Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1286
  • Last Modified:

Nessus Scan Against Linux Box?

I installed Nessus 4.4 Homefeed on an Ubuntu 10.04 machine. I can run scans against Windows machines and get good data from the test. I've tried running scans against Linux machines but never find any high vulnerabilities. At first I thought it was a credential problem so I tried running scans against the localhost where Nessus is installed and get similar results (no high vulnerabilities). I've entered the correct root password in the SSH section to no avail.

I thought that maybe.. just maybe my Linux system was secure and up to date. So I installed a fresh copy of Ubuntu 8.04 in a VM then installed Nessus 4.4 in it. I created a new policy with all plugins enabled and tried with both blank credentials and root credentials but no high vulnerabilities are detected. I've tried this on several different Ubuntu systems and get the similar results (never any high vulnerabilities). I know this Ubuntu instance is vulnerable because the Ubuntu Update Manager tells me I'm missing 263 "Important Security Updates".

When I run the scans, I've tried using both my local eth0 IP address and "localhost" as the target. Am I missing something? Am I doing something wrong?
0
ro6ot
Asked:
ro6ot
  • 6
  • 2
  • 2
  • +1
1 Solution
 
Hugh FraserConsultantCommented:
It sounds like you're doing things correctly. I'm assuming from your description that Nessus is finding some other issues so you know it's scanning; it will normally skip any target it can't ping.

Check the target log files to see if there are some obvious issues, like root login disabled from remote sites.

One of the secure installations I have included connection throttling rules in iptables to drop connections if a host makes multiple connections in a short period of time. Check iptables after doing a Nessus scan to see if it's being dropped.
0
 
ro6otAuthor Commented:
I just checked /etc/ssh/sshd_config and "PermitRootLogin" is set to "yes"

I manually turned off the firewall so I don't think any rules are dropping the connection.  I find lots of low vulnerabilities but never any high one.
0
 
Hugh FraserConsultantCommented:
Check to make sure you've got the correct Linux policies/plugins enabled. Also, not all plugins require authentication, so it's entirely possible to get results without a successful login. But to check patches, updates, etc., the login as root does need to work, so double check the credentials in your scan.
0
The Lifecycle Approach to Managing Security Policy

Managing application connectivity and security policies can be achieved more effectively when following a framework that automates repeatable processes and ensures that the right activities are performed in the right order.

 
ro6otAuthor Commented:
I've made sure all the plugins are enabled and I verified the root credentials. Something is blocking the scan but I can't figure out what it is.
0
 
Duncan RoeSoftware DeveloperCommented:
I would use tcpdump to monitor what kind of tests Nessus is running. Missing 263 "Important Security Updates" may just be showing you the difference between security expectations between Linux and Windows.
0
 
jlevieCommented:
If I understand correctly, your Nessus installation works as you expect when you scan a windows box, but just doesn't report serious vulnerabilities when directed against  Linux machines. Your concern seems to be that you know the Linux systems aren't up to date w/respect to patches and that you expect Nessus to find vulnerabilities.

The default configuration of a modern Linux installation isn't going to have but a few essential network services enabled (ICMP ECHO, ssh, etc). Those have been pretty secure from network attacks for quite a while, so it isn't overly surprising the Nessus isn't finding serious vulnerabilities. The updates should be applied, but the may cover other that network vulnerabilities of the may apply to services that aren't enabled on your systems.

 
0
 
ro6otAuthor Commented:
jlevie,

Your assumptions are correct. When I run a local check on this Linux system I do not find any high vulnerabilities but I know that it is in fact missing critical patches that the Nessus Ubuntu plugins should detect.
0
 
jlevieCommented:
But are you running the services that have network vulnerabilities that a patch(s) address? And do you have evidence that the missing patches should be detected by Nessus?
0
 
ro6otAuthor Commented:
I figured it out with help from the Nessus forums. I needed to escalate privileges with "su" instead of root.
0
 
ro6otAuthor Commented:
ok
0
 
ro6otAuthor Commented:
I found the solution on another discussion group. I posted the solution so it could help others in the future.
0

Featured Post

Who's Defending Your Organization from Threats?

Protecting against advanced threats requires an IT dream team – a well-oiled machine of people and solutions working together to defend your organization. Download our resource kit today to learn more about the tools you need to build you IT Dream Team!

  • 6
  • 2
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now