Tenable.SC plugin/feed updates failing & disk full

February 3, 2023 / Huxx / 0 Comments

Today I was called to help with a Tenable.SC instance that failed updating it’s plugins. It turned out that that had its “/opt” filled 100%.. A little investigation into where the space had gone led me to see that “/opt/sc/data/” folder was full of “feed.XXXX” folders each being 2.4GB in size. (~130+ GB in total..)

When looking at the logs I could see that as of December 6th updating the feed had failed (/opt/sc/admin/logs/sc-error.log).

PHP Fatal error: Allowed memory size of 1782579200 bytes exhausted (tried to allocate 20480 bytes) in /opt/sc/src/lib/FeedLib.php on line 2769

So in order to get the SC updating itself normally again I removed all unneeded feed folders, except the “latest feed update attempt” by running the following command:

find /opt/sc -name "feed.*" -ctime +1 | xargs rm -rf

And next in order to fix the “feed update failing” & prevent it from filling up the disk again within a month had to increase the PHP memory parameters. Todo that I edited “/opt/sc/support/etc/php.ini” and turned the memory limit up to 1900M, its default value was 1700m. After that restarted the SC by running :

service SecurityCenter stop && service SecurityCenter start

Additional thoughts on SC disk cleanup can be found in these 2 posts on tenables website:

Tenable.SC license renewal headache – things to keep in mind when renewing

November 23, 2020 / Huxx / 0 Comments

First year of Tenable usage was coming to an end. Nessus scanners/Managers and Tenable.SC all notified me that their licenses are about to expire. Contacted the company selling tenable in the region, got the licenses extended.

New license expiry date popped into the tenable support site, was wondering if the different instances would auto update their licenses. Looked at the scanners and managers – all was fine and licenses were extended. So I was happy problem solved, at least so I thought.. But I had missed one place, the SC, as I assumed that all their software/licenses would work the same way and didn’t waste any more time looking at the licenses.

A few weeks pass and suddenly I cannot log into the SC any more “with invalid license” error popping up when I try and log in. As it turned out – never assume that a vendors products all work the same way. When going to the admin interface of the SC I discover that the license states that its expired. Logged into the tenable support website to check on the license status all is supposed to be fine.

After that had a little chat with support – as it turns out licenses for Tenable.SC can be renewed in multiple ways. In one case your license is extended and the other just superseded so you need to re-download the license key file and upload it to your SC for it to start working again..

During the period the license was expired the scan data was not imported (rejected with an error by the SC). Fortunately it could be re-processed in the scan results list, but all the data ended up having the discovery date set as the manual re-processing date.. A minor inconvenience/integrity issue, but at least all the info still exists.

Tenable.SC and Nessus Scanner updates activation

February 3, 2020 / Huxx / 0 Comments

When installing Tenable.SC it asks for a activation key and installation continues. Then you install your Nessus scanner and during the install point it to the SC and it shows that its license is managed by Tenable.SC. Now that you have everything installed and up and running right? Wrong..

Updates for the plugins are not working yet, as for that you need to enter a separate license key. You need to log in to your Tenable Community account go to Your products and find the Tenable.sc activation key.

You need to insert that key into your Tenable.SC when logged into it as and administrator (not the scanning account). You need to navigate in the menu to System > Configuration > License and click on “Nessus Scanner” and paste the activation key you found on the Support site into there and press Register. After that your Tenable.SC and Nessus will be able to update their plugins and feeds.

Getting Tenable.SC working with Nessus Agents

February 2, 2020 / Huxx / 5 Comments

What do Nessus Agents do

Nessus Agent is a lightweight piece of software that You can install on a host to do patch management and vulnerability/compliance checking with out having some central server with credentials logging into every machine you have. For example the Nessus Credentialed scans. Instead the agent software just reports back to the central server and keeps polling to see if any commands have been given.

Nessus Agent can run patch level/vulnerability scan/malware scan or configuration compliance checks.

Requirements

I assume that when thinking about Nessus Agent based scans with Tenable.sc You already have a Tenable.SC license and working installation.

