How to Setup Nessus to Perform a Security Vulnerability Test on a Linux Machine

Vulnerability testing is a proactive approach to identifying potential weaknesses in your system. One of the most renowned tools for this purpose is Nessus. Originally a free open-source tool, Nessus has evolved into a full-fledged, commercial vulnerability scanner, trusted by many professionals.

In this guide, we will walk you through the process of setting up Nessus on a Linux machine to perform a security vulnerability test. By the end of this tutorial, you’ll have a clearer understanding of your server’s security posture. For a deeper dive into various server types, you might want to explore articles on web server software, Apache, Nginx, and LiteSpeed.

Let’s get started.

Step 1. Installation of Nessus

Visit the official Tenable website to download the Nessus package suitable for your Linux distribution.

Once downloaded, navigate to the directory containing the package and use the package manager to install it. For Debian/Ubuntu, you might use:

sudo dpkg -i Nessus-x.x.x.deb

For CentOS/RedHat:

sudo rpm -ivh Nessus-x.x.x.rpm

After installation, start the Nessus service:

sudo service nessusd start

Step 2. Configuration of Nessus

Access the Nessus Web Interface: Open a web browser and navigate to https://localhost:8834/. You should be greeted with the Nessus setup wizard.

• Create an Account: Set up an administrator account by providing a username and password.
• Activation: Nessus requires an activation code, even for the free version. Register on the Tenable website to get your activation code and enter it.
• Plugin Download: After activation, Nessus will download and update its plugins, which are essential for the vulnerability scanning process.

Step 3. Setting Up a Vulnerability Scan

Access the Nessus web interface and log in using the credentials you created.

Click on ‘New Scan’ and choose a scan type. For general purposes, a ‘Basic Network Scan’ is a good starting point.

Configure Scan Settings:

• Name: Provide a descriptive name for your scan.
• Targets: Enter the IP addresses or range you want to scan.
• Schedule: You can set the scan to run immediately or schedule it for a later time.
• Run the Scan: Once everything is set, click on ‘Save & Run’. Nessus will start the vulnerability scanning process.

Step 4. Analyzing the Results

After Nessus completes its vulnerability scan, you’ll be presented with a comprehensive report. This report is more than just a list; it’s a detailed analysis of your system’s security posture. Here’s how to break down and understand the results:

1. Vulnerability Overview: At the top of the report, Nessus typically provides an overview, often in the form of a chart or graph. This gives you a quick glance at the number of vulnerabilities categorized by their severity levels – Critical, High, Medium, Low, and Informational. If your chart shows a high number of critical vulnerabilities, immediate action is required. These are vulnerabilities that can be easily exploited and can lead to significant damage or data breaches.
2. Detailed Vulnerability Breakdown: This section lists each vulnerability detected. For each entry, you’ll see:
   • Vulnerability Name: A descriptive name of the vulnerability.
   • Severity Level: How critical the vulnerability is.
   • CVE Number: The Common Vulnerabilities and Exposures number, which is a standard identifier for publicly known cybersecurity vulnerabilities.
   • Description: A detailed explanation of the vulnerability, how it can be exploited, and the potential impact.

   A vulnerability named “OpenSSH Version 7.1 Detected” might be listed with a medium severity level. The description might explain that this version of OpenSSH has known vulnerabilities that can allow unauthorized access if exploited.

3. Solution & Mitigation: For each vulnerability, Nessus provides recommended solutions or mitigation strategies. This can range from patching software, changing configurations, or even disabling certain services. For the aforementioned OpenSSH vulnerability, the solution might be to update OpenSSH to the latest version or apply a specific security patch.
4. Affected Hosts: Nessus will list the IP addresses or hostnames of the devices affected by each vulnerability. This is especially useful for network-wide scans where multiple devices might be vulnerable. If you’re scanning a network of 50 devices and 10 have the OpenSSH vulnerability, Nessus will list the IP addresses of those 10 devices.
5. Additional Information: Some vulnerabilities might come with links to external resources, like the vendor’s website, where you can find more details or patches. There might also be references to known exploits, which can give you an idea of how attackers might take advantage of the vulnerability. A vulnerability in a popular web server software might include links to the official documentation where the vendor discusses the vulnerability and provides official patches.
6. Plugin Output: Nessus uses plugins to check for specific vulnerabilities. The output from these plugins can provide technical details about the detected vulnerability, such as which tests were performed and what results led to the vulnerability being flagged. A plugin checking for SSL vulnerabilities might output details about the SSL certificate, encryption algorithms in use, and any insecure configurations detected.

