


NESSUSD(8)                 User Manuals                NESSUSD(8)


NNAAMMEE
       nessusd - The server part of the Nessus Security Scanner


SSYYNNOOPPSSIISS
       nneessssuussdd [[_-_D]] [[_-_c  _C_F_G_-_F_I_L_E]] [[_-_a _B_I_N_D]] [[_-_p _P_O_R_T]]

       nneessssuussdd [[_-_v]] [[_-_h]] [[_-_d]]

       nneessssuussdd [[_-_C]] [[_-_L]] [[_-_K _K_E_Y]] [[_-_U _U_S_E_R]] [[_-_P _U_S_E_R[[,,[[_P_W_D]]]]]]

  or, using long options

       nneessssuussdd [[_-_-_b_a_c_k_g_r_o_u_n_d]] [[_-_-_c_o_n_f_i_g_-_f_i_l_e_=_C_F_G_-_F_I_L_E]] \
               [[_-_-_l_i_s_t_e_n_=_B_I_N_D]] [[_-_-_p_o_r_t_=_P_O_R_T]]

       nneessssuussdd [[_-_-_v_e_r_s_i_o_n]] [[_-_-_h_e_l_p]] [[_-_-_d_u_m_p_-_c_f_g]]

       nneessssuussdd [[_-_-_c_h_a_n_g_e_-_p_a_s_s_-_p_h_r_a_s_e]] [[_-_-_l_i_s_t_-_k_e_y_s]] \
               [[_-_-_d_e_l_e_t_e_-_k_e_y_=_K_E_Y]] \
               [[_-_-_l_i_s_t_-_u_s_e_r_-_p_w_d_=_U_S_E_R]] [[_-_-_m_a_k_e_-_u_s_e_r_=_U_S_E_R[[,,[[_P_W_D]]]]]]

DDEESSCCRRIIPPTTIIOONN
       The NNeessssuuss SSeeccuurriittyy SSccaannnneerr is a security auditing made up
       of two parts : a server, and a client.  The  server,  nneess--
       ssuussdd  is  in  charge of the attacks, while the client nneess--
       ssuuss(1) interferes with the user.

       Basically, the nneessssuuss suite is made of two parts, a client
       and  a server. While the server is described here, see the
       man page  nneessssuuss(1)  for  a  description  of  the  client.
       Optionally, the dialogue between server and client will be
       encrypted by a cciipphheerr llaayyeerr if you configured your nneessssuuss--
       lliibbrraarriieess package (which is part of the nneessssuuss suite) as

            ./configure --enable-cipher ...

       You  are  strongly encouraged to use the nneessssuuss suite _w_i_t_h
       _t_h_e _c_i_p_h_e_r _l_a_y_e_r _v_e_r_s_i_o_n_, _o_n_l_y_.

       The attacks performed by nneessssuussdd  are  coded  as  external
       modules (or plugins if you want) written in different lan-
       guages.

       Because nneessssuussdd is a security scanner, it is dangerous  to
       let  everyone use it.  This man page describes how to con-
       figure nneessssuussdd properly, so that it can not freely be used
       for evil purposes.


QQUUIICCKK TTAAKKEE OOFFFF
       When  the superuser rroooott starts the nneessssuussdd server for the
       first time, nneessssuussdd will do all setup automatically assum-
       ing  some defaults. If compiled with the cipher layer, you



The Nessus Project           Dec 1999                           1





NESSUSD(8)                 User Manuals                NESSUSD(8)


       need to assign a one time password for the first user as

            nneessssuussdd ----mmaakkee--uusseerr==_u_s_e_r_n_a_m_e,,_p_a_s_s_w_d

       or, equivalently using short options

            nneessssuussdd --PP _u_s_e_r_n_a_m_e,,_p_a_s_s_w_d

       where there must be no space on either side of  the  _u_s_e_r_-
       _n_a_m_e  and  _p_a_s_s_w_d  separating comma. You can dispatch that
       command, above  while another nneessssuussdd is  already  running
       (but wait until the pivate key is initially generated.) To
       verify, that the entry has been stored, you may do  a  key
       data base lookup as

            nneessssuussdd ----lliisstt--kkeeyyss

       or, equivalently using short options

            nneessssuussdd --LL

       Now,  let some nneessssuuss application login (see nneessssuuss(1)) as
       user _u_s_e_r_n_a_m_e and with password _p_a_s_s_w_d_.  Doing another key
       data  base  lookup you will see that the user password has
       been replaced by a public (El Gamal) user key.


