Feed Installation instructions

Please follow these simple instructions in order to receive the AlienVault Free Feed For Nessus.



Unix

  1. Download the updater shell script
  2. Run the shell script with either "nessus" or "openvas" as argument, depending on which one you're using (Note, you can point the NVT_DIR environment variable to your plugin location. Thanks Vlatko for the patch.)
  3. If you're running OpenVAS you might want to get the AV VRT Certificate and setup plugin validation as described at the OpenVAS site.
  4. For nessus please ensure that 'nasl_no_signature_check' is set to "yes"

Some plugins depend on external programs. If you want to make sure all checks are working for you please ensure the following programs are located in your path:

  • smbclient - Part of the Samba suite. Can be found as separate package on many distributions.
  • wmi-client - Looks like it's only available for Debian/Ubuntu right now, we're checking on this and will be updating here.

A sample session would look like this: 

ossim:/tmp# sh alienvault-feed-sync.sh nessus
AlienVault NVT Feed Sync
 
Configured Scanner: nessus
Configured NVT Feed: rsync://feed.alienvault.com:/nvt-feed
Synchronized into: /var/lib/nessus/plugins/
 
 
Searching for required system tools ...
Synchonizing NVTs via RSYNC ...
receiving file list ... 
5659 files to consider

sent 84 bytes  received 88082 bytes  16030.18 bytes/sec
total size is 7905247  speedup is 89.66
Synchronization successful.
 
Please restart your scanner daemon
ossim:/tmp#

Windows

  1. Download the updater zip
  2. Unzip it to a convenient location
  3. Run the bat script
  4. Please ensure that 'nasl_no_signature_check' is set to "yes" in your nessusd configuration
Note: a nice frontend for this task is under development.



Note

If you've got firewall restrictions set on rsync you can try using an http proxy, as sated on the man page:

You may establish the connection via a web proxy by setting the environment variable RSYNC_PROXY to a hostname:port pair pointing to your web proxy.
As an additional help, feed.alienvault.com:8080 points to the rsync daemon too, so setting your feed to:

rsync://feed.alienvault.com:8080/nvt-feed

Might further help you traverse firewall/proxy restrictions.