nessus(1)

NAME
nessus - client needed to use a nessus server
nessusd - performs a security testing on specified hosts

SYNOPSIS
nessus [-vnh] [-q host port user password target result] [report]
nessusd [-vhd] [-c config_file] [-p port]

DESCRIPTION
nessusd works by portscanning the specified hosts and then by testing known security breaches. It is possible to configure most of the things, but in order to use it properly, we need to use the client for this purpose, nessus
nessus connects to a nessusd server, and then logs in with the appropriate user login and password. The options we can set in the nessus client are:

Nessusd host
    Here we put the stuff to tell nessus where is the nessusd we want to use. We must set here:

•   The host running nessusd

•   The port on which nessusd is listening

•   Our user login

•   And finally our password

Target selection
    Here we set things what do we want to scan. There we can determine:

•   The primary hosts to scan. Those are the hosts nessus will scan first. It can be just one, or several ones, and if so, we must separate them with commas (ie: "host.net.edu,host.moc.com")

•   The maximum number of hosts to scan. It has a meaning because, as we will see right now, nessus can expand the testing through a network or by some others methods, so machines not determined as a primary host could also be tested. There we put a number or, if we don't want a limit, we set it to "Infinity", so it can test all the hosts he finds.

•   There we set what kind of expansion has to be done. The three methods can be combined, and all them are recursive, so if the primary host is A, and through A we see a host B to we must expand, then the same expansion rules applies to B, and if here (on B) we find a C host, the expansion rules will search again in C for a new host to test. Because of this, be careful with expansion options.
    There are three different types of expansion:
    The DNS expansion , which means that nessus will ask the DNS in charge of the domain of the host being scanned for a list of hosts that are down the same domain and will start scanning them as he does with the primary targets (if the host is abc.foo.net, it will find the other machines whithin the same domains, such as defg.foo.net and hijk.foo.net).
    The subnet expansion , that makes nessus test all the hosts in the same subnet as the primary is, and this subnet can be either a class A, B or C (so if the host attacked is 123.123.123.32 and it's a class A subnet, nessus will try to scan the hosts from 123.123.123.1 to 123.123.123.254);
    And last, we've got the NFS expansion , which makes nessus scan the hosts that have Network File System relationship with our target host (it means that if the scanned host, abc.def.org, exports some directory to the machine aei.ou.net, this machine will also be scanned).
    As I mentioned before, all those options are recursive, and nessus will try to expand again through the hosts added by the expansion. Also, those three methods can be combined.

•   Last, we must tell nessus what kind of subnet is the scanned host part of.

Plugins
    There we set the plugins we want to use against the host to be checked, that is, the known security breaches we want the system to be checked against.
    It's very simple, since it's divided into families, such as FTP checks, Sendmail checks, Denial of Service, remote file access, gain root remotely, and so on.
    You can turn a whole family off, or just toggle on or off single security checks.

Scan Options
    Here we can set how to do the scanning. The thigs we can set here are:

•   Set if the host to be checked must be pinged before, to see if it's alive or not. This option should be on if you're performing a check with the subnet expansion option enabled.

•   Then we can determine how will the scan be : Normal or heavy. It is not implemented yet.

•   Here we set the range of ports to be scanned. It can be a single port (21), several ports(21,25), a range of ports (21-100), or several ranges of ports and separate ports (21,25,80-100,1024,6000-8000).

•   Then we can set the maximum number of threads the server will launch for this scanning. The server launches several threads to do differnt things at the same time, this number indicates the maximum number of threads to launch.

•   Last, the remote file access plugin family, as well as some other checks, will try to obtain a file from the host being checked. There we must tell nessus which will be that file.

User
    Here there are the e-mail of the user, and the rules that the user has got. The e-mail that appears here is used by some checks that try to mail something to an e-mail address, and the user must set this address to his own. The rules will be explained a little bit later, while explaining the nessusd configuration files.

Now, we need to configure nessusd so we can connect to our nessusd server. The first thing to do is to run nessusd. It'll create three files called
/etc/nessusd.conf
/usr/local/share/nessus/nessusd.rules
and
/usr/local/share/nessus/nessusd.users.
The first file, nessusd.conf , defines where do the users and rules files are, and the set the defaults for a user using the nessus client. It is plain text and fairly easy to understand. Most of the options there can be modified by the nessus client.
The file nessusd.users sets the users allowed to connect to this nessus server, and also specify the personal rules for every single user. It has three fields, the user name, the password (it's not encrypted) and the rules. The three fields are separated by a space, and the users are separated by a semicolon. It should look something like that:
foo pass y:*;
where "foo" is the user name, "pass" is the password to use, and "y:*" is the default rule for this user.
The file nessusd.rules sets the default rules for all users. Rules are like a filter to don't test hosts you don't want to, even if they're found by the expansion options. Basically, a rule consists:
LETTER:PATTERN
where LETTER can be either n,y and N. n means that you DON'T want to scan the hosts that fit with pattern, y means that you DO want to scan the hosts that fit with the pattern and N means that you ABSOLUTELY DO NOT want to scan the hosts that fits the pattern. The pattern will be a text string, with the * and ? wildcards admitted. So the rules
n:*
y:*.foo.org
N:ppp*.foo.org
will mean : 'do not test any commputer except those in the foo.org domain, and even though, don't test the hosts that start with 'ppp' in this domain'. Easy, isn't it?
Once an attack has finished, a report window will pop up, and there you'll see the several hosts scanned, and into every host there will be all the open ports they've got, and with a red or black circle those who had a possitive response to some of the tests. The red means high risk, the black means medium or low risk.

OPTIONS

common arguments

-v  Displays the version number

-h  Displays the command line help nessus specific arguments

-n  Runs the nessus client without showing any of the pixmaps

-q host port user target result
    Runs in silent mode. Host is the host running nessusd, port is the port on which nessusd is listening, user is the user to log in as, target is the host to scan, and result is the file where the generated report is to be saved.

report
    If we supply an additional existing report file name, nessus will open the report and display it.

nessusd
    specific arguments

-c config_file
    Specify the configuration file to use. The default is /etc/nessusd.conf

-p port
    Specify the port to listen on. The default is 3001*

FILES
/etc/nessusd.conf - the nessusd configuration file
/usr/local/share/nessus/nessusd.messages - the nessusd log file
/usr/local/share/nessus/nessusd.users - the users database
/usr/local/share/nessus/nessusd.rules - the nessusd rules
/usr/local/share/nessus/plugins - the plugins folder
$HOME/.nessusrc - the client configuration file

BUGS
If you find some bug, please mail it to
Renaud Deraison <deraison@worldnet.fr> or report it to the Nessus mailing list <nessus@list.nessus.org>. More details at http://list.nessus.org.

OTHER INFOS
The canonical place to find Nessus info is at http://www.nessus.org. The unstable versions of Nessus are at http://www.nessus.org/wip.

AUTHOR
Renaud Deraison.