Building 22.4 from Source#
Building the Greenbone Community Edition stack from source requires knowledge about:
Using a terminal
Shell programming basics
Installing software via apt or dnf
Using a C compiler
Using CMake and make
Running services via systemd
Additionally, a basic knowledge about the architecture of the Greenbone Community Edition is required to follow this guide.
Hardware requirements#
Minimal:
CPU Cores: 2
Random-Access Memory: 4GB
Hard Disk: 20GB free
Recommended:
CPU Cores: 4
Random-Access Memory: 8GB
Hard Disk: 60GB free
Note
This guide is intended for developers who want to try out the newest features and/or want to get familiar with the source code. It is not intended for production setups.
Currently the docs support the following distributions
Debian stable (bullseye)
Ubuntu 22.04 LTS
Fedora 35 and 36
CentOS 9 Stream
Most likely, other Debian derivatives like Mint and Kali will also work with only minor adjustments required.
Prerequisites#
Note
Please follow the guide step by step. Later steps might require settings or output of a previous command.
The command sudo
is used for executing commands that require privileged
access on the system.
Creating a User and a Group#
The services provided by the GVM framework should run as a dedicated user and group. Therefore a gvm user and a group with the same name will be created.
Adjusting the Current User#
To allow the current user to run gvmd he must be added to the gvm group. To make the group change effective either logout and login again or use su.
sudo usermod -aG gvm $USER
su $USER
Setting the PATH#
On Debian systems the locations /sbin
, /usr/sbin
and
/usr/local/sbin
are not in the PATH
of normal users. To run
gvmd which is located in /usr/local/sbin
the PATH
environment variable should be adjusted.
export PATH=$PATH:/usr/local/sbin
Choosing an Install Prefix#
Before building the software stack, a (root) directory must be chosen where the built software will finally be installed. For example, when building packages, the distribution developers set this path to /usr.
By default, it is /usr/local
which is also used in this guide. This
directory will be stored in an environment variable INSTALL_PREFIX
to be able to reference it later.
export INSTALL_PREFIX=/usr/local
Creating a Source, Build and Install Directory#
To separate the sources and the build artifacts, a source and a build directory must be created.
This source directory will be used later in this guide via
an environment variable SOURCE_DIR
. Accordingly, a variable
BUILD_DIR
will be set for the build directory. Both can be set to any
directory to which the current user has write permissions. Therefore
directories in the current user’s home directory are chosen in this guide.
export SOURCE_DIR=$HOME/source
mkdir -p $SOURCE_DIR
export BUILD_DIR=$HOME/build
mkdir -p $BUILD_DIR
Additionally, an install directory will be set as an environment variable
INSTALL_DIR
. It is used as a temporary installation directory
before moving all built artifacts to the final destination.
export INSTALL_DIR=$HOME/install
mkdir -p $INSTALL_DIR
Choosing the Installation Source#
For building the GVM software stack, three different sources can be chosen depending on the desired stability:
Building from release tarballs
Building from git tags
Building from release branches
Linux distributions use the release tarballs because it is the most common and well known method to share source code.
Newer build systems may stick with the git tags.
If you are a developer and very familiar with building from source already, you may also try out using the git release branches. These have the advantage that they contain the newest fixes which may not yet be included in the release tarballs or git tags. As a downside, the release branches may contain only partially fixed issues and need to be updated more often.
This guide will use the tarballs to build the software.
Installing Common Build Dependencies#
For downloading, configuring, building and installing the GVM components, several tools and applications are required. To install this requirements the following commands can be used:
sudo apt update
sudo apt install --no-install-recommends --assume-yes \
build-essential \
curl \
cmake \
pkg-config \
python3 \
python3-pip \
gnupg
sudo dnf upgrade -y
sudo dnf groupinstall 'Development Tools' -y
sudo dnf install -y \
cmake \
python3-pip \
tar \
gcc-c++
sudo tee /etc/ld.so.conf.d/local.conf <<EOF
/usr/local/lib
/usr/local/lib64
EOF
sudo ldconfig
sudo dnf remove net-snmp net-snmp-devel
sudo dnf install -y \
systemd \
gcc \
openssl-devel \
bzip2-devel \
elfutils-devel \
libselinux-devel \
elfutils-libelf-devel \
rpm-devel \
perl-devel \
procps \
python3-devel \
python3-setuptools \
chrpath \
mariadb-connector-c-devel
curl -O https://netcologne.dl.sourceforge.net/project/net-snmp/net-snmp/5.9.1/net-snmp-5.9.1.tar.gz
tar xzf net-snmp-5.9.1.tar.gz
cd net-snmp-5.9.1
./configure
make -j$(nproc)
sudo make install
sudo dnf config-manager --set-enabled crb
sudo dnf install -y epel-release epel-next-release
sudo dnf upgrade -y
sudo dnf groupinstall 'Development Tools' -y
sudo dnf install -y \
cmake \
python3-pip \
tar \
gcc-c++ \
doxygen \
xmltoman
sudo tee /etc/ld.so.conf.d/local.conf <<EOF
/usr/local/lib
/usr/local/lib64
EOF
sudo ldconfig
sudo dnf remove net-snmp net-snmp-devel
sudo dnf install -y \
systemd \
gcc \
openssl-devel \
bzip2-devel \
elfutils-devel \
libselinux-devel \
elfutils-libelf-devel \
rpm-devel \
perl-devel \
procps \
python3-devel \
python3-setuptools \
chrpath \
mariadb-connector-c-devel
curl -O https://netcologne.dl.sourceforge.net/project/net-snmp/net-snmp/5.9.1/net-snmp-5.9.1.tar.gz
tar xzf net-snmp-5.9.1.tar.gz
cd net-snmp-5.9.1
./configure
make -j$(nproc)
sudo make install
curl -o paho.mqtt.c.tar.gz https://codeload.github.com/eclipse/paho.mqtt.c/tar.gz/refs/tags/v1.3.10
tar xzf paho.mqtt.c.tar.gz
cd paho.mqtt.c-1.3.10
mkdir build && cd build
cmake ..
make -j$(nproc)
sudo make install
Importing the Greenbone Signing Key#
To validate the integrity of the downloaded source files, GnuPG is used. It requires downloading the Greenbone Community Signing public key and importing it into the current user’s keychain.
curl -f -L https://www.greenbone.net/GBCommunitySigningKey.asc -o /tmp/GBCommunitySigningKey.asc
gpg --import /tmp/GBCommunitySigningKey.asc
For understanding the validation output of the gpg tool, it is best to mark the Greenbone Community Signing key as fully trusted.
