Re: Using a database as backend for Nessus (current state and volunteering for development)

Not to post a "me too" post, but really I like this idea.  I, for one,
have systems running nessusd that cannot connect to our database
directly, the only way is that I download the reports via ssh and then
use a script on the main database to import them all.  Poking another
firewall hole to send mysql through or forwarding ports via ssh is also
not an option for us.

Joe

On Mon, 2003-01-13 at 21:54, Michael Boman wrote:
> On Mon, Jan 13, 2003 at 09:29:04PM -0500, David Ford wrote:
> > Please use standard SQL92 or later rather than a specific sql server.  
> > It's a lot easier to write the intermediary abstraction interface than 
> > it is to [re]write every sql() function for each new DB that is supported :)
> > 
> > And just for the record, I somewhat strongly oppose using Berkely DB.  
> > They seem to love rewriting APIs with every release.
> > 
> > - -d
> 
> What about just writing the INSERT statments to a textfile the user can
> use a (provided*) shell script to upload it to the database. I think this
> is much better then supplying username/password/host/db to the nessus
> process. If it is done in this way the machine that runs nessus and the
> machine that runs the upload script doesn't need to be the same box,
> as the report.sql (or what you want to name it) could be transfered
> to another machine in the terms of shared network filesystem, scp,
> ftp <choose your poison>.
> 
> I think the DB scheme should be modeled up after the newer XML output
> plugin as AFAIK it contain more data then any other format - and data
> is good to have because you shouldn't assume that everyone wants to do
> the report in the same way..
> 
> I'll take a look at the XML format and start sketchign on a DB scheme.
> 
> Best regards
>  Michael Boman
> 
> (*)
>   For extra security measures it could make sure that it ONLY contains
>   INSERT statements, so that a hacker on a compromised nessus box doesn't
>   do anything in the style of 'drop database mysql' (example only). I know
>   for an fact that there are people that are giving out root access to
>   normal applications, either of laziness or just be un-informed about
>   the penalties.
> 
> -- 
> Michael Boman
> Security Architect, SecureCiRT (A SBU of Z-Vance Pte Ltd)
> http://www.securecirt.com