RE: minimum set of permissions

"Stewart James" <[email protected]> Thu, 12 Feb 2009 08:57:16 +1100
Newsgroups gmane.comp.security.nessus.general
Message-ID <00E01D096FCC5142BE3DA32148CC102502E49F2C@VUCLEX01-EVS1.ad.vu.edu.au>
This is a multi-part message in MIME format.

--===============0518938067==
Content-class: urn:content-classes:message
Content-Type: multipart/alternative;
	boundary="----_=_NextPart_001_01C98C93.B4DA8E51"

This is a multi-part message in MIME format.

------_=_NextPart_001_01C98C93.B4DA8E51
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

http://www.nessus.org/documentation/nessus_domain_whitepaper.pdf is
probably a good starting point.

=20

S. J

=20

From: [email protected]
[mailto:[email protected]] On Behalf Of Doug Nordwall
Sent: Thursday, 12 February 2009 3:25 AM
To: Nessus nessus
Subject: minimum set of permissions

=20

does anyone have the minimum set of permissions needed to run an
authenticated scan with safe checks enabled on windows machines? I know
there is a lot of registry reading, but I'm guessing not writing. My
desire is is to make a user that can complete a scan, but will pose
minimal other risks.

on unix, it doesn't appear possible to limit the command set much, as
most of it appears to be running through /bin/sh (run a sudo scan and
check your logs)

--=20
Doug Nordwall
Unix, Network, and Security Administrator
You mean the vision is subject to low subscription rates?!!? - Scott
Stone, on MMORPGs


------_=_NextPart_001_01C98C93.B4DA8E51
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 12 (filtered medium)">
<style>
<!--
 /* Font Definitions */
 @font-face
	{font-family:Wingdings;
	panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:Tahoma;
	panose-1:2 11 6 4 3 5 4 4 2 4;}
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
span.EmailStyle17
	{mso-style-type:personal-reply;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
.MsoChpDefault
	{mso-style-type:export-only;}
@page Section1
	{size:612.0pt 792.0pt;
	margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.Section1
	{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
 <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
 <o:shapelayout v:ext=3D"edit">
  <o:idmap v:ext=3D"edit" data=3D"1" />
 </o:shapelayout></xml><![endif]-->
</head>

<body lang=3DEN-AU link=3Dblue vlink=3Dpurple>

<div class=3DSection1>

<p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><a
href=3D"http://www.nessus.org/documentation/nessus_domain_whitepaper.pdf"=
>http://www.nessus.org/documentation/nessus_domain_whitepaper.pdf</a>
is probably a good starting point.<o:p></o:p></span></p>

<p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p>&nbsp;</o:p></span></p>

<p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>S. </span><span =
style=3D'font-size:11.0pt;font-family:Wingdings;
color:#1F497D'>J</span><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p></o:p></span></p>

<p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p>&nbsp;</o:p></span></p>

<div style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt =
0cm 0cm 0cm'>

<p class=3DMsoNormal><b><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:
"Tahoma","sans-serif"'>From:</span></b><span lang=3DEN-US =
style=3D'font-size:10.0pt;
font-family:"Tahoma","sans-serif"'> [email protected]
[mailto:[email protected]] <b>On Behalf Of </b>Doug =
Nordwall<br>
<b>Sent:</b> Thursday, 12 February 2009 3:25 AM<br>
<b>To:</b> Nessus nessus<br>
<b>Subject:</b> minimum set of permissions<o:p></o:p></span></p>

</div>

<p class=3DMsoNormal><o:p>&nbsp;</o:p></p>

<p class=3DMsoNormal>does anyone have the minimum set of permissions =
needed to
run an authenticated scan with safe checks enabled on windows machines? =
I know
there is a lot of registry reading, but I'm guessing not writing. My =
desire is
is to make a user that can complete a scan, but will pose minimal other =
risks.<br>
<br>
on unix, it doesn't appear possible to limit the command set much, as =
most of
it appears to be running through /bin/sh (run a sudo scan and check your =
logs)<br
clear=3Dall>
<br>
-- <br>
Doug Nordwall<br>
Unix, Network, and Security Administrator<br>
You mean the vision is subject to low subscription rates?!!? - Scott =
Stone, on
MMORPGs<o:p></o:p></p>

</div>

</body>

</html>

------_=_NextPart_001_01C98C93.B4DA8E51--

--===============0518938067==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Nessus mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus
--===============0518938067==--