If none of the Plugin writers familiar with SSH respond, what you need to do is take the exact message, and search for the plugin responsible for reporting the problem. When you have the plugin program, you need to read the NASL language to check how the check is actually happening.
Nessus reports do not relate back the plugin program easily. Often system version numbers are discovered by attempting a login, then parsing the returned response. This is often not exact, and requires constant maintenance of the plugins as services are upgraded. The plugin library is typically at: /usr/local/lib/nessus/plugins Some simple unix commands can locate the exact plugin. If you respond with the exact plugin error message, someone here can probably help with this. Robert -----Original Message----- From: kalin mintchev [mailto:[EMAIL PROTECTED] Sent: Monday, June 13, 2005 4:28 PM To: Robert Keith Cc: [email protected] Subject: RE: reports > > Nope, that is not a problem. cool... thanks. i'd still need some info about how and if i can get it to avoid these false security holes... it be nice for it to be able to detect those things correctly... any other ideas? thanks.... > > When the plugins fail due to an incompatibility with the Nessus engine, > you > may see thousands of errors. > > Rgs, > Robert > > -----Original Message----- > From: kalin mintchev [mailto:[EMAIL PROTECTED] > Sent: Monday, June 13, 2005 4:13 PM > To: Robert Keith > Subject: RE: reports > > >> >> Just to be sure, check the nessusd.dump log file. >> Versions of nessus at release 2.0.x is no longer completely compatible >> with >> the current NASL library, and your results may be unpredictable. >> >> The dump file typically is at /usr/local/var/nessus/logs > > what to look for there? there is only one line in it: > > [32385](/usr/local/lib/nessus/plugins/openlink_overflow.nasl) Undefined > function 'cgi_dir' > > that's it... > > thanks.. > > >> Rgs, >> Robert >> >> -----Original Message----- >> From: [EMAIL PROTECTED] >> [mailto:[EMAIL PROTECTED] >> On Behalf Of kalin mintchev >> Sent: Monday, June 13, 2005 3:23 PM >> To: [email protected] >> Subject: reports >> >> >> hi all... >> >> i just successfully installed and run a few audits.. i liked it but... >> >> i got a few false security holes so i was wondering why. where is nessus >> getting its wrong information from?... >> >> for example i got a security hole warning for ssh on a freebsd machine. >> it >> says that the machine is running OpenSSH older then 3.7.1. it's not. >> here: >> # ssh -V >> OpenSSH_3.9p1, OpenSSL 0.9.7d 17 Mar 2004 >> >> and also i got a security hole for php 4.3 when the machine is running >> 4.3.10 >> # php -v >> PHP 4.3.10 (cli) (built: Feb 10 2005 14:16:46) >> Copyright (c) 1997-2004 The PHP Group >> Zend Engine v1.3.0, Copyright (c) 1998-2004 Zend Technologies >> >> is there a way to avoid those false positives? >> like fine-tuning the scan maybe? >> >> the nessus server information is: >> # nessus -v >> nessus (Nessus) 2.0.10 for FreeBSD >> >> tha _______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus
