Setting up a Nessus server for vulnerability scanning

#Written by Michael Wood
#Date 12-3-2011
Nessus is a powerful, up-to-date and easy to use network security scanner. It is currently rated among the top products of its type throughout the security industry and is endorsed by professional information security organizations such as the SANS Institute. Nessus allows you to remotely audit a given network and determine if it has been broken into or misused in some way. Nessus also provides the ability to locally audit a specific machine for vulnerabilities, compliance specifications, content policy violations and more.

More information located here: http://www.nessus.org/products/nessus

So, now you know what Nessus is and what it does we are going to setup the server side of it on an Ubuntu Linux machine.  Then we can access the web interface from any web browser that supports Flash.

Go here http://www.nessus.org/products/nessus/nessus-download-agreement and "Accept" the agreement.  You will be redirected to download the package for your operating system.  I chose "Nessus-4.4.1-ubuntu1010_amd64.deb" for obvious reasons. If you have an x86 operating system download the x86 package.  Pretty easy, huh?

Next, you need to register for an "Activation code".   Browse here http://www.nessus.org/products/nessus/nessus-plugins/obtain-an-activation-code
Choose the "Home" option.  You are more than welcome to choose the "Professional" feed if you have $590-$4,790.  The Professional feed is pretty bad ass though.  It includes plugins for SCADA vulnerability checks to detect and audit Control System devices (Remember Stuxnet?) and a plethora of others.

Ok, so after you have clicked the link above go ahead and register for the "Home Feed".  Fill out your name and email address.  You will receive an email in a few moments with the activation code.  Later on in this tutorial we will register the activation code in the program.

Lets begin the install of Nessus.  You have the installation package you downloaded, right?  I downloaded mine from a Windows machine and uploaded it via SFTP to my Linux box.

Via SSH I'll begin the install process.  The file "Nessus-4.4.1-ubuntu1010_amd64.deb" is located, on my server, at /home/mwood.
cd /home/mwood

Run this command:
sudo dpkg -i Nessus-4.4.1-ubuntu1010_amd64.deb    <---Replace the filename with whatever version you downloaded x86 or x64

Output from running the above command:
Selecting previously deselected package nessus.
(Reading database ... 94106 files and directories currently installed.)
Unpacking nessus (from Nessus-4.4.1-ubuntu1010_amd64.deb) ...
Setting up nessus (4.4.1) ...
nessusd (Nessus) 4.4.1 [build M15078] for Linux
(C) 1998 - 2011 Tenable Network Security, Inc.

Processing the Nessus plugins...
[##################################################]

All plugins loaded

 - Please run /opt/nessus/sbin/nessus-adduser to add a user
 - Register your Nessus scanner at http://www.nessus.org/register/ to obtain
   all the newest plugins
 - You can start nessusd by typing /etc/init.d/nessusd start

Processing triggers for ureadahead ...


Now we need to register our activation code to use with Nessus.  Run this command:
/opt/nessus/bin/nessus-fetch --register XXXX-XXXX-XXXX-XXXX-XXXX        <---Replace the X's with your activation code

Output from running the above command:
Your activation code has been registered properly - thank you.
Now fetching the newest plugin set from plugins.nessus.org...
Your Nessus installation is now up-to-date.
If auto_update is set to 'yes' in nessusd.conf, Nessus will
update the plugins by itself.

Make sure it registed correctly.  You should see Home Feed (Non-commercial use only):
sudo cat /opt/nessus/lib/nessus/plugins/plugin_feed_info.inc

Output from the above command:
PLUGIN_SET = "201112022238";
PLUGIN_FEED = "HomeFeed (Non-commercial use only)";

You can change additional configuration settings in the /opt/nessus/etc/nessus/nessusd.conf file

We need to add a user, so run this command:
sudo /opt/nessus/sbin/nessus-adduser

It will ask you for a Login name and password.  Choose whatever you want here.  It will then ask you if you want the new user you just created to be an Admin user, choose "Y".

Output from the add-user command:
Login :
Login password :
Login password (again) :
Do you want this user to be a Nessus 'admin' user ? (can upload plugins, etc...) (y/n) [n]:
User rules
----------
nessusd has a rules system which allows you to restrict the hosts
that <username you chose> has the right to test. For instance, you may want
him to be able to scan his own host only.

Please see the nessus-adduser manual for the rules syntax

Enter the rules for this user, and enter a BLANK LINE once you are done :
(the user can have an empty rules set)



Login             : username you chose
Password         : ***********
This user will have 'admin' privileges within the Nessus server
Rules             :
Is that ok ? (y/n) [y]

Update the plugins:
sudo /opt/nessus/sbin/nessus-update-plugins

Start the Nessus service daemon:
sudo /etc/init.d/nessusd start

Let's take a gander at the web interface now.  The Nessus User Interface (UI) is a web-based interface to the Nessus scanner that is made up of a simple HTTP server and web client, requiring no software installation apart from the Nessus server.

Browse to https://[server IP]:8834

Continue by adding the security certificate to the exceptions list.  Now login with the user account you created earlier.  Just remember before you run any scans make sure to update the plugin cache:
sudo /opt/nessus/sbin/nessus-update-plugins

Additional information can be located here:
http://static.tenable.com/documentation/nessus_4.4_user_guide.pdf

Have Fun!