Here is my version of a Nessus Cheat Sheet. This is not meant to be a perfect implementation guideline, just a cheat sheet to get you up and running quickly! There are more advanced features and elements that I do not go into, that you should explore. This Cheat Sheet shows you how to build a one-host client and server setup, though this is not likely to be how you’d do it in production, for reasons of performance, proximity, etc…
By the way, I might be Your Linux Guy, but for this post, I’m assuming that *you* are someone else’s Linux person…. and I’m assuming you already know *why* you would want to install and use Nessus… 😉 This is why I tagged this as “advanced”.
The first thing you need to do is to get the software and install it. I’m not sure where you’ll get it from, but for me it was already in my distro (Opensuse 10.3). You can use your software installer, (apt-get, rpm, whatever) or do as I did:
yast -i nessus-core
(…yast will also install required items nessus-libraries and libnasl)
…but if you’re not using Suse, you may have to get the files directly from Nessus to get it installed. But, at this point, if you were to try:
rcnessusd start
…you’d get a failure, like this:
Starting nessusd
Please create your SSL certificate with nessus-mkcert
…since Nessus needs a certificate for private communication between the daemon and client. Remember, that although we are setting up Nessus here on one machine, it is really designed to be distributed. Anyway, make your certificate with the following command:
nessus-mkcert
…and you should receive a happy message about the CA being created, then the script prompts you through the rest of the certificate creation.
So far, so good. Next, since it is a client-server relationship, you need to create a user ID with which to log in to the server from the client, right? You do that with this command:
nessus-adduser
…and again, you receive happy messages about the user creation, and are prompted through the steps. A small caveat here for first-timers; when the prompt shows:
Authentication (pass/cert) [pass] :
…it means that it wants you to decide whether you want to use the password method OR certificate method (not an SSL cert, but an authentication cert), and you can hit enter to accept the default of “password”. Some people think this is a password creation prompt, and try to type in a password for the user… I did this the first time, myself. That comes next in the prompts only if you choose the password method (which I strongly advise you to do if this is the first time you’re attempting this, especially for the Cheat Sheet).
Next, when you are prompted at the “User rules” summary, just do a ctrl+D to end the dialog. Even in a production environment, you probably don’t want to place constraints in your initial user. However, subsequent users — for example, day-to-day administrators that might be looking for limited scan results or to read scans — should definitely have rules applied to them.
At this point, you could launch the client and log in. But wait! There’s more! You’re going to want to run it with updated plug-ins, right? But at this point, if you tried to update them with:
nessus-update-plugins
…you’d get a 404 error and a warning that you could not retrieve the plugins. This is because the fine people at Nessus want to know that you are using their fine software and their fine updates. Not the *finest* updates, however… no, you have to pay for those. But if you register, you get to use seven-day-old updates for free. Not bad!
So to get that ball rolling, fire up the ‘fox and go to http://66.240.11.101/plugins/ and decide if you want/need the purchasable version of the free version (with 7-day delay). Then click on “Obtain an activation code”. You will get an email with the resulting command and code, for example (one code per registration, and yes, it’s tracked):
nessus-fetch --register <some registration number>
…upon entering this, you get:
Your activation code has been registered properly - thank you.
Now fetching the newest plugin set from plugins.nessus.org...
Your Nessus installation is now up-to-date.
Make sure to call regularly use the command 'nessus-update-plugins' to stay up-to-date
To automate the update process, please visit <http://www.nessus.org/documentation/index.php?doc=cron>
…on a production system, it’s a darned good idea to automate the plugins with cron like they suggest, but that’s up to you. Now, all you really have left to do is to start the daemon with the following commands (the following is on Suse, your distro might be something like /etc/init.d/nessusd start):
rcnessusd stop
rcnessusd start
…and launch the client via the gui or with the command:
nessus
…Now go and enjoy. Log in and teach yourself how to use it. Scan yourself! Scan your friends! Scan your eneMieS! Just don’t scan Your Linux Guy… please….
😉