Gvm error cert data are missing

HackWare.ru

Этичный хакинг и тестирование на проникновение, информационная безопасность

Как установить Greenbone Vulnerability Management (GVM) (бывший OpenVAS) в Kali Linux

OpenVAS теперь переименована в Greenbone Vulnerability Management (GVM)

Когда создавался проект OpenVAS, он состоял только из движка для сканирования уязвимостей. Вскоре после этого Greenbone Networks получила финансирование для оказания профессиональной поддержки в области сканирования уязвимостей. Гринбоун начал руководить разработкой, добавил несколько программных компонентов и превратил OpenVAS в решение для многосторонней работы с уязвимостями, по-прежнему сохраняющее ценности открытого и бесплатного программного обеспечения.

Через несколько лет стало очевидно, что использование OpenVAS в качестве торговой марки для проекта с открытым исходным кодом и финансирование почти всей разработки проекта не было оценено извне. Поэтому после выпуска платформы OpenVAS 9 она была переименована в Greenbone Vulnerability Management (GVM) и выпущена как Greenbone Source Edition (GSE). Начиная с GVM 10 термин OpenVAS используется только для компонента сканера, как это было в начале проекта.

Пакеты Greenbone Vulnerability Management (GVM): https://github.com/greenbone

Ошибки при установке и запуске GVM, OpenVAS

В процессе установки и запуска у меня возникло довольно много ошибок, которые, тем не менее, удалось решить. Исходя из того предположения, что эти ошибки являются общими для всех (а не только для моей конкретной установки), я описал эти ошибки прямо в процессе установки, в результате чего инструкция стала загромождённой.

Если в процессе установки вы не столкнётесь с описываемыми ошибками, напишите, пожалуйста, об этом в комментариях — если ошибки не появляются у всех, то я вынесу их в самый конец статьи, благодаря чему в целом инструкция станет более ясной.

Как установить OpenVAS (GVM)

Поскольку авторы переименовали openvas в gvm (точнее, разделили на разные пакеты), то теперь основным пакетом является gvm, при его установке в качестве зависимостей также будут получены все другие необходимые пакеты.

Установка делается так:

Настройка OpenVAS

Начнём с настройки Open Vulnerability Assessment Scanner (OpenVAS), то есть открытого сканера оценки уязвимостей для Greenbone Vulnerability Management (GVM).

Он используется в Greenbone Security Manager и представляет собой полнофункциональный модуль сканирования, который выполняет постоянно обновляемую и расширенную подачу Network Vulnerability Tests (NVTs), то есть тестов сетевых уязвимостей.

Сканеру нужен запущенный сервер Redis для временного хранение собранной информации по сканированным хостам. Настройка сервера Redis делается так (эти команды нужно выполнить один раз):

Запуск сервера Redis (нужно делать после каждой перезагрузки компьютера):

Или, если хотите, добавьте его в автозагрузку:

Служба Greenbone Vulnerability Management (gvmd) действует как клиент OSP для подключения к сканерам и управления ими. openvas не действует как служба OSP — для этого вам понадобится модуль OSPD-OpenVAS. Фактические пользовательские интерфейсы (например, GSA или GVM-Tools) будут взаимодействовать только с gvmd и/или ospd-openvas, но не со сканером. Вы можете запустить openvas, чтобы загрузить плагины в Redis, используя следующую команду:

но ospd-openvas выполнит обновление автоматически.

Обратите внимание: хотя вы можете запускать openvas от имени пользователя без повышенных прав, рекомендуется запускать openvas от имени пользователя root, поскольку для выполнения ряда тестов на уязвимость сети (NVT) требуются привилегии root для выполнения определённых операций, таких как подделка пакетов. Если вы запускаете openvas от имени пользователя без разрешения на выполнение этих операций, результаты сканирования, скорее всего, будут неполными.

Поскольку openvas будет запускаться из процесса ospd-openvas с помощью sudo, в файле sudoers требуется следующая конфигурация:

добавьте эту строку, чтобы позволить пользователю, запускающему ospd-openvas, запускать openvas с правами root

Замените ПОЛЬЗОВАТЕЛЬ на имя вашего пользователя Linux.

Узнать имя пользователя можно командой:

Если что-то не работает, то посмотреть журнал можно командой:

Настройка Greenbone Vulnerability Management (GVM)

Greenbone Vulnerability Manager — это центральная служба управления между сканерами безопасности и пользовательскими клиентами.

Он управляет хранением любых конфигураций работы с уязвимостями и результатов сканирования. Доступ к данным, командам управления и рабочим процессам обеспечивается через протокол управления Greenbone Management Protocol (GMP) на основе XML. Управление сканерами, такими как OpenVAS, осуществляется через протокол открытого сканера (OSP).

Скрипт развёртывания (вместо openvas-setup):

Этот скрипт нужно запустить только один раз.

Работа скрипта завершилась ошибкой:

также показала наличие ошибки на четвёртом шаге:

Для исправления ошибки «ERROR: CERT data are missing. FIX: Run the CERT synchronization script greenbone-feed-sync.» выполните следующую команду:

Повторный запуск проверки показал ошибку на пятом шаге:

Там сразу несколько ошибок, но ключевой является «ERROR: No users found. You need to create at least one user to log in.», для её исправления выполните команду вида:

Например, для создания пользователя с именем mial и паролем 2:

Предыдущая команда завершилась неудачей:

Суть ошибки в том, что у команды не хватает прав на запись в файл /var/log/gvm/gvmd.log даже не смотря на то, что предыдущая команда запущена с sudo. Для исправления ошибки выполните следующую команду:

Затем вновь запустите создание нового пользователя.

И ещё одна ошибка на седьмом шаге:

Я не знаю как её решить до конца, но знаю как обойти.

Перейдём к запуску необходимых служб.

Не забывайте, что перед запуском службы вам нужно запустить сервер Redis, то есть перед выполнить команду:

И получаем следующее:

Суть сообщений в том, что всё нормально запустилось, кроме greenbone-security-assistant, то есть gsa, то есть Web UI (Greenbone Security Assistant), ну то есть веб-интерфейса.

Можно посмотреть содержимое журнала:

Не удалось запустить https демон.

У gsad есть опция —http-only которая запускает только HTTP без HTTPS. Воспользуемся ею:

Опять будет выведено очередное сообщение, что что-то не так:

Тем не менее, теперь веб-интерфейс доступен по адресу http://127.0.0.1:9392 (но не доступен по https://127.0.0.1:9392!).

Войдите в него используя учётные данные, которые вы придумали при создании нового пользователя.

В будущем для обновления сигнатур запускайте иногда команду:

Если что-то не работает, то посмотреть журнал можно командой:

Заключение

О том, как работать в Greenbone Vulnerability Management (GVM) (бывшем OpenVAS) будет посвящена одна из следующих инструкций.

А вы не забудьте написать — возникали ли у вас при установке описанные ошибки.

Источник

Статья Установка openvas на Kali Linux

Привет, мой дорогой читатель. Видел на форуме несколько проблем с установкой сканера openvas на kali linux. Решил написать полный мануал по установке этого детища, плюсом немного задену сканирование.

Перейдем непосредственно к установке openvas. Считается, что kali уже установлена и обновлена. Вводим незамысловатую команду:

apt install openvas

Отвечаем «y» на вопрос о том, что мы в трезвом сознании пытаемся установить эти пакеты и ждем окончания установки :=)

Следующей командой запустим сервис новоиспеченного openvas:

Откроется браузер поумолчанию (обычно это firefox) с панелью управления. Но так, как мы еще не все настроили надо будет его закрыть и перейти обратно в консоль. Вводим для создания пользователя:

И для создания пароля к этому пользователю:

Я надеюсь вместо USER и Password вы поняли, что надо подставить свои значения :=). Переходим к самой настройке. Вводим:

Как видно на скриншоте, после проверки имеются проблемы, устраняем их:

Работа этого скрипта займет примерно 5 минут. Вводим еще раз проверку установки:

Необходимо пофиксить еще одну проблему:

Опять проверка, и еще один скрипт необходимо запустить для достижения цели:

Можете расслабиться, откинуться на спинку стула, и наслаждаться зелеными цифрами на черном экране. Это действие будет выполняться не менее часа. Советую далеко от системы не отходить, так как возможно образование ошибки, после чего работа остановится, и необходимо будет заново ее запустить.
После окончания работы скрипта, необходимо запустить проверку еще раз, и снова запустить тот же скрипт на отработку. Да, вот такая штука эти компьютеры :=)

Теперь запускаем openvas еще раз, и еще раз проверяем установку:

В этот раз необходимо установить приложение nsis:

Смотрим еще раз, и устанавливаем rpm:

Следом, после проверки, нам проверка скажет, что необходимо установить alien:

Следом советую сразу обновить nmap

mrtyrel

ImFelix

New member

NOMAD

Member

ERROR: Your OpenVAS-9 installation is not yet complete!

Ronin

Member

Dallas system

В связи с частыми ошибками и нестабильной работы openvas от себя могу порекомендовать обратить на другое детище greenbone: The GSM Community Edition ссылка на сайт
По ссылке найдете комьюнити версию и достаточно подробный мануал по установке. ссылка на скачивание образа (526 MB)

Далее вольный перевод страницы по установке для тех, кто не может или не хочет читать ин.яз.:

Настройка GCE
Версия: 6.0.3
Совместимость: VirtualBox, ESXi
Минимальные требования: 2 ядра процессора, 4 ГБ ОЗУ

GSM Community Edition является производным от GSM ONE и позволяет быстро и легко выбрать Windows, Linux или Mac, чтобы испытать решение. Никаких особых ноу-хау не требуется.

В отличие от коммерческого решения, вместо Greenbone Security Feed используется Community Feed. Также некоторые функции управления, такие как сертификаты TLS, не включены. Обновления источников баз происходят регулярно, но сама система не может быть обновлена. Коммерческая версия может быть обновлена целиком и также включает доступ к поддержке Greenbone.

Community Edition, а также GSM ONE предназначены для использования с ноутбуком. Полный набор функций для процесса управления уязвимостями доступен только для более крупных моделей GSM и может быть получен от Greenbone дополнительно.

Установка Community Edition:
Создайте виртуальный образ:
Hyper-V через “New – Virtual Computer”:
Generation: Generation 1
Startup memory: 4096 MB
Use Dynamic Memory: deactivate
Network: выберите соединение с доступом к Интернету. Системе необходим доступ к интернету для настройки. Для использования системного веб-интерфейса вам необходим доступ к системе, из которой работает ваш веб-браузер.
Виртуальный жесткий диск: создайте новый, минимум 15 ГБ
Варианты установки: теперь выберите загруженный ISO-образ в качестве носителя.
После сохранения измените количество процессоров на 2

ESXi / VMWare: в основном следуйте подсказкам, как в «VirtualBox».
VirtualBox через «New»:
Тип: Linux
Версия: Другой Linux (64bit)
Память: 4096 МБ
Жесткий диск: 18 ГБ
Процессоры: 2
Создайте новый жесткий диск для виртуальной машины.
Позаботьтесь о том, чтобы сетевое соединение работало изнутри и снаружи VM: Системе необходим доступ к интернету для настройки. Для использования веб-интерфейса системы вам необходимо получить доступ к системе, из которой работает ваш веб-браузер.
Аудио, USB и дискета должны быть отключены.
Теперь выберите загруженный iso-образ в качестве носителя для CD-привода и запустите виртуальный компьютер.
В меню выберите пункт «Настройка» и подтвердите, что жесткий диск может быть перезаписан.

Процесс установки займет некоторое время. Вам будет предложено ввести имя пользователя и пароль для учетной записи администратора. Обратите внимание на эту учетную запись, потому что не будет другого способа администрирования системы.
Следуйте инструкциям до перезагрузки. Система автоматически перезагрузится во второй раз.
Как только появится приглашение «Welcome to Greenbone OS», войдите в систему с помощью ранее созданной учетной записи администратора.
Теперь вы входите в мастер настройки, который проведет вас через последние шаги:
Веб-пользователь: создание учетной записи администратора для веб-интерфейса. Там вы можете позже создать дополнительную учетную запись по мере необходимости.

Обновите базы записей (feed): без ленты вы не можете выполнять сканирование, а раздел SecInfo остается пустым. Поэтому загрузка настоятельно рекомендуется, но требует доступа в Интернет.
Обновление ленты работает в фоновом режиме, вы находитесь в главном меню администрации. Через «About» вы можете просмотреть ключевые свойства вашей установки, в частности адрес веб-интерфейса и то, запущен ли процесс обновления базы записей.

Войдите в веб-интерфейс с учетной записью веб-администратора.
Только после завершения обновления базы записей вся информация в области SecInfo будет доступна и возможно первое сканирование. Это может занять полчаса или даже дольше.

Во время установки был создан самозаверяющий сертификат TLS. Ваш браузер будет считать его небезопасным, и вы должны указать браузеру принять его как исключение.

Документация и руководства доступны на портале Techboc Greenbone. Тем не менее, пользовательский интерфейс говорит само за себя. Просто начните. Мастер поможет вам создать и запустить вашу первую задачу сканирования.
Обратите внимание: завершение работы виртуальной машины должно осуществляться только через меню «Обслуживание-> Питание», чтобы гарантировать, что важные системные процессы, такие как обновление ленты, не прерываются.

Авторское право, лицензии и источники:
Операционная система Feed и Greenbone состоит из различных компонентов с различными авторскими правами и лицензиями (с открытым исходным кодом). По сути, продукт может быть использован для любых целей, но для перераспределения необходимо учитывать условия лицензий. Подробности приведены в информации о лицензии. Там вы также найдете предложение для доступа к исходному коду в соответствии с GNU GPL.

Источник

Ethical hacking and penetration testing

InfoSec, IT, Kali Linux, BlackArch

How to install Greenbone Vulnerability Management (GVM) (formerly OpenVAS) on Kali Linux

OpenVAS is now renamed Greenbone Vulnerability Management (GVM)

When the OpenVAS project was created, it only consisted of a vulnerability scanning engine. Greenbone Networks received funding shortly thereafter to provide professional vulnerability scanning support. Greenbone took over development leadership, added a few software components, and turned OpenVAS into a multi-pronged vulnerability management solution that still retains the value of open and free software.

Over the years, it became apparent that the use of OpenVAS as a trademark for an open source project and funding for almost all of the project’s development had not been appreciated from outside. Therefore, after the release of the OpenVAS 9 platform, it was renamed Greenbone Vulnerability Management (GVM) and released as Greenbone Source Edition (GSE). Since GVM 10, the term OpenVAS is used only for the scanner component, as it was at the beginning of the project.

Greenbone Vulnerability Management (GVM) packages: https://github.com/greenbone

Errors when installing and starting GVM, OpenVAS

During the installation and launch process, I encountered quite a few errors, which, nevertheless, were resolved. Under the assumption that these errors are common to everyone (not just my particular installation), I described these errors right during the installation process, as a result of which the instructions became cluttered.

If during the installation process you do not encounter the described errors, please write about it in the comments – if the errors do not appear for everyone, then I will put them at the very end of the article, due to which, in general, the instruction will become clearer.

How to install OpenVAS (GVM)

Since the authors renamed openvas to gvm (more precisely, divided it into different packages), now the main package is gvm, when it is installed, all other necessary packages will also be obtained as dependencies.

Installation is done like this:

Setting up OpenVAS

Let’s start by setting up the Open Vulnerability Assessment Scanner (OpenVAS) for Greenbone Vulnerability Management (GVM) solution.

It is used in Greenbone Security Manager and is a full-fledged scan engine that performs constantly updated and expanded submissions of Network Vulnerability Tests (NVTs).

The scanner needs a running Redis server to temporarily store the collected information on the scanned hosts. Configuring the Redis server is done like this (these commands need to be executed once):

Starting the Redis server (must be done after every computer restart):

Or, if you like, add it to startup:

The Greenbone Vulnerability Management (gvmd) service acts as an OSP client to connect to and manage scanners. openvas does not act as an OSP service – you need the OSPD-OpenVAS module for that. Actual user interfaces (like GSA or GVM-Tools) will only interact with gvmd and/or ospd-openvas, not the scanner. You can run openvas to load plugins in Redis using the following command:

but ospd-openvas will update automatically.

Please note that although you can run openvas as a non-elevated user, it is recommended that you run openvas as root because some network vulnerability tests (NVTs) require root privileges to perform certain operations, such as package spoofing. If you run openvas as a user without permission to perform these operations, the scan results are likely to be incomplete.

Since openvas will be launched from the ospd-openvas process using sudo, the following configuration is required in the sudoers file:

add this line to allow the user running ospd-openvas to run openvas as root

Replace USERNAME with your Linux username.

You can find out the username with the command:

If something does not work, then you can view the log with the command:

Configuring Greenbone Vulnerability Management (GVM)

Greenbone Vulnerability Manager is the central management service between security scanners and user clients.

It manages the storage of any vulnerability management configuration and scan results. Data, control commands, and workflows are accessed through the XML-based Greenbone Management Protocol (GMP). Scanners such as OpenVAS are controlled through the Open Scanner Protocol (OSP).

Deployment script (instead of openvas-setup):

This script needs to be run only once.

