Manually Update Plugins on a Nessus Scanner (Linux)

I had an issue the other day with one of my Nessus Vulnerability Scanners which is being managed by Security Center. In Security Center the status of one of the Nessus scanners showed "Plugin Out of Sync". I tried to push the plugins to the Nessus scanner from the Security Center, but I was getting a status error of "Connection timed out".  So basically I was getting a latency issue on the connection. The Nessus scanner and the Security Center are in different states, so this may be why there is so much latency. I just built this Nessus scanner, so there were just too many plugins to be pushed over the wire by Security Center. To fix this issue, I just manually copied the plugins to the Nessus scanner. Then I manually loaded the plugins into the Nessus scanner. After I did this, I have not had this issue again.

Manually updating the Plugins can sometimes fix error or scanner status of "Protocol error". These instructions work on Nessus 5x and 6x, when managed by Security Center 4x or 5x.

Follow the instructions below to manually install plugins for the Nessus scanner on a Linux server. To do this on a Windows computer go here.

1. Login to the Nessus scanner.

root@earth> ssh nessus

2. Stop the Nessus service.

root@nessus> service nessusd stop

3. Remove the scanner from Security Center.

4. Reset the scanner

root@nessus> /opt/nessus/sbin/nessuscli fix --reset
Resetting Nessus configuration will permanently erase all your settings and causes Nessus to become unregistered.
Do you want to proceed? (y/n) [n]: y
Successfully reset Nessus configuration.

5. Connect the Nessus scanner.

root@nessus> /opt/nessus/sbin/nessuscli fetch --security-center
nessud can now be started, SeccrityCenter will upload the plugins

6. Manually copy over the plugins file.
    Copy the file tar.gz file from Security Center to or download latest plugins from Tenable.

Note - In Security Center The plugins are located here: /opt/sc/data/plugins

7. Load the plugins into Nessus.

root@nessus> /opt/nessus/sbin/nessuscli update plugins_file.tar.gz

* Update successful. The changes will be automatically processed by Nessus 

8. Start the Nessus service

root@nessus> service nessusd start

9. Login to the web interface for Nessus and wait for the bar to complete.

root@nessus> firefox https://localhost:8834

10. Login to the web interface for the Security Center. Add the Nessus scanner back and verify connectivity.

You're done.

If you have any questions or comments please post them below.

Related posts
Manually Update Plugins for your PVS
Reset Admin account on Security Center

How to install Java 7 & 8 on Solaris

In this how to, I will show you how to install Java 7 on a Solaris 10 operating system. These instructions will work if you need to install Java 8, as well. There have been some changes in the way Java is updated and installed. Now you can also update Java by using packages, unlike before when you had to install a package, to install a program and then patch to upgrade the program. This can be very helpful when installing Java 7 and 8, as Java 7 and 8 didn't come with Solaris 10 and getting patches for these versions of Java can be difficult if you don't have a software contract with Oracle. Oracle will only give patches Java 4, 5 and 6 if you only have a hardware contract with them. You can still update Java via patches like before, as explained in my previous post Updating Java on Solaris, With Oracle's new way way of doing things, we can install and patch Java on a Solaris system much faster and easier then ever before.

Download java

1) Go to java.com
2) Click on Free Java Download button
3) Click on See all Java downloads
4) Scroll down to the bottom of the page to where the Solaris files are.
5) Download the version you need for the platform to your using.

Installation of Java

1) Extract both the 32bit and 64bit versions of Java
Run the gzip -dc or zcat commands to extract the files

On SPARC processors

root@earth> gzip -dc jdk-7u80-solaris-sparc.tar.Z |tar xf -
root@earth> gzip -dc jdk-7u80-solaris-sparcv9.tar.Z |tar xf -

or

root@earth> zcat jdk-7u80-solaris-sparc.tar.Z |tar xf -
root@earth> zcat jdk-7u80-solaris-sparcv9.tar.Z |tar xf -

On x64/EM64T processors

root@earth> zcat jdk-7u80-solaris-i586.tar.Z | tar xf -
root@earth> zcat jdk-7u80-solaris-x64.tar.Z | tar xf -

Note - If you ran the commands as shown above, you will find the packages in same directory the .tar.Z files are in.

