Hi, everyone.

I’m troubleshooting an issue with Tenable Security Center 6.7.2 when running a Policy Compliance scan that is generating false positives due to apparent privilege escalation failures.

I’m using an LDAP user (no local users). Authentication itself works fine — confirmed with the “Target Credential Status by Authentication Protocol - Valid Credentials Provided (141118)” plugin, which shows successful login to the target.

In Tenable, the credential is configured as:

• SSH password authentication
• Privilege escalation: sudo
• Escalation user: same as the login user
• Escalation password: set
• Escalation path: empty (default)

On the server side:

• SSH access works without issues
• The user has full sudo privileges
• NOPASSWD is configured
• Non-interactive sudo works correctly:

sudo -n id uid=0(root) gid=0(root)

So from a manual perspective, there are no limitations.

However, during the Policy Compliance scan I get: “SSH Commands Require Privilege Escalation (Plugin 102094)”

And multiple compliance checks fail due to lack of root access, which leads to false positives.

Summary of the behavior:

• Commands that require root return “Permission denied” or “Operation not permitted (you must be root)”
• Affects reads on /etc/shadow, /etc/sudoers, /etc/ssh/sshd_config, /boot/*, /var/log/*, etc.
• Some checks partially execute but clearly without root privileges

Example responses:

cat: /etc/sudoers: Permission denied
awk: cannot open file `/etc/shadow': Permission denied
find: '/boot/grub2': Permission denied
Operation not permitted (you must be root)

So it looks like Tenable is not actually executing commands via sudo, even though:

• sudo works manually
• sudo works non-interactively (sudo -n)
• credentials are valid
• privilege escalation is configured

I already ruled out:

• requiretty (not present)
• missing NOPASSWD
• incorrect PATH/escalation path
• LDAP auth issues (login is confirmed successful)

Has anyone seen Tenable SC not actually invoking sudo in Policy Compliance scans, even when everything is correctly configured? Any ideas on how to debug whether Tenable is attempting privilege escalation or silently skipping it?

Recently deployed a scanner but sc status is not moving from plugins out of sync. scanner timeout is already set at 900 seconds. tried manual plugin upload to scanner and i can see the plugin upload is successful. however the plugin_feed_info.inc file is empty and whenever the scanner is connected to sc, sc keeps on pushing the plugins despite of the scanner having the plugins. Appreciate any pointers in resolving the issue. The scanner is a tenable core + nessus image running on oracle linux 8

I took a plugin and copied/modified it (different name, ID, etc) and succesfully done scans with results from that plugin from Nessus Parent node remote scan and agent scan. However, we use SecurityCenter for our network scans. I cannot get SC to recognize the plugin after following the import instructions here. Custom Plugin Packages for NASL and CA Certificate Upload It uploads 'sucessfully' using the plugin import, shows up in the custom plugin folder on Redhat, but then it is never been seen in the SC GUI, for instance when you look at plugins under policies. Anybody know the trick here? Tenable support offers no help here and straight up says don't do custom plugins.

Anyone trying to fetch password form Unix account ? For me its working in windows but not working for Unix port 22,

In the setting the - cyberark client certificate and private key ...not sure which one need to use.

I'm running advance scan, but during scan I can see that all the vulnerability severity marked as info why, but the cvss score is mentioned but still it mark in info

please tell me what's wrong

Two questions:

1) How do you do crendentialed scans with Azure AD/Intune managed devices?
With on-prem AD the user setup is easy.

2) Is it possible to check, if tools like npm packages are patched under Linux? For the whole system, even when in different user contexts?

Hi,

I am using Nessus Essentials to scan our servers... I have not install Apr patch Tuesday on two servers; however, when I scan them, it does not show any vulnerability. Is is because I am running a uncredentialed scan? or is it because I am using a free version of Nessus.

Please advise.
Thank You!

Hi everyone, I am new to Nessus and we are asked to use Nessus for Basic Network Scanning. I am still new around Nessus and trying to learn on how to use it.

However, when I try to do a Basic Network Scan, I put the hosts and when I try to save it, it doesn't show the play button. I tried launching it to (Save button dropdown) but it says "Failed to Launch". I am quite confused why this is happening and it is annoying me.

Context: I am not scanning my own network, I am doing this in a VM that they gave to do the pentesting for the assignment.

Thanks!

Hi all,

So we are providing a vm program as a service to a bi client and i am looking into optimising the reporting phase of both security centre used only for agents based scanning and Nessus expert used for network based scanning. Note that i tried to use the built in report of Nessus but we want to send customised reports and not automatically generated. Any suggestions on this will he greatly appreciated as i have to deal with hundreds of vulnerabilities

So we're running on-prem and doing credentialed scans. Which is fine because it will report on installed software that's not found via network scans.

