Audit System At CESNET-CERTS - WSEAS

WSEAS TRANSACTIONS on COMPUTERSPavel Vachek /opt/nessus/sbin/nessus-mkcert3 Auditing server configurationLinux on the auditing server runs in runlevel 3, i.e.,without any graphic user interface. Both the Nessusserver and command-line client are installed on thismachine. However, the Nessus GUI client must belaunched at least once on an accessible machine togenerate the appropriate client configuration file;afterwards, this resulting configuration file is to becopied to the auditing server.Command /opt/nessus/sbin/nessus-addusercreates nessusd account for user root (authentication password, password e.g., Secret). Forsimplicity, rules may be empty (press CTRL-Donly); this means that user root can audit anyInternet machine. Individual Nessus users accessingNessus through the E-mail interface will be limitedusing PERM directory as described later.The auditing server will run as few network servicesas possible - e.g., SSH (OpenSSH), SMTP (Postfix)and NTP (ntpd) only. Firewall will let these servicescommunicate with selected IP addresses only toprotect the server from Denial of Service and spamattacks.The following or similar data should be set in thenessusd.conf file:max hosts 10max checks 10log whole attack nodumpfile /dev/nullport range 0-65535optimize test nochecks read timeout 5safe checks noauto enable dependencies yesuse mac addr nolisten address 127.0.0.1 (if access from externalNessus clients is to be allowed, IP address ofexternal interface should be given here)3.1 Installing NessusTo access the up-to-date Nessus test plugins forcommercial purposes, buying the ProfessionalFeedlicense for an enterprise network is necessary.Tenable sends us our activation code and URL to loginto the Customer Support Portal. Mailedinstructions should be followed to activate theProfessionalFeed. We log into the auditing serverusing the root username. Using lynx or a similarbrowser, we download Nessus x.y.z for Linux andMD5.asc files from [12].Note: The following paths/filenames are valid for theOpenSUSE 10.x. Some data may slightly differ forother Linux distributions.where:max hosts . maximum number of hosts to test atthe same timemax checks . maximum numer of plugins to runconcurrently on each hostlog whole attack . log data on each pluginlauncheddumpfile . plugin error messages will be loggedhereport range . TCP and UDP ports to be tested(default: some 9000 ports according to/opt/nessus/var/nessus/services.txt)optimize test . banners of remote services aretrustworthychecks read timeout . 5 seconds for LANssafe checks . only safe tests should runauto enable dependencies . all necessary pluginsare launched automaticallyuse mac addr . tested machines are identifiedusing Ethernet addresseslisten address . nessusd listens on this interface IPaddressNessus-x.y.z-suse10.0.i586.rpm checksum should bechecked against the MD5.asc file. Both Nessus serverand command-line client are installed using rpm -Uvh Nessus-x.y.z-suse10.0.i586.rpmNessus server configuration file is created at fter,nessusd.conf). The following will be displayed:Create a nessusd certificate using/opt/nessus/sbin/nessus-mkcertAdd a nessusd user use/opt/nessus/sbin/nessus-adduserStart the Nessus daemon (nessusd) useby typing /etc/rc.d/nessusd startStart the Nessus client (nessus) use/opt/nessus/bin/nessusRegister your Nessus scanner athttp://www.nessus.org/register/ toobtain all the newest pluginsUsing the following command,3.2 Installing and configuring nessusd /etc/rc.d/nessusd startNessusd is started and all plugins are downloadedX.509 certificate is created usingISSN: 1109-27501454Issue 9, Volume 8, September 2009