echo "8AE4BE429B60A59B311C2E739823FAA60ED1E580:6:" > /tmp/ownertrust.txt
gpg --import-ownertrust < /tmp/ownertrust.txt
Setting the Version#
To make the downloading easier, an environment variable for the desired release version will be set. Using a variable allows adjusting the version easily after a new release.
export GVM_VERSION=22.4.0
Building and Installing the Components#
Note
The components should be build and installed in the listed order.
gvm-libs#
gvm-libs is a C library providing basic functionality like XML parsing and network communication. It is used in openvas-scanner, gvmd, gsad and pg-gvm.
export GVM_LIBS_VERSION=$GVM_VERSION
sudo apt install -y \
libglib2.0-dev \
libgpgme-dev \
libgnutls28-dev \
uuid-dev \
libssh-gcrypt-dev \
libhiredis-dev \
libxml2-dev \
libpcap-dev \
libnet1-dev \
libpaho-mqtt-dev
sudo apt install -y \
libldap2-dev \
libradcli-dev
sudo dnf install -y \
glib2-devel \
gpgme-devel \
gnutls-devel \
libgcrypt-devel \
libuuid-devel \
libssh-devel \
hiredis-devel \
libxml2-devel \
libpcap-devel \
libnet-devel \
paho-c-devel
sudo dnf install -y \
openldap-devel \
radcli-devel
sudo dnf install -y \
glib2-devel \
gpgme-devel \
gnutls-devel \
libgcrypt-devel \
libuuid-devel \
libssh-devel \
hiredis-devel \
libxml2-devel \
libpcap-devel \
libnet-devel \
uuid-devel
sudo dnf install -y \
openldap-devel \
radcli-devel
curl -f -L https://github.com/greenbone/gvm-libs/archive/refs/tags/v$GVM_LIBS_VERSION.tar.gz -o $SOURCE_DIR/gvm-libs-$GVM_LIBS_VERSION.tar.gz
curl -f -L https://github.com/greenbone/gvm-libs/releases/download/v$GVM_LIBS_VERSION/gvm-libs-$GVM_LIBS_VERSION.tar.gz.asc -o $SOURCE_DIR/gvm-libs-$GVM_LIBS_VERSION.tar.gz.asc
gpg --verify $SOURCE_DIR/gvm-libs-$GVM_LIBS_VERSION.tar.gz.asc $SOURCE_DIR/gvm-libs-$GVM_LIBS_VERSION.tar.gz
The output of the last command should be similar to:
gpg: Signature made Fri Apr 16 08:31:02 2021 UTC
gpg: using RSA key 9823FAA60ED1E580
gpg: Good signature from "Greenbone Community Feed integrity key" [ultimate]
If the signature is valid, the tarball can be extracted.
tar -C $SOURCE_DIR -xvzf $SOURCE_DIR/gvm-libs-$GVM_LIBS_VERSION.tar.gz
Afterwards, gvm-libs can be build and installed.
mkdir -p $BUILD_DIR/gvm-libs && cd $BUILD_DIR/gvm-libs
cmake $SOURCE_DIR/gvm-libs-$GVM_LIBS_VERSION \
-DCMAKE_INSTALL_PREFIX=$INSTALL_PREFIX \
-DCMAKE_BUILD_TYPE=Release \
-DSYSCONFDIR=/etc \
-DLOCALSTATEDIR=/var
make -j$(nproc)
make DESTDIR=$INSTALL_DIR install
sudo cp -rv $INSTALL_DIR/* /
rm -rf $INSTALL_DIR/*
gvmd#
The Greenbone Vulnerability Management Daemon (gvmd) is the main service of the current GVM stack. It handles authentication, scan management, vulnerability information, reporting, alerting, scheduling and much more. As a storage backend, it uses a PostgreSQL database.
export GVMD_VERSION=$GVM_VERSION
sudo apt install -y \
libglib2.0-dev \
libgnutls28-dev \
libpq-dev \
postgresql-server-dev-13 \
libical-dev \
xsltproc \
rsync \
libbsd-dev \
libgpgme-dev
sudo apt install -y --no-install-recommends \
texlive-latex-extra \
texlive-fonts-recommended \
xmlstarlet \
zip \
rpm \
fakeroot \
dpkg \
nsis \
gnupg \
gpgsm \
wget \
sshpass \
openssh-client \
socat \
snmp \
python3 \
smbclient \
python3-lxml \
gnutls-bin \
xml-twig-tools
sudo apt install -y \
libglib2.0-dev \
libgnutls28-dev \
libpq-dev \
postgresql-server-dev-14 \
libical-dev \
xsltproc \
rsync \
libbsd-dev \
libgpgme-dev
sudo apt install -y --no-install-recommends \
texlive-latex-extra \
texlive-fonts-recommended \
xmlstarlet \
zip \
rpm \
fakeroot \
dpkg \
nsis \
gnupg \
gpgsm \
wget \
sshpass \
openssh-client \
socat \
snmp \
python3 \
smbclient \
python3-lxml \
gnutls-bin \
xml-twig-tools
sudo dnf install -y \
glib2-devel \
gnutls-devel \
postgresql-server-devel \
libical-devel \
xsltproc \
rsync \
libbsd-devel \
gpgme-devel
sudo dnf install -y --setopt=install_weak_deps=False \
texlive-scheme-medium \
texlive-fontawesome \
texlive-fontmfizz \
texlive-fonts-churchslavonic \
texlive-fontsetup \
texlive-fontsize \
texlive-fonttable \
fontawesome-fonts \
gnupg2-smime \
openssh-clients \
xmlstarlet \
zip \
rpm \
fakeroot \
dpkg \
nsis \
gnupg \
wget \
sshpass \
socat \
samba-client \
python3-lxml \
gnutls-utils \
perl-XML-Twig
sudo dnf install -y \
glib2-devel \
gnutls-devel \
postgresql-server-devel \
libical-devel \
libxslt \
rsync \
libbsd-devel \
gpgme-devel
sudo dnf install -y --setopt=install_weak_deps=False \
texlive* \
gnupg2-smime \
openssh-clients \
xmlstarlet \
zip \
rpm \
fakeroot \
dpkg \
gnupg \
wget \
sshpass \
socat \
samba-client \
python3-lxml \
gnutls-utils \
perl-XML-Twig
Details about the optional dependencies can be found at https://github.com/greenbone/gvmd/blob/stable/INSTALL.md#prerequisites-for-optional-features
curl -f -L https://github.com/greenbone/gvmd/archive/refs/tags/v$GVMD_VERSION.tar.gz -o $SOURCE_DIR/gvmd-$GVMD_VERSION.tar.gz
curl -f -L https://github.com/greenbone/gvmd/releases/download/v$GVMD_VERSION/gvmd-$GVMD_VERSION.tar.gz.asc -o $SOURCE_DIR/gvmd-$GVMD_VERSION.tar.gz.asc
gpg --verify $SOURCE_DIR/gvmd-$GVMD_VERSION.tar.gz.asc $SOURCE_DIR/gvmd-$GVMD_VERSION.tar.gz
The output of the last command should be similar to:
gpg: Signature made Fri Apr 16 08:31:02 2021 UTC
gpg: using RSA key 9823FAA60ED1E580
gpg: Good signature from "Greenbone Community Feed integrity key" [ultimate]
If the signature is valid the tarball can be extracted.
