OpenVAS 9 auf Ubuntu 14.04 LTS installieren

Update 07.06.2017:
Hier kann der  neue Blogeintrag zu dem Thema “OpenVAS 9 auf Ubuntu Server 16.04 LTS installieren” gelesen werden.

Der laut eigener Webseite: “… most advanced Open Source vulnerability scanner and manager” ist nun auch in der Version 9 als Beta erschienen. Die Installation auf einem Ubuntu Server 14.04 gestaltet sich auf Grund der vorgefertigten Pakete relativ einfach.

Hier wird die Vorgehensweise kurz erläutert. Zunächst besorgt man sich die Paketquellen und fügt diese in die Datei /etc/apt/sources.list ein.

deb http://ppa.launchpad.net/mrazavi/openvas/ubuntu trusty main 
deb-src http://ppa.launchpad.net/mrazavi/openvas/ubuntu trusty main 
									

Noch schneller geht es, wenn  folgendes Kommando ausführt wird:

sudo apt-get install software-properties-common python-software-properties
sudo add-apt-repository ppa:mrazavi/openvas
									

Im nächsten Schritt wird der  ausgeworfenen PPA Key mit dem Schlüssel auf dieser Webseite verglichen. Stimmt er überein, so steht einer Installation nichts mehr im Wege.

apt-get update
apt-get install openvas9
									

Mit den nachfolgenden Kommandos werden die verschiedenen Signaturen heruntergeladen und OpenVAS für die erste Nutzung vorbereitet.

sudo apt-get install nmap sqlite3 nsis rpm alien
sudo openvas-nvt-sync
sudo openvas-scapdata-sync
sudo service openvas-scanner restart
sudo service openvas-manager restart
sudo openvasmd --rebuild --progress
									

Nachdem alles erledigt ist, prüfen wir mit dem Befehl netstat -tulpe ob alle relevanten Dienste gestartet sind. Der Server sollte vor allem auf den Ports 4000, 6379, 9390, 9391 und 80 “horchen”.

root@ubuntu:/home/frank# netstat -tulpe
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode       PID/Program name
tcp        0      0 *:ssh                   *:*                     LISTEN      root       1671        939/sshd        
tcp        0      0 localhost:6379          *:*                     LISTEN      redis      12813       3303/redis-server 1
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN      root       1673        939/sshd        
tcp6       0      0 [::]:4000               [::]:*                  LISTEN      root       16452       5850/gsad       
tcp6       0      0 [::]:9390               [::]:*                  LISTEN      root       19026       9521/openvasmd  
tcp6       0      0 [::]:9391               [::]:*                  LISTEN      root       19873       9498/openvassd: Wai
tcp6       0      0 [::]:http               [::]:*                  LISTEN      root       13254       5851/gsad       
udp        0      0 *:bootpc                *:*                                 root       9204        768/dhclient    
udp        0      0 *:32838                 *:*                                 root       10021       768/dhclient    
udp6       0      0 [::]:34995              [::]:*                              root       10022       768/dhclient    
root@ubuntu:/home/frank# 

									

Nun kann der erste Login  mit dem bevorzugten Browser erfolgen. Über die URL https://IP-Adresse:4000 gelangt man auf die Startseite. Hier sind die voreingestellten Nutzerdaten admin/admin zu nutzen.  Diese sollte im Webinterface unter Administration – Benutzer geändert werden.

Zum Testen der Konfiguration empfehle ich das Skript openvas-check-setup herunterzuladen und zu starten.

cd /home
wget https://svn.wald.intevation.org/svn/openvas/trunk/tools/openvas-check-setup --no-check-certificate
chmod +x openvas-check-setup 
./openvas-check-setup  --v9

									

Ein erfolgreicher Abschluss könnte wie folgt aussehen:

root@ubuntu:/home/frank# ./openvas-check-setup --v9
openvas-check-setup 2.3.3
  Test completeness and readiness of OpenVAS-9

  Please report us any non-detected problems and
  help us to improve this check routine:
  http://lists.wald.intevation.org/mailman/listinfo/openvas-discuss

  Send us the log-file (/tmp/openvas-check-setup.log) to help analyze the problem.

