


NESSUSD(8)                 User Manuals                NESSUSD(8)


NNAAMMEE
       nessusd - The server part of the Nessus Security Scanner


SSYYNNOOPPSSIISS
       nneessssuussdd [[_-_D]] [[_-_c  _C_F_G_-_F_I_L_E]] [[_-_a _B_I_N_D]] [[_-_p _P_O_R_T]]

       nneessssuussdd [[_-_v]] [[_-_h]] [[_-_d]]

       nneessssuussdd [[_-_C]] [[_-_L]] [[_-_K _K_E_Y]] [[_-_U _U_S_E_R]] [[_-_P _U_S_E_R[[,,[[_P_W_D]]]]]]

       nneessssuussdd [[_-_X _<_k_e_y_-_f_i_l_e_>]]

  or, using long options

       nneessssuussdd [[_-_-_b_a_c_k_g_r_o_u_n_d]] [[_-_-_c_o_n_f_i_g_-_f_i_l_e_=_C_F_G_-_F_I_L_E]] \
               [[_-_-_l_i_s_t_e_n_=_B_I_N_D]] [[_-_-_p_o_r_t_=_P_O_R_T]]

       nneessssuussdd [[_-_-_v_e_r_s_i_o_n]] [[_-_-_h_e_l_p]] [[_-_-_d_u_m_p_-_c_f_g]]

       nneessssuussdd [[_-_-_c_h_a_n_g_e_-_p_a_s_s_-_p_h_r_a_s_e]] [[_-_-_l_i_s_t_-_k_e_y_s]] \
               [[_-_-_d_e_l_e_t_e_-_k_e_y_=_K_E_Y]] \
               [[_-_-_l_i_s_t_-_u_s_e_r_-_p_w_d_=_U_S_E_R]] [[_-_-_m_a_k_e_-_u_s_e_r_=_U_S_E_R[[,,[[_P_W_D]]]]]]

       nneessssuuss [[_-_-_e_x_p_o_r_t_-_p_u_b_k_e_y_=_<_k_e_y_-_f_i_l_e_>_"_]_"

DDEESSCCRRIIPPTTIIOONN
       The NNeessssuuss SSeeccuurriittyy SSccaannnneerr is a security auditing made up
       of two parts : a server, and a client.  The  server,  nneess--
       ssuussdd  is  in  charge of the attacks, while the client nneess--
       ssuuss(1) interfaces with the user.

       Basically, the nneessssuuss suite is made of two parts, a client
       and  a server. While the server is described here, see the
       man page  nneessssuuss(1)  for  a  description  of  the  client.
       Optionally, the dialogue between server and client will be
       encrypted by a cciipphheerr llaayyeerr if you configured your nneessssuuss--
       lliibbrraarriieess package (which is part of the nneessssuuss suite) as

            ./configure --enable-cipher ...

       You  are  strongly encouraged to use the nneessssuuss suite _w_i_t_h
       _t_h_e _c_i_p_h_e_r _l_a_y_e_r _v_e_r_s_i_o_n_, _o_n_l_y_.

       The attacks performed by nneessssuussdd  are  coded  as  external
       modules (or plugins if you want) written in different lan-
       guages.

       Because nneessssuussdd is a security scanner, it is dangerous  to
       let  everyone use it.  This man page describes how to con-
       figure nneessssuussdd properly, so that it can not freely be used
       for evil purposes.





The Nessus Project           Dec 1999                           1





NESSUSD(8)                 User Manuals                NESSUSD(8)


QQUUIICCKK TTAAKKEE OOFFFF
       When  the superuser rroooott starts the nneessssuussdd server for the
       first time, nneessssuussdd will do all setup automatically assum-
       ing  some defaults. If compiled with the cipher layer, you
       need to assign a one time password for the first user as

            nneessssuussdd ----mmaakkee--uusseerr==_u_s_e_r_n_a_m_e,,_p_a_s_s_w_d

       or, equivalently using short options

            nneessssuussdd --PP _u_s_e_r_n_a_m_e,,_p_a_s_s_w_d

       where there must be no space on either side of  the  _u_s_e_r_-
       _n_a_m_e  and  _p_a_s_s_w_d  separating comma. You can dispatch that
       command, above  while another nneessssuussdd is  already  running
       (but wait until the pivate key is initially generated.) To
       verify, that the entry has been stored, you may do  a  key
       data base lookup as

            nneessssuussdd ----lliisstt--kkeeyyss

       or, equivalently using short options

            nneessssuussdd --LL

       Now,  let some nneessssuuss application login (see nneessssuuss(1)) as
       user _u_s_e_r_n_a_m_e and with password _p_a_s_s_w_d_.  Doing another key
       data  base  lookup you will see that the user password has
       been replaced by a public (El Gamal) user key.