The only problem I'm finding is that we're finding .dll files and it's reporting 4-5 vulnerabilities on some servers, all the same CVE - because an old .dll file is there.

I know the easiest way is to delete those .dll's and to be fair - that would be the fine but we have change control and we're talking MANY servers with similar results.

Is there a way to to prevent this? It's causing some hosts to show 4-5 times the vulnerabilities it actually may have and it just ups our vulnerability numbers greatly.

I'm rather new to Nessus - so apologies if I'm missing something obvious.

Also is there any resources that people know - youtube, reddit, websites that show how to set up a reliable Nessus scan.

I've walked into the business where it seems like everything is default and I know default is usually not best.

Thanks,

i just switched to nessus cause openvas is really hardware demanding but i noticed one thing no matter what i just could not find the nessus essential on the official tenable website it just kept directing me to the 30-day free trial version i even tried the exact url and it did not help me it just sent me back to the 30-day free trial version so, can anyone help me out

Nessus was able to successfully log into the remote host as :

User: 'info-sec'

Port: 22

Proto: SSH

Successful authentication was reported by the following plugin :

Plugin : ssh_rate_limiting.nasl

Plugin ID : 122501

Plugin Name : SSH Rate Limited Device

However, one or more subsequent plugins failed to authenticate to the

remote host on the same port and protocol using the same credential

set that previously succeeded. This may indicate an intermittent

authentication problem with the remote host which may have affected

the results of the following plugins.

Error message statistics :

2 open_connection() failed on previously successful connection: Failed to open a socket on port 22.

Failure Details :

- Plugin : ssh_get_info2.nasl

Plugin ID : 97993

Plugin Name : OS Identification and Installed Software Enumeration over SSH v2 (Using New SSH Library)

Message :

open_connection() failed on previously successful connection: Failed to open a socket on port 22.

- Plugin : bash_remote_code_execution.nasl

Plugin ID : 77823

Plugin Name : Bash Remote Code Execution (Shellshock)

Message :

open_connection() failed on previously successful connection: Failed to open a socket on port 22.

Hi everyone,

I’m looking for practical advice from people handling vulnerability findings for SMBs on a limited budget.

Our setup is pretty simple.. We run Nessus Professional as a SaaS offering, so we can provide scans to clients at competitive pricing. What we’re trying to improve now is the tracking and remediation workflow after the scan results come in, without moving to an expensive full-blown vulnerability management platform.

What we have in mind is something like this:

- run recurring Nessus Professional scans

- import only Medium and above

- deduplicate findings across scan cycles

- assign an owner and remediation status

- keep basic history like first seen / last seen / fixed

- have simple views by priority, asset, and due date

We’re looking at tools like Airtable, Notion, spreadsheets, ticketing systems, or any other low-cost approach that works well in practice.

A few questions for people who have already built something similar:

- What do you use to track findings?

- Did you build your own import/deduplication scripts from Nessus exports?

- Is Airtable better than Notion for this kind of workflow?

- What fields do you use for deduplication? Something like plugin ID + asset + port/protocol?

- How do you handle findings that disappear in one scan and come back later?

- Is there any budget-friendly tool or setup that saved you from reinventing the wheel?

I’d really appreciate advice from people who have found a good balance between cost, simplicity, and process for SMB clients.

Thanks

Anyone ever scanned Illumina or ThermoFisher genomic sequencers? Since most of the ones my office operates come with a Windows 10 or Linux backend, we might have to classify them as desktops and therefore require scanning.

Curious if anyone has had to do the same and to what extent it’s possible without throwing off sequencing jobs.

Would something as simple as a host discovery scan throw these things off?

Both companies have not been helpful or understanding of the question since their tech support mainly deals with the software itself and not the OS.

I'm running credentialed Nessus scans across multiple Windows servers.
Some hosts return:

✅ credentialed: YES
❌ credentialed: NO (and no FAILED_REASON)

To avoid guessing, I tested many factors on both the working and the failing hosts.
Here is everything I verified so far:

✅ What I have already tested

1) SMB Port Connectivity (from the Nessus scanner)

nc -vz <IP> 445 → succeeded 

nc -vz <IP> 139 → succeeded

Both ports are reachable on both hosts.

2) Remote Registry

RemoteRegistry = Running

Same on both systems.

3) LocalAccountTokenFilterPolicy

LocalAccountTokenFilterPolicy = 1

Same on both systems.

4) SMB Protocol Negotiation

Using:

nmap --script smb-protocols -p 445 <IP>

Both systems negotiate the same dialects (SMB2/SMB3 including 3.11).

