Package: nessusd
Version: 2.2.10-3
nessus-adduser generates an empty password hash file in
/var/lib/nessus/users/$USERNAME/auth/hash so the user cannot log in
because password authentication always fails.
Example:
=======
# nessus-adduser
Using /var/tmp as a temporary file holder
Add a new nessusd user
----------------------
Login : randomuser
Authentication (pass/cert) [pass] : pass
Login password :
Login password (again) :
User rules
----------
nessusd has a rules system which allows you to restrict the hosts
that randomuser has the right to test. For instance, you may want
him to be able to scan his own host only.
Please see the nessus-adduser(8) man page for the rules syntax
Enter the rules for this user, and hit ctrl-D once you are done :
(the user can have an empty rules set)
default accept
Login : randomuser
Password : ***********
DN :
Rules :
default accept
Is that ok ? (y/n) [y] y
user added.
# ls -l /var/lib/nessus/users/randomuser/auth/hash
-rw-r--r-- 1 root root 1 2008-06-07 20:41
/var/lib/nessus/users/randomuser/auth/hash
# hexdump -C /var/lib/nessus/users/randomuser/auth/hash
00000000 0a |.|
00000001
Proposed fix:
==========
A superfluous `awk '{print $1}' causes the output of `openssl md5` to
be truncated. This is with openssl 0.9.8g-10. A patch for
nessus-adduser follows:
--- /usr/sbin/nessus-adduser 2008-01-14 00:09:01.000000000 +0100
+++ nessus-adduser 2008-06-07 20:59:39.684381794 +0200
@@ -274,8 +274,8 @@
{
URANDOM=`dd if=/dev/urandom bs=16 count=16 2>/dev/null|$MD5CMD`
}
- SEED=`(echo $SEED; date; df; ls -l; echo $URANDOM) | $MD5CMD |
awk '{print $1}'`
- H=`echo $Xn $SEED$password$Xc | $MD5CMD | awk '{print $1}'`
+ SEED=`(echo $SEED; date; df; ls -l; echo $URANDOM) | $MD5CMD`
+ H=`echo $Xn $SEED$password$Xc | $MD5CMD`
echo $H $SEED > "$localstatedir/lib/nessus/users/$login/auth/hash"
else
echo "$password" >
"$localstatedir/lib/nessus/users/$login/auth/password"
Sorry for not using `reportbug`. The server running the software can't
send/receive e-mail, unfortunately.
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