OOPPTTIIOONNSS
       --DD, ----bbaacckkggrroouunndd
              Make the server run in background (daemon mode.)

       --cc _<_c_o_n_f_i_g_-_f_i_l_e_>, ----ccoonnffiigg--ffiillee==_<_c_o_n_f_i_g_-_f_i_l_e_>
              Use the alternate  configuration  file  instead  of
              _/_u_s_r_/_l_o_c_a_l_/_e_t_c_/_n_e_s_s_u_s_d_._c_o_n_f

       --aa _<_a_d_d_r_e_s_s_>, ----lliisstteenn==_<_a_d_d_r_e_s_s_>
              Tell  the  server  to only listen to the IP address
              _<_a_d_d_r_e_s_s_> for possible connections.   This  address
              is  not  a  machine  name. For instance, _n_e_s_s_u_s_d _-_a
              _1_9_2_._1_6_8_._1_._1  will  make  nessusd  only  listen   to
              requests going to _1_9_2_._1_6_8_._1_._1 This option is useful
              if you are running nessusd on a gateway and if  you
              don't want people on the outside to connect to your
              nessusd.

       --pp _<_p_o_r_t_>, ----ppoorrtt==_<_p_o_r_t_>
              Tell the server to listen to the  TCP  port  number
              _<_p_o_r_t_>  rather  than  listening  to  PCP  port 3001
              (default)




The Nessus Project           Dec 1999                           2





NESSUSD(8)                 User Manuals                NESSUSD(8)


       --vv, ----vveerrssiioonn
              Writes the version number and exits

       --hh, ----hheellpp
              Show a summary of the commands

       --dd, ----dduummpp--ccffgg
              Make the server dumps its compilation options


KKEEYY MMAANNAAGGEEMMEENNTT OOPPTTIIOONNSS
       The key management  options  can  be  used  while  another
       instance  of  nneessssuussdd is already running. Modifications on
       the user key data base will be  honoured  by  the  running
       instance.  If  nneessssuussdd  was invoked with a key manangement
       option, it will not start up as deamon.  These options are
       available only if nneessssuussdd is invoked as superuser rroooott.

       --CC, ----cchhaannggee--ppaassss--pphhrraassee
              Let  nneessssuussdd  secure  the private key by a personal
              pass phrase.  Using this feature, a pass phrase  is
              read  from  the  command  line  (see ggeettppaassss(1) for
              details upon the  input  device)  which  is  conse-
              quently  used  to  encrypt that key.  Upon restart,
              nneessssuussdd will not come up until you have entered the
              correct pass phrase.  Once, the pass phrase is lost
              you can only delete the  private  key  (usually  in
              /usr/local/etc/nessus/nessusd.private-keys.)

              In  order to remove the pass phrase from a key, you
              need to give an empty pass phrase.

       The user and host key data base entries can  be  addressed
       by host, or network specifications, or user names. A host,
       or network specification can be

            a simple host name, or an IP address

            a network written as  network-address/netmask,  where
            the  network-address  can  be a network name or an IP
            address and the netmask may look like an  IP  address
            or  a  number  indicating  the leading bits, set (eg.
            127.0.0.0/8 is the same as 127.0.0.0/255.0.0.0)

            a list host or network  names  concatenated  by  plus
            letters '+' like.127.0.0.0/8+cvs.nessus.org.

       A user key looks similar to an email address. It can be

            a simple name

            a name followed by a commercial at '@' and a host, or
            a network specification like
            jordan@127.0.0.0/8+cvs.nessus.org.



The Nessus Project           Dec 1999                           3





NESSUSD(8)                 User Manuals                NESSUSD(8)


       Using the general form of a network specification which is
       a  list  of  networks,  a user key or password can be made
       valid for a particuar collection client  netwoks,  all  at
       once.

