Mailing List Archive

non-authenticated script
Hi,
I'm learning nasl scripting, and I would like to make a simple script
that allow me to use nessus to execute an external program on the same
machine nessusd is. I wrote a very simple script to try this possibility:

if(description) {....}
res = pread(cmd: "/bin/ls", argv: makelist("/bin/ls", "-l",
"/home/andrea/"));
display(res);
security_note(res);

If I run this simple script with nessus, looking at
/var/nessus/logs/nessus.dump I find this string:

"A non-authenticated script attempted to use an authenticated function -
returning NULL"

and the same launching "nasl thisscript.nasl", while launching "nasl -X
thisscript.nasl" it produce the expected result.

Can someone help me? (or address me to where I can find an help)

Excuse me for my english.
Re: non-authenticated script [ In reply to ]
On Thu Mar 17 2005 at 10:28, Andrea Vitali wrote:

> "A non-authenticated script attempted to use an authenticated function
> returning NULL"

Calling external functions is dangerous. So only signed scripts can do
this.
nasl -X overrides the signature verification.

Another way is to set "nasl_no_signature_check = yes" in nessusd.conf
But this is dangerous, because if somebody could install a script that
tries to delete your system, steal your passwords, whatever...