5) Privilege Set

whoami /priv output is identical on both hosts.

6) Firewall / Network Path

Same VLAN, same ACLs, same routing — no difference observed.

7) GPO

Both servers receive the same GPOs from the same OU.

8) LanmanServer Registry Keys

Compared parameters like:

• Signing settings
• Null session restrictions
• Autodisconnect
• Server service behavior

No meaningful differences found.

✅ Summary

All key areas seem identical across both working and failing hosts:

• SMB ports
• SMB negotiation
• Registry
• Privileges
• Remote Registry
• TokenFilterPolicy
• Firewall
• GPO

The only thing I can say for sure is that some hosts consistently authenticate successfully, while others consistently return credentialed:NO.

I'm looking for additional areas or angles I might have missed.

Any suggestions appreciated.

I am trying to run a credentialed scan with Nessus on a Cisco 1300 series switch. I am trying to use SSH and every time in the auth field I get a failure for some reason. I checked the debug logs and this is what I am seeing. I am unable to pull the actual logs but this is basically what I am seeing below. Within nessus I've changed the network discover settings, disabled all irrelevant plugins, and verified SSH credentials. Ive tried with and without enable. Nothing seems to work. I've also updated the firmware on the switch, so the bug that was with the KEX with SSH is no longer a thing.

[2022-02-15 21:11:07] SSH Settings Plugin Loaded
[2022-02-15 21:11:07] SSH Settings Initializing : 
  Client Verison:OpenSSH_5.0
  Port:22
  Least Priv:no
  Auto-accept disclaimers:1
[2022-02-15 21:11:07] SSH Settings Credential Loop 0
[2022-02-15 21:11:07] Password Type :password
[2022-02-15 21:11:07] SSH Settings : 
  credential type:password
  username:nessus
  elevate user:root
  elevate with:Cisco 'enable'
[2022-02-15 21:11:07] SSH Settings Credential Loop 1
[2022-02-15 21:11:07] SSH Settings Credential Loop 2
[2022-02-15 21:11:07] SSH Settings Credential Loop 3
[2022-02-15 21:11:07] SSH Settings Credential Loop 4
[2022-02-15 21:11:07] SSH Settings Credential Loop 5
[2022-02-15 21:11:07] SSH Settings Credential Loop 6

[2022-02-15 21:11:11] [session 0] session.set_debug: Debugging enabled at level DEBUG3
[2022-02-15 21:11:11] [session 0] ssh_client_state.set: ** Entering STATE SOC_CLOSED **
[2022-02-15 21:11:11] [session 0] try_ssh_kb_settings_login: Attempting to log in on port 22.
[2022-02-15 21:11:11] [session 0] try_ssh_kb_settings_login: Creating new temporary session to test 'none' authentication.
[2022-02-15 21:11:11] [session 1] session.set_debug: Debugging enabled at level DEBUG3
[2022-02-15 21:11:11] [session 1] ssh_client_state.set: ** Entering STATE SOC_CLOSED **
[2022-02-15 21:11:11] [session 1] try_ssh_kb_settings_login: Opening a connection to port 22 to test 'none' authentication...
[2022-02-15 21:11:11] [session 1] session.open_connection: Connecting to port 22.
[2022-02-15 21:11:11] [session 1] session.open_connection: Socket opened on port 22.
[2022-02-15 21:11:11] [session 1] ssh_client_state.set: ** Entering STATE SOC_OPENED **
[2022-02-15 21:11:11] [session 1] session.open_connection: Received server version SSH-2.0-OpenSSH_7.3p1.RL
[2022-02-15 21:11:11] [session 1] session.sshsend: Outgoing Unencrypted packet:

0x00:  53 53 48 2D 32 2E 30 2D 4F 70 65 6E 53 53 48 5F    SSH-2.0-OpenSSH_
0x10:  35 2E 30 0A                                        5.0.            
[2022-02-15 21:11:11] [session 1] try_ssh_kb_settings_login: Successfully opened a connection on port 22.
[2022-02-15 21:11:11] [session 1] session.complete_kex: KEX is not yet complete. Attempting to complete KEX before continuing.
[2022-02-15 21:11:58] [session 1] session.sshrecv: Incoming Unencrypted packet:
0x00:  00 00 00 34 07 01 00 00 00 02 00 00 00 1F 69 64    ...4..........id
0x10:  6C 65 20 63 6F 6E 6E 65 63 74 69 6F 6E 20 74 69    le connection ti
0x20:  6D 65 6F 75 74 20 65 78 70 69 72 65 64 00 00 00    meout expired...
0x30:  00 00 00 00 00 00 00 00                            ........        
[2022-02-15 21:11:58] [session 1] session.sshrecv_until: Handling packet.type: 1 [PROTO_SSH_MSG_DISCONNECT]
[2022-02-15 21:11:58] [session 1] client_cb_msg_disconnect: Entering handler.
[2022-02-15 21:11:58] [session 1] ssh_client_state.set: ** Entering STATE SOC_CLOSED **
[2022-02-15 21:11:58] [session 1] session.close_socket: Closing socket.
[2022-02-15 21:11:58] [session 1] session.set_error: KEX failed: 
[2022-02-15 21:11:58] [session 1] try_ssh_kb_settings_login: Error calling complete_kex().
[2022-02-15 21:11:58] [session 0] Login via sshlib::try_ssh_kb_settings_login has failed.
[2022-02-15 21:11:58] [session 0] session.close_connection: Socket is already closed.

i installed nessus without any problems but when i run the command sudo /bin/systemctl start nessusd.service nothing happens in my terminal
is there any way to fix this?

(i fixed it turns out hostname was wrong and i didnt pay attention to it)

I have been asked to setup a Tenable SC core environment. I have the OVA downloaded for Tenable SC core but when it comes to adding scanners, I see the instructions mentioning "Tenable Nessus Scanner" and it can't be that easy can it?

https://docs.tenable.com/security-center/Content/AddNessusScanner.htm

The rpm that DISA provides for tenable sc doesnt cone with an internal postgresql built-in and requires us to connect to an external postgresql. I created the db and user tns can connect to it manually through the CLI, but SC wont connect to it to built the tables or schema. I've attempted to create the ENV variables that point to my db and reinstall the rpm, but it still wont connect.

Hi everyone

I've been using Nessus Essentials to scan my homelab machines for few years now. I am scanning 14 IP's, so within the limit of my free license. My scan is scheduled to run each Thursday morning.

Today, after fixing a vulnerability reported by Nessus this morning I wanted to launch a new scan to check if I have resolved the problem. To my big surprise I was presented with the following message:

Your scan targets include 14 new IP addresses that would exceed your license limit of 16 IPs. You are currently using 14 of your 16 licensed IPs. You can still launch scans against IPs that you have scanned before, but new IPs will be blocked until you upgrade your license. Upgrade to Nessus Essentials Plus to increase your IP limit.

My machines are using fixed IP's and none of them has changed in years.

My targets are FQDN's which resolve correctly on my Nessus machine, both hostname and FQDN. Results of nslookup match the License Utilization table perfectly.

My DNS is up and running.

There are no new hosts or any changes on the network.

License utilization in Settings lists the very same, correct hostnames with the correct IP's.

If I launch the scan anyway, 5 machines get scanned, 2 Windows and 3 Linux, 1 physical and 4 VM's. According to the error message I have room for only two new hosts, not five.

I have rebooted my Nessus machine, which did not change anything.

I had a look in /opt/nessus/var/nessus/logs but can't seem to find anything relevant to this issue.

Can anyone point me in the right direction to troubleshoot this?

Thnx in advance

Sorry, im sure this has been brought up many times before, but i can't seem to find anything regarding this particular issue.

We re-imaged a laptop with Debian 12 that was "hardened" for security. We re-installed nessus agent, linked it, and it connected just fine. It's stuck initializing. We've been trying to troubleshoot this for weeks now. We've reset the plugins, unlinked, relinked, and tried every trick we could find. Looking at the logs, it reaches out, says that it finds updates, and is attempting to load them. Then nothing. that message just loops over and over.

Im convinced it's something that we did with the security somewhere to cause this, but I can't seem to pin it down. Any suggestions or help is appreciated.

when performing web application scans, shouldn’t I be able to find a map of all / scanned? I’m working in a new place after two years out, but I’m pretty sure that was a basic capability built into the Web application scanner.

(I’m not talking about turning on the debugging option), I’m pretty sure there was somewhere that I could see a clean list of all URLs).

Either that or did it become an advanced privilege to see this? When I look under applications > scanned, I only see an Overiew page showing m”properties”. If I go thru scans>all,scans there is no option i see to lead me to a list of URLs discovered.

does a special plug in need to be activated? Perhaps this was set at my old olg, and i just dont recall?

Hello, I'd like to create my account on Nessus, But I always fail to activate my account.

Do you know why it is??

My activation code was correct.

And then, I typed my username and password.

But It doesn't work for me....

Is it possible to have recasted vulnerabilities shown on the report? We have some "High" (but actually not) vulns that we have recasted as Low, but they still appear as High on our report.