       --LL, ----lliisstt--kkeeyyss
              List the entries in the user key data base.

       --KK _<_k_e_y_>, ----ddeelleettee--kkeeyy==_<_k_e_y_>
              Delete  the  user  key from user the data base. The
              <_k_e_y_> argument can be a host, or  user  entry  that
              matches  the network specs associated with this key
              or the whole key literally as listed with  the  --LL,
              or  ----lliisstt--kkeeyyss option.

              For instance _j_o_r_d_a_n_@_1_2_7_._0_._0_._0_/_8_+_c_v_s_._n_e_s_s_u_s_._o_r_g does
              not    match    a    data    base    entry     _j_o_r_-
              _d_a_n_@_1_2_7_._0_._0_._0_/_8_+_2_1_2_._1_9_8_._1_4_._1_7   even   if  cvs.nes-
              sus.org were  resolved  as  212.198.14.17.  On  the
              other  hand, _j_o_r_d_a_n_@_l_o_c_a_l_h_o_s_t matches the data base
              entry _j_o_r_d_a_n_@_1_2_7_._0_._0_._0_/_8_+_c_v_s_._n_e_s_s_u_s_._o_r_g,

       --XX _<_k_e_y_-_f_i_l_e_>,, ----eexxppoorrtt--ppuubbkkeeyy_=_<_k_e_y_-_f_i_l_e_>
              Export the public server key into the argument file
              _<_k_e_y_-_f_i_l_e_>.   If the key tag exists, already in the
              file and the key is the same as  the  current  one,
              nothing  is  done.   If the key tag is found with a
              different key, an error is printed.  Otherwise  the
              key is appended to the file.

              If the argument _<_k_e_y_-_f_i_l_e_> is a dash --, the current
              key is printed to stdout.

       --UU _<_u_s_e_r_-_n_a_m_e_>, ----lliisstt--uusseerr--ppwwdd==_<_u_s_e_r_-_n_a_m_e_>
              Print the plain text information of the user speci-
              fication  as  stored  in the date base. This is the
              number of login failures, the  username  and  pass-
              word,  and  the  network  access sepecification (if
              available.)

              The matching rules for the <user-name> argument are
              similar  to  the  ones  decribed  with  the  -K, or
              ----ddeelleettee--kkeeyyss option, above.

       --PP _<_u_s_e_r_-_p_w_d_-_m_o_d_>, ----mmaakkee--uusseerr==_<_u_s_e_r_-_p_w_d_-_m_o_d_>
              Add, delete or modify a user name with an  assigned
              password  as  described, below.  User passwords are
              used only for  the  initial  communication  between
              server and client.  Instead of manually putting the
              client key in a data base, a temporary password  is
              used to initiate the connection.  Server and client
              must have agreed upon using the same initial  pass-
              word.




The Nessus Project           Dec 1999                           4





NESSUSD(8)                 User Manuals                NESSUSD(8)


              Once,  a client has logged in successfully, it will
              send a public key to to the server.  At  subsequent
              connection  set  up,  client  and server will use a
              challenge/response   scheme   for   authentication.
              There will be no login password, anymore.

              By  default,  there can be at most 5 login failures
              before a user password is destroyed, automagically.

              A  _u_s_e_r_n_a_m_e  is  always  part of the _<_u_s_e_r_-_p_w_d_-_m_o_d_>
              argument.  Note that in the case that  user  exists
              already  in  the  data base, the matching rules for
              the _u_s_e_r_n_a_m_e against the data base are  similar  to
              the  ones  decribed  with  the --KK, or ----ddeelleettee--kkeeyyss
              option, above.

              --PP _u_s_e_r_n_a_m_e,,_p_a_s_s_w_d, ----mmaakkee--uusseerr==_u_s_e_r_n_a_m_e,,_p_a_s_s_w_d
                   Add or replace the  password  _p_a_s_s_w_d  for  the
                   user _u_s_e_r_n_a_m_e.

                   It  may happen, that a a general network specs
                   is replaced by a more restricted one when set-
                   ting  a new password due to the matching rules
                   for the _u_s_e_r_n_a_m_e.

