Re: mySQL database for nessusd (code!)

On Fri, 7 Feb 2003, Javier Fernandez-Sanguino wrote:

> William Heinbockel wrote:
> > Just an update on the database backend for nessusd...
> > 
> > I've started coding a mysql interface/library for nessusd.
> > It is written in C and uses mysql.h (the mysql C API).
> 
> That's great!
> 
> > I'm working with the database schema that Javi posted awhile back,
> > but due to my lack of SQL knowledge and the way nessusd is set-up,
> > I don't think that some of the tables can be setup in that manner.
> 
> 	Which ones specifically?
> 
All of the ID's...
Currently I'm using the timestamp for the SessionID, but have no
idea what to do with the UserID, ExecutionID, ProtocolID...
This is probably most due to my lack of knowledge with databases.
And what is UserSessions::Location and User::Hash?

It might also end up being a problem to store these ID's and pass
them in the program.

> > 
> > I think the easiest way to incorporate the non-session specific data
> > (i.e. the Nessus-plugin table and Services table and the like...) is
> > to write a simple [perl?] script to create an sql modules directly
> > from the plugins' directory and hard code a script to deal with the
> > services.
> 
> 	For the plugin information you already have a way to do it. Check the 
> nessus-extract tool:
> http://cvs.nessus.org/cgi-bin/cvsweb.cgi/nessus-tools/nessus-extract/nessus-extract.pl?rev=1.4&content-type=text/x-cvsweb-markup
> 
> It does not (yet) output in the schema that I proposed a while back for 
> plugins (CVE/Bugtraq references should be held in a separate table to 
> accomodate better with having multiple references per plugin)
> 

Right now, I am mainly trying to focus on where the information for the
database can be best obtained, for some stuff with the plugins, such
as RevisionNumber, you might have to integrate some code into NASL and
such.  I don't know for certain though.
 
> 
> 	As for the service information it should be pretty easy to make a 
> script to take all services (from /etc/services, the nmap services file 
> or whatever) and add them to a table. However, since services are not 
> referenced by port you need to first look into the service table (and 
> extract the ServiceId before inserting into the DetectedService table.
> 	Regards
> 
> 	Javi
> 
> PS: Starting next week I hope I will have more time available to work on 
> this.
> 
> 

----------------------
William Heinbockel
Information Security Incident Response Assistant
Co-op Risk & Safety Management
Rochester Institute of Technology
E-mail: [email protected]