tar -C $SOURCE_DIR -xvzf $SOURCE_DIR/gvmd-$GVMD_VERSION.tar.gz
mkdir -p $BUILD_DIR/gvmd && cd $BUILD_DIR/gvmd
cmake $SOURCE_DIR/gvmd-$GVMD_VERSION \
-DCMAKE_INSTALL_PREFIX=$INSTALL_PREFIX \
-DCMAKE_BUILD_TYPE=Release \
-DLOCALSTATEDIR=/var \
-DSYSCONFDIR=/etc \
-DGVM_DATA_DIR=/var \
-DGVMD_RUN_DIR=/run/gvmd \
-DOPENVAS_DEFAULT_SOCKET=/run/ospd/ospd-openvas.sock \
-DGVM_FEED_LOCK_PATH=/var/lib/gvm/feed-update.lock \
-DSYSTEMD_SERVICE_DIR=/lib/systemd/system \
-DLOGROTATE_DIR=/etc/logrotate.d
make -j$(nproc)
mkdir -p $BUILD_DIR/gvmd && cd $BUILD_DIR/gvmd
cmake $SOURCE_DIR/gvmd-$GVMD_VERSION \
-DCMAKE_INSTALL_PREFIX=$INSTALL_PREFIX \
-DCMAKE_BUILD_TYPE=Release \
-DLOCALSTATEDIR=/var \
-DSYSCONFDIR=/etc \
-DGVM_DATA_DIR=/var \
-DGVMD_RUN_DIR=/run/gvmd \
-DOPENVAS_DEFAULT_SOCKET=/run/ospd/ospd-openvas.sock \
-DGVM_FEED_LOCK_PATH=/var/lib/gvm/feed-update.lock \
-DSYSTEMD_SERVICE_DIR=/lib/systemd/system \
-DLOGROTATE_DIR=/etc/logrotate.d \
-DPostgreSQL_TYPE_INCLUDE_DIR=/usr/include/postgresql
make -j$(nproc)
mkdir -p $BUILD_DIR/gvmd && cd $BUILD_DIR/gvmd
cmake $SOURCE_DIR/gvmd-$GVMD_VERSION \
-DCMAKE_INSTALL_PREFIX=$INSTALL_PREFIX \
-DCMAKE_BUILD_TYPE=Release \
-DLOCALSTATEDIR=/var \
-DSYSCONFDIR=/etc \
-DGVM_DATA_DIR=/var \
-DGVMD_RUN_DIR=/run/gvmd \
-DOPENVAS_DEFAULT_SOCKET=/run/ospd/ospd-openvas.sock \
-DGVM_FEED_LOCK_PATH=/var/lib/gvm/feed-update.lock \
-DSYSTEMD_SERVICE_DIR=/lib/systemd/system \
-DLOGROTATE_DIR=/etc/logrotate.d
sudo mkdir /usr/include/postgresql
sudo cp /usr/include/libpq-fe.h /usr/include/postgresql/libpq-fe.h
make -j$(nproc)
pg-gvm#
pg-gvm is a PostgreSQL server extension that adds several functions used by gvmd, e.g., iCalendar and host range evaluation. In previous versions, these functions were managed directly by gvmd while pg-gvm uses the extension management built into PostgreSQL.
export PG_GVM_VERSION=$GVM_VERSION
sudo apt install -y \
libglib2.0-dev \
postgresql-server-dev-13 \
libical-dev
sudo apt install -y \
libglib2.0-dev \
postgresql-server-dev-14 \
libical-dev
sudo dnf install -y \
glib2-devel \
gnutls-devel \
postgresql-server-devel \
libical-devel
curl -f -L https://github.com/greenbone/pg-gvm/archive/refs/tags/v$PG_GVM_VERSION.tar.gz -o $SOURCE_DIR/pg-gvm-$PG_GVM_VERSION.tar.gz
curl -f -L https://github.com/greenbone/pg-gvm/releases/download/v$PG_GVM_VERSION/pg-gvm-$PG_GVM_VERSION.tar.gz.asc -o $SOURCE_DIR/pg-gvm-$PG_GVM_VERSION.tar.gz.asc
gpg --verify $SOURCE_DIR/pg-gvm-$PG_GVM_VERSION.tar.gz.asc $SOURCE_DIR/pg-gvm-$PG_GVM_VERSION.tar.gz
The output of the last command should be similar to:
gpg: Signature made Fri Apr 16 08:31:02 2021 UTC
gpg: using RSA key 9823FAA60ED1E580
gpg: Good signature from "Greenbone Community Feed integrity key" [ultimate]
If the signature is valid the tarball can be extracted.
tar -C $SOURCE_DIR -xvzf $SOURCE_DIR/pg-gvm-$PG_GVM_VERSION.tar.gz
Afterwards, pg-gvm can be build and installed.
mkdir -p $BUILD_DIR/pg-gvm && cd $BUILD_DIR/pg-gvm
cmake $SOURCE_DIR/pg-gvm-$PG_GVM_VERSION \
-DCMAKE_BUILD_TYPE=Release
make -j$(nproc)
mkdir -p $BUILD_DIR/pg-gvm && cd $BUILD_DIR/pg-gvm
cmake $SOURCE_DIR/pg-gvm-$PG_GVM_VERSION \
-DCMAKE_BUILD_TYPE=Release \
-DPostgreSQL_TYPE_INCLUDE_DIR=/usr/include/postgresql
make -j$(nproc)
mkdir -p $BUILD_DIR/pg-gvm && cd $BUILD_DIR/pg-gvm
cmake $SOURCE_DIR/pg-gvm-$PG_GVM_VERSION \
-DCMAKE_BUILD_TYPE=Release
make -j$(nproc)
make DESTDIR=$INSTALL_DIR install
sudo cp -rv $INSTALL_DIR/* /
rm -rf $INSTALL_DIR/*
Greenbone Security Assistant#
The Greenbone Security Assistant (GSA) sources consist of two parts:
Web server gsad
Web application GSA
GSA#
The web application is written in JavaScript and uses the react framework. It requires nodejs for building the application and yarn (or npm) for maintaining the JavaScript dependencies.