The script ended with an error:

also showed an error in the fourth step:

To fix the error “ERROR: CERT data are missing. FIX: Run the CERT synchronization script greenbone-feed-sync” run the following command:

Re-running the check showed an error at the fifth step:

There are several errors at once, but the key one is “ERROR: No users found. You need to create at least one user to log in.”, To fix it, run a command like this:

For example, to create a user named mial and password 2:

The previous command failed:

The essence of the error is that the command does not have enough permissions to write to the /var/log/gvm/gvmd.log file, even though the previous command was run with sudo. To fix the error, run the following command:

Then run the new user creation again.

And one more mistake at the seventh step:

I don’t know how to solve it completely, but I know how to get around it.

Let’s move on to starting the necessary services.

Do not forget that before starting the service you need to start the Redis server, that is, type following before executing the primary command:

Main service start:

And we get the following:

The essence of the messages is that everything started fine, except for the greenbone-security-assistant, that is, gsa, that is, Web UI (Greenbone Security Assistant), that is, the web interface.

You can see the contents of the log file:

gsad has a —http-only option which only runs HTTP without HTTPS. Let’s use it:

Again, the next message will be displayed that something is wrong:

However, the web interface is now available at http://127.0.0.1:9392 (but not available at https://127.0.0.1:9392!).

Log in using the credentials that you came up with when creating a new user.

To stop the service:

In the future, sometimes run the command to update signatures:

If something does not work, then you can view the log with the command:

Conclusion

One of the following instructions will be devoted to how to work in Greenbone Vulnerability Management (GVM) (formerly OpenVAS).

And do not forget to write – have you encountered the described errors during installation?

Related articles:

Recommended for you:

I found feed status are «update in progress» and «scap database is required» on my Open VAS GVM platform.I have tried may option to update feeds but notings works.

This is log OPEN VAS:

libgvm util:MESSAGE:2022-09-11 06h52.30 utc:5664: Updated NVT cache from version 0 to 202209101034
libgvm util:MESSAGE:2022-09-11 09h04.08 utc:1213: Updated NVT cache from version 0 to 202209101034
libgvm util:MESSAGE:2022-09-11 09h48.54 utc:1297: Updated NVT cache from version 0 to 202209101034
libgvm util:MESSAGE:2022-09-11 10h09.17 utc:1168: Updated NVT cache from version 0 to 202209101034
libgvm util:MESSAGE:2022-09-11 13h05.31 utc:1220: Updated NVT cache from version 0 to 202209101034
libgvm util:MESSAGE:2022-09-11 13h23.30 utc:1159: Updated NVT cache from version 0 to 202209101034
libgvm util:MESSAGE:2022-09-11 13h55.51 utc:1148: Updated NVT cache from version 0 to 202209101034
libgvm util:MESSAGE:2022-09-11 15h45.48 utc:1197: Updated NVT cache from version 0 to 202209101034
libgvm util:MESSAGE:2022-09-11 17h46.23 utc:1712: Updated NVT cache from version 0 to 202209101034
libgvm util:MESSAGE:2022-09-11 18h09.25 utc:1194: Updated NVT cache from version 0 to 202209101034
libgvm util:MESSAGE:2022-09-13 15h31.07 utc:1204: Updated NVT cache from version 0 to 202209101034
libgvm util:CRITICAL:2022-09-13 15h31.17 utc:2876: redis_find: redis connection error to /run/redis-openvas/redis.sock: No such file or directory
libgvm util:CRITICAL:2022-09-13 15h31.17 utc:2876: get_redis_ctx: redis connection error to /run/redis-openvas/redis.sock: No such file or directory
libgvm util:CRITICAL:2022-09-13 15h31.17 utc:2876: get_redis_ctx: redis connection error to /run/redis-openvas/redis.sock: No such file or directory
libgvm util:CRITICAL:2022-09-13 15h37.41 utc:3412: redis_find: redis connection error to /run/redis-openvas/redis.sock: No such file or directory
libgvm util:CRITICAL:2022-09-13 15h37.41 utc:3412: get_redis_ctx: redis connection error to /run/redis-openvas/redis.sock: No such file or directory
libgvm util:CRITICAL:2022-09-13 15h37.41 utc:3412: get_redis_ctx: redis connection error to /run/redis-openvas/redis.sock: No such file or directory
libgvm util:MESSAGE:2022-09-13 16h25.01 utc:3395: Updated NVT cache from version 0 to 202209131026
libgvm util:MESSAGE:2022-09-13 16h34.58 utc:1214: Updated NVT cache from version 0 to 202209131026

Hi! thanks for the tutorial!

on «sudo gvm-setup» i get this:

rsync: [generator] failed to set permissions on «/var/lib/openvas/plugins/2014/gb_fedora_2014_5004_httpd_fc19.nasl»: Function not implemented (38)
rsync: [generator] failed to set permissions on «/var/lib/openvas/plugins/2014/gb_fedora_2014_5006_json-c_fc20.nasl»: Function not implemented (38)
rsync: [generator] failed to set permissions on «/var/lib/openvas/plugins/2014/gb_fedora_2014_5015_elfutils_fc20.nasl»: Function not implemented (38)

Источник

Install OpenVAS (GVM) on Kali 2019

In this setup guide, we step through the process of getting OpenVAS (GVM) running on Kali 2019. Installing OpenVAS into a Kali-based system is made much easier by the inclusion of a quick setup script.

When using Kali Linux for OpenVAS scanning, resource usage should always be taken into account. Whether running Kali in a virtual machine or on bare metal, you will want to have sufficient memory and cpu available for the scanner to be optimised for speed (4 cores & 8GB should be a minimum). If you are hoping to run large numbers of parallel scans, then you will need more resources. Several performance tuning options are available in the OpenVAS scanner configuration file to better use the resources you have available. See our OpenVAS tutorial for details on modifying the configuration file.

Install

First step is to install the packages through apt install openvas .

Config

It is then a simple matter of running the configuration script to get OpenVAS configured with required services, user accounts and the latest NVT updates from the Greenbone Community Feed.

The output shown here is a bit daunting, however it is all automated. Assuming all goes well you should soon have a working and up to date OpenVAS installation. The actual time taken for this script will vary depending on download speeds as it is grabbing a fair amount of data for the signatures and CVE data.

By utilising the prebuilt configuration script we can get up and running with OpenVAS in a very short amount of time.

OpenVAS Web Client (Green Security Assistant)

Access the Greenbone Web Client using your web browser. Login with admin and the password in the script output and you will be launching a scan of your target systems within a few minutes.

Lets first check that gsad is running and listening.

Now browse to https://localhost:9392/. The Greenbone Security Assistant is a web portal front end to the GVM and OpenVAS scanner.

Task Wizard

The quickest way to fire off a scan is using the Task Wizard.

Enter the target and scan profile. Launch. Results are available under the reports option.

Modify gsad to listen on all interfaces

In the netstat output above, we can see that gsad is only listening on localhost . Here is how to change it so you can access the web interface over your local network.

Kali 2019 is using systemd for its services so we have to edit the following file to make the web interface listen on all interfaces.

Now change the 127.0.0.1 to 0.0.0.0 , we also need to add a new parameter to the ExecStart line. This allows remote hosts to connect to our IP address (or hostname). Otherwise, we will get the following error in the browser:

If your IP address is 192.168.1.100 then make the changes as shown below.

Now restart the service and check with netstat or ss .

Looks like we are up and running, now you can access the OpenVAS web interface from any system on your network.

OpenVAS Command Line Client (omp or gvm-cli)

Accessing OpenVAS from the command line is a powerful feature that gives you full control over scan tasks, reports and other management tasks. The current client in Kali is the omp client. Newer versions of GVM will use the gvm-cli command that is part of the gvm-tools package.

Both clients use XML to perform actions on the GVM server. The omp client has a number of command line switches, but the XML is where the real power lies.

# omp —help Usage: omp [OPTION…] — OpenVAS OMP Command Line Interface Help Options: -?, —help Show help options Application Options: -h, —host= Connect to manager on host -p, —port= Use port number -V, —version Print version. -v, —verbose Verbose messages (WARNING: may reveal passwords). —use-certs Use client certificates to authenticate. —client-cert= Client certificate. Default: /usr/var/lib/openvas/CA/clientcert.pem —client-key= Client key. Default: /usr/var/lib/openvas/private/CA/clientkey.pem —client-ca-cert= Client CA certificate. Default: /usr/var/lib/openvas/CA/cacert.pem -u, —username= OMP username -w, —password=

OMP password —config-file= Configuration file for connection parameters. -P, —prompt Prompt to exit. -O, —get-omp-version Print OMP version. -n, —name= Name for create-task. -C, —create-task Create a task. -m, —comment= Comment for create-task. -c, —config= Config for create-task. -t, —target= Target for create-task. -E, —delete-report Delete one or more reports. -D, —delete-task Delete one or more tasks. -R, —get-report Get report of one task. -F, —get-report-formats Get report formats. (OMP 2.0 only) -f, —format=

Источник

Ethical hacking and penetration testing

InfoSec, IT, Kali Linux, BlackArch

How to install Greenbone Vulnerability Management (GVM) (formerly OpenVAS) on Kali Linux

OpenVAS is now renamed Greenbone Vulnerability Management (GVM)

When the OpenVAS project was created, it only consisted of a vulnerability scanning engine. Greenbone Networks received funding shortly thereafter to provide professional vulnerability scanning support. Greenbone took over development leadership, added a few software components, and turned OpenVAS into a multi-pronged vulnerability management solution that still retains the value of open and free software.