WSEAS TRANSACTIONS on COMPUTERSPavel Vachektested. Security audit is launched by clicking on theSTART THE SCAN button. Audit results shouldagain be inspected and any problems concerningthis workstation should be fixed. After the audit,Nessus client configuration file /root/.nessusrc iscreated which allows running all test plugins. It iscopied to file .NESSUSRC and moved to theauditing server.from the Nessus plugin server. Command ps -ef grep nessusdshould display the following string if nesssusd islistening:nessusd: waiting for incomingconnectionsTo allow automatic plugin download, the followingshould be set in nessusd.conf on the auditingmachine:3.3 Installing and configuring Nessus clientThe following command# Automatic plugins updates - if enabled and nessusis registered, then# fetch the newest plugins from plugins.nessus.orgautomaticallyauto update yes# Number of hours to wait between two updatesauto update delay 24# Should we purge the plugin db at each update ?(slower)purge plugin db no nessus -x -T text -q localhost 1241 root Secrettargets results &checks both Nessus client and server operation usingthe command-line interface. In addition, a “safe”security audit of our auditing server is performedfrom within.Parameters are as follows:-x . X.509 certificate is not checked-T text . result file in ASCII text format-q . batch modelocalhost . nessusd server address1241 . nessusd listens on this TCP portroot . nessus usernameSecret . this user's passwordtargets . file containing a list of machines to betested (localhost)results . name of audit result file4 E-mail interface programsThere are two e-mail interface programs: auditXXand procXX. Both are written in the Perl language.Both the Perl interpreter and modules from [13] areneeded.AuditXX runs under the audit username. Its maintasks are: receiving e-mail from local SMTP server checking for PGP signature presence andvalidity checking for correct length of receivedmessages (messages with excessive lengthare silently ignored but reported to theauditing server administrator; most likelycause for this may be spam or even ourown bounced outgoing messages) sending unsigned e-mail containing a shortsummary of allowed commands and theirpossible parameters in response to receivedunsigned e-mail extracting required audit parameters(CONFIG, FORMAT, DELAY, etc.) fromreceived valid mail building and queuing appropriate batch fileQfile sending PGP-signed response (especiallypositive acknowledgement message) toreceived signed e-mailThe following notice will be displayed:The plugins that have the ability tocrash remote services or hosts havebeen disabled. You should activate themif you want your security audit to becompleteAfter the audit has terminated, the results file shouldbe checked and any security problems of the auditingserver should be fixed.To allow all plugins including those potentiallydangerous, a GUI Nessus client must run on someother accessible machine – probably on a workstationon which GUI is running. NessusClient-x.y.zsuse10.3.i586.rpm together with MD5.asc should bedownloaded, checked and installed on thisworkstation. Command nessus &Program procXX runs under the root username. Itsmain tasks are: inspecting the queued batch files everyminutewill display the Nessus GUI interface. Allappropriate settings should be selected, especially theENABLE ALL option and address of machine to beISSN: 1109-27501455Issue 9, Volume 8, September 2009

WSEAS TRANSACTIONS on COMPUTERS Pavel Vachekchecking for existence of lock files. Thesefiles indicate whether another security auditis running or whether the Nessus clientcould not connect to the Nessus server; thelatter might happen, e.g., during Nessusplugin feed retrieval and this would be nocause for alarmlaunching security audit using appropriateparameters at proper time (i.e., if no otheraudit is running, security audit should startwith a tolerance of /- 30 seconds)returning the security audit results in a PGPsigned mail to the originating e-mailaddress.(file is any test file to be sent, e.g., in HTMLformat). After successful termination, the followingshould be displayed:xx input lines, yyy charactersread . sent.Recipients should check for correct mail deliveryand readability. MailtestXX proper might essages) might contain some as well.4.3 Installing and testing auditXXAuditXX (currently, audit53) should be copied to/home/audit/bin.AppropriatePGPKeyId,passphrase and server e-mail address must beinserted into the auditXX source file:Installation instructions of the e-mail interface onserver audit.example.net follow. Username audit iscreated to communicate using e-mail addressaudit@audit.example.net. Nessus server andcommand-line client, Postfix, sshd, ntpd, and procXXrun under the root username. from 'audit@audit.example.net';# server Email address keyid '037ADEADBEEF1256';# foraudit@audit.example.net pass 'AuditPwd';# Passphrase4.1 E-mail system configurationAudit.example.net is the only host accepting e-mailfor the auditing server. Zone file for the example.netdomain contains a single MX record for the audithost (no secondary backup MX servers are used toavoid possible spam):audit IN MX 10 auditUnder OpenSUSE 10.x, the followingnecessary to allow access to Perl modules: chmod -R 755 /usr/lib/perl5/site perl/5.8.8/*To test the auditXX operation, a short (or possiblyempty) unsigned e-mail should be sent to theauditing server. AuditXX should respond with an email similar to the following Fig.5:SMTP server Postfix is configured both for acceptingand sending e-mail. E-mail delivered toaudit@audit.example.net is forwarded to theauditXX standard input using the .forward file:\audit, " /home/audit/bin/auditXX"From: audit@audit.example.netDate: Fri, 21 Mar 2009 14:21:58 0000To: test@example.czSubject: Re: TEST 14.2 PGP and E-mail system operation .net are generated using gpg.Resulting private key is also copied into the rootkeyring. PGP-signed test e-mail containing simpletext and an attached file can be sent using ourprogram MailtestXX. PGP KeyId, passphrase,sending and receiving e-mail address must beinserted into the source file:AUDIT v. 53 (4.3.2009) start: Fri Aug21 14:21:58 2009 GMTThe following UNSIGNED text has T 1 from 'audit@audit.example.net';# server email address to 'test@example.cz, test2@example.cz'; #receiving address(es) keyid '037ADEADBEEF1256';# foraudit@audit.example.net pass 'AuditPwd';# Passphrase for PGP keyPlease resend using a correct PGP key.This may also help:CESNET AUDIT v. 53 (4.3.2009) HELP:CONFIG: previous full safeFORMAT:previous nbe html html graph text xml old-xml tex nsrTARGET:previous list of IP ordomain addresses to be testedTCPSCAN: previous all defaultLaunch the program as follows: MailtestXX fileISSN: 1109-2750was1456Issue 9, Volume 8, September 2009

