Hello list
I am fighting with the SSH local checks, I cannot figure out if they are
working or not. Is there some kind of indicator that will tell me?
I am running with nessus 2.1.3
I have made the private and public key. The public key is copied onto the
remote server that I want to scan, ~/.ssh/authrozied_keys
.ssh = chmod 0700
authrozied_keys = chmod 0600
My pirvate key is here, /home/morten/keys/nes
My public key is here, /home/morten/keys/nes.pub
The test scan user is ?roffel?
when I do ssh -i /home/morten/keys/nes -l roffel <remote server> I am asked
for the password(hejsa) for the nes key, which is typed ? and I am logged
in.
I get the following in my /var/log/auth.log on the remote server.
sshd[23274]: Accepted publickey for roffel from x.x.x.x
Okay, so I know the key works, that?s a good thing.
Now to the nessus part.
I have this in my config.
SSH settings[file]:SSH public key to use : = /home/morten/keys/nes.pub
SSH settings[file]:SSH private key to use : = /home/morten/keys/nes
SSH settings[password]:Passphrase for SSH key : = hejsa
SSH settings[entry]:SSH user name : = roffel
I have made my config with the update-nessusrc2.32 script by George Theall.
/home/morten/update-nessusrc-2.32 -f "FreeBSD Local Security Checks,Gain
root remotely,General" /home/morten/hosts/remote_server
I run nessus like this.
nessus -c /home/morten/hosts/remote_server -q localhost 1241 nesmorten
nesmorten /home/morten/ip/remote_server
/home/morten/results/remote_server.html
It runs fine, but I cannot determine if nessus makes local checks or not.
In my /var/log/auth.log on the remote server I get:
Oct 15 10:19:28 wuss sshd[23740]: Did not receive identification string from
x.x.x.x
Oct 15 10:19:54 wuss sshd[23743]: Did not receive identification string from
x.x.x.x
Oct 15 10:20:03 wuss sshd[23746]: Did not receive identification string from
x.x.x.x
Oct 15 10:20:28 wuss login: pam_authenticate(): conversation failure
Oct 15 10:20:28 wuss login: 1 LOGIN FAILURE FROM x.x.x.x
Oct 15 10:20:28 wuss login: 1 LOGIN FAILURE FROM x.x.x.x, dos
In my remote_server.html there is no sign of nessus have made localchecks.
As (http://www.nessus.org/doc/local_reports.png)
Thanks in advanced.
Morten Kallesøe.
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus
