Nessus - Network Vulnerability Scanner

Nessus is made up of two parts : a client and a server.
You need a Unix-like system to use the server (Linux is just fine).

Steps

1) First Install Nessus Server

2) Second Install Nessus Plugins

3) Third Install Nessus Client

4) After you have done the above Register with Nessus to activate Plugins

http://www.nessus.org/plugins/register

http://www.nessus.org/plugins/index.php?view=register

5) Activate Plugin,

#nessus-fetch --register 5DC4-24CD-0B17-6ED8-1BFA

5DC4-24CD-0B17-6ED8-1BFA --- is the code i received in my Mailbox

6) Update the Plugin
[root@localhost ~]# nessus-update-plugins -v

7) Add a Nessus user to login to server and scan for Vulnerabilities.

In Mandriva 2006

You need to fetch 3 things For using Nessus:

For Nessus Server
[root@localhost ~]#urpmi nessus

For Nessus Plugins
[root@localhost ~]# urpmi nessus-plugins

ftp://distrib-coffee.ipsl.jussieu.fr/pub/linux/MandrivaLinux/official/2006.0
/i586/media/contrib/nessus-plugins-2.2.4-1mdk.i586.rpm
installing nessus-plugins-2.2.4-1mdk.i586.rpm from /var/cache/urpmi/rpms
Preparing... ###############################
1/1: nessus-plugins #############################################

For Nessus Client
[root@localhost ~]# urpmi nessus-client

ftp://distrib-coffee.ipsl.jussieu.fr/pub/linux/MandrivaLinux/official/2006.0
/i586/media/contrib/nessus-client-2.2.4-1mdk.i586.rpm
installing nessus-client-2.2.4-1mdk.i586.rpm from /var/cache/urpmi/rpms
Preparing... ###################################
1/1: nessus-client ##################################


Update Nessus Plugin :

#nessus-fetch --register 5DC4-24CD-0B17-6ED8-1BFA

Now Create a Nessus User to be able to login from Nessus Client :

[root@localhost ~]# nessus-adduser

Add a new nessusd user
----------------------

Login : sriram
Authentication (pass/cert) [pass] : pass
Login password :
Login password (again) :

User rules
----------
nessusd has a rules system which allows you to
restrict the hosts that sriram has the right
to test. For instance, you may want
him to be able to scan his own host only.

Please see the nessus-adduser(8) man page for
the rules syntax

Enter the rules for this user, and hit ctrl-D once
you are done :
(the user can have an empty rules set)
deny 10.163.156.1
accept 10.163.156.0/24
default deny

Login : sriram
Password : ***********
DN :
Rules :

deny 10.163.156.1
accept 10.163.156.0/24
default deny

Is that ok ? (y/n) [y] Y
user added.

Start Nessus Server

[root@localhost ~]# nessusd -D
Loading the plugins... 2856 (out of 3584)
------------------------------------------------------------------------------
You are running a version of Nessus which is not configured to receive
a full plugin feed. As a result, your security audits might produce incomplete
results.

To obtain a full plugin feed, you need to register your Nessus scanner
at the following URL :

http://www.nessus.org/register/

------------------------------------------------------------------------------

All plugins loaded

Update the Plugins :

[root@localhost ~]# nessus-update-plugins -v

Now login to the client with the user name created to find ,
if there are any Vulnerabilities :

[root@localhost ~]#nessus (This will open the Nessus Client)