WSEAS TRANSACTIONS on COMPUTERSDELAY:mm MVERBOSEENDPavel Vachektested. Filename format is:ssssssssss.rrrr or ssssssssss.tttttttttt.rrrr ssssssssss . requested start time of securityaudit in Unix epoch time tttttttttt . time of sending this request ifdelay specified in Unix epoch time rrrr . pseudorandom number to makefilenames unique.hh H mm M mm M hh H hh H (for debugging purposes)(end of input data)Fig.5: Response to a short unsigned e-mailDetails concerning any encountered errors and theircauses can be found in file /home/audit/DEBUG or inthe Postfix error log.Files CFG and CFG.sav contain the CONFIG,FORMAT, TARGET, and TCPSCAN parameters ofthe last successful security audit. For repeatedaudits, parameter values missing in e-mail arereplaced by the saved values in CFG. However, atleast one parameter must always be given so that anempty signed e-mail sent inadvertently does notlaunch scan by mistake.In the next step, correct receipt of PGP-signedmessages must be tested. Let us suppose that: user test@example.cz may run security auditof 10.1.2.3, 10.2.3.5user user@example.com may run securityaudit of 192.168.100.200.204Files in the /home/audit/AUDIT/PERM directorycontain a list of IP addresses which respective usersare allowed to test. Their format is simple:We shall call a PGP signing party with these users,sign their public keys and insert them into audit androot user keyrings. All data necessary for theoperation of security audits will be found within the /home/audit/AUDIT directory:# test@example.cz may test 10.1.2.3, 10.2.3.5:10.1.2.310.2.3.5 ls -R /home/audit/AUDIT/# user@example.com - 192.168.100.200.204# Several addresses (space or TAB separated) may# be given on each line192.168.100.200 192.168.100.201 192.168.100.202192.168.100.203 192.168.100.204/home/audit/AUDIT/: (created on 1st auditXX run)test@example.cz/(created on 1st receipt ofsigned e-mail from user)user@example.com/(created on 1st receipt ofsigned e-mail from test)PERM/(created on 1st receipt ofsigned e-mail)PROC/(created manually by root)QUEUE/(created on 1st auditXX run)# CIDR notation may also be used:# another user might be allowed to check whole# class B' e.cz:CFG CFG.sav(created by auditXX)Administrator of the auditing server creates thesefiles manually according to the users' requests. Heknows these users personally and he can check ifthey have a right to audit the respective machines.This is also the reason why auditing requests fromexternal users whom the audit administrator doesnot know personally are rejected; official networkadministrators of University and/or CESNETcustomer networks are allowed audits only of theirown respective networks as stated in the CESNETAudit System FAQ [14]./home/audit/AUDIT/user@example.com:CFG CFG.sav(created by auditXX)/home/audit/AUDIT/PERM:test@example.cz user@example.commanually by audit administrator)(files created/home/audit/AUDIT/PROC:NESSUSFAIL(lock file created and deletedby procXX if necessary)NESSUSLOCK(lock file created and deletedby procXX if necessary)RESFILE(result file created byprocXX)TARGFILE(list of tested hosts createdby procXX)Full operation of the e-mail interface can be testedeasily as described in Chapter 2 above. Completedebugging information of audit request processingcan be found in file /home/audit/DEBUG; anyimportant error message is sent to the user by e-mailin the format of his original e-mail, i.e., unsigned,inline (clearsigned) PGP, or PGP/MIME. Auditserver administrator is also informed using SMS ore-mail message./home/audit/AUDIT/QUEUE:Queued files are inserted by auditXX and removed byprocXX. Top (the oldest) file is the first one to beISSN: 1109-27501457Issue 9, Volume 8, September 2009