Over the years, it became apparent that the use of OpenVAS as a trademark for an open source project and funding for almost all of the project’s development had not been appreciated from outside. Therefore, after the release of the OpenVAS 9 platform, it was renamed Greenbone Vulnerability Management (GVM) and released as Greenbone Source Edition (GSE). Since GVM 10, the term OpenVAS is used only for the scanner component, as it was at the beginning of the project.

Greenbone Vulnerability Management (GVM) packages: https://github.com/greenbone

Errors when installing and starting GVM, OpenVAS

During the installation and launch process, I encountered quite a few errors, which, nevertheless, were resolved. Under the assumption that these errors are common to everyone (not just my particular installation), I described these errors right during the installation process, as a result of which the instructions became cluttered.

If during the installation process you do not encounter the described errors, please write about it in the comments – if the errors do not appear for everyone, then I will put them at the very end of the article, due to which, in general, the instruction will become clearer.

How to install OpenVAS (GVM)

Since the authors renamed openvas to gvm (more precisely, divided it into different packages), now the main package is gvm, when it is installed, all other necessary packages will also be obtained as dependencies.

Installation is done like this:

Setting up OpenVAS

Let’s start by setting up the Open Vulnerability Assessment Scanner (OpenVAS) for Greenbone Vulnerability Management (GVM) solution.

It is used in Greenbone Security Manager and is a full-fledged scan engine that performs constantly updated and expanded submissions of Network Vulnerability Tests (NVTs).

The scanner needs a running Redis server to temporarily store the collected information on the scanned hosts. Configuring the Redis server is done like this (these commands need to be executed once):

Starting the Redis server (must be done after every computer restart):

Or, if you like, add it to startup:

The Greenbone Vulnerability Management (gvmd) service acts as an OSP client to connect to and manage scanners. openvas does not act as an OSP service – you need the OSPD-OpenVAS module for that. Actual user interfaces (like GSA or GVM-Tools) will only interact with gvmd and/or ospd-openvas, not the scanner. You can run openvas to load plugins in Redis using the following command:

but ospd-openvas will update automatically.

Please note that although you can run openvas as a non-elevated user, it is recommended that you run openvas as root because some network vulnerability tests (NVTs) require root privileges to perform certain operations, such as package spoofing. If you run openvas as a user without permission to perform these operations, the scan results are likely to be incomplete.

Since openvas will be launched from the ospd-openvas process using sudo, the following configuration is required in the sudoers file:

add this line to allow the user running ospd-openvas to run openvas as root

Replace USERNAME with your Linux username.

You can find out the username with the command:

If something does not work, then you can view the log with the command:

Configuring Greenbone Vulnerability Management (GVM)

Greenbone Vulnerability Manager is the central management service between security scanners and user clients.

It manages the storage of any vulnerability management configuration and scan results. Data, control commands, and workflows are accessed through the XML-based Greenbone Management Protocol (GMP). Scanners such as OpenVAS are controlled through the Open Scanner Protocol (OSP).

Deployment script (instead of openvas-setup):

This script needs to be run only once.

The script ended with an error:

also showed an error in the fourth step:

To fix the error “ERROR: CERT data are missing. FIX: Run the CERT synchronization script greenbone-feed-sync” run the following command:

Re-running the check showed an error at the fifth step:

There are several errors at once, but the key one is “ERROR: No users found. You need to create at least one user to log in.”, To fix it, run a command like this:

For example, to create a user named mial and password 2:

The previous command failed:

The essence of the error is that the command does not have enough permissions to write to the /var/log/gvm/gvmd.log file, even though the previous command was run with sudo. To fix the error, run the following command:

Then run the new user creation again.

And one more mistake at the seventh step:

I don’t know how to solve it completely, but I know how to get around it.

Let’s move on to starting the necessary services.

Do not forget that before starting the service you need to start the Redis server, that is, type following before executing the primary command:

Main service start:

And we get the following:

The essence of the messages is that everything started fine, except for the greenbone-security-assistant, that is, gsa, that is, Web UI (Greenbone Security Assistant), that is, the web interface.

You can see the contents of the log file:

https daemon failed to start .

gsad has a —http-only option which only runs HTTP without HTTPS. Let’s use it:

Again, the next message will be displayed that something is wrong:

However, the web interface is now available at http://127.0.0.1:9392 (but not available at https://127.0.0.1:9392!).

Log in using the credentials that you came up with when creating a new user.

To stop the service:

In the future, sometimes run the command to update signatures:

If something does not work, then you can view the log with the command:

Conclusion

One of the following instructions will be devoted to how to work in Greenbone Vulnerability Management (GVM) (formerly OpenVAS).

And do not forget to write – have you encountered the described errors during installation?

Related articles:

• Default passwords in Kali Linux (100%)
• Kali Linux Rolling post install tips (51.2%)
• How to install OWASP Mutillidae II and Damn Vulnerable Web Application (DVWA) in Kali Linux (51.2%)
• How to install and run VLC, Google Chrome, and Chromium on Kali Linux (51.2%)
• How to update Kali Linux (51.2%)
• How to install Java (JDK) on Windows and Linux (RANDOM — 50%)

Recommended for you:

I found feed status are «update in progress» and «scap database is required» on my Open VAS GVM platform.I have tried may option to update feeds but notings works.

This is log OPEN VAS:

libgvm util:MESSAGE:2021-09-11 06h52.30 utc:5664: Updated NVT cache from version 0 to 202109101034
libgvm util:MESSAGE:2021-09-11 09h04.08 utc:1213: Updated NVT cache from version 0 to 202109101034
libgvm util:MESSAGE:2021-09-11 09h48.54 utc:1297: Updated NVT cache from version 0 to 202109101034
libgvm util:MESSAGE:2021-09-11 10h09.17 utc:1168: Updated NVT cache from version 0 to 202109101034
libgvm util:MESSAGE:2021-09-11 13h05.31 utc:1220: Updated NVT cache from version 0 to 202109101034
libgvm util:MESSAGE:2021-09-11 13h23.30 utc:1159: Updated NVT cache from version 0 to 202109101034
libgvm util:MESSAGE:2021-09-11 13h55.51 utc:1148: Updated NVT cache from version 0 to 202109101034
libgvm util:MESSAGE:2021-09-11 15h45.48 utc:1197: Updated NVT cache from version 0 to 202109101034
libgvm util:MESSAGE:2021-09-11 17h46.23 utc:1712: Updated NVT cache from version 0 to 202109101034
libgvm util:MESSAGE:2021-09-11 18h09.25 utc:1194: Updated NVT cache from version 0 to 202109101034
libgvm util:MESSAGE:2021-09-13 15h31.07 utc:1204: Updated NVT cache from version 0 to 202109101034
libgvm util:CRITICAL:2021-09-13 15h31.17 utc:2876: redis_find: redis connection error to /run/redis-openvas/redis.sock: No such file or directory
libgvm util:CRITICAL:2021-09-13 15h31.17 utc:2876: get_redis_ctx: redis connection error to /run/redis-openvas/redis.sock: No such file or directory
libgvm util:CRITICAL:2021-09-13 15h31.17 utc:2876: get_redis_ctx: redis connection error to /run/redis-openvas/redis.sock: No such file or directory
libgvm util:CRITICAL:2021-09-13 15h37.41 utc:3412: redis_find: redis connection error to /run/redis-openvas/redis.sock: No such file or directory
libgvm util:CRITICAL:2021-09-13 15h37.41 utc:3412: get_redis_ctx: redis connection error to /run/redis-openvas/redis.sock: No such file or directory
libgvm util:CRITICAL:2021-09-13 15h37.41 utc:3412: get_redis_ctx: redis connection error to /run/redis-openvas/redis.sock: No such file or directory
libgvm util:MESSAGE:2021-09-13 16h25.01 utc:3395: Updated NVT cache from version 0 to 202109131026
libgvm util:MESSAGE:2021-09-13 16h34.58 utc:1214: Updated NVT cache from version 0 to 202109131026

Hi! thanks for the tutorial!

on «sudo gvm-setup» i get this:

rsync: [generator] failed to set permissions on «/var/lib/openvas/plugins/2014/gb_fedora_2014_5004_httpd_fc19.nasl»: Function not implemented (38)
rsync: [generator] failed to set permissions on «/var/lib/openvas/plugins/2014/gb_fedora_2014_5006_json-c_fc20.nasl»: Function not implemented (38)
rsync: [generator] failed to set permissions on «/var/lib/openvas/plugins/2014/gb_fedora_2014_5015_elfutils_fc20.nasl»: Function not implemented (38)

Источник

In this guide, you will learn how to install and setup GVM 20.08 on Debian 10. Greenbone Vulnerability Management (GVM), previously known as OpenVAS, is a network security scanner which provides a set of network vulnerability tests (NVTs) to detect security loopholes in systems and applications. As of this writing, GVM 20.08 is the current stable release and  is the first release that uses a calendar based versioning (August of 2020).

