On Sun, Oct 12, 2003 at 07:44:09AM -0400, Michael Scheidell wrote:
> > "trusted" scripts will have the ability to execute local commands
> > (calling nikto, nmap, whatever). This will facilitate the inclusion of
> > third-party programs by avoiding to create a .nes plugins for each of
> > them (which is painful to maintain and bug-prone).
> >
>
> Cool: I have a bunch of things I want to do, wondering about
> documentation on it.
>
> guess we would not need nikto (you did) hydro, nmap (you mentioned).
> also, some of the 'smb browse' functions seem to work better outside of
> nessus:
>
> Case in point: smbclient can so smbmx calls, get returns larger than the
> (4128?) bytes. and some of the samba functions work better from cmd
> prompts.
Err... The point is not to replace every script by a call to an external
programs. Such calls end up being very expensive because external
programs don't share memory. The smb implementation in nessusd is fine
the way it is, and using the external smbclient won't gain anything.
[...]
> would of course need to make sure we can't accidentally run 'passwd',
> yppasswd.
This is *why* the new pread() call will only be accessible by 'trusted'
scripts, and why we'll go with all the trouble of having two plugins
directories, and this is why we will avoid using it as much as possible.
Scripts calling pread() will run with root privileges, with all the
security risks associated with that.
-- Renaud
