November 1st, 2003 09:54 AM
Introduction to Nessus
Source: http://www.securityfocus.com/infocus/1741 for complete tutorial, follow the link.
Nessus is a great tool designed to automate the testing and discovery of known security problems. Typically someone, a hacker group, a security company, or a researcher discovers a specific way to violate the security of a software product. The discovery may be accidental or through directed research; the vulnerability, in various levels of detail, is then released to the security community. Nessus is designed to help identify and solve these known problems, before a hacker takes advantage of them. Nessus is a great tool with lots of capabilities. However it is fairly complex and few articles exist to direct the new user through the intricacies of how to install and use it. Thus, this article shall endeavor to cover the basics of Nessus setup and configuration. The features of the current versions of Nessus (Nessus 2.0.8a and NessusWX 1.4.4) will be discussed. Future articles will cover Nessus in more depth.
Nessus is a public domain program released under the GPL. Historically, many in the corporate world have ridiculed such public domain software as being a waste of time, instead choosing "supported" products developed by established companies. Typically these packages cost hundreds or thousands of dollars, and are often purchased using the logic that you get what you pay for. Some people are starting to realize that public domain software, such as Nessus, isn't always inferior and sometimes it is actually superior. Paid technical support for Nessus is even available from www.tenablesecurity.com. Nessus also has a great community of developers anchored by the primary author, Renaud Deraison. When allowed to fairly compete in reviews against other vulnerability scanners, Nessus has equaled or outshined products costing thousands of dollars. [ref: Information Security, Network Computing]
One of the very powerful features of Nessus is its client server technology. Servers can be placed at various strategic points on a network allowing tests to be conducted from various points of view. A central client or multiple distributed clients can control all the servers. The server portion will run on most any flavor of Unix. It even runs on MAC OS X and IBM/AIX, but Linux tends to make the installation simpler. These features provide a great deal of flexibility for the penetration tester. Clients are available for both Windows and Unix. The Nessus server performs the actual testing while the client provides configuration and reporting functionality.
November 2nd, 2003 03:37 AM
Re: Introduction to Nessus
Originally posted by \/IP3R
Nessus is a public domain program released under the GPL. Historically, many in the corporate world have ridiculed such public domain software as being a waste of time, instead choosing "supported" products developed by established companies. Typically these packages cost hundreds or thousands of dollars, and are often purchased using the logic that you get what you pay for. Some people are starting to realize that public domain software, such as Nessus, isn't always inferior and sometimes it is actually superior.
I realize that you are simply quoting the article by Harry Anderson verbatim here \/IP3R, so don't take anything here as a correction to your post.
First, I can't let a reference to software licesnsed under the GPL as being 'Public Domain" slide; call me a troll, but this really gets under my skin as it implies an entirely different meaning in legaleese, and Harry Anderson would serve everyone better by calling it what it is, Open Source.
Now, to back Harry up, I don't know of a single commercial security product (except perhaps anti-Virus software) that is superior to the Open or freely available security tools. One trip to http://www.packetstormsecurity.nl will yield more high quality free tools and documentation than any site should ever need to properly secure and monitor their machines and network.
Whew, now with that off my chest... If you don't have Nessus, go get it! If you don't know how to use Nessus, RTFM until you do! if Nessus won't run on your machines beg like a dog for someone to port it to your OS/Arch, or do it yourself if you know how.
Get OpenSolaris http://www.opensolaris.org/
November 3rd, 2003 01:19 AM
For those M$ users... great intro to linux is http://www.knoppix.net/ distro... boots off of CD and comes packages with Nessus (among other tools). Distro is licensed under GNU.
November 3rd, 2003 05:59 PM
For a more indepth introduction to Nessus... visit SecurityFocus.
Introduction to Nessus
is a firefox extension that gives you stats on how long you have quit smoking, how much money you\'ve saved, how much you haven\'t smoked and recent milestones. Very helpful for people who quit smoking and used to smoke at their computers... Helps out with the urges.
November 3rd, 2003 07:15 PM
If you want step-by-step setup instructions for Nessus, see my tut:
Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden
November 3rd, 2003 08:17 PM
Why is almost every post on AntiOnline a link to someone elses work/writings/code/etc.? Can't anyone of you come up with an original thought of your own?
Here's an idea! Why don't you all get together and patent the lift system you're using to elevate LAME to unprescedented new heights. I'm sure you'll make a fortune.
November 3rd, 2003 10:26 PM
The problem with irony, and even sarcasm is that it tends to fall flat on its face if you cannot be bothered to spell correctly?
I might even be tempted to describe it as "lame"
Hey folks, did someone forget to put something back in its box after Halloween?
If you cannot do someone any good: don't do them any harm....
As long as you did this to one of these, the least of my little ones............you did it unto Me.
What profiteth a man if he gains the entire World at the expense of his immortal soul?
November 7th, 2003 04:42 PM
Yes, knoppix is very good for a bootable linux on a cd. I have also heard great things about flak. It is supposed to be a linux security cd based distro, similar to knoppix but full of security tools and patches.
support your favorites, **** the masses.