With the release of GVM 20.08, GVM 10 and GVM 11 were set to retire by end of 2020.

Prerequisites

In this demo, we will install and setup GVM 20.08 on Debian 10 from source code. As such, below are the system requirements I would personally recommend.

• At least 4 GB RAM
• At least 4 vCPUs
• More than 8 GB disk space (We used 16 GB in this demo)

These requirements will vary depending on your use cases, however. Just be sure to provide “enough”.

Run System Update

To begin with, update and upgrade your system packages;

apt update

apt upgrade

Create GVM User on Ubuntu

In this demo, we will run GVM 20.08 as a non privileged system user. Thus, create gvm system user account.

useradd -r -d /opt/gvm -c "GVM User" -s /bin/bash gvm

Create the GVM user directory as specified by option -d in the command above and set the user and group ownership to gvm.

mkdir /opt/gvm

chown gvm: /opt/gvm

Install Required Build Tools

In order to successfully build GVM 20.08 on Debian 10, you need to install a number of required dependencies and build tools.

apt install gcc g++ make bison flex libksba-dev curl redis libpcap-dev 
cmake git pkg-config libglib2.0-dev libgpgme-dev nmap libgnutls28-dev uuid-dev 
libssh-gcrypt-dev libldap2-dev gnutls-bin libmicrohttpd-dev libhiredis-dev 
zlib1g-dev libxml2-dev libradcli-dev clang-format libldap2-dev doxygen 
gcc-mingw-w64 xml-twig-tools libical-dev perl-base heimdal-dev libpopt-dev  libunistring-dev graphviz 
libsnmp-dev python3-setuptools python3-paramiko python3-lxml python3-defusedxml python3-dev gettext python3-polib xmltoman 
python3-pip texlive-fonts-recommended texlive-latex-extra --no-install-recommends xsltproc sudo vim rsync

Install Yarn on Debian 10

Next, install Yarn JavaScript package manager

curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add -

echo "deb https://dl.yarnpkg.com/debian/ stable main" | tee /etc/apt/sources.list.d/yarn.list

apt update

apt install yarn -y

Install PostgreSQL on Debian 10

GVM 20.08 uses PostgreSQL as the backend database. Therefore, run the command below to install PostgreSQL on Debian 10;

apt install postgresql postgresql-contrib postgresql-server-dev-all

Create PostgreSQL User and Database

Once the installation is done, create the PostgreSQL user and database for Greenbone Vulnerability Management Daemon (gvmd). Note that the database and user should be created as PostgreSQL user, postgres.

sudo -Hiu postgres
createuser gvm
createdb -O gvm gvmd

Grant PostgreSQL User DBA Roles

psql gvmd
create role dba with superuser noinherit;
grant dba to gvm;
create extension "uuid-ossp";
create extension "pgcrypto";
q
exit

Once that is done, restart PostgreSQL;

systemctl restart postgresql

systemctl enable postgresql

Want to get started in CyberSecurity? Check the link below;

Cybersecurity: The Beginner’s Guide: A comprehensive guide to getting started in cybersecurity

Building GVM 20.08 from Source Code

There are different tools required to install and setup GVM 20.08 on Debian 10. These include;

• GVM Libraries
• OpenVAS Scanner
• OSPd
• ospd-openvas
• Greenbone Vulnerability Manager
• Greenbone Security Assistant
• Python-GVM
• GVM-Tools
• OpenVAS SMB

Every component has README.md and a INSTALL.md file that explains how to build and install it.

Since we are running GVM as non-privileged user, gvm, then we will install all the GVM configuration files and libraries under, /opt/gvm.

Update the PATH environment variable on /etc/environment, to include the GVM binary path such that it looks like;

echo "PATH=$PATH:/opt/gvm/bin:/opt/gvm/sbin:/opt/gvm/.local/bin" > /etc/profile.d/gvm.sh

Add GVM library path to /etc/ld.so.conf.d.

echo "/opt/gvm/lib" > /etc/ld.so.conf.d/gvm.conf

Build and Install GVM 20.08 on Debian 10

Switch to GVM user, gvm and create a temporary directory to store GVM source files.

su - gvm

mkdir gvm-source

Download GVM 20.08 Source Files

Navigate to temporary directory created above and run the subsequent commands to clone the GVM github branch files.

cd gvm-source

git clone -b gvm-libs-20.08 https://github.com/greenbone/gvm-libs.git

git clone -b master https://github.com/greenbone/openvas-smb.git

git clone -b openvas-20.08 https://github.com/greenbone/openvas.git

git clone -b ospd-20.08 https://github.com/greenbone/ospd.git

git clone -b ospd-openvas-20.08 https://github.com/greenbone/ospd-openvas.git

git clone -b gvmd-20.08 https://github.com/greenbone/gvmd.git

git clone -b gsa-20.08 https://github.com/greenbone/gsa.git

Once the source files are in place, proceed to build and install GVM 20.08 on Debian 10.

Note the current working directory;

pwd

/opt/gvm/gvm-source

ls -1

gsa
gvmd
gvm-libs
openvas
openvas-smb
ospd
ospd-openvas

Note that we will install all GVM 20.08 files and libraries to a non-standard location, /opt/gvm. As such, you need to set the PKG_CONFIG_PATH environment variable to the location of your pkg-config files before configuring:

export PKG_CONFIG_PATH=/opt/gvm/lib/pkgconfig:$PKG_CONFIG_PATH

Be sure to replace the path, /opt/gvm, accordingly.

I would suggest you take a snapshot of your machine at this point, just in case things don’t work out, you can revert to this stage without having to start from scratch!

Build and Install GVM 11 Libraries

From within the source directory, /opt/gvm/gvm-source, in this setup, change to GVM libraries directory;

cd gvm-libs

Create a build directory and change into it;

mkdir build
cd build

Configure the build;

cmake .. -DCMAKE_INSTALL_PREFIX=/opt/gvm

Next, compile and install GVM libraries

make

make install

Build and Install OpenVAS scanner and OpenVAS SMB

Open Vulnerability Assessment Scanner (OpenVAS) is a full-featured scan engine that executes a continuously updated and extended feed of Network Vulnerability Tests (NVTs).

OpenVAS SMB provides modules for the OpenVAS Scanner to interface with Microsoft Windows Systems through the Windows Management Instrumentation API and a winexe binary to execute processes remotely on that system.

Build and install openvas-smb;

cd ../../openvas-smb/
mkdir build
cd build
cmake .. -DCMAKE_INSTALL_PREFIX=/opt/gvm
make
make install

Build and install OpenVAS scanner;

cd ../../openvas

Proceed to build and install openvas.

mkdir build
cd build
cmake .. -DCMAKE_INSTALL_PREFIX=/opt/gvm
make
make install

Configuring OpenVAS Scanner

The host scan information is stored temporarily on Redis server. The default configuration of Redis server is /etc/redis/redis.conf.

Switch back to privileged user and proceed.

exit

To begin run the command below to create the cache to the installed shared libraries;

ldconfig

Next, copy OpenVAS scanner Redis configuration file, redis-openvas.conf, to the same Redis config directory;

cp /opt/gvm/gvm-source/openvas/config/redis-openvas.conf /etc/redis/

Update the ownership of the configuration.

chown redis:redis /etc/redis/redis-openvas.conf

Update the path to Redis unix socket on the /opt/gvm/etc/openvas/openvas.conf using the db_address parameter as follows;

echo "db_address = /run/redis-openvas/redis.sock" > /opt/gvm/etc/openvas/openvas.conf

Note, the Unix socket path is defined on /etc/redis/redis-openvas.conf file.

chown gvm:gvm /opt/gvm/etc/openvas/openvas.conf

Add gvm user to redis group;

usermod -aG redis gvm

You can also optimize Redis server itself improve the performance by making the following adjustments;

Increase the value of somaxconn in order to avoid slow clients connections issues.

echo "net.core.somaxconn = 1024" >> /etc/sysctl.conf

Redis background save may fail under low memory condition. To avoid this, enable memory overcommit (man 5 proc).

echo 'vm.overcommit_memory = 1' >> /etc/sysctl.conf

Reload sysctl variables created above.

sysctl -p

To avoid creation of latencies and memory usage issues with Redis, disable Linux Kernel’s support for Transparent Huge Pages (THP). To easily work around this, create a systemd service unit for this purpose.

cat > /etc/systemd/system/disable_thp.service << 'EOL'
[Unit]
Description=Disable Kernel Support for Transparent Huge Pages (THP)

[Service]
Type=simple
ExecStart=/bin/sh -c "echo 'never' > /sys/kernel/mm/transparent_hugepage/enabled && echo 'never' > /sys/kernel/mm/transparent_hugepage/defrag"

[Install]
WantedBy=multi-user.target
EOL

Reload systemd configurations;

systemctl daemon-reload

Start and enable this service to run on system boot.

systemctl enable --now disable_thp

Restart OpenVAS Redis server

systemctl enable --now [email protected]

A number of Network Vulnerability Tests (NVTs) require root privileges to perform certain operations. Since openvas is launched from an ospd-openvas process, via sudo, add the line below to sudoers file to ensure that the gvm user used in this demo can run the openvas with elevated rights using passwordless sudo.

echo "gvm ALL = NOPASSWD: /opt/gvm/sbin/openvas" > /etc/sudoers.d/gvm

Also, update the secure_path to include the GVM /sbin paths, /opt/gvm/sbin.

visudo

Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin:/opt/gvm/sbin"

Also, enable gvm user to run GSA web application daemon, gsad, with passwordless sudo.

echo "gvm ALL = NOPASSWD: /opt/gvm/sbin/gsad" >> /etc/sudoers.d/gvm

Update NVTs

Update Network Vulnerability Tests feed from Greenbone Security Feed/Community Feed using the greenbone-nvt-sync command.

The greenbone-nvt-sync command must not be executed as privileged user root, hence switch back to GVM user we created above and update the NVTs.

su - gvm

Next, update the NVTs as openvas user;

greenbone-nvt-sync

Once the update is done, you need to update Redis server with the same VT info from VT files;

sudo openvas --update-vt-info

Build and Install Greenbone Vulnerability Manager

export PKG_CONFIG_PATH=/opt/gvm/lib/pkgconfig:$PKG_CONFIG_PATH

cd gvm-source/gvmd
mkdir build
cd build
cmake .. -DCMAKE_INSTALL_PREFIX=/opt/gvm
make
make install

Build and Install Greenbone Security Assistant

cd ../../gsa
mkdir build
cd build
cmake .. -DCMAKE_INSTALL_PREFIX=/opt/gvm
make
make install

Generate GVM Certificates

Next, run the command below to generate certificates gvmd. Server certificates are used for authentication while client certificates are primarily used for authorization. More on man gvm-manage-certs.

gvm-manage-certs -a

Keeping the feeds up-to-date

The gvmd Data, SCAP and CERT Feeds should be kept up-to-date by calling the greenbone-feed-sync script regularly (e.g. via a cron entry):

sudo -Hiu gvm greenbone-feed-sync --type GVMD_DATA

sudo -Hiu gvm greenbone-feed-sync --type SCAP

sudo -Hiu gvm greenbone-feed-sync --type CERT

Please note: The CERT feed sync depends on data provided by the SCAP feed and should be called after syncing the later.

Also, in case the commands fail with such an error;

rsync: read error: Connection reset by peer (104)
rsync error: error in socket IO (code 10) at io.c(794) [receiver=3.1.3]
rsync: connection unexpectedly closed (1047 bytes received so far) [generator]
rsync error: error in rsync protocol data stream (code 12) at io.c(235) [generator=3.1.3]

Try adding --rsync option to the command, for example;

sudo -Hiu gvm greenbone-feed-sync --type CERT --rsync

Build and Install OSPd and OSPd-OpenVAS

Open Scanner Protocol (OSP) creates a unified interface for different security scanners and makes their control flow and scan results consistently available under the central Greenbone Vulnerability Manager service.

As much as you can build them from the source, it has been made such that you can install using Python package manager, pip as shown below;

su - gvm

pip3 install wheel

pip3 install python-gvm gvm-tools

Build and install OSPd and OSPd-openvas:

cd /opt/gvm/gvm-source/ospd
python3 -m pip install .

cd /opt/gvm/gvm-source/ospd-openvas
python3 -m pip install .

Running OpenVAS Scanner, GSA and GVM services

In order to make the management of OpenVAS scanner, GSA (WebUI service) and GVM daemon, create systemd service unit files for each of them as follows.

Log out as gvm user and execute the commands below as a privileged user.

exit

Creating Systemd Service units for GVM services

Create OpenVAS systemd service

cat > /etc/systemd/system/openvas.service << 'EOL'
[Unit]
Description=Control the OpenVAS service
After=redis.service
After=postgresql.service

[Service]
ExecStartPre=-rm -rf /opt/gvm/var/run/ospd-openvas.pid /opt/gvm/var/run/ospd.sock /opt/gvm/var/run/gvmd.sock
Type=simple
User=gvm
Group=gvm
Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/opt/gvm/bin:/opt/gvm/sbin:/opt/gvm/.local/bin
ExecStart=/usr/bin/python3 /opt/gvm/.local/bin/ospd-openvas 
--pid-file /opt/gvm/var/run/ospd-openvas.pid 
--log-file /opt/gvm/var/log/gvm/ospd-openvas.log 
--lock-file-dir /opt/gvm/var/run -u /opt/gvm/var/run/ospd.sock
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
EOL

Reload systemd service unit configurations.

systemctl daemon-reload

systemctl start openvas

Check the status of the service;

systemctl status openvas

● openvas.service - Control the OpenVAS service
   Loaded: loaded (/etc/systemd/system/openvas.service; disabled; vendor preset: enabled)
   Active: active (exited) since Thu 2021-02-11 04:22:34 EST; 12s ago
  Process: 2785 ExecStartPre=/usr/bin/rm -rf /opt/gvm/var/run/ospd-openvas.pid /opt/gvm/var/run/ospd.sock /opt/gvm/var/run/gvmd.sock (code=exited, status=0/SUCCESS)
  Process: 2786 ExecStart=/usr/bin/python3 /opt/gvm/.local/bin/ospd-openvas --pid-file /opt/gvm/var/run/ospd-openvas.pid --log-file /opt/gvm/var/log/gvm/ospd-openvas.log --
 Main PID: 2786 (code=exited, status=0/SUCCESS)
    Tasks: 6 (limit: 2359)
   Memory: 61.4M
   CGroup: /system.slice/openvas.service
           ├─2788 /usr/bin/python3 /opt/gvm/.local/bin/ospd-openvas --pid-file /opt/gvm/var/run/ospd-openvas.pid --log-file /opt/gvm/var/log/gvm/ospd-openvas.log --lock-fil
           ├─2790 /usr/bin/python3 /opt/gvm/.local/bin/ospd-openvas --pid-file /opt/gvm/var/run/ospd-openvas.pid --log-file /opt/gvm/var/log/gvm/ospd-openvas.log --lock-fil
           ├─2798 openvas --update-vt-info
           └─2799 openvas --update-vt-info

Feb 11 04:22:34 debian systemd[1]: Starting Control the OpenVAS service...
Feb 11 04:22:34 debian systemd[1]: Started Control the OpenVAS service.

Enable OpenVAS scanner to run on system boot;

systemctl enable openvas

Create GSA systemd service Unit file

cat > /etc/systemd/system/gsa.service << 'EOL'
[Unit]
Description=Control the OpenVAS GSA service
After=openvas.service

[Service]
Type=simple
User=gvm
Group=gvm
Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/opt/gvm/bin:/opt/gvm/sbin:/opt/gvm/.local/bin
ExecStart=/usr/bin/sudo /opt/gvm/sbin/gsad
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
EOL

cat >  /etc/systemd/system/gsa.path << 'EOL'
[Unit]
Description=Start the OpenVAS GSA service when gvmd.sock is available

[Path]
PathChanged=/opt/gvm/var/run/gvmd.sock
Unit=gsa.service

[Install]
WantedBy=multi-user.target
EOL

Create GVM Systemd Service unit file

cat > /etc/systemd/system/gvm.service << 'EOL'
[Unit]
Description=Control the OpenVAS GVM service
After=openvas.service

[Service]
Type=simple
User=gvm
Group=gvm
Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/opt/gvm/bin:/opt/gvm/sbin:/opt/gvm/.local/bin
ExecStart=/opt/gvm/sbin/gvmd --osp-vt-update=/opt/gvm/var/run/ospd.sock
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
EOL

cat > /etc/systemd/system/gvm.path << 'EOL'
[Unit]
Description=Start the OpenVAS GVM service when opsd.sock is available

[Path]
PathChanged=/opt/gvm/var/run/ospd.sock
Unit=gvm.service

[Install]
WantedBy=multi-user.target
EOL

Reload system unit configs and start the services;

systemctl daemon-reload
systemctl enable --now gvm.{path,service}
systemctl enable --now gsa.{path,service}

Checking the status;

systemctl status gvm.{path,service}

● gvm.path - Start the OpenVAS GVM service when opsd.sock is available
   Loaded: loaded (/etc/systemd/system/gvm.path; enabled; vendor preset: enabled)
   Active: active (waiting) since Thu 2021-02-11 04:24:50 EST; 31s ago

Feb 11 04:24:50 debian systemd[1]: Started Start the OpenVAS GVM service when opsd.sock is available.

● gvm.service - Control the OpenVAS GVM service
   Loaded: loaded (/etc/systemd/system/gvm.service; enabled; vendor preset: enabled)
   Active: active (exited) since Thu 2021-02-11 04:24:50 EST; 31s ago
 Main PID: 2885 (code=exited, status=0/SUCCESS)
    Tasks: 8 (limit: 2359)
   Memory: 336.5M
   CGroup: /system.slice/gvm.service
           ├─2886 gvmd: Waiting for incoming connections
           ├─2938 gpg-agent --homedir /opt/gvm/var/lib/gvm/gvmd/gnupg --use-standard-socket --daemon
           ├─2947 gvmd: Reloading NVTs
           ├─2948 gvmd: Syncing SCAP: Updating CPEs
           ├─2949 gvmd: OSP: Updating NVT cache
           ├─2950 gvmd: Syncing CERT
           ├─2957 sh -c xml_split -s40Mb split.xml && head -n 2 split-00.xml > head.xml && echo '</cpe-list>' > tail.xml && for F in split-*.xml; do    awk 'NR>3 {print las
           └─2958 /usr/bin/perl -w /usr/bin/xml_split -s40Mb split.xml

Feb 11 04:24:50 debian systemd[1]: Started Control the OpenVAS GVM service

systemctl status gsa.{path,service}

● gsa.path - Start the OpenVAS GSA service when gvmd.sock is available
   Loaded: loaded (/etc/systemd/system/gsa.path; enabled; vendor preset: enabled)
   Active: active (running) since Thu 2021-02-11 04:24:51 EST; 55s ago

Feb 11 04:24:51 debian systemd[1]: Started Start the OpenVAS GSA service when gvmd.sock is available.

● gsa.service - Control the OpenVAS GSA service
   Loaded: loaded (/etc/systemd/system/gsa.service; enabled; vendor preset: enabled)
   Active: active (exited) since Thu 2021-02-11 04:24:51 EST; 55s ago
  Process: 2907 ExecStart=/usr/bin/sudo /opt/gvm/sbin/gsad (code=exited, status=0/SUCCESS)
 Main PID: 2907 (code=exited, status=0/SUCCESS)
    Tasks: 4 (limit: 2359)
   Memory: 3.9M
   CGroup: /system.slice/gsa.service
           ├─2909 /opt/gvm/sbin/gsad
           └─2910 /opt/gvm/sbin/gsad

Feb 11 04:24:51 debian systemd[1]: Started Control the OpenVAS GSA service.
Feb 11 04:24:52 debian sudo[2907]:      gvm : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/opt/gvm/sbin/gsad
Feb 11 04:24:52 debian sudo[2907]: pam_unix(sudo:session): session opened for user root by (uid=0)
Feb 11 04:24:52 debian sudo[2907]: Oops, secure memory pool already initialized
Feb 11 04:24:52 debian sudo[2907]: pam_unix(sudo:session): session closed for user root

Various Log files are located under the /opt/gvm/var/log/gvm directory.

ls /opt/gvm/var/log/gvm

gsad.log  gvmd.log  openvas.log  ospd-openvas.log

Create GVM Scanner

Since we launched the scanner and set it to use our non-standard scanner host path (/opt/gvm/var/run/ospd.sock), we need to create and register our scanner;

sudo -Hiu gvm gvmd --create-scanner="Kifarunix-demo OpenVAS Scanner" --scanner-type="OpenVAS" --scanner-host=/opt/gvm/var/run/ospd.sock

Next, you need to verify your scanner. For this, you first need to get the scanner identifier;

sudo -Hiu gvm gvmd --get-scanners

08b69003-5fc2-4037-a479-93b440211c73  OpenVAS  /var/run/ospd/ospd.sock  0  OpenVAS Default
6acd0832-df90-11e4-b9d5-28d24461215b  CVE    0  CVE
50afbf2b-d854-4b6d-879f-c62aa62254d2  OpenVAS  /opt/gvm/var/run/ospd.sock  9390  Kifarunix-demo OpenVAS Scanner

Based on the output above, our scanner UUID is, 50afbf2b-d854-4b6d-879f-c62aa62254d2.

Verify the scanner;

sudo -Hiu gvm gvmd --verify-scanner=50afbf2b-d854-4b6d-879f-c62aa62254d2

Command output;

Scanner version: OpenVAS 20.8.2.

Create OpenVAS (GVM) Admin User

Create OpenVAS administrative user by running the command below;

sudo -Hiu gvm gvmd --create-user admin

This command generates a random password for the user. See sample output below;

User created with password 'fee42e66-117c-42f8-9b48-429e51194a13'.

If you want to create a user and at the same time create your own password;

sudo -Hiu gvm gvmd --create-user gvmadmin [email protected]

Otherwise, you can reset the password of an already existing user;

sudo -Hiu gvm gvmd --user=<USERNAME> --new-password=<PASSWORD>

An administrator user can later create further users or administrators via clients like the Greenbone Security Assistant (GSA).

If you want to reset the GVM admin password, simply run the command below;

sudo -Hiu gvm gvmd --user=admin --new-password=<new-password>

Replace the <new-password> with your password.

Set the Feed Import Owner

According to gvmd/INSTALL.md, certain resources that were previously part of the gvmd source code are now shipped via the feed. An example is the config “Full and Fast”.

gvmd will only create these resources if a “Feed Import Owner” is configured:

sudo -Hiu gvm gvmd --modify-setting 78eceaec-3385-11ea-b237-28d24461215b --value <uuid_of_user>

The UUIDs of all created users can be found using

sudo -Hiu gvm gvmd --get-users --verbose

Sample output;

admin 9a9e5070-d2f0-4802-971e-c9d61e682c21

Then modify the gvmd settings with the user UUID.

sudo -Hiu gvm gvmd --modify-setting 78eceaec-3385-11ea-b237-28d24461215b --value 9a9e5070-d2f0-4802-971e-c9d61e682c21

Accessing GVM 20.08 (OpenVAS)

Greenbone Security Assistant (GSA) WebUI daemon opens port 443 and listens on all interfaces. If firewall is running, open this port to allow external access.

ufw allow 443/tcp

You can now access GSA via the url https:<serverIP-OR-hostname>. Accept the self-signed SSL warning and proceed.

Login with the administrative credentials generated above.

Port lists

And there you go. That is all it take to install and Setup GVM 20.08 on Debian 10. You can now start running your scans.

In case you see The SCAP database is required, upon accessing the NVTs, CVEs, then the SCAP database might still being rebuild. Check the gvmd.log file;

tail -f /opt/gvm/var/log/gvm/gvmd.log

md manage:MESSAGE:2021-02-12 06h17.42 utc:11210: No SCAP database found
util gpgme:MESSAGE:2021-02-12 06h17.46 utc:11210: Setting GnuPG dir to '/opt/gvm/var/lib/gvm/gvmd/gnupg'
util gpgme:MESSAGE:2021-02-12 06h17.46 utc:11210: Using OpenPGP engine version '2.2.12'
md manage:WARNING:2021-02-12 06h17.47 utc:11237: update_scap: No SCAP db present, rebuilding SCAP db from scratch
md manage:   INFO:2021-02-12 06h17.53 utc:11237: update_scap: Updating data from feed
md manage:   INFO:2021-02-12 06h17.53 utc:11237: Updating CPEs
...

The error will disappear once the SCAP database rebuild completes and such logs appear on gvmd.log file;

md manage:   INFO:2021-02-12 06h48.36 utc:13337: Updating CVSS scores for OVAL definitions
md manage:   INFO:2021-02-12 06h48.45 utc:13337: Updating placeholder CPEs
md manage:   INFO:2021-02-12 06h54.31 utc:13337: Updating Max CVSS for DFN-CERT
md manage:   INFO:2021-02-12 06h54.57 utc:13337: Updating DFN-CERT CVSS max succeeded.
md manage:   INFO:2021-02-12 06h54.57 utc:13337: Updating Max CVSS for CERT-Bund
md manage:   INFO:2021-02-12 07h05.02 utc:13337: Updating CERT-Bund CVSS max succeeded.
md manage:   INFO:2021-02-12 07h05.14 utc:13337: update_scap_end: Updating SCAP info succeeded

NOTE: When creating a scan task, be sure to select the Scanner we created above.