              --PP _u_s_e_r_n_a_m_e,,, ----mmaakkee--uusseerr==_u_s_e_r_n_a_m_e,,
                   Delete the password entry for the  user  _u_s_e_r_-
                   _n_a_m_e.  Note that the option argument ends with
                   a comma.

              --PP _u_s_e_r_n_a_m_e, ----mmaakkee--uusseerr==_u_s_e_r_n_a_m_e
                   This option is somewhat similar to the --UU,  or
                   ----lliisstt--uusseerr--ppwwdd  option  described,  above. It
                   lets nneessssuussdd print some plain text information
                   of  the password data base separated by spaces
                   as

                      <login-failures> <username> <password>

                   The option argument does _n_o_t end with a comma,
                   here.


TTHHEE CCOONNFFIIGGUURRAATTIIOONN FFIILLEE
       The     default     nessusd    configuration    file    is
       _/_u_s_r_/_l_o_c_a_l_/_e_t_c_/_n_e_s_s_u_s_d_._c_o_n_f_.  It is made of lines  looking
       like

          _<_k_e_y_w_o_r_d_> == _<_v_a_l_u_e_>

       or  of  comment  lines that start with a hash ## character.
       There follows a description of the keywords:





The Nessus Project           Dec 1999                           5





NESSUSD(8)                 User Manuals                NESSUSD(8)


       pplluuggiinnss__ffoollddeerr
              Contains the location of the plugins  folder.  This
              is  usually  /usr/local/lib/nessus/plugins, but you
              may change this.

       llooggffiillee
              path to the logfile. You can enter  _s_y_s_l_o_g  if  you
              want  the  nessusd  messages  to be logged via ssyyss--
              llooggdd((8)) You may also enter _s_t_d_e_r_r if you  want  the
              nessusd logs to be written on stdout.  _B_e_c_a_u_s_e _n_e_s_-
              _s_u_s_d _i_s _a _s_e_n_s_i_t_i_v_e _p_r_o_g_r_a_m_, _y_o_u _s_h_o_u_l_d  _k_e_e_p  _y_o_u_r
              _l_o_g_s_. _S_o _e_n_t_e_r_i_n_g _s_y_s_l_o_g _i_s _u_s_u_a_l_l_y _n_o_t _a _g_o_o_d _i_d_e_a
              _a_n_d _s_h_o_u_l_d _b_e _d_o_n_e _o_n_l_y _f_o_r _d_e_b_u_g_g_i_n_g _p_u_r_p_o_s_e_s

       mmaaxx__tthhrreeaaddss
              is maximum number of hosts to test at the same time
              which  should  be  given  to  the client (which can
              override it). This value  must  be  computed  given
              your  bandwidth,  the  number  of hosts you want to
              test, and so on.  The more  threads  you  activate,
              the  more  likely you will loose packets during the
              test, and the more likely you will miss vulnerabil-
              ities.   On  the  other  hand, the more threads you
              put, the faster your test will  go.  I  personnally
              tested  50 threads on a PII 450, with 128Mb of RAM,
              and the test was smooth and  quick  against  a  /24
              network.

       uusseerrss  path to the user database

       rruulleess  path to the rules database

       llaanngguuaaggee
              Is  the  language  you  want nessusd to use when it
              sends its reports  to  the  client.  The  currently
              available  languages  are  "english" and "francais"
              (french).


       cchheecckkss__rreeaadd__ttiimmeeoouutt
              Number of seconds that  the  security  checks  will
              wait  for when doing a recv().  You should increase
              this value if you are running nessusd across a slow
              network  link  (testing a host via a dialup connec-
              tion for instance)


       ppeekkss__uusseerrnnaammee
              This is the name of  the  nneessssuussdd  server  used  to
              identify themself in the private key data base.

       ppeekkss__kkeeyylleenn
              The minimum key length for public keys.




The Nessus Project           Dec 1999                           6





NESSUSD(8)                 User Manuals                NESSUSD(8)


       ppeekkss__kkeeyyffiillee
              The path of the private key data base.

       ppeekkss__uussrrkkeeyyss
              The  path  of the publuc user key and password data
              base.

       ppeekkss__ppwwddffaaiill
              The maximal number of login failured befor a tempo-
              rary password is destroyed.

