AWS Builder Center

Builder Center

Installing Tenable Nessus Professional on Amazon Linux 2023 in AWS with Secure Remote Access

Installing Tenable Nessus Professional on Amazon Linux 2023 in AWS with Secure Remote Access

Learn how to install and configure Tenable Nessus Professional on Amazon Linux 2023 running on an EC2 instance in AWS. This guide demonstrates how to securely access the Nessus web interface from a local laptop using AWS Systems Manager port forwarding, avoiding the need to expose management ports to the public internet.

J.R. De Guzman

AWS Authorized Instructor (AAI) | Former Network Engineer | Cybsecurity Support Engineer

Introduction

Organizations increasingly run security tools in the cloud to support vulnerability management, security testing, and infrastructure assessments. In many cases, customers want to deploy vulnerability scanners such as Tenable Nessus directly in their cloud environments so they can assess workloads running within their cloud networks.
In my previous article, I demonstrated how to securely access the Amazon Linux 2023 graphical desktop environment on an EC2 instance using TigerVNC and AWS Systems Manager Session Manager, without exposing SSH or VNC ports to the internet.
Building on that setup, this article demonstrates how to install Tenable Nessus Professional on an Amazon Linux 2023 EC2 instance and access it securely from a local laptop. Instead of exposing the Nessus web interface publicly, we will access it using AWS Systems Manager port forwarding, which allows administrators to manage Nessus remotely while keeping the scanner isolated inside the AWS environment.
This approach provides a practical way for customers to run cloud-based vulnerability scanning infrastructure while maintaining strong security controls.

Architecture Overview

Prerequisites:

Ensure you've successfully completed my previous article which can be found here https://builder.aws.com/content/3Ag8tIz0rWJ9gwncay1kM4q8hyb/access-amazon-linux-2023-gui-securely-using-tigervnc-and-aws-systems-manager

Important Installation Notes

When installing Tenable Nessus on Linux, there are several important considerations.
  • If a system already has another Tenable component running nessusd, the installation process will terminate those processes.
  • Scan data may be lost if another Nessus process is stopped during installation.
  • Tenable Nessus does not support symbolic links for /opt/nessus/.
  • The hostname package is required when installing Nessus RPM packages.
If the hostname package is not installed, install it using the appropriate package manager.
Example:
sudo dnf install hostname
Many Linux package managers automatically install dependencies during installation. In those cases, installing the hostname package separately may not be required

Step 1 - Download the Tenable Nessus package

Download the Nessus installation package from the Tenable website.
https://www.tenable.com/downloads/nessus
For Amazon Linux 2023, download the Linux RPM package.

Step 2 - Install Tenable Nessus

Install the Nessus package using the appropriate command for your operating system.
For Amazon Linux / Red Hat–based systems:
sudo dnf install Nessus-<version>-el8.x86_64.rpm
This installs Nessus in the following directory:
/opt/nessus/

Step 3 - Start the Nessus Service

After installation, start the Nessus daemon.
sudo systemctl start nessusd

Step 4 - Open the Nessus Web Interface

After the service starts, the Nessus web interface becomes available.
If accessing locally from the server, you can open:
https://localhost:8834
If accessing a remote Nessus instance directly, it would normally be:
https://<remote IP address>:8834
However, in this architecture we do not expose the Nessus interface to the internet.
Instead, we will access it securely using AWS Systems Manager port forwarding.

Secure Remote Access Using AWS Systems Manager

To securely access the Nessus web interface from your local laptop, we use AWS Systems Manager port forwarding. This creates a temporary encrypted tunnel between your local machine and the Nessus service running on the EC2 instance.
In the previous article, TigerVNC access was established using port forwarding for port 5901. Because Tenable Nessus runs on port 8834, accessing both services simultaneously requires separate port-forwarding sessions.
In practice, this means running two terminal (or PowerShell) windows, each maintaining its own session.

Port Forwarding for TigerVNC (Desktop Access)

If you want to continue accessing the Amazon Linux 2023 desktop environment, start the TigerVNC port forwarding session using the same command from the previous article.
1
2
3
4
5
aws ssm start-session `  
--region us-east-1 `  
--target INSTANCE-ID `  
--document-name AWS-StartPortForwardingSession `  
--parameters "portNumber=5901,localPortNumber=5901"
(IF THIS IS RUNNING ALREADY, SKIP THIS PART)
SSM Port Forwarding 5901
After the session starts, connect using your VNC client:
  1. Open TigerVNC viewer
  2. Enter localhost:5901
This allows you to interact with the graphical desktop running on the EC2 instance.

