[NTLUG:Discuss] linux based security tool...recommendation

[MadHat]

On Jan 13, 2004, at 5:18 PM, Chris Cox wrote:
> MadHat wrote:
> ...snip..
>> nmap is great and will do a great job of telling you what ports you 
>> have open and  in many cases what is listening, but will not tell you 
>> if the daemon listening is vulnerable or not.  Even if you find out 
>> you have BIND 4.9.2, you still ahve to search securityfocus.com or do 
>> google searches and find info on the vulnerability, then see if you 
>> can find a way to exploit it to test if you are vulnerable to attack. 
>>  Nessus will use nmap and run scans on what it finds open.   
>> Unfortunately there are a lot of false positives with nessus.  Some 
>> of the nasl scripts are written poorly and ahve hard coded ports, for 
>> example, so even though it is a web server running on port 25, it 
>> tries running sendmail vulns, or if sendmail is running on port 80, 
>> it will runn the sendmail vuln on port 25 whether or not it is open.  
>>   But I digress.
>
> ISS scanner has some of the same problems though... just can't
> be perfect.  I think nessus is just as good ... of course
> it doesn't cost $$$$$$ like ISS does.

No argument there.  And Nessus runs on Linux.  And you can run the 
scanner on one box and use the client from another, controlling a 
scanner from your desktop easily.  Don't get me wrong, it is a good 
product, but don't think everything it says is 100% accurate and do 
some research after the fact if you want to know the real details.  
This is true of any security product, commercial or free.