       The other options in this file can usually be redefined by
       the client.


TTHHEE UUSSEERRSS DDAATTAABBAASSEE
       The user database contains the list of the users that  are
       allowed  to  use  nessusd.   Why  making  a list of users,
       instead of allowing only one ? Well, with the  rules  file
       which  will be defined later in this document, you can set
       up a central nessusd server in your company, and add users
       who  will  have the right to test only a part of your net-
       work. For instance, you may want the  R&D  folks  to  test
       their  part  of the network, while you will test the rest.
       You can even configure nessusd so that everyone  can  test
       it to test only one's computer.

       The user database has a very simple format which is :

       _u_s_e_r_:_p_a_s_s_w_o_r_d _[_r_u_l_e_s_]

       Where :

       user   is  the  login  name  you  want to add. This can be
              whatever you want.  There must be a special entry :
              the  user  whose  name  is '*'. It is used for your
              public-key authentificated users.


       password
              is the password associated  with  this  user.   _T_h_e
              _p_a_s_s_w_o_r_d  _i_s  _i_n _p_l_a_i_n _t_e_x_t so check that the users
              database is in mode 0600.  If you want the user  to
              log in via its public key, set this to nothing.

       rules  The rules that apply to this specific user.  A typ-
              ical nessusd.users file would be :

          # User foo, with password bar
          foo:bar
          deny 192.168.1.1/32
          accept 192.168.0.0/16
          default deny
          #



The Nessus Project           Dec 1999                           7





NESSUSD(8)                 User Manuals                NESSUSD(8)


          # User oof authentificates using his public key :
          #
          oof:
          deny 192.168.1.1/24
          accept 192.168.0.0/16
          default deny


TTHHEE RRUULLEE SSEETT FFOORRMMAATT
       A rule has always the same format which is :
            keyword IP/mask


       _K_e_y_w_o_r_d is one of _d_e_n_y , _a_c_c_e_p_t or _d_e_f_a_u_l_t

       In addition to this, the IP adress may be preceded  by  an
       exclamation  mark  (!) which means : 'not' There are three
       sources of rules :


       +o      the rules database, which applies to every users

       +o      the users database rules, which applies to one user

       +o      the users rules, defined by the user in the client

              You must know that there is a priority in the rules
              : the user can not extend its privileges,  but  can
              only  lower  them.   (that it, it can only restrict
              the set of hosts he is allowed to test).


TTHHEE RRUULLEESS DDAATTAABBAASSEE
       The rules database contains the system-wide  rules,  which
       applies for every user. Its syntax has been defined in the
       previous section.  Example :
            accept 127.0.0.0/8
            deny 192.168.1.1/32
            deny !192.168.0.0/16
            default deny

       This allows the user to test localhost, and all the  hosts
       on 192.168.0.0/16, except 192.168.1.1/32.
       The rules accept the special keyword which is replaced, at
       connection time, by the IP of the user who logs in. If you
       want everyone to test his own box only, then you can do :
            accept client_ip/32
            default deny









The Nessus Project           Dec 1999                           8





NESSUSD(8)                 User Manuals                NESSUSD(8)


SSEEEE AALLSSOO
       nneessssuuss(1), nneessssuuss--aadddduusseerr((88)),,getpass((11)),,nmap(1)

MMOORREE IINNFFOORRMMAATTIIOONN AABBOOUUTT TTHHEE NNEESSSSUUSS PPRROOJJEECCTT
       The  canonical places where you will find more information
       about the Nessus project are :

          http://www.nessus.org (Official site)
          http://cvs.nessus.org (Developers site)

AAUUTTHHOORRSS
       The Nessus Project was started and is being maintained  by
       Renaud   Deraison  <deraison@cvs.nessus.org>.  The  nessus
       server is mainly Copyright (C) 1998-1999 Renaud  Deraison,
       as well as most of the attack modules.

       Jordan  Hrycaj <jordan@mjh.teddy-net.com> is the author of
       the cipher layer between the server and  the  client.  The
       cipher library (libpeks) is (C) 1998-1999 Jordan Hrycaj

       And  several  other  people  have been kind enough to send
       patch and bug reports.  Thanks to them.



































The Nessus Project           Dec 1999                           9


