On Wed, Jan 25, 2006 at 02:05:45PM -0600, Brent Stackhouse wrote:
1. I've got multiple rc files I'm using for different scan targets but
I'm not clear on how to update them with the latest plugins.
Specifically, I'm using cron jobs to execute scripts that use the
NessusClient with various options. Does the -p option have any impact
on this? I saw some "update-nessusrc" script floating around but
wondered if there was a better/newer way to deal with this issue.
The "-p" option to nessus or NessusClient queries a server for a list of
plugins currently available there. The trick is then to figure out which
ones to enable and which to disable. And this is where the
update-nessusrc scripts come in:
Edgeos' python-based update-nessusrc.py
http://www.edgeos.com/resources/
My perl-based update-nessusrc
http://www.tifaware.com/perl/update-nessusrc/
Mine probably has some additional functionality not in Edgeos' script,
but grab them both and judge for yourself.
2. Has anyone experienced issues in Nessus 3.x with "knocking over"
devices by enabling all plugins _with_ Safe Checks enabled?
This isn't something specific with Nessus 3.x or even Nessus itself.
Enabling safe checks disables plugins that _try_ to crash a service /
host, but it's no guarantee that, say, a device with a
poorly-implemented TCP/IP stack will stay up when you port-scan it.
This topic comes up periodically on the list. There was even talk
several years ago of compiling a list of problemmatic equipment; eg, see
http://mail.nessus.org/pipermail/nessus/2003-December/msg00060.html
There are some techniques you can follow to minimize the likelihood of
crashes, and the above also references a post by Renaud that outlines
some of them.
By the way, you may want to look at Tenable's NeVO product --
http://www.tenablesecurity.com/products/nevo.shtml -- whether to replace
or complement Nessus. It's a passive scanner that detects flaws simply
by monitoring network traffic.
George
--
theall@tenablesecurity.com
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus
