Ubuntu 20.04 üzerine GVM 11 kurulumu (Güncel OpenVAS – zaafiyet, açıklık tarama sistemi)

Ubuntu 20.04 Üzerine GVM 11 Kurulumu
Yararlanılan Döküman…
Gereksinimleri Belirle
Asgari 4 GB RAM
Asgari 4 vCPUs
8 GB ve fazlası depolama (disk).

apt update
apt upgrade

Gvm Kullanıcısı Oluştur
useradd -r -d /opt/gvm -c "GVM User" -s /bin/bash gvm
mkdir /opt/gvm
chown gvm:gvm /opt/gvm
Gerekli Derleme Araçlarını Yükle
apt install gcc g++ make bison flex libksba-dev curl redis libpcap-dev \
cmake git pkg-config libglib2.0-dev libgpgme-dev libgnutls28-dev uuid-dev \
libssh-gcrypt-dev libldap2-dev gnutls-bin libmicrohttpd-dev libhiredis-dev \
zlib1g-dev libxml2-dev libradcli-dev clang-format libldap2-dev doxygen \
gcc-mingw-w64 xml-twig-tools libical-dev perl-base heimdal-dev libpopt-dev \
libsnmp-dev python3-setuptools python3-paramiko python3-lxml python3-defusedxml python3-dev gettext python3-polib xmltoman \
python3-pip texlive-fonts-recommended texlive-latex-extra --no-install-recommends

Ubuntu 20.04 Üzerine Yarn (JavaScript paket yöneticisi) Kurulumu
curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add -
echo "deb https://dl.yarnpkg.com/debian/ stable main" | tee /etc/apt/sources.list.d/yarn.list
apt update
apt install yarn -y

Ubuntu 20.04 Üzerine PostgreSQL Kurulumu
GVM 11 sqlite3 desteğini kesti ve sadece PostgreSQL’i backend veritabanu olarak kullanmakta.
apt install postgresql postgresql-contrib postgresql-server-dev-all
PostgreSQL Veritabanı ve Kulanıcı Oluştur
Greenbone Vulnerability Management Daemon (gvmd) için PostgreSQL kullanıcı ve veritabanı oluştur.

sudo -Hiu postgres
createuser gvm
createdb -O gvm gvmd
Grant PostgreSQL User DBA Roles

psql gvmd
create role dba with superuser noinherit;
grant dba to gvm;
create extension "uuid-ossp";
\q
exit
Bu iş tamam PostgreSQL’i yeniden başlat;

systemctl restart postgresql
systemctl enable postgresql
GVM 11 Kaynak Kodtan Derleme

GVM 11 için birçok farklı araçlara ihtiyaç var. Bunlar;

GVM Libraries
OpenVAS Scanner
OSPd
ospd-openvas
Greenbone Vulnerability Manager
Greenbone Security Assistant
Python-GVM
GVM-Tools
OpenVAS SMB

Since we are running GVM as non-privileged user, gvm, then we will install all the GVM configuration files and libraries under, /opt/gvm.
Update the PATH environment variable on /etc/environment, to include the GVM binary path such that it looks like;
vim /etc/environment
PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/opt/gvm/bin:/opt/gvm/sbin:/opt/gvm/.local/bin"
Add GVM library path to /etc/ld.so.conf.d.
echo "/opt/gvm/lib" > /etc/ld.so.conf.d/gvm.conf
GVM 11 Derleme ve Yükleme
Switch to GVM user, gvm and create a temporary directory to store GVM source files.
su - gvm
mkdir /tmp/gvm-source
GVM Kaynak Dosyalarını İndir
cd /tmp/gvm-source
git clone -b gvm-libs-11.0 https://github.com/greenbone/gvm-libs.git
git clone https://github.com/greenbone/openvas-smb.git
git clone -b openvas-7.0 https://github.com/greenbone/openvas.git
git clone -b ospd-2.0 https://github.com/greenbone/ospd.git
git clone -b ospd-openvas-1.0 https://github.com/greenbone/ospd-openvas.git
git clone -b gvmd-9.0 https://github.com/greenbone/gvmd.git
git clone -b gsa-9.0 https://github.com/greenbone/gsa.git
gvm@ubuntu20:/tmp/gvm-source$ ls
gsa gvmd gvm-libs openvas openvas-smb ospd ospd-openvas
Note that we will install all GVM files and libraries to a non-standard location, /opt/gvm. As such, you need to set the PKG_CONFIG_PATH environment variable to the location of your pkg-config
files before configuring:
export PKG_CONFIG_PATH=/opt/gvm/lib/pkgconfig:$PKG_CONFIG_PATH
Be sure to replace the path, /opt/gvm, accordingly.
GVM 11 Kütüphanelerini Derle ve Yükle.
cd gvm-libs
Create a build directory and change into it;
mkdir build
cd build
Configure the build;
cmake .. -DCMAKE_INSTALL_PREFIX=/opt/gvm
GVM 11 Kütüphanelerini Derle ve Yükle.
make
make install
OpenVAS scanner and OpenVAS SMB Derle ve Yükle
Open Vulnerability Assessment Scanner (OpenVAS) is a full-featured scan engine that executes a continuously updated and extended feed of Network Vulnerability Tests (NVTs).
OpenVAS SMB provides modules for the OpenVAS Scanner to interface with Microsoft Windows Systems through the Windows Management Instrumentation API and a winexe binary to execute processes remotely on that system.
openvas-smb Derle ve Yükle;
cd ../../openvas-smb/
mkdir build
cd build
cmake .. -DCMAKE_INSTALL_PREFIX=/opt/gvm
make
make install
install OpenVAS scanner Derle ve Yükle;
cd ../../openvas
Proceed to build and install openvas.
mkdir build
cd build
cmake .. -DCMAKE_INSTALL_PREFIX=/opt/gvm
make
make install
If you encounter the error, …error: ‘pcap_lookupdev’ is deprecated: use ‘pcap_findalldevs’… while compiling openvas, edit the CMakeLists.txt file and replace the line as shown below.

vim ../../openvas/CMakeLists.txt
...
#set (CMAKE_C_FLAGS_DEBUG "${CMAKE_C_FLAGS_DEBUG} ${COVERAGE_FLAGS}")
set (CMAKE_C_FLAGS_DEBUG "${CMAKE_C_FLAGS_DEBUG} -Werror -Wno-error=deprecated-declarations")
…
Once done, save and exit the file and rerun the installation.
Configuring OpenVAS Scanner
The host scan information is stored temporarily on Redis server. The default configuration of Redis server is /etc/redis/redis.conf.
Switch back to privileged user and proceed.
exit
To begin run the command below to create the cache to the installed shared libraries;
ldconfig
Next, copy OpenVAS scanner Redis configuration file, redis-openvas.conf, to the same Redis config directory;
cp /tmp/gvm-source/openvas/config/redis-openvas.conf /etc/redis/
Update the ownership of the configuration.
chown redis:redis /etc/redis/redis-openvas.conf
Update the path to Redis unix socket on the /opt/gvm/etc/openvas/openvas.conf using the db_address parameter as follows;
echo "db_address = /run/redis-openvas/redis.sock" > /opt/gvm/etc/openvas/openvas.conf
Note, the Unix socket path is defined on /etc/redis/redis-openvas.conf file.
chown gvm:gvm /opt/gvm/etc/openvas/openvas.conf
Add gvm user to redis group;
usermod -aG redis gvm
You can also optimize Redis server itself improve the performance by making the following adjustments;
Increase the value of somaxconn in order to avoid slow clients connections issues.
echo "net.core.somaxconn = 1024" >> /etc/sysctl.conf
Redis background save may fail under low memory condition. To avoid this, enable memory overcommit (man 5 proc).
echo 'vm.overcommit_memory = 1' >> /etc/sysctl.conf
Reload sysctl variables created above.
sysctl -p
To avoid creation of latencies and memory usage issues with Redis, disable Linux Kernel’s support for Transparent Huge Pages (THP). To easily work around this, create a systemd service unit for this purpose.
vim /etc/systemd/system/disable_thp.service
[Unit]
Description=Disable Kernel Support for Transparent Huge Pages (THP)