WSEAS TRANSACTIONS on COMPUTERSPavel VachekComplete log of procXX operation can be found in/root/DEBUG; again, any important error messageis e-mailed both to the user and audit serveradministrator.4.4 Installing and checking procXX operationThis is even simpler. ProcXX (current version 66)should be copied into /root/bin. As in the case ofauditXX, the following must be inserted into thesource file: from 'audit@audit.example.net';mail address keyid '037ADEADBEEF1256';audit@audit.example.net pass 'AuditPwd';5 OpenVAS# server e-As mentioned in Chapter 2 above, Nessus version 2was released under the GPL license but thefollowing versions were released using a closedlicense in binary form only. In reaction to this, bythe end of 2005, a team of developers launched theOpenVAS Project [15] which is a fork of Nessusversion 2.2.5. The OpenVAS (Open VulnerabilityAssessment System) attempts to provide both theOpenVAS and its Plugin Feed free of charge usingGNU GPL.## PassphraseProcXX is launched by cron every minute; therefore,the following two lines should be put into crontab:# Checking the nessus audit queue every minute:* * * * * /audit/AUDIT/QUEUE/, procXX checks thefilename of the first, i.e., oldest file. Its leftmost partgives the Unix epoch time when the security audit isto be launched. At appropriate time and if no otherinstance of Nessus is running, a new Nessus client islaunched with appropriate parameters taken from thisQfile. At the same time, NESSUSLOCK file iscreated as described in the following paragraph.After Nessus terminates, procXX e-mails the securityaudit results to the appropriate user address anddeletes the Qfile. Afterwards, the first followingQfile (if any) is checked and the above process isrepeated immediately; otherwise, procXX terminatesand NESSUSLOCK is deleted.Rough comparison of Nessus and OpenVAS features(end of August 2009) is as follows:Latest version: Nessus: OpenVAS:Approximate number of test plugins: Nessus:30000 OpenVAS:13000Server communicates on default port: Nessus:TCP 1241 OpenVAS:TCP 9390Command-line client: Nessus:part of server OpenVAS:GUI klient "--disablegtk"Lock file/home/audit/AUDIT/PROC/NESSUSLOCK is createdwhen Nessus is launched. Existence of this fileindicates that no other security audit may be started.Immediately after its start, procXX checks if fileNESSUSLOCK exists. Should procXX learn that thisis so and that NESSUSLOCK is older than somepreselected value (several hours), it sends warningSMS and/or e-mail messages at regular intervals tothe audit server administrator.Plugin Feed Enhanced Security: Nessus:none OpenVAS:PGP-signed pluginsCost for Professional Users: Nessus:1200 USD/year OpenVAS:noneAnother lock file/home/audit/AUDIT/PROC/NESSUSFAIL is createdif Nessus is launched but terminates with an errormessage. So far, this has been recorded in caseswhen download of Nessus Plugin Feed wasunderway and a new instance of Nessus waslaunched at the same time. This is taken as an errorwhich may yet be recovered soon: NESSUSFAILindicates that launch of Nessus using appropriateQfile may be reattempted several times. To be able todistinguish the current Qfile which is to be reused, itsfilename is prefixed with character C'. Serveradministrator will be informed about every suchrepeated attempt as well as about the final outcome.ISSN: 1109-27504.0.12.0.4The above data shows that OpenVAS looks veryinteresting, especially but not only with regard to itszero cost. Its main disadvantage seems to be thesignificantly lower number of OpenVAS test pluginscompared to that of Nessus.While collecting further data on Nessus andOpenVAS, an interesting document [16] was found.Its main conclusions are: 1458Nessus discovered significantly more of allknown vulnerabilities (mainly older ones)OpenVAS found significantly more CVEIssue 9, Volume 8, September 2009

WSEAS TRANSACTIONS on COMPUTERSPavel Vachekvulnerabilities which were discoveredduring last two years (2008 and 2009). Overall, OpenVAS is also a reliable andtrustworthy tool for security audit.A diagram summarizing the results of this document is shown in the following Fig.6:NESSUS x OpenVASDetection Efficiency Comparison9080All CVEs25 new CVEs70[%]605040nessus, openvas 'safe' tests30NESSUS, OpenVAS 'all' tests20100nessusNESSUSopenvasOpenVASFig.6: Comparison of Nessus and OpenVAS known vulnerability detection efficiencyOpenVAS on tested machines give identical results.In near future, CESNET Audit users should be ableto run OpenVAS audit of their machines after theNessus audit terminates simply

Nessus versions are available: Nessus version 2.2.11 is an old version which is still distributed in source code under the GPL license. Tenable does not support this version any more. Nessus 3.2.1 has been until recently the latest version. Otherwise, all features of the following version 4.0.1