Tenable.SC needs to have access to the TCP port 8834 on the Nessus Manager.

Nessus Manager preferrably has internet access to download updates and activate the license.

Nessus Agents need access to the TCP port 8834 on the Nessus Manager.

Licensing hassle

In order to get Nessus Agents info into Tenable.SC there are some extra steps You need to take besides the Tenable.SC and Nessus Scanner installation. You actually also need to install Nessus Manager to get Agents working. Regular Nessus scanners haven’t got the ability to work with Agents.

To actually get Nessus Manager, it turned out to be a bit of a hassle. As it turns out, although the software comes with the Tenable.SC license, You actually need to ask for it separately. After a short e-mail exchange with support and some signed documents later, You will actually get Nessus Manager license added to your Tenable account.

The installation

After You get the license key, download the regular “Tenable Core + Nessus” software from https://www.tenable.com/downloads/tenable-appliance and install the VM. The install will be the same as for regular Nessus Scanner.

After having set up the VM open Your web browser and go to the appliance web page https://nessus-manager-ip-here:8834/, then the wizard will open. From there select Nessus Manager instead of Nessus Scanner and insert the license key when prompted. The setup will also ask for you to create an account for you self.. It will take a while for the wizard to download and compile all the needed components. After it completes you have a ready working Nessus Manager.

After the wizard completes, login to the the Appliance with the account You created during the wizard. First thing You need to do is create a “group” for the agents. IE for your web servers call it “Web Servers” or for Client PC’s call it “Client PC’s”. After having created the groups you now can proceed to linking your Agents.

To install the agents first You need to download the proper Agent software from https://www.tenable.com/downloads/nessus-agents. Installation is quite straight forward. As an example on a 64bit Centos7 machine, it would go like this:

Copy the Agent to the machine
Elevate privileges to root or use sudo
Install the agent by issuing the “rpm -i NessusAgent-7.5.1-es7.x86_64.rpm” command. You should get the following output:
warning: NessusAgent-7.5.1-es7.x86_64.rpm: Header V4 RSA/SHA1 Signature, key ID 1c0c4a5d: NOKEY
You must first start Nessus Agent by typing /bin/systemctl start nessusagent.service
To link this agent to the Nessus Manager, use the ‘/opt/nessus_agent/sbin/nessuscli agent’ command.
Type ‘/opt/nessus_agent/sbin/nessuscli agent help’ for more info.

Next you need to link Your agent to the Nessus Manager. In order to do that copy the “Linking Key” from Nessus Manager, which can be found at the Agents page in the “Linked Agents” section. After having found the key you can create your linking command on your client. Which is looks something like this:
/opt/nessus_agent/sbin/nessuscli agent lin/opt/nessus_agent/sbin/nessuscli agent link –key=”your-linking-key” –host=”your-nessus-manager-address” –port=8834 –groups=”Web Servers”

After issuing the previous command on the client it should now show up in the linked agents list where You got the linking key from. After having linked the agent to the manager you also need to start the service as was mentioned in the output from the rpm.

It will take a bit of time for the agent to come online. I initially thought something was broken. But it actually took ~5min for the client to go into the “initializing state” for a bitand then again offline. But after being in the initializing state the list started showing some more inf about the client, not only IP address. After that it stay’s offline again for some time, for me it was something like 15-20min and then the host started showing up as online. During that period might as well link the Nessus Manager and Tenable.SC.

Linking Nessus Manager and Tenable.SC goes is the same as with regular Nessus Scanner.

Running your first Agent scan

After having linked Your agents to Nessus Manager and Nessus Manager to Tenable.SC You can now define and run Agent scans.

Unlike how scanning works with Tenable.SC and Nessus Scanner, the agent scan needs to be defined and run on Nessus Manager instead. Tenable.SC only imports the reports actually although the button says run scan.

So you need to log in to Nessus Manager and under scans you should create a new scan. For every scan you need to select a group that the scan gets run on and also the interval if you want it to be a recurring one.