export GSA_VERSION=$GVM_VERSION
Note
GSA is a JavaScript based web application. For maintaining the JavaScript dependencies, yarn is used.
export NODE_VERSION=node_14.x
export KEYRING=/usr/share/keyrings/nodesource.gpg
export DISTRIBUTION="$(lsb_release -s -c)"
curl -fsSL https://deb.nodesource.com/gpgkey/nodesource.gpg.key | gpg --dearmor | sudo tee "$KEYRING" >/dev/null
gpg --no-default-keyring --keyring "$KEYRING" --list-keys
echo "deb [signed-by=$KEYRING] https://deb.nodesource.com/$NODE_VERSION $DISTRIBUTION main" | sudo tee /etc/apt/sources.list.d/nodesource.list
echo "deb-src [signed-by=$KEYRING] https://deb.nodesource.com/$NODE_VERSION $DISTRIBUTION main" | sudo tee -a /etc/apt/sources.list.d/nodesource.list
sudo apt update
sudo apt install -y nodejs
curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -
echo "deb https://dl.yarnpkg.com/debian/ stable main" | sudo tee /etc/apt/sources.list.d/yarn.list
sudo apt update
sudo apt install -y yarn
sudo dnf module enable nodejs:14 -y
sudo dnf install -y nodejs yarnpkg nodejs-typescript
curl -sL https://rpm.nodesource.com/setup_14.x | sudo bash -
sudo dnf install -y nodejs yarnpkg
Building the web application GSA requires the installation of several JavaScript dependencies. These dependencies have to be downloaded automatically by yarn (or npm) during the build process.
curl -f -L https://github.com/greenbone/gsa/archive/refs/tags/v$GSA_VERSION.tar.gz -o $SOURCE_DIR/gsa-$GSA_VERSION.tar.gz
curl -f -L https://github.com/greenbone/gsa/releases/download/v$GSA_VERSION/gsa-$GSA_VERSION.tar.gz.asc -o $SOURCE_DIR/gsa-$GSA_VERSION.tar.gz.asc
gpg --verify $SOURCE_DIR/gsa-$GSA_VERSION.tar.gz.asc $SOURCE_DIR/gsa-$GSA_VERSION.tar.gz
The output of both commands should be similar to:
gpg: Signature made Fri Apr 16 08:31:02 2021 UTC
gpg: using RSA key 9823FAA60ED1E580
gpg: Good signature from "Greenbone Community Feed integrity key" [ultimate]
If the signatures are valid, the two tarballs can be extracted.
tar -C $SOURCE_DIR -xvzf $SOURCE_DIR/gsa-$GSA_VERSION.tar.gz
cd $SOURCE_DIR/gsa-$GSA_VERSION
rm -rf build
yarn
yarn build
sudo mkdir -p $INSTALL_PREFIX/share/gvm/gsad/web/
sudo cp -r build/* $INSTALL_PREFIX/share/gvm/gsad/web/
gsad#
The web server gsad is written in the C programming language. It serves static content like images and provides an API for the web application. Internally it communicates with gvmd using GMP.
export GSAD_VERSION=$GVM_VERSION
sudo apt install -y \
libmicrohttpd-dev \
libxml2-dev \
libglib2.0-dev \
libgnutls28-dev
sudo firewall-cmd --add-port=9392/tcp
sudo firewall-cmd --runtime-to-permanent
sudo dnf install -y \
glib2-devel \
gnutls-devel \
libmicrohttpd-devel \
libxml2-devel
curl -f -L https://github.com/greenbone/gsad/archive/refs/tags/v$GSAD_VERSION.tar.gz -o $SOURCE_DIR/gsad-$GSAD_VERSION.tar.gz
curl -f -L https://github.com/greenbone/gsad/releases/download/v$GSAD_VERSION/gsad-$GSAD_VERSION.tar.gz.asc -o $SOURCE_DIR/gsad-$GSAD_VERSION.tar.gz.asc
gpg --verify $SOURCE_DIR/gsad-$GSAD_VERSION.tar.gz.asc $SOURCE_DIR/gsad-$GSAD_VERSION.tar.gz
The output of both commands should be similar to:
gpg: Signature made Fri Apr 16 08:31:02 2021 UTC
gpg: using RSA key 9823FAA60ED1E580
gpg: Good signature from "Greenbone Community Feed integrity key" [ultimate]
If the signatures are valid, the two tarballs can be extracted.
tar -C $SOURCE_DIR -xvzf $SOURCE_DIR/gsad-$GSAD_VERSION.tar.gz
mkdir -p $BUILD_DIR/gsad && cd $BUILD_DIR/gsad
cmake $SOURCE_DIR/gsad-$GSAD_VERSION \
-DCMAKE_INSTALL_PREFIX=$INSTALL_PREFIX \
-DCMAKE_BUILD_TYPE=Release \
-DSYSCONFDIR=/etc \
-DLOCALSTATEDIR=/var \
-DGVMD_RUN_DIR=/run/gvmd \
-DGSAD_RUN_DIR=/run/gsad \
-DLOGROTATE_DIR=/etc/logrotate.d
make -j$(nproc)
make DESTDIR=$INSTALL_DIR install
sudo cp -rv $INSTALL_DIR/* /
rm -rf $INSTALL_DIR/*
openvas-smb#
openvas-smb is a helper module for openvas-scanner. It includes libraries (openvas-wmiclient/openvas-wincmd) to interface with Microsoft Windows Systems through the Windows Management Instrumentation API and a winexe binary to execute processes remotely on that system.
It is an optional dependency of openvas-scanner but is required for scanning Windows-based systems.
Note
openvas-smb is released independently of the GVM framework. Therefore, the newest compatible version is used.