[Install]
WantedBy=multi-user.target
Reload systemd configurations;

systemctl daemon-reload
Start and enable this service to run on system boot.

systemctl enable --now disable_thp
Restart OpenVAS Redis server

systemctl enable --now redis-server@openvas
A number of Network Vulnerability Tests (NVTs) require root privileges to perform certain operations. Since openvas is launched from an ospd-openvas process, via sudo, add the line below to sudoers file to ensure that the gvm user used in this demo can run the openvas with elevated rights using passwordless sudo.

echo "gvm ALL = NOPASSWD: /opt/gvm/sbin/openvas" > /etc/sudoers.d/gvm
Also, update the secure_path to include the GVM /sbin paths, /opt/gvm/sbin.

visudo
Defaults secure_path=”/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin:/opt/gvm/sbin”
Also, enable gvm user to run GSA web application daemon, gsad, with passwordless sudo.

echo "gvm ALL = NOPASSWD: /opt/gvm/sbin/gsad" >> /etc/sudoers.d/gvm
NVT’leri Güncelle
Update Network Vulnerability Tests feed from Greenbone Security Feed/Community Feed using the greenbone-nvt-sync command.
The greenbone-nvt-sync command must not be executed as privileged user root, hence switch back to GVM user we created above and update the NVTs.

su - gvm
Next, update the NVTs as openvas user;

greenbone-nvt-sync
Once the update is done, you need to update Redis server with the same VT info from VT files;

sudo openvas --update-vt-info
Greenbone Vulnerability Manager Derle ve Yükle
export PKG_CONFIG_PATH=/opt/gvm/lib/pkgconfig:$PKG_CONFIG_PATH
cd /tmp/gvm-source/gvmd
mkdir build
cd build
cmake .. -DCMAKE_INSTALL_PREFIX=/opt/gvm
make
make install
Greenbone Security Assistant Derle ve Yükle
cd ../../gsa
mkdir build
cd build
cmake .. -DCMAKE_INSTALL_PREFIX=/opt/gvm
make
make install
Update GVM CERT and SCAP data from the feed servers;

greenbone-scapdata-sync
greenbone-certdata-sync
Consider setting cron jobs to run the nvts, cert and scap data update scripts at your preferred frequency to pull updates from the feed servers.
Next, run the command below to generate certificates gvmd. Server certificates are used for authentication while client certificates are primarily used for authorization. More on man gvm-manage-certs.

gvm-manage-certs -a
Build and Install OSPd and OSPd-OpenVAS
Open Scanner Protocol (OSP) creates a unified interface for different security scanners and makes their control flow and scan results consistently available under the central Greenbone Vulnerability Manager service.

export PKG_CONFIG_PATH=/opt/gvm/lib/pkgconfig:$PKG_CONFIG_PATH
mkdir -p /opt/gvm/lib/python3.8/site-packages/
export PYTHONPATH=/opt/gvm/lib/python3.8/site-packages
cd /tmp/gvm-source/ospd
python3 setup.py install --prefix=/opt/gvm
cd ../ospd-openvas
python3 setup.py install --prefix=/opt/gvm
Start OpenVAS Scanner, GSA and GVM services
Run the commands below as gvm user to start OpenVAS scanner, GSA (WebUI service) and GVM daemon. Execute the commands in the presented order.
Start OpenVAS
</usr/bin/python3 /opt/gvm/bin/ospd-openvas \
--pid-file /opt/gvm/var/run/ospd-openvas.pid \
--log-file /opt/gvm/var/log/gvm/ospd-openvas.log \
--lock-file-dir /opt/gvm/var/run -u /opt/gvm/var/run/ospd.sock
Start GVM
gvmd --osp-vt-update=/opt/gvm/var/run/ospd.sock
Start GSA
sudo gsad
Consider creating systemd service unit files for these services to enable you manage them easily.
Servis durumlarını kontrol et
ps aux | grep -E "ospd-openvas|gsad|gvmd" | grep -v grep
Örnek çıktı;

