines on your network, you need to start the Nessus daemon. To start the daemon, follow these steps:

1. Type the following command and press Enter:

#/usr/local/sbin/nessusd -D

2.To start the user interface, type this command and press Enter:

#/usr/local/bin/nessus

The Nessus Setup window opens, as shown in Figure 37-4.

•Figure 37-4: The Nessus Setup window.

3.Enter your Nessus login and password in the appropriate fields in the setup window, and then click Log In.

After validating your password, Nessus opens a dialog, offering you choices about your level of security.

4. View and approve the certificate to continue.

Nessus moves you to the Plugins tab of the Nessus Setup window.

A Warning dialog opens, warning you that volatile plug-ins have been disabled (see Figure 37-5).

• Figure 37-5: A fairly ominous-looking warning dialog.

By default, Nessus disables dangerous plug-ins that may crash the computer you scan. The warning that you see is telling you that your security audit won’t be complete without enabling the plug-ins that are a threat to your system.

If you enable the dangerous plug-ins, you may crash the target system. Are you feeling lucky today?

5. Click OK to continue.

On the Plugins tab, you see a list of the plug-ins that are currently installed on your system. They are grouped according to component type in the top frame of the window, as shown in Figure 37-6.

6. In the Plugin Selection area, highlight one of the types to display a list of the plug-ins that make up that component in the lower part of the window.

Use the scroll bar to cruise through the list. You can see that the boxes next to the plug-ins that are considered volatile are not checked, as shown in Figure 37-7.

260 Technique 37: Evaluating Your Network Security with Nessus

• Figure 37-6: The Plugins tab of the Nessus Setup window.

• Figure 37-7: The Nessus Setup window with volatile plug-ins.

7. Hover the mouse pointer over the dangerous plug-in’s warning icon (the little yellow yield sign with the ! on it) to display a tooltip that tells you what might happen to your system if you invoke this plug-in (see Figure 37-8).

•Figure 37-8: Check out the warnings.

8.Click the yield sign to display a more graphic explanation of the problems you may encounter if you enable the plug-in (see the example in Figure 37-9).

• Figure 37-9: The complete explanation.

		Using Nessus to Scan Your Network	261
	We don’t recommend enabling dangerous	Enable All but Dangerous Plug-ins: Don’t
	plug-ins unless you have a specific security	enable the plug-ins that might cause problems
	need. Be sure not to probe someone else’s	on the target systems.
	machine with a dangerous plug-in enabled	Disable All: Disable all the plug-ins for a
	because some of the plug-ins can crash the
		minimal scan.
	remote machine.
	9. Highlight a plug-in in the list box at the bottom	Upload Plugin: Upload any plug-ins that you
		write to the Nessus server.
	of the window to display a more complete
	explanation of the specific security threat it’s	For a good starting place, click the Enable All
	designed to combat (see Figure 37-10).	but Dangerous Plugins button. That way, you
		avoid spending time fixing system corruption

until you’ve done some preliminary scans for loose security. Save the risky endeavors for Fridays, before slow weekends, after a good solid backup.

11. Click the Target Selection tab to select the machine that you want to test. Enter the host name (or IP address) in the Target(s) field and click the Start the Scan button.

The scan opens another window, where progress bars chart the progress of the scan, as shown in Figure 37-11. When the scan is complete, the original window and a window with the results of the scan appear on your desktop. Now, you need to interpret those results, which we discuss in the next section, “Reading the grim results.”

• Figure 37-10: Information about the plug-in.

10. Across the middle of the Plugins tab are four buttons, indicating the plug-ins you’d like to apply to your scan. Choose to

Enable All: Enable all the plug-ins currently on your system.

• Figure 37-11: The scan in progress.