Step 5. Regular Maintenance and Updates

After setting up Nessus and conducting your initial scans, it’s crucial to maintain the tool and keep it updated:

• Update Nessus Regularly: Tenable, the company behind Nessus, frequently releases updates to address new vulnerabilities and improve the tool’s functionality. Ensure you regularly check for and apply these updates. I.e. sudo nessuscli update.
• Review and Act on Scan Results: Regularly review the results of your Nessus scans. Address high-priority vulnerabilities immediately and develop a plan to tackle less critical issues.
• Stay Informed: Join forums, or online communities related to Nessus and vulnerability scanning. This will keep you informed about the latest best practices, emerging threats, and updates.

Step 6. Integrating Nessus with Other Tools

For a more comprehensive security posture, consider integrating Nessus with other security tools:

• Intrusion Detection Systems: Tools like Snort can detect malicious activities in real-time. Integrating Nessus with an IDS can provide a more holistic view of your network’s security.
• Security Information and Event Management: Platforms like Splunk or ELK Stack can aggregate logs from various sources. By feeding Nessus scan results into a SIEM, you can correlate data and identify patterns that might indicate a security threat.
• Configuration Management Tools: Tools like Ansible or Puppet can help automate the patching process. If Nessus identifies a vulnerability, these tools can automatically deploy patches or configuration changes to address the issue.

Commands Mentioned

• sudo dpkg -i Nessus-x.x.x.deb – Installs the Nessus package on Debian/Ubuntu systems.
• sudo rpm -ivh Nessus-x.x.x.rpm – Installs the Nessus package on CentOS/RedHat systems.
• sudo service nessusd start – Starts the Nessus service.

FAQ

1. What is Nessus primarily used for?

   Nessus is a vulnerability scanner used to detect potential security threats in systems, networks, and applications. It provides detailed reports on vulnerabilities, their severity, and recommendations for mitigation.

2. Is Nessus free to use?

   Nessus offers a free version called Nessus Essentials, which is suitable for personal use or small organizations. However, for advanced features and larger networks, a paid version is recommended.

3. How often should I run vulnerability scans?

   It’s advisable to run vulnerability scans regularly, depending on the criticality of your infrastructure. For high-risk environments, weekly scans might be suitable, while monthly scans might suffice for less critical systems.

4. Do I need to shut down my server during a scan?

   No, Nessus is designed to scan live systems. However, it’s always a good practice to inform stakeholders and ensure backups are in place before initiating a scan, especially in production environments.

5. Can Nessus detect all vulnerabilities?

   While Nessus is a powerful tool with a vast database of known vulnerabilities, no scanner can guarantee 100% detection. It’s essential to combine Nessus scans with other security practices for comprehensive protection.

Conclusion

Ensuring the security of your server is a continuous process. Tools like Nessus provide an invaluable perspective on potential vulnerabilities, but they are just one part of a broader security strategy.

Nessus is a powerful tool in the arsenal of any webmaster or server administrator. While it provides invaluable insights into potential vulnerabilities, it’s essential to remember that no tool is infallible.

By following the steps outlined in this guide, you’ll be well on your way to ensuring that your Linux server remains secure and resilient against potential threats.

Regularly updating software, adhering to best practices in server management, and staying informed about the latest threats are equally crucial. Whether you’re using a dedicated server, VPS server, cloud hosting, or shared hosting, it’s essential to prioritize security to protect your data, users, and reputation.