Re: Using a database as backend for Nessus (current state and volunteering for development)

Thomas Reinke wrote:

>
>
>> I fear you have been the victim of FUD.  "root" means nothing to 
>> postgres data other than the fact that "root" can do pretty much what 
>> root wants on a filesystem.
>>
>> Postgres does not use unix username/password mapping thus "root" is 
>> not root within postgres.   The postgres database owner is the all 
>> powerful user..again, inside the database.  There is no correlation 
>> to /etc/password and the pg_users table unless you distinctly and 
>> intentionally create it.
>
>
> Nah...am aware of the difference between postgres superuser and
> real root. But obviously I seem to remember things wrong. I
> seemed to have recalled that I was unable to do a "createuser root"
> as postgres user to set up root for db access.  But when I tried
> it now, it worked like a charm. So obviously I had my facts
> wrong on that one.
>
That's not an issue. Regardless of what user nessusd run as you can 
still connect to the database using any other user. If the proper 
configuration (user+location of the database+password) can be done 
through nessus.conf it's up to the admin/user to make user that the 
database will allow the authentication of the user Nessus claim to be 
(in Postgres, for example, you have different authentication mechanisms 
and you can configure, as needed, either a 'trust users in this host' 
 or a 'require password to access this database', it's pretty flexible).

Regards

Javi