gvm 8221 0.0 0.0 81196 1436 ? Ss 10:47 0:00 gpg-agent –homedir /opt/gvm/var/lib/gvm/gvmd/gnupg –use-standard-socket –daemon
gvm 8475 2.0 6.0 382248 122184 pts/0 Sl 10:54 1:23 /usr/bin/python3 /opt/gvm/bin/ospd-openvas –pid-file /opt/gvm/var/run/ospd-openvas.pid –log-file /opt/gvm/var/log/gvm/ospd-openvas.log –lock-file-dir /opt/gvm/var/run -u /opt/gvm/var/run/ospd.sock
gvm 8523 0.1 10.1 295648 206108 pts/0 S 10:57 0:06 gvmd: Waiting for incoming connections
postgres 8541 0.1 7.7 225436 157888 ? SLs 10:57 0:05 postgres: 12/main: gvm gvmd [local] idle
root 8599 0.0 0.8 664696 17064 pts/0 Sl 10:58 0:00 gsad
root 8600 0.0 0.1 205912 3608 pts/0 Sl 10:58 0:00 gsad
gvm 11911 0.0 9.7 295648 198056 pts/0 S 12:01 0:00 gvmd: Reloading NVTs
gvm 11913 0.0 9.8 295648 201172 pts/0 S 12:01 0:00 gvmd: OSP: Updating NVT cache
postgres 11917 0.1 0.9 217796 19544 ? Ss 12:01 0:00 postgres: 12/main: gvm gvmd [local] idle
Logları bu dizinde bulacaksın, /var/log/gvm/, bu çalışmada /opt/gvm/var/log/gvm.

GVM Scanner Oluştur
Since we launched the scanner and set it to use our non-standard scanner host path (/opt/gvm/var/run/ospd.sock), we need to create and register our scanner;
gvmd --create-scanner="h4ck3r OpenVAS Scanner" --scanner-type="OpenVAS" --scanner-host=/opt/gvm/var/run/ospd.sock
Next, you need to verify your scanner. For this, you first need to get the scanner identifier;
gvmd --get-scanners
08b69003-5fc2-4037-a479-93b440211c73 OpenVAS /tmp/ospd.sock 0 OpenVAS Default
6acd0832-df90-11e4-b9d5-28d24461215b CVE 0 CVE
xxxf2214-eb7c-4y13-9ybd-21551b259xxx OpenVAS /opt/gvm/var/run/ospd.sock 9390 h4ck3r OpenVAS Scanner
Based on the output above, our scanner UUID is, xxxf2214-eb7c-4y13-9ybd-21551b259xxx.
Scanner’ı doğrula;
gvmd --verify-scanner=xxxf2214-eb7c-4y13-9ybd-21551b259xxx.
OpenVAS (GVM 11) Admin Oluştur
gvmd --create-user gvmadmin
Bu komut kullanıcı için random pass tanımlar. Kendi parolanınızı oluşturmak için;
gvmd --create-user gvmadmin --password=P@ssw0rd
Mevcut kullanıcının parolasının değiştirmek için;
gvmd --user= --new-password=
GVM 11 (OpenVAS)’a webten eriş
Greenbone Security Assistant (GSA) WebUI daemon 443 portunu açar ve tüm arayüzleri dinler. Eğer güvenlik duvarı aktifse portu harici erişime izin vermek gerekir. GSA’ya https: ile ulaşabilirsiniz.