Port Forwarding for Nessus Web Interface

To access the Nessus web interface from your local laptop, open a second PowerShell window and start another port-forwarding session.
1
2
3
4
5
aws ssm start-session
--region us-east-1
--target INSTANCE-ID
--document-name AWS-StartPortForwardingSession
--parameters "portNumber=8834,localPortNumber=8834"
SSM Port Forwarding 8834
Once the session is active, open your browser and navigate to:
https://localhost:8834
Although the browser points to localhost, the traffic is securely forwarded through AWS Systems Manager to the Nessus service running on the EC2 instance.
TigerVNC Access Connection via SSM
Local Web Browser Access via SSM
Important Notes
  • Each port-forwarding session remains active only while the terminal window is open.
  • Closing the terminal ends the tunnel immediately.
  • Separate sessions are required because TigerVNC and Nessus run on different ports.
In many cases, administrators may only need the Nessus web interface, which means the TigerVNC tunnel is not required. However, keeping the VNC connection available can be useful for troubleshooting or performing additional administrative tasks on the EC2 instance.

Configuring Tenable Nessus

When opening Nessus for the first time, your browser may display a security warning.
This occurs because Nessus uses a self-signed SSL certificate. This behaviour is expected and normal.
After proceeding past the warning, the Welcome to Nessus page appears.
You may configure several optional settings, including:
  • Proxy server configuration
  • Custom plugin feed host
  • Encryption password for Nessus data
If an encryption password is configured, Nessus will encrypt scan policies, scan results, and configuration data.
Important: If the encryption password is lost, it cannot be recovered.

Activating Nessus Professional

During the installation process, you will need to activate the product.
On the Welcome to Nessus page:
  1. Click Continue
  2. Select Set up a purchased instance of Nessus
  3. Click Continue
    • If you already have an activation code, click Skip.
    • Enter the Nessus Activation Code that you have. To find your activation code, please sign into your Tenable Connect  account or set a password to finish setting up your account.
    • Click Continue TWICE
  4. Create a Tenable Nessus administrator user account that you use to log in to Tenable Nessus
    • In the Username box, enter a username
    • In the Password box, enter a password for the user account.
  5. Click Submit.
    • Tenable Nessus finishes the configuration process, which may take several minutes.
  6. Using the administrator user account you created, Sign In to Tenable Nessus
    • Note: When you sign in to Tenable Nessus for the first time, you receive the following message: Plugins are compiling. Tenable Nessus functionality will be limited until compilation is complete. You cannot create or launch scans, view or create policies or plugin rules, or use the upgrade assistant while Tenable Nessus compiles plugins.
Tenable Nessus Professional UI
Settings

Restoring Access After Timeout or Restart

Follow these steps to regain access to both the desktop environment and the Nessus web interface.
Step 1 - Connect to the Instance via Session Manager
Start a new Session Manager session.
Step 2 - Switch to the ec2-user
If you are connected as ssm-user, switch to the default user:
sudo su - ec2-user
Step 3 - Start the VNC Server
Restart the TigerVNC session:
vncserver :1
This will start the desktop environment again on display :1 (port 5901).
Step 4 - Re-establish Port Forwarding Sessions
From your local machine, start both port-forwarding sessions again.
  • PowerShell 1 - TigerVNC
1
2
3
4
5
aws ssm start-session `  
--region us-east-1 `  
--target INSTANCE-ID `  
--document-name AWS-StartPortForwardingSession `  
--parameters "portNumber=5901,localPortNumber=5901"
  • PowerShell 2 - Nessus Web Interface
1
2
3
4
5
aws ssm start-session
--region us-east-1
--target INSTANCE-ID
--document-name AWS-StartPortForwardingSession
--parameters "portNumber=8834,localPortNumber=8834"
Step 5 - Reconnect
  • Open TigerVNC Viewer >localhost:5901
  • Open your browser > https://localhost:8834

Conclusion

In this article, we installed Tenable Nessus Professional on an Amazon Linux 2023 EC2 instance and configured secure remote access using AWS Systems Manager.
Running vulnerability scanning tools in the cloud allows organizations to assess workloads deployed in AWS while maintaining centralized security operations. By combining AWS Systems Manager port forwarding with Nessus, administrators can securely manage the scanner without exposing management interfaces to the internet.
While this guide focused on a manual installation approach, organizations may also consider deploying Nessus through the AWS Marketplace (BYOL) for a more streamlined setup. However, the method demonstrated in this article provides greater flexibility and control over the environment, particularly for custom configurations and learning purposes.
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article