NESSUS(1)

NAME
nessus - The client part of the Nessus Security Scanner

SYNOPSIS
nessus [-n]

nessus [-q] Server Port Login Targetsfile Resultsfile

nessus [-C] [-L] [-K <keyname>] [-k <keylen>]

nessus [-X <key-file>]

nessus [-v] [-h]

nessus [-c<file>]

nessus [-T<type>]

or, using long options

nessus [--no-pixmaps]

nessus [--batch-mode] Server Port Login Trgfile Resultsfile

nessus [--change-pass-phrase] [--list-keys] \
       [--delete-key=<keyname>] [--set-key-length=<keylen>]

nessus [--export-pubkey=<key-file>"]"

nessus [--config-file=<file>]
nessus [--output-type=<type>]
nessus [--version] [--help]

DESCRIPTION

The Nessus Security Scanner is a security auditing tool made up of two parts: a server, and a client. The server, nessusd(8) is in charge of the attacks, whereas the client nessus provides an interface to the user. It comes in two flavours, with and without GUI (grephical user interface) support.

As an X11 client, Nessus is based on the Gimp ToolKit (GTK) and needs no arguments upon start up.

As a command line version, Nessus always needs the following arguments placed after the options:

Server
is the address, or the host name of the Nessusd server host to connect to,

Port
is the port, the nessus server lisens on for connect requests,

Login
is the user login name that is to be used for connecting to the Nessusd server,

Trgfile
is the name of a file containing the lists of targets host adresses, or names that are to be checked or scanned,

Resultsfile
is the name of a file where the Nessus client will stored the scan results at the end of the test.

In that sense, Nessus will always adopt a command line behaviour if there are any command line arguments which are not detectes ad options, i.e. they do not begin with a dash '-'.

OPTIONS

-v, --version
    shows version number and quits

-h, --help
    lists the available options

-n, --no-pixmaps
    no pixmaps. Handy if you are running nessus on a remote computer as it reduces bandwidth.

-k <key-len>, --set-key-length=<key-len>
    Enforce a minimum key length different from the default 1024.

-T <type>, --output-type=<type>
    Save the data as <type>, where <type> can be 'html', 'html_graph', 'text', 'tex' or 'nsr'

-q, --batch-mode
    force quiet, or batch mode. Setting this option, the nessus client always expects the options for the batch mode, following.

-r <report-file>, --open-report=<report-file>
    Using the gui, Nessus visualizes a report file from a previous session. Repeating this option, more files are displayed.

KEY MANAGEMENT OPTIONS

The key management options can be used while another instance of nessus is already running. Modifications on the key data base will be honoured by the running instance. If nessus was invoked with a key manangement option, it will not start up as deamon.

-C, --change-pass-phrase
    Let nessus secure the private key by a personal pass phrase. Using this feature, a pass phrase is read from the command line (see getpass(1) for details upon the input device) which is consequently used to encrypt that key. Upon restart, nessus will not come up until you have entered the correct pass phrase. Once, the pass phrase is lost you can only delete the private key (usually in $HOME/.nessus.keys.)

    In order to remove the pass phrase from a key, you need to give an empty pass phrase.

-L, --list-keys
    List the entries in the user key data base.

-K <delete-key>,--delete-key=<delete-key>
    Delete a key from user the data base.

-X <key-file>, --export-pubkey=<key-file>
    Export the public user key into the argument file <key-file>. If the key tag exists, already in the file and the key is the same as the current one, nothing is done. If the key tag is found with a different key, an error is printed. Otherwise the key is appended to the file.

    If the argument <key-file> is a dash -, the current key is printed to stdout.

X11 USER INTERFACE

The nessus client interface is divided in several panels:

The nessusd host section
    In this section, you must enter the nessusd host to connect to, as well as the port. You must also enter your nessusd user name and your password (not the one of the system). Once you are done, you must click on the 'login now!' button, which will establish the connection the the nessusd host.
    Once the connection is established, nessusd sends to the client the list of attacks it will perform, as well as the default preferences to use.

The target selection section
    In this section, you are required to enter the primary target. A primary target may be a single host (like prof.fr.nessus.org), an IP (192.168.1.1), a subnet (192.168.1.1/24, or prof.fr.nessus.org), or a list of hosts, separated by commas (like : 192.168.1.1, 192.168.2.1/24, prof.fr.nessus.org, joyeux.fr.nessus.org).

    You can restrict the maximum number of hosts to test using the Max Hosts entry. This is an extra security
     which will garantee you that you will not test other by accident (for instance, if you only plan to test prof.fr.nessus.org and www.fr.nessus.org, you can safely set this entry to 2).

    This panel also allows you to enable the Perform a DNS zone transfer option. This option is dangerous and should be enabled with caution. For instance, if you want to test www.nessus.org, then if this option is set, nessusd will attempt to get the list of the hosts in the nessus.org domain.

    The latter option may be dangerous. For instance, if you enable it and you ask to test 192.168.1.1/24, then nessusd will do a reverse lookup on every IP, and will attempt a DNS zone transfer on every domain. That is, if 192.168.1.1 is www.foo.bar, and 192.168.1.10 is mail.bar.foo, then a DNS zone transfer will be made on the domains foo.barandbar.foo.

The Plugins section
    Once you have successfully logged into the remote nessusd server, this section is filed with the list of the attacks that the server will perform. This panel is divided in two parts : the plugins families, and the plugins themselves. If you click on the name of a plugin, then a dialog will appear, showing you which will be the error message sent by the plugin if the attack is successful.

ENVIRONMENT VARIABLES

NESSUSUSER
    If this environemt variable is set, the name specified by this variable is considered as login name and used for tagging/identifying the personal key.

NESSUSHOME
    If the environemt variable is set, this path is used instead of the
    path defined    by the HOME variable.  This path is referred to
    as ~/, below.

userprofile
    Ignored on non-Windows machines, this variable takes precedence over HOME, which has the same meaning in the given context.

HOME
    The path to the user's home directory which will hold the client configuration cache .nessusrc and the key data base .nessus.keys (see below.) The path is referred to as ~/, below.

FILES

~/.nessusrc
    is the client configuration cache, which contains the options about, which nessusd server to connect to by default, which plugins to activate, and so on. The file is created automatically within the first nessus(1) session.

~/.nessus.keys
    contains the client private key, as well as the nessusd servers public keys. This file is created automatically when starting nessus(1).

SEE ALSO

nessus(1), getpass(1)

MORE INFORMATION ABOUT THE NESSUS PROJECT

The canonical places where you will find more information about the Nessus project are :

http://www.nessus.org (Official site)
http://cvs.nessus.org (Developers site)

AUTHORS

The Nessus Project was started and is being maintained by Renaud Deraison <deraison@cvs.nessus.org>. The nessus server is mainly Copyright (C) 1998-1999 Renaud Deraison, as well as the attack modules.

Jordan Hrycaj <jordan@mjh.teddy-net.com> is the author of the optional cipher layer between the server and the client. The cipher library (libpeks) is (C) 1998-1999 Jordan Hrycaj

And several other people have been kind enough to send patches and bug reports. Thanks to them.