OOPPTTIIOONNSS
       --DD, ----bbaacckkggrroouunndd
              Make the server run in background (daemon mode.)

       --cc _<_c_o_n_f_i_g_-_f_i_l_e_>, ----ccoonnffiigg--ffiillee==_<_c_o_n_f_i_g_-_f_i_l_e_>
              Use the alternate  configuration  file  instead  of
              _/_n_e_s_s_u_s_/_e_t_c_/_n_e_s_s_u_s_d_._c_o_n_f

       --aa _<_a_d_d_r_e_s_s_>, ----lliisstteenn==_<_a_d_d_r_e_s_s_>
              Tell  the  server  to only listen to the IP address
              _<_a_d_d_r_e_s_s_> for possible connections.   This  address
              is  not  a  machine  name. For instance, _n_e_s_s_u_s_d _-_a
              _1_9_2_._1_6_8_._1_._1  will  make  nessusd  only  listen   to
              requests going to _1_9_2_._1_6_8_._1_._1 This option is useful
              if you are running nessusd on a gateway and if  you
              don't want people on the outside to connect to your
              nessusd.

       --pp _<_p_o_r_t_>, ----ppoorrtt==_<_p_o_r_t_>
              Tell the server to listen to the  TCP  port  number
              _<_p_o_r_t_>  rather  than  listening  to  PCP  port 3001
              (default)

       --vv, ----vveerrssiioonn
              Writes the version number and exits





The Nessus Project           Dec 1999                           2





NESSUSD(8)                 User Manuals                NESSUSD(8)


       --hh, ----hheellpp
              Show a summary of the commands

       --dd, ----dduummpp--ccffgg
              Make the server dumps its compilation options


KKEEYY MMAANNAAGGEEMMEENNTT OOPPTTIIOONNSS
       The key management  options  can  be  used  while  another
       instance  of  nneessssuussdd is already running. Modifications on
       the user key data base will be  honoured  by  the  running
       instance.  If  nneessssuussdd  was invoked with a key manangement
       option, it will not start up as deamon.  These options are
       available only if nneessssuussdd is invoked as superuser rroooott.

       --CC, ----cchhaannggee--ppaassss--pphhrraassee
              Let  nneessssuussdd  secure  the private key by a personal
              pass phrase.  Using this feature, a pass phrase  is
              read  from  the  command  line  (see ggeettppaassss(1) for
              details upon the  input  device)  which  is  conse-
              quently  used  to  encrypt that key.  Upon restart,
              nneessssuussdd will not come up until you have entered the
              correct pass phrase.  Once, the pass phrase is lost
              you can only delete the  private  key  (usually  in
              /nessus/etc/nessus/nessusd.private-keys.)

              In  order to remove the pass phrase from a key, you
              need to give an empty pass phrase.

       The user and host key data base entries can  be  addressed
       by host, or network specifications, or user names. A host,
       or network specification can be

            a simple host name, or an IP address

            a network written as  network-address/netmask,  where
            the  network-address  can  be a network name or an IP
            address and the netmask may look like an  IP  address
            or  a  number  indicating  the leading bits, set (eg.
            127.0.0.0/8 is the same as 127.0.0.0/255.0.0.0)

            a list host or network  names  concatenated  by  plus
            letters '+' like.127.0.0.0/8+cvs.nessus.org.

       A user key looks similar to an email address. It can be

            a simple name

            a name followed by a commercial at '@' and a host, or
            a network specification like
            jordan@127.0.0.0/8+cvs.nessus.org.

       Using the general form of a network specification which is
       a  list  of  networks,  a user key or password can be made



The Nessus Project           Dec 1999                           3





NESSUSD(8)                 User Manuals                NESSUSD(8)


       valid for a particuar collection client  netwoks,  all  at
       once.

       --LL, ----lliisstt--kkeeyyss
              List the entries in the user key data base.

       --KK _<_k_e_y_>, ----ddeelleettee--kkeeyy==_<_k_e_y_>
              Delete  the  user  key from user the data base. The
              <_k_e_y_> argument can be a host, or  user  entry  that
              matches  the network specs associated with this key
              or the whole key literally as listed with  the  --LL,
              or  ----lliisstt--kkeeyyss option.

              For instance _j_o_r_d_a_n_@_1_2_7_._0_._0_._0_/_8_+_c_v_s_._n_e_s_s_u_s_._o_r_g does
              not    match    a    data    base    entry     _j_o_r_-
              _d_a_n_@_1_2_7_._0_._0_._0_/_8_+_2_1_2_._1_9_8_._1_4_._1_7   even   if  cvs.nes-
              sus.org were  resolved  as  212.198.14.17.  On  the
              other  hand, _j_o_r_d_a_n_@_l_o_c_a_l_h_o_s_t matches the data base
              entry _j_o_r_d_a_n_@_1_2_7_._0_._0_._0_/_8_+_c_v_s_._n_e_s_s_u_s_._o_r_g,

       --UU _<_u_s_e_r_-_n_a_m_e_>, ----lliisstt--uusseerr--ppwwdd==_<_u_s_e_r_-_n_a_m_e_>
              Print the plain text information of the user speci-
              fication  as  stored  in the date base. This is the
              number of login failures, the  username  and  pass-
              word,  and  the  network  access sepecification (if
              available.)

              The matching rules for the <user-name> argument are
              similar  to  the  ones  decribed  with  the  -K, or
              ----ddeelleettee--kkeeyyss option, above.

       --PP _<_u_s_e_r_-_p_w_d_-_m_o_d_>, ----mmaakkee--uusseerr==_<_u_s_e_r_-_p_w_d_-_m_o_d_>
              Add, delete or modify a user name with an  assigned
              password  as  described, below.  User passwords are
              used only for  the  initial  communication  between
              server and client.  Instead of manually putting the
              client key in a data base, a temporary password  is
              used to initiate the connection.  Server and client
              must have agreed upon using the same initial  pass-
              word.

              Once,  a client has logged in successfully, it will
              send a public key to to the server.  At  subsequent
              connection  set  up,  client  and server will use a
              challenge/response   scheme   for   authentication.
              There will be no login password, anymore.

              By  default,  there can be at most 5 login failures
              before a user password is destroyed, automagically.

              A  _u_s_e_r_n_a_m_e  is  always  part of the _<_u_s_e_r_-_p_w_d_-_m_o_d_>
              argument.  Note that in the case that  user  exists
              already  in  the  data base, the matching rules for
              the _u_s_e_r_n_a_m_e against the data base are  similar  to



The Nessus Project           Dec 1999                           4





NESSUSD(8)                 User Manuals                NESSUSD(8)


              the  ones  decribed  with  the --KK, or ----ddeelleettee--kkeeyyss
              option, above.

              --PP _u_s_e_r_n_a_m_e,,_p_a_s_s_w_d, ----mmaakkee--uusseerr==_u_s_e_r_n_a_m_e,,_p_a_s_s_w_d
                   Add or replace the  password  _p_a_s_s_w_d  for  the
                   user _u_s_e_r_n_a_m_e.

                   It  may happen, that a a general network specs
                   is replaced by a more restricted one when set-
                   ting  a new password due to the matching rules
                   for the _u_s_e_r_n_a_m_e.

              --PP _u_s_e_r_n_a_m_e,,, ----mmaakkee--uusseerr==_u_s_e_r_n_a_m_e,,
                   Delete the password entry for the  user  _u_s_e_r_-
                   _n_a_m_e.  Note that the option argument ends with
                   a comma.

              --PP _u_s_e_r_n_a_m_e, ----mmaakkee--uusseerr==_u_s_e_r_n_a_m_e
                   This option is somewhat similar to the --UU,  or
                   ----lliisstt--uusseerr--ppwwdd  option  described,  above. It
                   lets nneessssuussdd print some plain text information
                   of  the password data base separated by spaces
                   as

                      <login-failures> <username> <password>

                   The option argument does _n_o_t end with a comma,
                   here.


TTHHEE CCOONNFFIIGGUURRAATTIIOONN FFIILLEE
       The default nessusd configuration file is _/_n_e_s_s_u_s_/_e_t_c_/_n_e_s_-
       _s_u_s_d_._c_o_n_f_.  It is made of lines looking like

          _<_k_e_y_w_o_r_d_> == _<_v_a_l_u_e_>

       or of comment lines that start with a  hash  ##  character.
       There follows a description of the keywords:

       pplluuggiinnss__ffoollddeerr
              Contains  the  location of the plugins folder. This
              is usually /nessus/lib/nessus/plugins, but you  may
              change this.

       llooggffiillee
              path  to  the  logfile. You can enter _s_y_s_l_o_g if you
              want the nessusd messages to  be  logged  via  ssyyss--
              llooggdd((8))  You  may also enter _s_t_d_e_r_r if you want the
              nessusd logs to be written on stdout.  _B_e_c_a_u_s_e _n_e_s_-
              _s_u_s_d  _i_s  _a _s_e_n_s_i_t_i_v_e _p_r_o_g_r_a_m_, _y_o_u _s_h_o_u_l_d _k_e_e_p _y_o_u_r
              _l_o_g_s_. _S_o _e_n_t_e_r_i_n_g _s_y_s_l_o_g _i_s _u_s_u_a_l_l_y _n_o_t _a _g_o_o_d _i_d_e_a
              _a_n_d _s_h_o_u_l_d _b_e _d_o_n_e _o_n_l_y _f_o_r _d_e_b_u_g_g_i_n_g _p_u_r_p_o_s_e_s





The Nessus Project           Dec 1999                           5





NESSUSD(8)                 User Manuals                NESSUSD(8)


       mmaaxx__tthhrreeaaddss
              is maximum number of hosts to test at the same time
              which should be given  to  the  client  (which  can
              override  it).  This  value  must be computed given
              your bandwidth, the number of  hosts  you  want  to
              test,  and  so  on.  The more threads you activate,
              the more likely you will loose packets  during  the
              test, and the more likely you will miss vulnerabil-
              ities.  On the other hand,  the  more  threads  you
              put,  the  faster  your test will go. I personnally
              tested 50 threads on a PII 450, with 128Mb of  RAM,
              and  the  test  was  smooth and quick against a /24
              network.

       uusseerrss  path to the user database

       rruulleess  path to the rules database

       llaanngguuaaggee
              Is the language you want nessusd  to  use  when  it
              sends  its  reports  to  the  client. The currently
              available languages are  "english"  and  "francais"
              (french).


       cchheecckkss__rreeaadd__ttiimmeeoouutt
              Number  of  seconds  that  the security checks will
              wait for when doing a recv().  You should  increase
              this value if you are running nessusd across a slow
              network link (testing a host via a  dialup  connec-
              tion for instance)


       ppeekkss__uusseerrnnaammee
              This  is  the  name  of  the nneessssuussdd server used to
              identify themself in the private key data base.

       ppeekkss__kkeeyylleenn
              The minimum key length for public keys.

       ppeekkss__kkeeyyffiillee
              The path of the private key data base.

       ppeekkss__uussrrkkeeyyss
              The path of the publuc user key and  password  data
              base.

       ppeekkss__ppwwddffaaiill
              The maximal number of login failured befor a tempo-
              rary password is destroyed.

       The other options in this file can usually be redefined by
       the client.




The Nessus Project           Dec 1999                           6





NESSUSD(8)                 User Manuals                NESSUSD(8)


TTHHEE UUSSEERRSS DDAATTAABBAASSEE
       The  user database contains the list of the users that are
       allowed to use nessusd.   Why  making  a  list  of  users,
       instead  of  allowing only one ? Well, with the rules file
       which will be defined later in this document, you can  set
       up a central nessusd server in your company, and add users
       who will have the right to test only a part of  your  net-
       work.  For  instance,  you  may want the R&D folks to test
       their part of the network, while you will test  the  rest.
       You  can  even configure nessusd so that everyone can test
       it to test only one's computer.

       The user database has a very simple format which is :

       _u_s_e_r_:_p_a_s_s_w_o_r_d _[_r_u_l_e_s_]

       Where :

       user   is the login name you want  to  add.  This  can  be
              whatever you want.  There must be a special entry :
              the user whose name is '*'. It  is  used  for  your
              public-key authentificated users.


       password
              is  the  password  associated  with this user.  _T_h_e
              _p_a_s_s_w_o_r_d _i_s _i_n _p_l_a_i_n _t_e_x_t so check that  the  users
              database  is in mode 0600.  If you want the user to
              log in via its public key, set this to nothing.

       rules  The rules that apply to this specific user.  A typ-
              ical nessusd.users file would be :

          # User foo, with password bar
          foo:bar
          deny 192.168.1.1/32
          accept 192.168.0.0/16
          default deny
          #
          # User oof authentificates using his public key :
          #
          oof:
          deny 192.168.1.1/24
          accept 192.168.0.0/16
          default deny


TTHHEE RRUULLEE SSEETT FFOORRMMAATT
       A rule has always the same format which is :
            keyword IP/mask


       _K_e_y_w_o_r_d is one of _d_e_n_y , _a_c_c_e_p_t or _d_e_f_a_u_l_t




The Nessus Project           Dec 1999                           7





NESSUSD(8)                 User Manuals                NESSUSD(8)


       In  addition  to this, the IP adress may be preceded by an
       exclamation mark (!) which means : 'not' There  are  three
       sources of rules :


       +o      the rules database, which applies to every users

       +o      the users database rules, which applies to one user

       +o      the users rules, defined by the user in the client

              You must know that there is a priority in the rules
              :  the  user can not extend its privileges, but can
              only lower them.  (that it, it  can  only  restrict
              the set of hosts he is allowed to test).


TTHHEE RRUULLEESS DDAATTAABBAASSEE
       The  rules  database contains the system-wide rules, which
       applies for every user. Its syntax has been defined in the
       previous section.  Example :
            accept 127.0.0.0/8
            deny 192.168.1.1/32
            deny !192.168.0.0/16
            default deny

       This  allows the user to test localhost, and all the hosts
       on 192.168.0.0/16, except 192.168.1.1/32.
       The rules accept the special keyword which is replaced, at
       connection time, by the IP of the user who logs in. If you
       want everyone to test his own box only, then you can do :
            accept client_ip/32
            default deny





SSEEEE AALLSSOO
       nneessssuuss(1), nneessssuuss--aadddduusseerr((88)),,getpass((11)),,nmap(1)

MMOORREE IINNFFOORRMMAATTIIOONN AABBOOUUTT TTHHEE NNEESSSSUUSS PPRROOJJEECCTT
       The canonical places where you will find more  information
       about the Nessus project are :

          http://www.nessus.org (Official site)
          http://cvs.nessus.org (Developers site)

AAUUTTHHOORRSS
       The  Nessus Project was started and is being maintained by
       Renaud  Deraison  <deraison@cvs.nessus.org>.  The   nessus
       server  is mainly Copyright (C) 1998-1999 Renaud Deraison,
       as well as most of the attack modules.




The Nessus Project           Dec 1999                           8





NESSUSD(8)                 User Manuals                NESSUSD(8)


       Jordan Hrycaj <jordan@mjh.teddy-net.com> is the author  of
       the  cipher  layer  between the server and the client. The
       cipher library (libpeks) is (C) 1998-1999 Jordan Hrycaj

       And several other people have been  kind  enough  to  send
       patch and bug reports.  Thanks to them.



















































The Nessus Project           Dec 1999                           9


