Nessus scan / Tivoli Maestro

[Senthil Prabu.S]

Signature MailHello,
      Normally HP-UX (PA machines) crashes once you scan them with Nessus. I think, you 
are facing the same problem. Also I guess ur OS crashes is not bez of any applications like 
Tivoli Maestro. It is the problem with OS. HP-UX crashes under following scenario,

1. Portmapper might crash when ports scanned on HP-UX.
2. Finger print scan crashes HP-UX.
3. Sometime NFS scan crashes HP-UX (this was the case, I faced with ).
4. Telnet scanning causes these problem as well.
   and many other cases.....  

Solution:
    Find out the plugins which does above scanning and disable them.

For more details,you can refer the following mailinglist discussion, which gives a list of scenario
 where Nessus causes a system crash.
http://mail.nessus.org/mailman/htdig/nessus/2003-December/msg00060.html

Also,go through the mailing list archives and search for key word "hpux". You can get a
clear idea. These problems were discussed many times in the list.

Note:
    On my experience on HP-UX machines, System crash happends due to NFS scanning.
So I disabled the following plugins nfs_mount.nasl, showmount.nasl, mountd_overflow.nasl, 
nfs_xlog_overflow.nasl, source_routed.nasl, nfs_dotdot.nasl, rpc_automountd.nasl,
nfs_portmap.nasl and nfs_fsirand.nasl. After removing these scripts, now I am able to scan
11.11 PA, 11.23 PA machines. Also these problems donot occur with IPF machines.

Hope this helps. Feel free to mail me in future if you are in need of more details.

--
Senthil Prabu.S

If you are smart enough to know that you're not smart enough to be an
Engineer, then you're in Business.
_________________________________________________________________  


----- Original Message ----- 
  From: Olivier Le Foll 
  To: Nessus Mailing List 
  Sent: Monday, January 10, 2005 5:19 PM
  Subject: Nessus scan / Tivoli Maestro


  Hello,

  I just configured a set of Nessus (2.2.2a) scans for unix servers (HP/UX).
  These servers run Tivoli Maestro (service running on TCP/31111) and this application crashes after Nessus scans !!!

  Does anyone already meet this problem ? Is there a way to avoid this problem or limit the nessus action ?

  Thanks for help.

  Regards,

  -- 

  ------------------------------------------------------
  Olivier Le Foll
  Courriel : Olivier.Le-Foll at atosorigin.com

  ------------------------------------------------------
  Ce message et les pièces jointes sont confidentiels et réservés à l'usage exclusif de ses destinataires. Il peut également être protégé par le secret professionnel. Si vous recevez ce message par erreur, merci d'en avertir immédiatement l'expéditeur et de le détruire.
  L'intégrité du message ne pouvant être assurée sur Internet, la responsabilité du groupe Atos Origin ne pourra être recherchée quant au contenu de ce message. Bien que les meilleurs efforts soient faits pour maintenir cette transmission exempte de tout virus, l'expéditeur ne donne aucune garantie à cet égard et sa responsabilité ne saurait être recherchée pour tout dommage résultant d'un virus transmis.

  This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it.
  As its integrity cannot be secured on the Internet, the Atos Origin group liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted.




------------------------------------------------------------------------------


  _______________________________________________
  Nessus mailing list
  Nessus at list.nessus.org
  http://mail.nessus.org/mailman/listinfo/nessus
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.nessus.org/pipermail/nessus/attachments/20050111/a4aef70c/attachment.html