You can now create your target hosts to scan and schedule the scans to run at your own preferred time.

That marks the end of our tutorial on how to install and setup GVM 20.08 on Debian 10.

Did I miss anything, drop it in the comments section!! Enjoy

Reference

Source files README.md and INSTALL.md files

Related Tutorials

Install OpenVAS 10 (GVM) on Debian 10 Buster

Install OpenVAS 9 with PostgreSQL in Ubuntu 18.04

How to Add and Scan a Target for Vulnerabilities on OpenVAS Scanner

How to Install and Setup OpenVAS 9 Vulnerability Scanner on Ubuntu 18.04

How to Install and Use WPScan WordPress Vulnerability Scanner Ubuntu 18.04

It’s time to cover some vulnerability scanning! What better way to start this than with the installation of OpenVAS? Today I will show you how to install OpenVAS on Kali Linux in a step-by-step guide for you to follow along.

Table of Contents

• What is OpenVAS?
• Step 1 – Install OpenVAS on Kali Linux
• Step 2 – Configuring OpenVAS
• Step 3 – Running your first Scan
• Finding Exploits with OpenVAS
• Troubleshooting
  • PostgreSQL Version Errors v13 and v14
  • PostgreSQL Version Errors v14 and v15
  • OpenVAS failed to find config
• Conclusion

⚠️ Kali Linux Wiki
➡️ Download Kali Linux Safe & Easy
➡️ Install Kali Linux on VirtualBox
➡️ Install Kali Linux on VMWare Workstation
➡️ Dual Boot Kali Linux with Windows
➡️ Install Kali Linux on WSL 2
➡️ Install Kali Linux on a Laptop
➡️ Install VSCode on Kali Linux
➡️ Install OpenVAS on Kali Linux
➡️ Install Docker on Kali Linux
➡️ WiFi Adapter for Kali Linux

What is OpenVAS?

OpenVAS is an open-source vulnerability scanner. OpenVAS started under the name of GNessUs, a fork of the previously open-source Nessus scanning tool (which costs you money now). OpenVAS is also under the GNU General Public License (GPL).

I personally used this software in many different kinds of assessments and was always satisfied with the results I got (keeping in mind that it is completely free).

Of course, tools like Nessus and NeXpose are more feature-rich, but they come with a high price tag too.

For starters, OpenVAS is simply perfect and gives you a good idea of how a vulnerability scanner works. I also found it very intuitive to work with.

So without further ado, let’s dive right into the installation.

The first thing we want to do is to make sure that our Kali installation is up-to-date. So open a terminal window and run:

sudo apt update && sudo apt upgrade -y
Code language: Bash (bash)

This will update your repository and upgrade your Kali, the -y at the end saves you a press of the button “Y” in the process.

The next thing we want to do is to install OpenVAS. Again in the Terminal type:

sudo apt install openvas
Code language: Bash (bash)

Confirm that you are aware that an additional ~1,2 Gigabyte of Disk Space will be used by pressing Y.

Now this will take a good while. Grab a coffee or prepare some Yerba Mate while we are waiting 🙂

Once that is done we will run another command in the terminal window:

sudo gvm-setup
Code language: Bash (bash)

Note: In case you run into a PostgreSQL error – check out the troubleshooting section at the end of this article.

This is going to take very long.

Phew… That took about 2 hours for me to finish. I still didn’t get why it takes so long, but just go for a long walk and come back later…

After the setup process is finished, don’t forget to note down your password that was generated at the end, you need it to log in for the first time.

Step 2 – Configuring OpenVAS

The installation is now finished. Next, we verify if our installation is working.

sudo gvm-check-setup
Code language: Bash (bash)

I got an error (SCAP DATA are missing), but if you look through the error message, you can see that you can fix it by running:

sudo runuser -u _gvm -- greenbone-feed-sync --type SCAP
Code language: Bash (bash)

This fixed my issue.

First, we are starting the OpenVAS Service.

sudo gvm-start
Code language: Bash (bash)

Now your OpenVAS Service should be up and running. OpenVAS listens on the Ports: 9390, 9391, 9392, and on Port 80. Your web browser should automatically open and lead to the OpenVAS Login Page.

If not, open a web browser manually and enter the URL

https://127.0.0.1:9392
Code language: Bash (bash)

The first time you want to open this URL you will get a security warning. Click on Advanced and Add an Exception.

Remember the password you noted down before? Now we are going to need it.

Forgot your Admin Password?

Reset it by typing: sudo gvmd --user=admin --new-password=passwd;

Log in to OpenVAS with admin // your password

First things first – Navigate to To your User Profile / My Settings / Click on Edit and change the password.

This is basically all you need to do. OpenVAS is now running and ready for use.

Step 3 – Running your first Scan

Now it’s time to run our first scan.

As this is just the installation part I won’t go into details, but I will show you quickly how to run your first scan. There will be more articles covering OpenVAS and we will continue looking into all of the different options we have and how to process scan results.

So the easiest way is simply to Navigate to Scans / Tasks and click on the little Magic Wand icon and start the Task Wizard.

Now you can enter either a single IP, a whole subnet, a range of IP Addresses, or a domain.

This will start a default-depth scan. Depending on the scale of the Network you want to scan this can take from a few minutes up to several hours or even days if the network is large enough and you choose a deep scan.

This and more will be covered in the next article for OpenVAS, which is coming soon.

Finding Exploits with OpenVAS

I created a video a while ago on how to find Exploits using OpenVAS, which basically goes through the whole process of scanning and then finding Exploits for your findings. The video is a bit older but still valid. Give it a watch if you want to learn how to use OpenVAS in-depth.

Troubleshooting

There is a lot that can go wrong during the installation of OpenVAS as some of our readers has pointed out, therefore, we decided to create a little extra section here, covering the most common errors.

PostgreSQL Version Errors v13 and v14

There are multiple possible version errors for PostgreSQL. As our reader Tom has pointed out, the first one is:

[>] Starting PostgreSQL service
[-] ERROR: The default PostgreSQL version (13) is not 14 that is required by libgvmd
[-] ERROR: Use pg_upgradecluster to update your PostgreSQL cluster

Solution:

Open the postgresql.conf file of version 14 and change the port to 5432:

sudo nano /etc/postgresql/14/main/postgresql.conf

Then open the postgresql.conf file of version 13 and check if the port is the same as in version 14. If it is the same – change it to 5433:

sudo nano /etc/postgresql/13/main/postgresql.conf

Restart the PostgreSQL service:

sudo systemctl restart postgresql

PostgreSQL Version Errors v14 and v15

During my installation, I got the following error affecting v14 and v15 of PostgreSQL:

[>] Starting PostgreSQL service
[-] ERROR: The default PostgreSQL version (14) is not 15 that is required by libgvmd
[-] ERROR: Use pg_upgradecluster to update your PostgreSQL cluster

Gladly, the solution to this problem was easier than the one above and might as well work for the problem above:

sudo systemcctl stop postgresql@14-main
sudo /usr/bin/pg_dropcluster --stop 14 main
Code language: CSS (css)

OpenVAS failed to find config

Another common error is the failed to find config ‘long-string-value’ message. There are multiple possible solutions for this issue. The one that worked for me is the following:

sudo runuser -u _gvm – gvmd --get-scanners
Code language: JavaScript (javascript)

Note down the scanner ID.

Then run:

sudo runuser -u _gvm – gvmd --get-users --verbose
Code language: JavaScript (javascript)

This gives you the users, including their IDs. You are probably an admin. To solve the issue, enter:

sudo runuser -u _gvm – gvmd --modify-scanner [scanner id] --value [user id]
Code language: CSS (css)

Conclusion

This is how easy it is to install OpenVAS on Kali Linux and start a basic scan. There is a lot more to learn about OpenVAS, but this should get you up and running in no time!

👀 This Tutorial has some related Articles!
👉 How to get started in Cyber Security – The Complete Guide
👉 How to get started with Bug Bounties
👉 Terminal Customization Series
👉 Best Ethical Hacking Books
👉 Download Kali Linux Safe & Easy
👉 Best Ethical Hacking Tools
👉 Install VSCode on Kali Linux
👉 Dual Boot Kali Linux with Windows
👉 Install Kali Linux on VirtualBox – Complete Beginner Guide
👉 Top Things to do after installing Kali Linux
👉 WiFi Adapter for Kali Linux – The Ultimate Guide
👉 Nmap Beginner Guide Series
👉 Metasploit Tutorial Series
👉 Burp Suite Beginner Guide