2) Install the packages
Enter the command below, when prompted answer yes to all the questions.

root@earth> pkgadd -d . SUNWj7rt SUNWj7dev SUNWj7cfg SUNWj7man
root@earth> pkgadd -d . SUNWj7rtx SUNWj7dvx

Note - If you want a minimal install, then all you need to install is SUNWj7rt & SUNWj7rtx

Note - Java 8 has combined the 32 bit and 64 bit versions, so you only need to install what appears to be only the 32 bit version.

Now you are done, congratulations. If you want more info, review the references and man pages below. Also be sure to checkout some of my other posts on Java.

References
Installation Instructions form Java.com
The Offical Instructions from Oracle

Man Pages
pkgadd
gzip
zcat

Related posts on this blog:
How to install or upgrade Java in Linux
Updating Java on Solaris
Checking Java Versions Remotely
Download Java in MOS
Access the Java Control Panel
Updating Java in NetBackup

If have any question on how to install Java on Solaris then feel free to ask below.

Find Free Money

From time to time you unknowingly leave money behind. Go to the webpage linked to below, to access resources that will help you find that money. This webpage has links to unclaimed properly departments of all the states, as well as Washington DC and Puerto Rico. Go to each state you have lived in to see if you have anything to claim there. Also check the states that any of your relatives may have lived in if the have passed on.


http://www.osc.state.ny.us/ouf/money/


Good luck any free money that is owed to you.

Is SELinux running?

There is a simple question that you need to know when you get a new Linux server to manage, is SELinux running? If so, what are its setting? Below are some ways to answer these questions.

See if the SELinux configuration file exists and if it does what the settings for SELinux are.

root@earth> cat /etc/sysconfig/selinux
#    This file controls the state of SELinux on the system.
#    SELINUX= can take one of these three values:
#                enforcing - SELinux security policy is enforced.
#                permissive - SELinux prints warnings instead of enforcing.
#                disabled - No SELinux policy is loaded.
SELINUX=permissive
#    SELINUXTYPE= can take one of these two values:
#               targeted - Only targeted network daemons are protected.
#               strict - Full SELinux protection.
#               mls - Multi Level Security protection.
SELINUXTYPE=targeted
#    SETLOCALDEFS= Check local definition changes
SETLOCALDEFS=0

The getenforce command displays the current SELinux enforcement policy being used.

root@earth> /usr/sbin/getenforce
Permissive

The sestatus command is a tool that is used to get the status of  a system running SELinux.

root@earth> /usr/sbin/sestatus
SELinux status:              enabled
SELinuxfs mount:           /selinux
Current mode:                permissive
Mode from config file:     permissive
Policy version:               21
Policy from config file:    targeted

Reference
Security Enhanced Linux (SELinux) project page
Wikipedia - SELinux

Clear fmadm or FMA fault logs

If the System Administrator doesn't have log rotation setup, logs fill up on the server from time to time. Usually the system or audit logs are the root cause, but sometimes the Fault Management Architecture (FMA) logs are the cause. On Solaris or if installed on Linux, there is a utility called fmd (Fault Manager Daemon) that checks for issues with the system hardware. This program is managed by the fmadm program. Follow the steps below to clear out the logs.

Clear error fmadm reports

root@earth> fmadm repair  UUID

The UUID is the event code that is shown when you run the fmadm faulty command.

* Note: If the above command doesn't clear the error then, there is a real issue hardware that needs to be addressed.

Clear reports and resource cache

root@earth> cd /var/fm/fmd
root@earth> rm e* f* c*/eft/* r*/*

Clearing out FMA files without rebooting.

root@earth> svcadm disable -s svc:/system/fmd:default
root@earth> cd /var/fm/fmd
root@earth> find /var/fm/fmd -type f -exec ls {} \;
root@earth> find /var/fm/fmd -type f -exec rm {} \;
root@earth> svcadm enable -s svc:/system/fmd:default

Reference
blogs.oracle.com: How to clear fmadm log or FMA faults log
Fault Management Architecture

Manpage:
fmadm(1M)
fma

Symantec Training

I found some free Symantec training. All you need to do is register for a account. The free classes are listed as Symantec eLibrary. Select this item and go to the checkout.

http://techcenter.symantec.com/ecampus/enterprise

Unlock locked accounts

These are my notes no unlocking user accounts, below I go over a few ways to get a user account back up and running. Such as changing the expiration date on an expired account and resetting the PAM Tally for a user.

