On Jun 20, 2005, at 12:38 PM, George A. Theall wrote: > On Mon, Jun 20, 2005 at 10:39:33AM +0200, > M.A.C.Dekker@private wrote: > > >> Is it possible to run a local check for risky lines in say >> the apache config http.config or the php config php.ini >> files? I seem to see only local scans on registry-values? >> > > As others have pointed out, this is do-able under Windows. > > Under *nix, though, plugins can't run arbitrary commands by > default unless they have been signed using the private key > corresponding to the public key nessus_org.pem (in > /usr/local/var/nessus by default). You can shoot yourself in > the foot^H^H^H^H^Hget around this restriction if you insist > by setting 'nasl_no_signature_check' in nessusd.conf and > restarting the Nessus server. See Edgeos' Nessus Knowledge > Base for more info on this: > > http://www.edgeos.com/nessuskb/details.php?option_id=288 Is it possible to gen your own keys and sign your own nasl scripts? I mean I know it would break the auto-update, but would allow you to do other things. -- MadHat (at) Unspecific.com, C˛ISSP E786 7B30 7534 DCC2 94D5 91DE E922 0B21 9DDC 3E98 gpg --keyserver wwwkeys.us.pgp.net --recv-keys 9DDC3E98 _______________________________________________ Plugins-writers mailing list Plugins-writers@private http://mail.nessus.org/mailman/listinfo/plugins-writers
This archive was generated by hypermail 2.1.3 : Mon Jun 20 2005 - 11:26:06 PDT