Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

100

|

Chapter 3: Hardening Linux and Using iptables

Nessus’s client component, nessus, can connect to and authenticate against the

nessusd server either with a standard username and password scheme (which is the

method I’ll describe momentarily) or via a challenge-response scheme using X.509

certificates. Don’t be afraid that the username/password method is weak; if you’ve

compiled OpenSSL into Nessus (on both your client and server systems), your logon

session will be encrypted.

Furthermore, you can use the same system as both nessus client and nessusd server,

in which case each session’s authentication and subsequent scanning data will never

leave your local system (with the exception of the scan itself, which of course will

connect to various “target” hosts).

Once you’ve connected to a Nessus server, you’re presented with a list of “plug-ins”

(vulnerability tests) supported by the server and a number of other options. You may

also choose to run a “detached” scan that can continue running even if you close your

client session; the scan’s output will be saved on the server for you to retrieve later.

Nessus also supports a Knowledge Base, which allows you to store scan data and use

it to track your hosts’ security from scan to scan (e.g., to run “differential” scans).

Once you’ve configured ...