Tenable Appliance 4.1 User Guide

136 Pages·2017·5.08 MB·English

by  Tenable Network Security

Tenable Appliance 4.1 User Guide
Last Updated: 07 February,2017
Contents
Introduction 6
Tenable VM Appliance Installation 8
VM Image Prerequisites 9
Security Considerations 10
Obtainingthe Tenable VMware VirtualMachine Image 11
Obtainingthe Tenable Hyper-VVirtualMachine Image 13
VM Updgrade Compatability 15
Tenable Hardware Appliance Installation 17
Prerequisites 18
Unpackingthe Box 19
Rack MountInstructions 20
Hardware Specifications 21
Hardware Features 22
Network Connections andInitialization 23
ConfigurationandOperations 25
SetAdminPassword 28
Configuration/Operations Tab 30
Appliance Tab 31
Hardware Migration 33
AdministrationTab 43
Updates 44
System 46
Copyright©2017.TenableNetworkSecurity,Inc.Allrightsreserved.TenableNetworkSecurity,Nessus,SecurityCenterContinuousView,PassiveVulnerabilityScanner,andLogCorrelationEngineareregistered
trademarksofTenableNetworkSecurity,Inc.Allotherproductsorservicesaretrademarksoftheirrespectiveowners.
Restart/ShutDown 47
Configure Clock Settings 48
Configure SNMPAgentStrings 50
SystemLogForwarding 51
WebInterface 52
Appliance ManagementInterface Users 53
Recovery Code Link 54
Configure Response Headers 56
Configure Website SSLCertificate 57
Generate Certificate SigningRequest 58
LogoutRedirectionURL 59
RestrictConsole Operations 60
ReinstallAppliance (Hardware Appliance Only) 61
BackupTab 62
BackupAppliance 65
Standalone ApplicationImport 66
Restore fromFile 67
NetworkingTab 68
Configure Networking 70
Configure Hostname 71
Interfaces 72
Configure VLANs 74
ParentInterface 76
Bulk Import/Configuration 77
Copyright©2017.TenableNetworkSecurity,Inc.Allrightsreserved.TenableNetworkSecurity,Nessus,SecurityCenterContinuousView,PassiveVulnerabilityScanner,andLogCorrelationEngineareregistered
trademarksofTenableNetworkSecurity,Inc.Allotherproductsorservicesaretrademarksoftheirrespectiveowners.
AddVLAN 79
VLANs (Configure/Export) 81
Logs Tab 82
SupportTab 84
Applications Tab 86
Enable anApplication 87
The SecurityCenter Application 88
Enable SecurityCenter 91
CurrentDisk Capacity 92
Manage SecurityCenter 93
PluginManagement 94
WebServer ListeningConfiguration 96
AWebServer Security 97
WebServer Authentication 98
Certificate Authority Management 99
The Nessus Application 100
Enable the Nessus Application 102
Manage Nessus 103
AdditionalNessus Actions 104
EditNessus Users 105
Certificate Management 106
WebServer Authentication 107
Nessus Rules (nesusd.rules) 108
The LCEApplication 109
Copyright©2017.TenableNetworkSecurity,Inc.Allrightsreserved.TenableNetworkSecurity,Nessus,SecurityCenterContinuousView,PassiveVulnerabilityScanner,andLogCorrelationEngineareregistered
trademarksofTenableNetworkSecurity,Inc.Allotherproductsorservicesaretrademarksoftheirrespectiveowners.
LCEClients 110
The PVS Application 112
Manage PVS 114
PVS MonitoringConfiguration 115
Certificate Management 116
WebServer Authentication 117
UsingNessus, SecurityCenter, andPVS 118
Troubleshooting 119
VirtualImage Migration 121
Appendix 2:Expandingthe VirtualDisk onVMware 123
Appendix 3:Expandingthe VirtualDisk onMicrosoft's Hyper-VServer 124
ExpandVirtualDisk - VMware 125
ExpandHardDisk 2 127
Ignore RepartitionNotice 130
BootAppliance 131
Acknowledgements 132
RelatedThird-Party andOpen-Source Licenses 136
Copyright©2017.TenableNetworkSecurity,Inc.Allrightsreserved.TenableNetworkSecurity,Nessus,SecurityCenterContinuousView,PassiveVulnerabilityScanner,andLogCorrelationEngineareregistered
trademarksofTenableNetworkSecurity,Inc.Allotherproductsorservicesaretrademarksoftheirrespectiveowners.
Introduction
This document describes the installationandoperationofthe Tenable Appliance.The Tenable Appli-
ance is a browser-managedapplicationthat hosts various Tenable enterprise applications including Nes-
sus,SecurityCenter(SC),andthe Passive Vulnerability Scanner(PVS).Alink is providedforthe Log
CorrelationEngine (LCE) application,whichwill be available ina future release.
The Tenable Appliance is available as eithera Virtual Machine downloadoras a physical hardware appli-
ance.The functionality is nearly identical forboth,but there are some differences inthe installation.
Applications are available forinstallationonanas-neededbasis onthe appliance andmay be enabledor
disabledconveniently underone platform.Please email any comments andsuggestions tosup-
[email protected].
Abbreviations
The following abbreviations are usedthroughout this documentation:
LCE-Log CorrelationEngine
l
PVS -Passive Vulnerability Scanner
l
SC -SecurityCenter
l
VM -Virtual Machine
l
SSL -Secure Sockets Layer
l
Tenable Appliance Platform
The Tenable Appliance VM is available forMicrosoft’s HyperVplatform,VMware Server,VMware
Player,VMware ESX,VMware Workstation,andVMware Fusion(http://vmware.com/) andmay be
downloadedfromthe Tenable Support Portal locatedat https://support.tenable.com/.The Tenable
Appliance is alsoavailable as Series 100,200,or300 hardware models,whichcanbe obtainedby con-
tacting [email protected].
Skill Requirements
It is recommendedthat the Tenable Appliance be configuredby personnel familiarwiththe Nessus vul-
nerability scanner,Tenable Enterprise Solutions (SC,LCE,andPVS),andthe organization’s security
Copyright©2017.TenableNetworkSecurity,Inc.Allrightsreserved.TenableNetworkSecurity,Nessus,SecurityCenterContinuousView,PassiveVulnerabilityScanner,andLogCorrelationEngine
-6-
areregisteredtrademarksofTenableNetworkSecurity,Inc.Allotherproductsorservicesaretrademarksoftheirrespectiveowners.
policies andprocedures.Iftraining is requiredforNessus orTenable Enterprise Solutions,please visit:
http://tenable.com/training/.
When usingtheVM version of theappliance, somegeneral knowledgeof theVirtual Machineplatform
beingused isrequired.
Copyright©2017.TenableNetworkSecurity,Inc.Allrightsreserved.TenableNetworkSecurity,Nessus,SecurityCenterContinuousView,PassiveVulnerabilityScanner,andLogCorrelationEngine
-7-
areregisteredtrademarksofTenableNetworkSecurity,Inc.Allotherproductsorservicesaretrademarksoftheirrespectiveowners.
Tenable VM Appliance Installation
This sectiondescribes the installationsteps forthe Tenable VM Appliance.Ifyouhave purchasedthe
Tenable Hardware Appliance,please refertothe sectiontitled“Tenable Hardware Appliance Install-
ation”.
Copyright©2017.TenableNetworkSecurity,Inc.Allrightsreserved.TenableNetworkSecurity,Nessus,SecurityCenterContinuousView,PassiveVulnerabilityScanner,andLogCorrelationEngine
-8-
areregisteredtrademarksofTenableNetworkSecurity,Inc.Allotherproductsorservicesaretrademarksoftheirrespectiveowners.
VM Image Prerequisites
Before beginning installation,please be sure tohave a host systemwiththe following resources avail-
able:
Asystemwiththe ability toruna VM image andat least 4 GB ofassignedmemory.
l
Theneeded assigned memoryfor aVM imagewill varydependingon theTenableapplications
enabled. Pleaserefer to theinstallation documentation for theindividual applicationsfor memory
recommendationsand adjusttheVM memorysettingasappropriate.
At least 6 GB offree disk space toaccommodate the base VM image.Ifyouchoose toincrease the
l
VM disk size make sure the extra space is available onthe VM host system.
At least one IPaddress forthe appliance.By default,the VM appliance will obtainanIPaddress
l
froma DHCPserver,ifone is available.Otherwise,a fixedaddress,netmask,andoptional gate-
way may be assignedduring the installationprocess.Ifthere is a DHCPserveravailable,but a
staticIPaddress is tobe assigned,this may be set during the configurationprocess.Using multiple
addresses allows formulti-homing the appliance ondifferent network segments tocut downon
the network load.
Aswith anysecuritymanagementdevice, astatic IP address(assigned manuallyor viaDHCP)is
recommended for useon theappliancenetworkinterfaces.
Along withthe IPaddress,the following values must be configuredforthe Tenable VM Appliance tobe
network accessible:
The network subnet mask forthe appliance.
l
The IPaddress ofthe Default Gateway forthe appliance (ifapplicable).
l
The IPaddresses ofthe DNSservers forthe appliance (ifapplicable).
l
Ahostname forthe appliance.
l
Itisnecessaryto haveahostnameavailableto assign to theapplianceduringinstallation to ensuretheSSL
certificateisgenerated properly. Theapplianceshipswith thedefaulthostnameof “tnsappliance”.
Whenever thehostnameischanged, anew server certificatewill begenerated and thedevicewill require
areboot.
Copyright©2017.TenableNetworkSecurity,Inc.Allrightsreserved.TenableNetworkSecurity,Nessus,SecurityCenterContinuousView,PassiveVulnerabilityScanner,andLogCorrelationEngine
-9-
areregisteredtrademarksofTenableNetworkSecurity,Inc.Allotherproductsorservicesaretrademarksoftheirrespectiveowners.
Security Considerations
Whendeploying the Tenable Appliance inanexternal oruntrustedenvironment,it is strongly recom-
mendedthat additional security precautions be takentoprotect the device fromattack andillicit use.
Considerimplementing the following recommendations:
Use a signedSSL Certificate froma trustedandreliable Certificate Authority.
l
Configure userrules that restrict scanning toIPaddresses they are permittedtoscan.Adopt a
l
“default deny” policy foruserroles andscanning activity.
Whenconfiguring the device via the webinterface,avoidusing a webproxy orotherdevice that
l
may assist a thirdparty inobtaining sensitive information.
Copyright©2017.TenableNetworkSecurity,Inc.Allrightsreserved.TenableNetworkSecurity,Nessus,SecurityCenterContinuousView,PassiveVulnerabilityScanner,andLogCorrelationEngine
-10-
areregisteredtrademarksofTenableNetworkSecurity,Inc.Allotherproductsorservicesaretrademarksoftheirrespectiveowners.