Logon to the Greenbone Manager assistend at https://127.0.0.1:9392.
Security information is an important part of a security scanner. It describes how we can detect security issues on our network/systems.
It always a good idea to update your security date regularly.
gvm-feed-update script, this will use
greenbone-feed-sync as the
_gvm user to update the
GVMD_DATA, SCAP and CERT data.
$ sudo gvm-feed-update 1 ⨯ [sudo] password for staf: [>] Updating OpenVAS feeds [*] Updating: NVT Greenbone community feed server - http://feed.community.greenbone.net/ This service is hosted by Greenbone Networks - http://www.greenbone.net/ <snip> receiving incremental file list timestamp 13 100% 12.70kB/s 0:00:00 (xfr#1, to-chk=0/1) sent 43 bytes received 115 bytes 105.33 bytes/sec total size is 13 speedup is 0.08 staf㉿kali)-[~]
You can review the security data at the [SecInfo] tab in Greenbone Manager.
Documentation is available at the greenbone website: https://docs.greenbone.net/GSM-Manual/gos-20.08/en/managing-secinfo.html
OpenVAS use the following security information;
- NVT (Network Vulnerability Tests)
Test that that detects vulnerabilities on the targets.
- CVE (Common Vulnerabilities and Exposures)
Most people know this term, it provides a standard way of publishing security vulnerability information.
- CPE (Common Enumeration)
CPE is less know, it is a standard way of describing the device, system, software for security information. eg OpenSSH running on GNU/Linux.
OVAL (Open Vulnerability Assessment Language)
This is a list that vendors publish with their software and the vulnerabilities. Security scanner like OpenVAS can use this data to detect outdated software.
This is standard developed by NIST as part of the SCAP (Security Automation Protocol)
Most Linux distributions publish OVAL data.
One distribution that doesn’t publish OVAL is Centos. Redhat publishes OVAL data for RHEL but not for Centos. You can update the Redhat OVAL data for Centos (add the Centos CPE to the Redhat OVAL) But this is not certified officially. Also with the move to CentOS stream, this will not be possible anymore…
CERT-Bund Advisories are published by the CERT-Bund.
- DFN-CERT Advisories
DFN-CERT advisories are published by the DFN-CERT.
Under the tab [Configuration] [Scan Configs] you can configure the scan config that you can use to execute a scan on the target.
The default scan config can’t be updated. To clone a scan config you can press the “clone sheep” button. This allows you to update it, or to review the SCAP data that is used.
If you want to scan only GNU/Linux systems for example. You can create a custom profile with only the Linux distributions that you use, this will speed up the scan. Keep in mind that OpenVAS need to have access to the system to detect outdated software with the “Local Security Checks” with an authenticated scan.
Authentication can be configured on the [Configuration] [Credentials], we’ll not explain authentication scans in this blog post, but it should be self-explanatory.
As always be careful with creating backdoors on your network to manage or in this case review it for security. It’s important to protect the system that hosts the keys/passwords.
To create a new target goto the [Configuration] [Targets] and click on [New Target] icon. This will open the “New Target” window.
You can configure your target in this window, fill in the IP address etc. If you know that your Target has a firewall running, you can set “Alive Test” to “Consider Alive”.
When you have configured Credentials for your target you can use configure them at the “Credentials for authenticated checks” section.
Press [Save] to save the Target.
Configure the scan
To configure the scan goto the [Scans] tab and select [Tasks].
Click on the [New Task] icon this will give two options “New Task” and “New Container Task”.
A “Container Scan” is used to import reports of other Greenbone Security Managers. A “normal scan” will execute the scan on the Target.
We’ll set up regular scan, so select “New Task”.
This will open the “New Task” Windows
Openvas has two types of Builtin Scanners:
OpenVAS Default Scanner
This will execute a security scan on the Target.
This scanner is used to make a forecast of the possible security risks base on information of the Target that was gathered by previous scans (Like the OpenVAS Scanner). It takes the CPE (information of installed software etc) and makes a forecast of possible security risks with the CVE information found at [SecInfo].
With Alterable Task we can specify if the task can be updated, if we allow the task to be alterable the reports of the scan are more difficult to compare to the previous scans.
At Scan Config we select the desired Scan Configuration select [Full and fast].
Click on the [Start Scan] icon to start the scan.
Depending on the scan configuration and the number of hosts in your scan task configuration this will take some time.
To view the report of scan you can click on the Reports column next to the scan. At the [Scans] tab you can select Reports, Results, Vulnerabilities.
At the Dashboards tab you get a nice overview of the Scan and the results. It’s also possible to create custom dashboards.