Warning
openvas-smb doesn’t work on CentOS at the moment! It is not a hard requirement.
export OPENVAS_SMB_VERSION=22.4.0
sudo apt install -y \
gcc-mingw-w64 \
libgnutls28-dev \
libglib2.0-dev \
libpopt-dev \
libunistring-dev \
heimdal-dev \
perl-base
sudo dnf install -y \
glib2-devel \
gnutls-devel \
popt-devel \
mingw64-gcc \
libunistring-devel \
heimdal-devel \
perl
sudo cat << EOF > /lib64/pkgconfig/heimdal-krb5.pc
Name: heimdal-krb5
Description: Heimdal implementation of the Kerberos network authentication.
Version: 7.7.0
Libs: -L/usr/lib64/heimdal -lkrb5
Libs.private: -lhx509 -lcom_err -lhcrypto -lasn1 -lwind -lheimbase -lroken -lcrypt -pthread -lpthread -ldl -lresolv -pthread -lpthread
Cflags: -I/usr/include/heimdal
EOF
sudo cat << EOF > /lib64/pkgconfig/heimdal-gssapi.pc
Name: heimdal
Description: Heimdal is an implementation of Kerberos 5, freely available under a three clause BSD style license.
Version: 7.7.0
URL: http://www.pdc.kth.se/heimdal/
Requires.private: heimdal-krb5
Libs: -L/usr/lib64/heimdal -lgssapi
Libs.private: -lheimntlm -lcrypt
Cflags: -I/usr/include/heimdal
EOF
curl -f -L https://github.com/greenbone/openvas-smb/archive/refs/tags/v$OPENVAS_SMB_VERSION.tar.gz -o $SOURCE_DIR/openvas-smb-$OPENVAS_SMB_VERSION.tar.gz
curl -f -L https://github.com/greenbone/openvas-smb/releases/download/v$OPENVAS_SMB_VERSION/openvas-smb-$OPENVAS_SMB_VERSION.tar.gz.asc -o $SOURCE_DIR/openvas-smb-$OPENVAS_SMB_VERSION.tar.gz.asc
gpg --verify $SOURCE_DIR/openvas-smb-$OPENVAS_SMB_VERSION.tar.gz.asc $SOURCE_DIR/openvas-smb-$OPENVAS_SMB_VERSION.tar.gz
The output of the last command should be similar to:
gpg: Signature made Fri Apr 16 08:31:02 2021 UTC
gpg: using RSA key 9823FAA60ED1E580
gpg: Good signature from "Greenbone Community Feed integrity key" [ultimate]
If the signature is valid, the tarball can be extracted.
tar -C $SOURCE_DIR -xvzf $SOURCE_DIR/openvas-smb-$OPENVAS_SMB_VERSION.tar.gz
mkdir -p $BUILD_DIR/openvas-smb && cd $BUILD_DIR/openvas-smb
cmake $SOURCE_DIR/openvas-smb-$OPENVAS_SMB_VERSION \
-DCMAKE_INSTALL_PREFIX=$INSTALL_PREFIX \
-DCMAKE_BUILD_TYPE=Release
make -j$(nproc)
make DESTDIR=$INSTALL_DIR install
sudo cp -rv $INSTALL_DIR/* /
rm -rf $INSTALL_DIR/*
openvas-scanner#
openvas-scanner is a full-featured scan engine that executes a continuously updated and extended feed of Vulnerability Tests (VTs). The feed consist of thousands of NASL (Network Attack Scripting Language) scripts which implement all kind of vulnerability checks.
export OPENVAS_SCANNER_VERSION=$GVM_VERSION
sudo apt install -y \
bison \
libglib2.0-dev \
libgnutls28-dev \
libgcrypt20-dev \
libpcap-dev \
libgpgme-dev \
libksba-dev \
rsync \
nmap \
libjson-glib-dev \
libbsd-dev
sudo apt install -y \
python3-impacket \
libsnmp-dev
sudo dnf install -y \
bison \
glib2-devel \
gnutls-devel \
libgcrypt-devel \
libpcap-devel \
gpgme-devel \
libksba-devel \
rsync \
nmap \
json-glib-devel \
libbsd-devel
sudo dnf install -y \
python3-impacket
sudo dnf install -y \
bison \
glib2-devel \
gnutls-devel \
libgcrypt-devel \
libpcap-devel \
gpgme-devel \
libksba-devel \
rsync \
nmap \
json-glib-devel \
libbsd-devel
curl -f -L https://github.com/greenbone/openvas-scanner/archive/refs/tags/v$OPENVAS_SCANNER_VERSION.tar.gz -o $SOURCE_DIR/openvas-scanner-$OPENVAS_SCANNER_VERSION.tar.gz
curl -f -L https://github.com/greenbone/openvas-scanner/releases/download/v$OPENVAS_SCANNER_VERSION/openvas-scanner-$OPENVAS_SCANNER_VERSION.tar.gz.asc -o $SOURCE_DIR/openvas-scanner-$OPENVAS_SCANNER_VERSION.tar.gz.asc
gpg --verify $SOURCE_DIR/openvas-scanner-$OPENVAS_SCANNER_VERSION.tar.gz.asc $SOURCE_DIR/openvas-scanner-$OPENVAS_SCANNER_VERSION.tar.gz
The output of the last command should be similar to:
gpg: Signature made Fri Apr 16 08:31:02 2021 UTC
gpg: using RSA key 9823FAA60ED1E580
gpg: Good signature from "Greenbone Community Feed integrity key" [ultimate]
If the signature is valid, the tarball can be extracted.
tar -C $SOURCE_DIR -xvzf $SOURCE_DIR/openvas-scanner-$OPENVAS_SCANNER_VERSION.tar.gz
mkdir -p $BUILD_DIR/openvas-scanner && cd $BUILD_DIR/openvas-scanner
cmake $SOURCE_DIR/openvas-scanner-$OPENVAS_SCANNER_VERSION \
-DCMAKE_INSTALL_PREFIX=$INSTALL_PREFIX \
-DCMAKE_BUILD_TYPE=Release \
-DSYSCONFDIR=/etc \
-DLOCALSTATEDIR=/var \
-DOPENVAS_FEED_LOCK_PATH=/var/lib/openvas/feed-update.lock \
-DOPENVAS_RUN_DIR=/run/ospd
make -j$(nproc)
make DESTDIR=$INSTALL_DIR install
sudo cp -rv $INSTALL_DIR/* /
rm -rf $INSTALL_DIR/*
ospd-openvas#
ospd-openvas is an OSP server implementation to allow GVM to remotely control an openvas-scanner. It is running as a daemon and waits for incoming OSP requests from gvmd.
