Guide to Setting Up and Running Tenable Nessus Essentials in Docker

Tenable Nessus Essentials is a popular tool for vulnerability scanning and management, and running it in Docker provides a streamlined and isolated environment. This guide will walk you through setting up the Nessus Essentials Docker image, obtaining an activation code, and performing a basic network scan.

About Nessus

Nessus is a widely used vulnerability assessment tool developed by Tenable. It is designed to help security professionals identify network vulnerabilities, misconfigurations, and compliance issues. Nessus is known for its extensive vulnerability database, customizable scanning capabilities, and detailed reporting features.

Key Features:

• Comprehensive Scanning: Detects many vulnerabilities, including missing patches, configuration errors, and security flaws.
• Customizable Policies: Users can configure scans according to specific needs or compliance requirements.
• Detailed Reporting: Generates in-depth reports with actionable recommendations for remediation.
• Plugin-based Architecture: Utilizes a large library of plugins to scan for various vulnerabilities and threats.

Nessus vs. Nmap

Both are great tools in network security, each serving distinct purposes. Nessus is primarily a vulnerability scanner designed to identify a wide range of network vulnerabilities, misconfigurations, and compliance issues. It provides comprehensive vulnerability assessments, detailed reporting, and compliance checks. Nessus is well-suited for thorough vulnerability assessments, compliance audits, and in-depth security analysis.

On the other hand, Nmap is a network scanner used mainly to discover hosts and services on a network. It provides capabilities for network discovery, port scanning, service detection, and basic vulnerability assessment through scripting. Nmap is ideal for initial reconnaissance, network mapping, and service identification.

When comparing the two, Nessus is focused on delivering detailed vulnerability scanning, offering an extensive depth of analysis with robust reporting capabilities. In contrast, Nmap is geared more towards network discovery and basic service detection, providing a more surface-level scan.

Despite their differences, Nessus and Nmap can complement each other effectively. Nmap can be employed for initial network discovery and mapping, while Nessus can then be used for more detailed vulnerability analysis, leveraging the initial data gathered by Nmap.

Prerequisites

Before you start, ensure you have:

• Docker installed on your machine. If you haven’t installed Docker yet, you can get it from Docker’s official site.
• Basic knowledge of Docker and command-line operations.
• Permission to perform network scans on your target network.

Obtain an Activation Code

The first step in using Nessus Essentials is to obtain an activation code. Visit the Nessus Activation Code Registration Page on Tenable’s website. Once there, register for Nessus Essentials by completing the registration form with your name, email address, and other required details. After submitting the form, Tenable will email you an activation code.

Create a Docker Compose File

Using Docker Compose makes it easier to manage your Docker containers. Create a docker-compose.yml file with the following content:

version: '3.8'

services:
  nessus-essentials:
    image: tenable/nessus:latest-ubuntu
    container_name: nessus-essentials
    ports:
      - "8834:8834"
    environment:
      - USERNAME=admin 
      - PASSWORD=admin
      - ACTIVATION_CODE=YOUR_ACTIVATION_CODE
    restart: unless-stopped

Replace YOUR_ACTIVATION_CODE with the code you received from Tenable. Also, make sure you set a secure USERNAME and PASSWORD.

Deploy Nessus Essentials

1. Open a terminal window on your machine.
2. Navigate to the directory where you saved your docker-compose.yml file.
3. Run the following command to start the Nessus Essentials container: docker-compose up -d This command will download the Nessus Docker image (if not already available) and start the container in detached mode.

Access the Nessus Web Interface

1. Open a web browser and navigate to http://localhost:8834.
2. Log in using the credentials specified in your docker-compose.yml file.
3. Complete the initial setup:
   • Follow the prompts to activate Nessus Essentials using the activation code.
   • Then, configure any additional settings as needed.

Run a Basic Network Scan

1. Go to the Scans tab in the Nessus web interface.
2. Create a New Scan:
   • Click on “New Scan”.
   • Choose a scan template that suits your needs, such as “Basic Network Scan”.
   • Then, provide a name for your scan and adjust any necessary settings.
3. Set Up Scan Targets:
   • Enter the IP addresses or network ranges you want to scan.
4. Launch the Scan:
   • Click “Save” to save your scan configuration.
   • Click “Launch” to start the scan.
5. Monitor the Scan:
   • Track the scan progress and review the results from the Nessus web interface.

Wrapping Up

Running Tenable Nessus Essentials in Docker provides a convenient and isolated environment for vulnerability scanning. Following these steps, you can easily deploy Nessus Essentials, activate it with your code, and perform network scans to identify potential security vulnerabilities.

For more information and advanced configuration options, refer to the official Tenable documentation and the Tenable Nessus Docker Hub page.

Feel free to ask if you have any questions or run into any issues. Happy scanning!