Centos7 Docker环境部署系统漏洞扫描工具Nessus

docker部署nessus

pull nessus镜像

docker pull tenableofficial/nessus

启动docker镜像，同时配置用户名和口令、不启动自动更新

docker run -it -d -p8834:8834 --name nessus -e USERNAME=Nessus -e AUTO_UPDATE=no -e PASSWORD=123456 tenableofficial/nessus

进入nessus容器

docker exec -it nessus bash

启动nessus服务

/opt/scripts/configure_scanner.py

访问nessus界面（必须https）

https://localhost:8834

获取官方插件库和激活码

获取第一个值Challenge code

docker exec -it nessus bash
/opt/nessus/sbin/nessuscli fetch --challenge

保存Challenge code后面的

Challenge code:41f9607d08d7f9fd43f00e5a13195489d1eda1e2

获取第二个值Activation Code

https://zh-cn.tenable.com/products/nessus/nessus-essentials?tns_redirect=true

填姓名、邮箱，接收邮箱获取，保存Your activation code for Nessus Essentials is后面的

Your activation code for Nessus Essentials is:QMZ3-BDV9-NF7Q-XGKE-CF6F

把保存的两个值依次粘贴这获取插件、激活码

https://plugins.nessus.org/v2/offline.php

更新插件库、激活码

插件下载后，从Docker宿主机复制文件到Docker容器

docker cp all-2.0.tar.gz nessus:/usr/local/

Docker容器中更新插件库

docker exec -it nessus /bin/bash
cd /usr/local
/opt/nessus/sbin/nessuscli update all-2.0.tar.gz

添加激活码

vi nessus.license

激活

/opt/nessus/sbin/nessuscli fetch --register-offline nessus.license

重新启动nessus服务

/opt/scripts/configure_scanner.py

访问nessus界面等待加载插件库

https://localhost:8834

修改限制

nessus初始化完成后Hosts显示为"0 of 16 used”，修改其限制

进入容器

docker exec -it nessus /bin/bash

备份plugins插件库

cp -r /opt/nessus/lib/nessus/plugins/ /

查看plugins插件库复制是否成功，若不成功则重新复制

du -h /plugins/

备份plugin_feed_info.inc

mkdir /pluginsinc
cp /opt/nessus/lib/nessus/plugins/plugin_feed_info.inc /pluginsinc/plugin_feed_info.inc.libinc
cp /opt/nessus/var/nessus/plugin_feed_info.inc /pluginsinc/plugin_feed_info.inc.varinc

将plugin_feed_info.inc内容修改为专业版，PLUGIN_SET序号号为Policy Template Version=202205311353或其后序号

vi /pluginsinc/plugin_feed_info.inc

PLUGIN_SET = "202205311353";
PLUGIN_FEED = "ProfessionalFeed (Direct)";
PLUGIN_FEED_TRANSPORT = "Tenable Network Security Lightning";

关闭Nessus服务

supervisorctl stop nessusd

替换已修改的文件

rm -f /opt/nessus/lib/nessus/plugins/plugin_feed_info.inc
cp /pluginsinc/plugin_feed_info.inc /opt/nessus/var/nessus/plugin_feed_info.inc

重启Nessus服务

supervisorctl start nessusd

查看状态

du -h /opt/nessus/lib/nessus/plugins/

查看修改的文件是否已替换

more /opt/nessus/lib/nessus/plugins/plugin_feed_info.inc
more /opt/nessus/var/nessus/plugin_feed_info.inc

访问Nessus并更新规则库，此过程特慢需放置等待

https://localhost:8834

Hosts位置由0~16变为Unlimited，且保留插件库

配置启动重置

因服务重启时unlimited失效，根据状态异常操作步骤重新操作，编写nessus_start.sh代替service nessusd start，因为命令执行过程较长且Nessus需要重新加载插件，启动过程慢是正常现象

进入容器

docker exec -it nessus /bin/bash

配置启动文件

vi /root/nessus_start.sh

#!/bin/bash
rm -rf /opt/nessus/lib/nessus/plugins/
cp -r /plugins /opt/nessus/lib/nessus/
supervisorctl stop nessusd
rm -f /opt/nessus/lib/nessus/plugins/plugin_feed_info.inc
cp /pluginsinc/plugin_feed_info.inc /opt/nessus/var/nessus/plugin_feed_info.inc
supervisorctl start nessusd

给予启动文件执行权限

chmod +x /root/nessus_start.sh

每次nessus容器重启了都要进容器里执行这个

/root/nessus_start.sh