Re: Help with local security checks
George Theall <[email protected]>
| Newsgroups | gmane.comp.security.nessus.devel |
|---|---|
| Message-ID | <[email protected]> |
On Fri, Aug 20, 2004 at 08:07:33AM -0400, Info.Sec wrote: > Hi. I'm attempting to compile up nessus devel with the local security > checks, ... > [root@localhost root]# nessusd -D > /usr/local/lib/nessus/plugins/snmpwalk_portscan.nasl: bad signature. > Will not execute this script > /usr/local/lib/nessus/plugins/snmpwalk_portscan.nasl could not be loaded > /usr/local/lib/nessus/plugins/nikto.nasl: bad signature. Will not > execute this script > /usr/local/lib/nessus/plugins/nikto.nasl could not be loaded > /usr/local/lib/nessus/plugins/ssh_settings.nasl: bad signature. Will not > execute this script > /usr/local/lib/nessus/plugins/ssh_settings.nasl could not be loaded > /usr/local/lib/nessus/plugins/ssh_get_info.nasl: bad signature. Will not > execute this script > /usr/local/lib/nessus/plugins/ssh_get_info.nasl could not be loaded These warnings indicate the trusted scripts are not signed properly. From what I understand, Renaud is on vacation and he's the only one with access to the private key used for this. By default, the nasl interpreter won't load trusted scripts that aren't signed properly since they give one the ability to run arbitrary commands on the targets themselves. If you can't wait until they're signed properly (I have no idea when that will be) and are confident in the security of your nessusd server, you can set "nasl_no_signature_check = yes" in your nessusd.conf and restart the server to tell the interpreter not to check the signature of trusted scripts. Aside: the presence of this configurable variable kind of defeats the idea of trusted scripts, doesn't it? That is, if one has the ability to modify scripts he almost certainly also has the ability to modify nessusd.conf and restart the daemon. George -- [email protected] _______________________________________________ Nessus-devel mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus-devel
signature.asc
(application/pgp-signature, 189 B)
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) iD8DBQFBJhALsWUciNmuHkURAvOsAKC3XNfHEIibCaT240jbDp5gIUoKjgCgv/Fk ATnBS325+LuvlJQ4ZfuDd9Q= =8nJQ -----END PGP SIGNATURE-----