export OSPD_OPENVAS_VERSION=$GVM_VERSION
sudo apt install -y \
python3 \
python3-pip \
python3-setuptools \
python3-packaging \
python3-wrapt \
python3-cffi \
python3-psutil \
python3-lxml \
python3-defusedxml \
python3-paramiko \
python3-redis \
python3-paho-mqtt
INSTALL_PREFIX=/usr
sudo apt install -y \
python3 \
python3-pip \
python3-setuptools \
python3-packaging \
python3-wrapt \
python3-cffi \
python3-psutil \
python3-lxml \
python3-defusedxml \
python3-paramiko \
python3-redis \
python3-paho-mqtt
INSTALL_PREFIX=/usr
sudo dnf install -y \
python3 \
python3-pip \
python3-setuptools \
python3-packaging \
python3-wrapt \
python3-cffi \
python3-psutil \
python3-lxml \
python3-defusedxml \
python3-paramiko \
python3-redis \
python3-paho-mqtt
sudo dnf install -y \
python3 \
python3-pip \
python3-setuptools \
python3-packaging \
python3-wrapt \
python3-cffi \
python3-psutil \
python3-lxml \
python3-defusedxml \
python3-paramiko \
python3-redis \
python3-wheel
curl -f -L https://github.com/greenbone/ospd-openvas/archive/refs/tags/v$OSPD_OPENVAS_VERSION.tar.gz -o $SOURCE_DIR/ospd-openvas-$OSPD_OPENVAS_VERSION.tar.gz
curl -f -L https://github.com/greenbone/ospd-openvas/releases/download/v$OSPD_OPENVAS_VERSION/ospd-openvas-$OSPD_OPENVAS_VERSION.tar.gz.asc -o $SOURCE_DIR/ospd-openvas-$OSPD_OPENVAS_VERSION.tar.gz.asc
gpg --verify $SOURCE_DIR/ospd-openvas-$OSPD_OPENVAS_VERSION.tar.gz.asc $SOURCE_DIR/ospd-openvas-$OSPD_OPENVAS_VERSION.tar.gz
The output of the last command should be similar to:
gpg: Signature made Fri Apr 16 08:31:02 2021 UTC
gpg: using RSA key 9823FAA60ED1E580
gpg: Good signature from "Greenbone Community Feed integrity key" [ultimate]
If the signatures are valid, the tarballs can be extracted.
tar -C $SOURCE_DIR -xvzf $SOURCE_DIR/ospd-openvas-$OSPD_OPENVAS_VERSION.tar.gz
cd $SOURCE_DIR/ospd-openvas-$OSPD_OPENVAS_VERSION
python3 -m pip install . --prefix=$INSTALL_PREFIX --root=$INSTALL_DIR --no-warn-script-location
sudo cp -rv $INSTALL_DIR/* /
rm -rf $INSTALL_DIR/*
notus-scanner#
notus-scanner is used for detecting vulnerable products by evaluating internal system information gathered by openvas-scanner. It communicates with openvas-scanner and ospd-openvas via MQTT. It is running as a daemon.
export NOTUS_VERSION=$GVM_VERSION
sudo apt install -y \
python3 \
python3-pip \
python3-setuptools \
python3-paho-mqtt \
python3-psutil \
python3-gnupg
INSTALL_PREFIX=/usr
sudo apt install -y \
python3 \
python3-pip \
python3-setuptools \
python3-paho-mqtt \
python3-psutil \
python3-gnupg
INSTALL_PREFIX=/usr
sudo dnf install -y \
python3 \
python3-pip \
python3-setuptools \
python3-paho-mqtt \
python3-psutil \
python3-gnupg
sudo dnf install -y \
python3 \
python3-pip \
python3-setuptools \
python3-wheel \
python3-psutil
curl -f -L https://github.com/greenbone/notus-scanner/archive/refs/tags/v$NOTUS_VERSION.tar.gz -o $SOURCE_DIR/notus-scanner-$NOTUS_VERSION.tar.gz
curl -f -L https://github.com/greenbone/notus-scanner/releases/download/v$NOTUS_VERSION/notus-scanner-$NOTUS_VERSION.tar.gz.asc -o $SOURCE_DIR/notus-scanner-$NOTUS_VERSION.tar.gz.asc
gpg --verify $SOURCE_DIR/notus-scanner-$NOTUS_VERSION.tar.gz.asc $SOURCE_DIR/notus-scanner-$NOTUS_VERSION.tar.gz
The output of the last command should be similar to:
gpg: Signature made Fri Apr 16 08:31:02 2021 UTC
gpg: using RSA key 9823FAA60ED1E580
gpg: Good signature from "Greenbone Community Feed integrity key" [ultimate]
If the signatures are valid, the tarballs can be extracted.
tar -C $SOURCE_DIR -xvzf $SOURCE_DIR/notus-scanner-$NOTUS_VERSION.tar.gz
cd $SOURCE_DIR/notus-scanner-$NOTUS_VERSION
python3 -m pip install . --prefix=$INSTALL_PREFIX --root=$INSTALL_DIR --no-warn-script-location
sudo cp -rv $INSTALL_DIR/* /
rm -rf $INSTALL_DIR/*
gvm-tools#
The Greenbone Vulnerability Management Tools, or gvm-tools in short, are a collection of tools that help with controlling the Greenbone Vulnerability Management stack remotely.
Essentially, the tools aid accessing the communication protocols Greenbone Management Protocol (GMP) and Open Scanner Protocol (OSP).
gvm-tools are optional and not required for a functional GVM stack.
Note
gvm-tools is released independently of the GVM framework. Therefore, the newest version is used.
sudo apt install -y \
python3 \
python3-pip \
python3-setuptools \
python3-packaging \
python3-lxml \
python3-defusedxml \
python3-paramiko
dnf install -y \
python3 \
python3-pip \
python3-setuptools \
python3-packaging \
python3-lxml \
python3-defusedxml \
python3-paramiko
The latest version of gvm-tools can be installed for each user via the standard Python installation tool pip.
python3 -m pip install --user gvm-tools
To install it system-wide without running pip as root user, the following commands can be used:
python3 -m pip install --prefix=$INSTALL_PREFIX --root=$INSTALL_DIR --no-warn-script-location gvm-tools
sudo cp -rv $INSTALL_DIR/* /
rm -rf $INSTALL_DIR/*
Performing a System Setup for GVM#
Setting up the Redis Data Store#
Looking at the Architecture, the Redis key/value storage is used by the scanner (openvas-scanner and ospd-openvas) for handling the VT information and scan results.
sudo apt install -y redis-server
sudo dnf install -y redis
sudo dnf install -y policycoreutils-python-utils
sudo semanage fcontext -a -f a -t redis_var_run_t -r s0 '/var/run/redis-openvas(/.*)?'