Eğer problem veya bir sorun yaşarsanız aşağıdaki scripti kullanabilirsiniz.
#!/bin/bash
######################################################################
# Ubuntu 20.04 üzerine Greenbone/OpenVAS Yükleme Scripti
#
# Not: root olarak çalıştırın
#
# Kullanım: sudo ./install_gvm11.sh
#
# Licensed under GPLv3 or later
######################################################################
apt-get update
apt-get upgrade
useradd -r -d /opt/gvm -c "GVM (OpenVAS) User" -s /bin/bash gvm
mkdir /opt/gvm
chown gvm:gvm /opt/gvm
apt-get -y install gcc g++ make bison flex libksba-dev curl redis libpcap-dev cmake git pkg-config libglib2.0-dev libgpgme-dev libgnutls28-dev uuid-dev libssh-gcrypt-dev libldap2-dev gnutls-bin libmicrohttpd-dev libhiredis-dev zlib1g-dev libxml2-dev libradcli-dev clang-format libldap2-dev doxygen nmap gcc-mingw-w64 xml-twig-tools libical-dev perl-base heimdal-dev libpopt-dev libsnmp-dev python3-setuptools python3-paramiko python3-lxml python3-defusedxml python3-dev gettext python3-polib xmltoman python3-pip texlive-fonts-recommended texlive-latex-extra --no-install-recommends
curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add -
echo "deb https://dl.yarnpkg.com/debian/ stable main" | tee /etc/apt/sources.list.d/yarn.list
apt-get update
apt-get -y install yarn
apt-get -y install postgresql postgresql-contrib postgresql-server-dev-all
sudo -Hiu postgres createuser gvm
sudo -Hiu postgres createdb -O gvm gvmd
sudo -Hiu postgres psql -c 'create role dba with superuser noinherit;' gvmd
sudo -Hiu postgres psql -c 'grant dba to gvm;' gvmd
sudo -Hiu postgres psql -c 'create extension "uuid-ossp";' gvmd
systemctl restart postgresql
sed -i 's/\"$/\:\/opt\/gvm\/bin\:\/opt\/gvm\/sbin\:\/opt\/gvm\/\.local\/bin\"/g' /etc/environment
echo "/opt/gvm/lib" > /etc/ld.so.conf.d/gvm.conf
sudo -Hiu gvm mkdir /tmp/gvm-source
cd /tmp/gvm-source
sudo -Hiu gvm git clone -b gvm-libs-11.0 https://github.com/greenbone/gvm-libs.git
sudo -Hiu gvm git clone https://github.com/greenbone/openvas-smb.git
sudo -Hiu gvm git clone -b openvas-7.0 https://github.com/greenbone/openvas.git
sudo -Hiu gvm git clone -b ospd-2.0 https://github.com/greenbone/ospd.git
sudo -Hiu gvm git clone -b ospd-openvas-1.0 https://github.com/greenbone/ospd-openvas.git
sudo -Hiu gvm git clone -b gvmd-9.0 https://github.com/greenbone/gvmd.git
sudo -Hiu gvm git clone -b gsa-9.0 https://github.com/greenbone/gsa.git
sudo -Hiu gvm cp --recursive /opt/gvm/* /tmp/gvm-source/
sudo -Hiu gvm touch /opt/gvm/.bashrc
sudo -Hiu gvm mv /opt/gvm/.bashrc /opt/gvm/.bashrc.bak # save original bashrc file
sudo -Hiu gvm touch /opt/gvm/.bashrc
sudo -Hiu gvm echo "export PKG_CONFIG_PATH=/opt/gvm/lib/pkgconfig:$PKG_CONFIG_PATH" | sudo -Hiu gvm tee -a /opt/gvm/.bashrc

# Default şifreyi değiştirmeyi unutma
echo "Username is gvmadmin and pasword is P@ssw0rd"
echo "Remember to change this default password"
echo "sudo -Hiu gvm gvmd --user=gvmadmin --new-password="