In keeping with the space theme, I will be using earth as the server's hostname and man as the name of the user account.

This the most common way to unlock your account.

root@earth> passwd -u man

Change the expiration date of the user account

root@earth> usermod --expire 9999 man

This works on some systems

root@earth> ipa user-unlock man

This resets the account if all else fails.

root@earth> pam_tally --user=man --reset

References.
www.cyberciti.biz
From RHEL user-unlock command
SuperUser pam command

Disable VRFY for Postfix (Retina ID 146)

The Retina Network Security Scanner from BeyondTrust, Inc was run against my servers and ID 146 was a hit or finding on one of my servers. Retina can give good results on network security vulnerabilities, but false finds are also common. The problem with that the scanner is that it doesn't show you how it finds the vulnerability or how to fix it. I did some research and it turns out that you need to disable the VRFY command in postfix. Below I have posted the security vulnerability from Retina, with instructions on how to fix the issue.

What Retina says about the vulnerability 

Retina ID or vID 146
Description The VRFY command can lead to a remote attacker gaining the first and last name registered to any given email account. This can aid an attacker in social engineering attacks.

Discussion - fix Follow your SMTP server's manual on how to disable the VRFY command. If no instructions are provided contact your SMTP server's vender.

Severity = Low to Med
SevCode = III
Port = TCP:25
IA Controls = Mail Server

Retina scan Version 5.19.9.2802
Expected "252" and found "252 2.0.0. administrator"

Test for this issue.

man@earth> telnet localhost 25
Trying 127.0.0.1...
Connected to localhost
Escape character is '^]'.
220 earth.planet.com ESMTP Postfix
VRFY
502 5.51.1 VRFY command is disabled

If the VRFY command does not come back as "VRFY command is disabled" then this is a finding.

Remediation
Add this line below to the /etc/postfix/main.cf.

disable_vrfy_command = yes

Reference section

Ref for fix:
cyberciti.biz

Ref for Security issue:
iss.net
xforce.iss.net

Manpages
Sendmail
Postfix

See Cyber Attacks on Global Scale

I found this website that claims to show live cyber attacks.

http://map.ipviking.com/

Brocade Training

It appears that Brocade has some free training on their website. I don't know about you but I love free training. You will need to register on the site to get these benefits.



http://community.brocade.com/t5/Brocade-University/Brocade-University-At-a-G
lance-Schedule/ta-p/3063

I hope someone finds this useful.

How to install or upgrade Java in Linux

These are my notes on how to install or update Java on a Linux server. In this how to, I will be using the Java from Oracle and not the operating systems or distros repository. You can download and install either a rpm or a tar file, from Oracle's site.

When using the Java provided on Oracle's website, they give you a choice of downloading rpm or tar file.

You can download Java here.
http://www.java.com/en/download/linux_manual.jsp

Installing Java with using RPM

Find the current version of Java on the system.

root@earth> find / -name java -type f
/usr/java/jre1.7.0_55/bin/java

Note If you use which or java -version commands to find Java on you system. This will only show your the system's main java. You may have additional versions installed.

Now take each line of output and paste it at the end of this command. This gives you the name of the rpm package that installed this file and version of Java.

root@earth> rpm -qf    /usr/java/jre1.7.0_55/bin/java
jre-1.7.0_55-fcs

Uninstall the old package.

root@earth> rpm -e  jre-1.7.0_55-fcs

Note- Do not run the above command for java that is part of an application. If the file was in /usr/bin/ you should be fine.

Install Java

root@earth> rpm  -ivh    jre-7u65-linux-x64.rpm

You can alternately upgrade Java instead.

root@earth> rmp   -Uvh    jre-7u65-linux-x64.rpm

Install Java using a tar file
Change directory to where Java is going to be installed. Usually it will be /user/java.

root@earth> cd  /usr/java

Move the tar file to /usr/java.

Unpack the tarball and install Java

root@earth> tar  zxvf   jre-7u65-linux-i586.tar.gz

Delete the tar file after you test Java and your done.

Reference:
Java.com

Related posts on this Blog
How to install Java 7 & 8 on Solaris
Access the Java Control Panel
Updating Java on Solaris