sudo cat << EOF > /etc/tmpfiles.d/redis-openvas.conf
d /var/lib/redis/openvas 0750 redis redis - -
z /var/lib/redis/openvas 0750 redis redis - -
d /run/redis-openvas 0750 redis redis - -
z /run/redis-openvas 0750 redis redis - -
EOF
systemd-tmpfiles --create
sudo cat << EOF > /etc/systemd/system/redis-server@.service
[Unit]
Description=Redis persistent key-value database
After=network.target
After=network-online.target
Wants=network-online.target
[Service]
WorkingDirectory=/var/lib/redis/%i
ExecStart=/usr/bin/redis-server /etc/redis/redis-%i.conf --daemonize no --supervised systemd
ExecStop=/usr/libexec/redis-shutdown
Type=notify
User=redis
Group=redis
RuntimeDirectory=%i
RuntimeDirectoryMode=0755
[Install]
WantedBy=multi-user.target
EOF
After installing the Redis server package, a specific configuration for the openvas-scanner must be added.
sudo cp $SOURCE_DIR/openvas-scanner-$GVM_VERSION/config/redis-openvas.conf /etc/redis/
sudo chown redis:redis /etc/redis/redis-openvas.conf
echo "db_address = /run/redis-openvas/redis.sock" | sudo tee -a /etc/openvas/openvas.conf
sudo systemctl start redis-server@openvas.service
sudo systemctl enable redis-server@openvas.service
Additionally the gvm user must be able to access the redis unix socket at
/run/redis-openvas/redis.sock
.
sudo usermod -aG redis gvm
Setting up the Mosquitto MQTT Broker#
The Mosquitto MQTT broker is used for communication between ospd-openvas, openvas-scanner and notus-scanner.
sudo apt install -y mosquitto
sudo dnf install -y mosquitto
After installing the Mosquitto broker package, the broker must be started and the server uri must be added to the openvas-scanner configuration.
sudo systemctl start mosquitto.service
sudo systemctl enable mosquitto.service
echo "mqtt_server_uri = localhost:1883" | sudo tee -a /etc/openvas/openvas.conf
Adjusting Permissions#
For a system-wide multi-user installation, it must be ensured that the directory permissions are set correctly and are matching the group setup. All users of the group gvm should be able to read and write logs, lock files and data like VTs.
sudo mkdir -p /var/lib/notus
sudo mkdir -p /run/gvmd
sudo chown -R gvm:gvm /var/lib/gvm
sudo chown -R gvm:gvm /var/lib/openvas
sudo chown -R gvm:gvm /var/lib/notus
sudo chown -R gvm:gvm /var/log/gvm
sudo chown -R gvm:gvm /run/gvmd
sudo chmod -R g+srw /var/lib/gvm
sudo chmod -R g+srw /var/lib/openvas
sudo chmod -R g+srw /var/log/gvm
To allow all users of the group gvm access to the postgres database via the various gvmd commands, the permissions of the gvmd executable will be adjusted to always run as the gvm user and under the gvm group.
sudo chown gvm:gvm /usr/local/sbin/gvmd
sudo chmod 6750 /usr/local/sbin/gvmd
Additionally the feed sync script permissions should be adjusted to only allow gvm user to execute them. Otherwise the permissions of the synced files will be broken.
sudo chown gvm:gvm /usr/local/bin/greenbone-nvt-sync
sudo chmod 740 /usr/local/sbin/greenbone-feed-sync
sudo chown gvm:gvm /usr/local/sbin/greenbone-*-sync
sudo chmod 740 /usr/local/sbin/greenbone-*-sync
Feed Validation#
For validating the feed content, a GnuPG keychain with the Greenbone Community Feed integrity key needs to be created.
export GNUPGHOME=/tmp/openvas-gnupg
mkdir -p $GNUPGHOME
gpg --import /tmp/GBCommunitySigningKey.asc
gpg --import-ownertrust < /tmp/ownertrust.txt
export OPENVAS_GNUPG_HOME=/etc/openvas/gnupg
sudo mkdir -p $OPENVAS_GNUPG_HOME
sudo cp -r /tmp/openvas-gnupg/* $OPENVAS_GNUPG_HOME/
sudo chown -R gvm:gvm $OPENVAS_GNUPG_HOME
Setting up sudo for Scanning#
For vulnerability scanning, it is required to have several capabilities for which only root users are authorized, e.g., creating raw sockets. Therefore, a configuration will be added to allow the users of the gvm group to run the openvas-scanner application as root user via sudo.
Warning
Make sure that only necessary users have access to the gvm group. Each user of the gvm group can manipulate the Vulnerability Test (VT) scripts (.nasl files). These scripts are run with root privileges and therefore can be used for exploits. See https://csal.medium.com/pentesters-tricks-local-privilege-escalation-in-openvas-fe933d7f161f.
sudo visudo
...
# allow users of the gvm group run openvas
%gvm ALL = NOPASSWD: /usr/local/sbin/openvas
sudo visudo
...
# allow users of the gvm group run openvas
%gvm ALL = NOPASSWD: /usr/local/sbin/openvas
sudo visudo
...
# Allow /usr/local path
Defaults secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
# allow users of the gvm group run openvas
%gvm ALL = NOPASSWD: /usr/local/sbin/openvas
Setting up PostgreSQL#
The PostgreSQL database management system is used as a central storage for user and scan information. gvmd connects to a PostgreSQL database and queries the data. This database must be created and configured.
sudo apt install -y postgresql
sudo dnf install -y postgresql-server postgresql-contrib
If necessary the PostgreSQL database server needs to be started manually
sudo systemctl start postgresql@13-main
sudo systemctl start postgresql@14-main
sudo postgresql-setup --initdb --unit postgresql
sudo systemctl start postgresql
sudo -u postgres bash
createuser -DRS gvm
createdb -O gvm gvmd
exit
sudo -u postgres bash
psql gvmd
create role dba with superuser noinherit;
grant dba to gvm;
exit
exit
Setting up an Admin User#
For accessing and configuring the vulnerability data, an administrator user needs to be created. This user can log in via the Greenbone Security Assistant (GSA) web interface. They will have access to all data and will later be configured to act as the Feed Import Owner.
gvmd --create-user=admin
The new administrator user’s password is printed on success. An administrator user can later create further users or administrators via the GSA web interface.
To create the administrator user with a password of your choice instead of the generated password, the following command can be used:
gvmd --create-user=admin --password=<password>
If the output doesn’t show
User created.
you need to look at the /var/log/gvm/gvmd.log
for errors.
