Re: Using a database as backend for Nessus (current state and volunteering for development)

While a db back-end is a great idea, keep in mind one
_very_ important design issue.  If you have a db, and
you issue a new release of Nessus, you don't have nearly
the same flexibility changing the db design as you do
changing nessus functionality.

People will have lots of scans in the db, and if you go
and change the schema, you're now forced to do a db conversion.
It's not impossible. Not even terribly difficult. But it
certainly can be prone to problems.

You'll need to do things like marking the schema, and
when a new release of Nessus tries to access an old schema
oriented db, deny the transactions and indicate a conversion
needs to be done.

Not only that, but you'll be faced with possibly multiple
conversions. At minimum, each schema change will require
a conversion script. At worst, you'll need to accomodate
several different types of conversions as people who skip
releases of several different schema changes want to bump
themselves up to the latest and greatest without necessarily
going through the conversion from all the previous releases
(unless you can make that relatively painless for them).

There's also the minor issue of permissions - e.g. with
postgres, afaik, one cannot be root and access the db
(or at least its HIGHLY discouraged). Since Nessus needs
to run as root, you have a minor problem now that you need
to solve if the server is the one accessing the DB. From
that perspective, it may be worthwhile to completely
separate out the DB management actions from the Nessus
daemon.

Cheers, Thomas