  Use the parameter --server to skip checks for client tools
  like GSD and OpenVAS-CLI.

Step 1: Checking OpenVAS Scanner ... 
        OK: OpenVAS Scanner is present in version 5.1+beta2.
        OK: OpenVAS Scanner CA Certificate is present as /var/lib/openvas/CA/cacert.pem.
        OK: redis-server is present in version v=2.8.4.
        OK: scanner (kb_location setting) is configured properly using the redis-server socket: /var/run/redis/redis.sock
        OK: redis-server is running and listening on socket: /var/run/redis/redis.sock.
        OK: redis-server configuration is OK and redis-server is running.
        OK: NVT collection in /var/lib/openvas/plugins contains 44735 NVTs.
        WARNING: Signature checking of NVTs is not enabled in OpenVAS Scanner.
        SUGGEST: Enable signature checking (see http://www.openvas.org/trusted-nvts.html).
        OK: The NVT cache in /var/cache/openvas contains 44735 files for 44735 NVTs.
Step 2: Checking OpenVAS Manager ... 
        OK: OpenVAS Manager is present in version 6.1+beta2.
        OK: OpenVAS Manager client certificate is present as /var/lib/openvas/CA/clientcert.pem.
        OK: OpenVAS Manager database found in /var/lib/openvas/mgr/tasks.db.
        OK: Access rights for the OpenVAS Manager database are correct.
        OK: sqlite3 found, extended checks of the OpenVAS Manager installation enabled.
        OK: OpenVAS Manager database is at revision 155.
        OK: OpenVAS Manager expects database at revision 155.
        OK: Database schema is up to date.
        OK: OpenVAS Manager database contains information about 44735 NVTs.
        OK: At least one user exists.
        OK: OpenVAS SCAP database found in /var/lib/openvas/scap-data/scap.db.
        OK: OpenVAS CERT database found in /var/lib/openvas/cert-data/cert.db.
        OK: xsltproc found.
Step 3: Checking user configuration ... 
        WARNING: Your password policy is empty.
        SUGGEST: Edit the /etc/openvas/pwpolicy.conf file to set a password policy.
Step 4: Checking Greenbone Security Assistant (GSA) ... 
        OK: Greenbone Security Assistant is present in version 6.1+beta2.
Step 5: Checking OpenVAS CLI ... 
        OK: OpenVAS CLI version 1.4.3.
Step 6: Checking Greenbone Security Desktop (GSD) ... 
        SKIP: Skipping check for Greenbone Security Desktop.
Step 7: Checking if OpenVAS services are up and running ... 
        OK: netstat found, extended checks of the OpenVAS services enabled.
        OK: OpenVAS Scanner is running and listening on all interfaces.
        OK: OpenVAS Scanner is listening on port 9391, which is the default port.
        OK: OpenVAS Manager is running and listening on all interfaces.
        OK: OpenVAS Manager is listening on port 9390, which is the default port.
        OK: Greenbone Security Assistant is listening on port 80, which is the default port.
Step 8: Checking nmap installation ...
./openvas-check-setup: 1: ./openvas-check-setup: nmap: not found
        WARNING: Your version of nmap is not fully supported:
        SUGGEST: You should install nmap 5.51 if you plan to use the nmap NSE NVTs.
Step 10: Checking presence of optional tools ...
        OK: pdflatex found.
        WARNING: PDF generation failed, most likely due to missing LaTeX packages. The PDF report format will not work.
        SUGGEST: Install required LaTeX packages.
        OK: ssh-keygen found, LSC credential generation for GNU/Linux targets is likely to work.
        WARNING: Could not find rpm binary, LSC credential package generation for RPM and DEB based targets will not work.
        SUGGEST: Install rpm.
        WARNING: Could not find makensis binary, LSC credential package generation for Microsoft Windows targets will not work.
        SUGGEST: Install nsis.

It seems like your OpenVAS-9 installation is OK.

If you think it is not OK, please report your observation
and help us to improve this check routine:
http://lists.wald.intevation.org/mailman/listinfo/openvas-discuss
Please attach the log-file (/tmp/openvas-check-setup.log) to help us analyze the problem.