Setting the Feed Import Owner#
Certain resources that were previously part of the gvmd source code are now shipped via the feed. An example is the scan configuration “Full and Fast”.
Currently every resource needs an owner to apply the permissions and manage the access to the resources.
Therefore, gvmd will only create these resources if a Feed Import Owner is configured. Here the previously created admin user will be used as the Feed Import Owner.
gvmd --modify-setting 78eceaec-3385-11ea-b237-28d24461215b --value `gvmd --get-users --verbose | grep admin | awk '{print $2}'`
Performing an Initial Feed Synchronization#
For the actual vulnerability scanning, Vulnerability Test scripts, security information like CVEs, port lists and scan configurations are required. All this data is provided by the Greenbone Community Feed and needs to be download initially before starting the services.
Note
Downloading the data during the initial synchronization may take a while depending on the network connection and server resources.
Note
The CERT feed synchronization depends on the data provided by the SCAP feed and should be called after synchronizing the latter.
sudo -u gvm greenbone-feed-sync --type SCAP
sudo -u gvm greenbone-feed-sync --type CERT
sudo -u gvm greenbone-feed-sync --type GVMD_DATA
Starting Services with Systemd#
Systemd is used to start the daemons ospd-openvas, notus-scanner, gvmd and gsad. Therefore, service files are required.
cat << EOF > $BUILD_DIR/ospd-openvas.service
[Unit]
Description=OSPd Wrapper for the OpenVAS Scanner (ospd-openvas)
Documentation=man:ospd-openvas(8) man:openvas(8)
After=network.target networking.service redis-server@openvas.service
Wants=redis-server@openvas.service
ConditionKernelCommandLine=!recovery
[Service]
Type=forking
User=gvm
Group=gvm
RuntimeDirectory=ospd
RuntimeDirectoryMode=2775
PIDFile=/run/ospd/ospd-openvas.pid
ExecStart=/usr/local/bin/ospd-openvas --unix-socket /run/ospd/ospd-openvas.sock --pid-file /run/ospd/ospd-openvas.pid --log-file /var/log/gvm/ospd-openvas.log --lock-file-dir /var/lib/openvas --socket-mode 0o770 --mqtt-broker-address localhost --mqtt-broker-port 1883 --notus-feed-dir /var/lib/notus/advisories
SuccessExitStatus=SIGKILL
Restart=always
RestartSec=60
[Install]
WantedBy=multi-user.target
EOF
sudo cp $BUILD_DIR/ospd-openvas.service /etc/systemd/system/
cat << EOF > $BUILD_DIR/notus-scanner.service
[Unit]
Description=Notus Scanner
Documentation=https://github.com/greenbone/notus-scanner
After=mosquitto.service
Wants=mosquitto.service
ConditionKernelCommandLine=!recovery
[Service]
Type=forking
User=gvm
RuntimeDirectory=notus-scanner
RuntimeDirectoryMode=2775
PIDFile=/run/notus-scanner/notus-scanner.pid
ExecStart=/usr/local/bin/notus-scanner --products-directory /var/lib/notus/products --log-file /var/log/gvm/notus-scanner.log
SuccessExitStatus=SIGKILL
Restart=always
RestartSec=60
[Install]
WantedBy=multi-user.target
EOF
sudo cp $BUILD_DIR/notus-scanner.service /etc/systemd/system/
cat << EOF > $BUILD_DIR/gvmd.service
[Unit]
Description=Greenbone Vulnerability Manager daemon (gvmd)
After=network.target networking.service postgresql.service ospd-openvas.service
Wants=postgresql.service ospd-openvas.service
Documentation=man:gvmd(8)
ConditionKernelCommandLine=!recovery
[Service]
Type=forking
User=gvm
Group=gvm
PIDFile=/run/gvmd/gvmd.pid
RuntimeDirectory=gvmd
RuntimeDirectoryMode=2775
ExecStart=/usr/local/sbin/gvmd --osp-vt-update=/run/ospd/ospd-openvas.sock --listen-group=gvm
Restart=always
TimeoutStopSec=10
[Install]
WantedBy=multi-user.target
EOF
sudo cp $BUILD_DIR/gvmd.service /etc/systemd/system/
cat << EOF > $BUILD_DIR/gsad.service
[Unit]
Description=Greenbone Security Assistant daemon (gsad)
Documentation=man:gsad(8) https://www.greenbone.net
After=network.target gvmd.service
Wants=gvmd.service
[Service]
Type=forking
User=gvm
Group=gvm
RuntimeDirectory=gsad
RuntimeDirectoryMode=2775
PIDFile=/run/gsad/gsad.pid
ExecStart=/usr/local/sbin/gsad --listen=127.0.0.1 --port=9392 --http-only
Restart=always
TimeoutStopSec=10
[Install]
WantedBy=multi-user.target
Alias=greenbone-security-assistant.service
EOF
sudo cp $BUILD_DIR/gsad.service /etc/systemd/system/
Afterwards, the services need to be activated and started.
sudo systemctl daemon-reload
sudo systemctl enable notus-scanner
sudo systemctl enable ospd-openvas
sudo systemctl enable gvmd
sudo systemctl enable gsad
Warning
Please be aware, even if the systemctl start commands are returning immediately, the first startup of the services may take several minutes or even hours!
At the first start the scanner needs to load all VTs into Redis and gvmd must process the CERT and SCAP data. gvmd requests all VT information from the scanner after they are loaded by the scanner. The scan configurations are only available if a Feed Import Owner is set, gvmd can connect to the scanner and the VTs are fully loaded by both services.
Running a vulnerability scan when not all data has been loaded may lead to empty
or erroneous reports. You can check the /var/log/gvm/gvmd.log
file for
activity and also have a look at the SecInfo pages (for example
).
sudo systemctl start notus-scanner
sudo systemctl start ospd-openvas
sudo systemctl start gvmd
sudo systemctl start gsad
sudo systemctl status notus-scanner
sudo systemctl status ospd-openvas
sudo systemctl status gvmd
sudo systemctl status gsad
Starting the Vulnerability Management#
After the services have started and all data has been loaded, the Greenbone Security Assistant web interface – GSA – can be opened in the browser.
xdg-open "http://127.0.0.1:9392" 2>/dev/null >/dev/null &
The browser will show the login page of GSA and after using the credentials created in the Setting Up an Admin User chapter, it is possible to start with the vulnerability scanning.

Greenbone Security Assistant after logging in for the first time#