Sergio Ricote Loeches <[EMAIL PROTECTED]> writes: > Is it mandatory to have root permissions to install Nessus on Sun > OS?
The short answer is "Yes". On any OS in fact. The longer answer is that you probably could install Nessus as any user, but you'll need to be root to run it, and I am definitely not convinced that any "privilege separations" in the daemon code would be a notable increase in security. And the long followup to the longer answer... The only interesting project IMHO would be to split the daemon in two part: one running under an unprivileged ID (maybe in a chroot jail) would handle the incoming connection and client X.509 certificate authentication if any, the other (biggest) part being what is running today minus SSL for the client / server communication. That way, we would be partialy protected against an attack on OpenSSL. This is not urgent, because: - such an architecture can be build with stunnel (OK, that's a quick and dirty work around) - running an unprotected Nessus daemon on Internet or any large network is definitely a bad idea. Restrict the access with libwrap! -- [EMAIL PROTECTED] http://arboi.da.ru FAQNOPI de fr.comp.securite http://faqnopi.da.ru/ _______________________________________________ Nessus mailing list [EMAIL PROTECTED] http://mail.nessus.org/mailman/listinfo/nessus
