* Hemsley, Trevor <[EMAIL PROTECTED]> [031124 04:11]:
> The answer to 1) depends on your settings. 5 hours to scan 2286 IP addresses does
> seem like a long time. What plugins do you have enabled in the SCANNER_SET section?
Here's the excerpt from my .nessusrc file:
------------------------------------------
begin(SCANNER_SET)
10180 = yes
10277 = no
10278 = no
10331 = no
10335 = yes
10841 = no
10336 = no
10796 = no
11219 = no
11840 = yes
end(SCANNER_SET)
If this is in direct correlation to the plugin tab of the gtk client,
these should be 'RPC, 'Window', and 'Windows, User Management'.
>What nmap settings do you have set up? I take it that you have looked at your system
>load during the scan and that you aren't overloading your system?
I accepted the default set-up from the gtk client. Here's how the
resultant .nessusrc file looks (w. respect to nmap) :
-----------------------------------------------------
Nmap[radio]:TCP scanning technique : = connect()
Nmap[checkbox]:UDP port scan = no
Nmap[checkbox]:RPC port scan = no
Nmap[checkbox]:Ping the remote host = no
Nmap[checkbox]:Identify the remote OS = no
Nmap[checkbox]:Use hidden option to identify the remote OS = no
Nmap[checkbox]:Fragment IP packets (bypasses firewalls) = no
Nmap[checkbox]:Get Identd info = no
Nmap[radio]:Port range = User specified range
Nmap[checkbox]:Do not randomize the order in which ports are scanned = yes
Nmap[entry]:Source port : = any
Nmap[radio]:Timing policy : = Normal
As to the load on the box running nessusd:
it's high (like 6.0 plus or minus 4.0), but it must be due to
iowait, cuz the cpu is not hammered. Response time to entering
commands on the box is just fine.
> 2) specify 10.1.8.0/24 in your target file. Nessus accepts individual IP addresses
> and ranges given as x.x.x.x/yy and x.x.x.x - y.y.y.y
I tried the x.x.x.x/yy notation, and could have sworn that it did not
work. I have since tried the x.x.x.x - y.y.y.y notation, and found it
does work. Thanks.
> 3) grep REPORT nessus.nsr > highsev.nsr
Is 'nesus.nsr' supposed to be the name of a report file? If so,
I've been saving the reports to plain text so that I can easily
post-process them. What format is '.nsr' in, and if I make the nessus
client save in nsr format, can I easily convert to plain text so that I
can do the post-processing that i need?
> 5) Look for the Login configurations[entry]:SMB account = option in your .nessusrc.
> It also has a corresponging password entry too.
Ok. Can I specify more than one username/password combo? My goal is to
find Ms.Win* machines that are susceptible to the agobot virii, which
spread by exploiting 'weak' IPC$ password shares. Therefore, I'd like
to have nessus use the same set of username/passwords as the agobot
virii use, and that set is at least 50 in size.
Thanks for your response,
Jon Detert
> -----Original Message-----
> From: Jonathan C. Detert [mailto:[EMAIL PROTECTED]
> Sent: 21 November 2003 23:06
> To: [EMAIL PROTECTED]
> Subject: newbie performance & configuration questions
>
>
>
> Hello All,
>
> I'm new to nessus, and am having two problems:
>
> 1) i need to speed up the scans, if possible
> 2) it's hard to know what is possible to configure, and how.
>
> I have 6 questions. If anyone can help with any one of them, I'd be
> very grateful.
>
> Thanks in Advance,
>
> Jon Detert
>
>
> 1) speed issues
> it took about 5 hours to scan 2286 IPs, using only 3 categories of plugins,
> 'RPC', 'Windows', and 'Windows : User management'.
> Any suggestions on how to make it finish faster?
>
> Here are what I believe to be relevant bits from my nessusrc file:
> ------------------------------------------------------------------
> max_hosts = 20
> max_checks = 20.
> checks_read_timeout = 5
> delay_between_tests = 1
> ping_hosts = no
> reverse_lookup = no
> unscanned_closed = yes
>
> I'm running nessusd on an Intel PIII 800MHz w. 256 MB RAM
>
> 2) target specification
> As far as I can tell, my only choice is to give the client a file that lists
> every ip i want to scan. Is there some way to give it network definitions
> instead? Like 10.1.8.0/24 ?
>
> 3) is there a way to suppress reports less than the 'security hole' level?
> i.e. What if I don't care about the 'notes' and 'warnings' - if i only
> care about the 'security holes'?
>
> 4) output sorting
> Is there a way to make the output sort by IP ?
>
> 5) week Ms. IPC$ passwords
> Is there way I can tell it what usernames & passwords to try to
> connect to IPC$ shares?
>
> 6) Can someone point me to a reference that explains what all the
> options in my .nessusrc file mean, and what their possible values
> are?
>
> --
> Happy Landings,
>
> Jon Detert
> IT Systems Administrator, Milwaukee School of Engineering
> 1025 N. Broadway, Milwaukee, Wisconsin 53202
> _______________________________________________
> Nessus mailing list
> [EMAIL PROTECTED]
> http://mail.nessus.org/mailman/listinfo/nessus
--
Happy Landings,
Jon Detert
IT Systems Administrator, Milwaukee School of Engineering
1025 N. Broadway, Milwaukee, Wisconsin 53202
_______________________________________________
Nessus mailing list
[EMAIL PROTECTED]
http://mail.nessus.org/mailman/listinfo/nessus
