On Thu, Jan 24, 2002 at 09:38:43AM -0500, Perciaccante, Robert wrote:
> Well, here is the 30,000 foot view.
>
> Nessus runs on a box that is dual-homed. For argument sake:
>
> eth0 - (Nessus interface)
> eth1 - Admin interface
>
> eth0 is on a DMZ rail
> eth1 is on an admin rail
>
> The overall concept is this. Eth1 is used to collect results, change
> .nessusrc files, etc. Eth0 is on a DMZ, and if bound to an IP address, is
> vulnerable to attack from anyone on this segment.
>
> If Nessus was able to send packets out with spoofed IP/MAC addresses, and
> then sniff the results off the wire, it could perform the necessary scans,
> but not itself be vulnerable to attack on that segment.
>
> Does this make sense? I know that this is WAY over my head (still
> learning), but I would like to see if it is possible, or try to figure out a
> way to retro-fit Nessus to do this.
Provided that eth0 and eth1 are on different subnets (which is
expected), then you can do that without any problem, as Nessus does not
bind any port during the scan (apart 1241/tcp which is always bound).
So if you want nessusd to be reachable only from the admin network, then
start it as :
nessusd -D -a ip.of.the.host.on.the.admin.network
-- Renaud
