Perhaps I am missing something:
Server:
# nessusd -v
nessusd (Nessus) 1.2.0 for Linux
(C) 1998, 1999, 2000 Renaud Deraison <[EMAIL PROTECTED]>
Target:
RedHat 6.2 w/ 1.2.27 ssh (port22) and apache 1.3.12 (port 80)
After running a full nessus scan (with all plugins enabled except for
DOS and a fast nmap scan) these are the results:
<Rather long paste>
NESSUS SECURITY SCAN REPORT
Created 30.04.2002 Sorted by host names
Session Name : dhcp
Start Time : 30.04.2002 10:13:07
Finish Time : 30.04.2002 10:20:41
Elapsed Time : 0 day(s) 00:07:33
Plugins used in this scan:
Id Name
----------------------------------------------------------------------------
Preferences settings for this scan:
max_threads = 8
log_whole_attack = yes
cgi_path = /cgi-bin
port_range = 1-65535
optimize_test = yes
language = english
track_iothreads = yes
cookie_logpipe_suptmo = 2
checks_read_timeout = 15
delay_between_tests = 1
plugins_timeout = 160
ntp_save_sessions = yes
ntp_detached_sessions = yes
server_info_nessusd_version = 1.2.0
server_info_libnasl_version = 1.2.0
server_info_libnessus_version = 1.2.0
server_info_thread_manager = fork
server_info_os = Linux
server_info_os_version = 2.2.19
max_checks = 8
safe_checks = yes
reverse_lookup = no
ntp_keep_communication_alive = yes
ntp_opt_show_end = yes
save_session = yes
save_knowledge_base = yes
detached_scan = no
continuous_scan = no
Total security holes found : 6
high severity : 0
low severity : 4
informational : 2
Scanned hosts:
Name High Low Info
------------------------------------------------
xxx.xxx.x.xxx 0 4 2
Host: xxx.xxx.x.xxx
Open ports:
ssh (22/tcp)
www (80/tcp)
Service: general/tcp
Severity: Low
Nmap found that this host is running Linux 2.1.19 - 2.2.17, Linux
2.2.19 on a DEC Alpha
Service: ssh (22/tcp)
Severity: Low
a ssh server is running on this port
Service: www (80/tcp)
Severity: Low
a web server is running on this port
Service: general/tcp
Severity: Low
"Fast scan" set. nmap will ignore the user specified port range and
scan only the ports that are declared in nmap-services
<end of paste>
Now there is no mention of the vulnerable ssh running. I also tried
the scan with all plugins disabled except for the ssh insertion and
nmap ones and the results still did not show the server as being
vulnerable. Running snort at the same time (with all disabled but the
ssh insertion attack) showed nothing but the port scan. The
nessusd.messages file contained the following:
[Tue Apr 30 10:14:41 2002][7731] user danielh : launching
ssh_insertion.nasl against xxx.xxx.x.xxx [8046]
[Tue Apr 30 10:14:41 2002][7731] ssh_insertion.nasl (process 8046)
finished its job in 0.65 seconds
Running the nasl script by itself produces nothing as well:
# nasl -t xxx.xxx.x.xxx ssh_insertion.nasl
ssh_insertion.nasl : Warning : evaluating unknown variable -
description
but in this case the banner is successfully transmitted across the
wire (seen a packet capture).
I also checked to make sure that the target is up and running a
vulnerable version:
# nc xxx.xxx.x.xxx 22
SSH-1.5-1.2.27
So my question is: Am I missing something obvious here that is
stopping nessus from preforming the checks?
thanks.
-dan
