Re: New NESSUS_SQL tag in CVS sources

On Tue, 18 Feb 2003, Javier Fernandez-Sanguino wrote:

> Just a note to say I have just created the NESSUS_SQL tag in the CVS 
> sources (1.3.4 version), as per Renaud request. I will include there all 
> the changes made by William Heinbockel and the database squemas/diagrams 
> sent by Eric Arnoth.
> 
> For those you want to keep up with the development in this branch either 
> check changes through the cvsweb interface [1] or download it from the 
> CVS directly [2]
> 
> Regards
> 
> Javi
> 
> [1] 
> http://cvs.nessus.org/cgi-bin/cvsweb.cgi/nessus-core/?only_with_tag=NESSUS_SQL
> 
> [2]
> $ export CVSROOT=":pserver:[email protected]:/usr/local/cvs"
> $ cvs login
> $ cvs -z3 checkout -rNESSUS_SQL nessus-core
> 
> 

I was just looking over the database schema(.png) in the CVS there
are a couple of things that I suggest changing.

I don't see any use for the Knowledgebase table.

HOST Table:
  Change the IP to VARCHAR(16), unless you want to add it '0' fillers
  Add StartTime and EndTime values
  Add a Status value - DEAD, CURRENTLY TESTING, or SUCCESS (or similar)

EXECUTED_PLUGINS Table:
  Change the Complete value to be of TinyInt (or similar) so that the
    status can be more than two options - VULNERABILITY FOUND,
    TEST PASSED, PLUGIN NOT RUN (failed a dependency)

Would there be any benefit to adding CVE and BID numbers into the
NESSUS_PLUGIN Table?

Also, some of the Fields will have to support NULL values.


Currently, I am upgrading my files to match the schema.
Also, I have renamed the save_mysql files to save_db and made the
code inside Nessus as well as the code in the database library, more
flexible so that other db architectures can easily be added.

I will hopefully upload the files to Javi in the next couple of days
so that he can add them into the CVS repository.

----------------------
William Heinbockel
Information Security Incident Response Assistant
Co-op Risk & Safety Management
Rochester Institute of Technology
E-mail: [email protected]