OPENVAS(Ubuntu)

Task OpenVAS Uitilization Guide¶

Conditions¶

Utilizing the provided sudo privileges, run vulnerability scans on UNIX/Linux hosts

Standards¶

Setup OpenVAS
Conduct vulnerability scan

End State¶

Completed a vulnerability scan utilizing OpenVAS

Manual Steps¶

OpenVAS – Verification ONLY if OpenVAS is installed already
Move to Step 1 if OpenVAS(GVM) is not installed
From a terminal shell as root type the following:
```
openvas-check-setup
```
Verify that all checks are good and openvas responds with OK

1. (OpenVAS) Greenbone Vulnerability Manager Installation¶

To install the Greenbone Vulnerability Management 11 packages on Ubuntu 18.04 Bionic Beaver first you need to install PostgreSQL database server (if you don't already have one - it could also be installed on a remote machine):
```
sudo apt install postgresql
```

Then use the following commands to install GVM:

sudo add-apt-repository ppa:mrazavi/gvm
sudo apt install gvm

Finally, you have to update the greenbone nvt/cert/scap data with these commands:

greenbone-nvt-sync
sudo greenbone-scapdata-sync
sudo greenbone-certdata-sync

You can access the Greenbone Security Assistant web interface at: https://x.x.x.x:9392

2. OpenVAS – Verify all signatures and feeds are up-to-date¶

Access OpenVAS web front-end at: https://x.x.x.x:9392
Click on Administration -> NVT Feed and verify that the Feed Version is the latest version Format is in the form of a timestamp: YYYYMMDDHHSS
Completed the above for all feeds under Administration Menu, or to update all feeds from the terminal type the following:
```
openvas-nvt-sync
```

3. OpenVAS – Simple Scan¶

Access OpenVAS web front-end at: https://x.x.x.x:9392. If you do not know the username and password see [Step 5. Note 2] below.
Enter the IP address or host name of the system(s) you wish to scan and press Start Scan
- You will be presented with an updated progress bar as the scan progresses through the scan
- Once the scan is completed you will be presented with a results page
- Verify results are in compliance with enclave SOP and local policy
Review the report
- The complete report as well as only filtered results can be viewed and downloaded
- By default, only the High and Medium risks are displayed

4. OpenVAS – Authenticated / Credentialed Scan¶

This option can be heavy on the network
Access the OpenVAS web front-end at https://x.x.x.x:9392
- If you do not know the username and password see [Step 5. Note 2] below
Create Credentials for Host being scanned
- From the top menu select Configuration -> credentials
- Click the Blue Star icon – New Credential and fill in the information below
- Click Create Credential Button
- For Linux / Unix hosts ensure SSH is utilized
- If you receive an error when saving please see [Step 5. Note 3] below
Start the Advanced Wizard
- by hovering over the purple New Wizard icon and selecting "Advanced Wizard"
- Enter in Task Name for scan
- Change Scan Config to "Full and Fast"
- Enter in IP address or CIDR address range for Target Hosts
- Ensure “Start immediately” radio button is selected
- Select the credentials created in step 2 above:
  - Ensure Linux/Unix hosts use SSH Credentials
  - Ensure Windows hosts use SMB Credentials
Click Create Task to start your scan

Once the scan is complete it will state "Done" in the Tasks pane. Click on the completed scan to view results

Verify that the scan completed with credentials by checking the status of the "SMB Login"

5. OpenVAS – Report and remediate all High Medium and Low findings¶

From the OpenVAS web page click on the Completed Report Date of the Report you would like to review
Vulnerabilities will be listed in order of severity (High, Medium, Low)
Click on each vulnerability and review/implement suggested remediation and workarounds per local SOP

Notes:¶

1: To perform Credentialed / Authenticated scans on windows hosts you must:
- Ensure remote registry service is started
- The credentials used must be members of the Local or Domain administrator group on scanned hosts
- The File and Printer Sharing is activated – if host is Windows XP do not use Simple File Sharing
2: To change your OpenVAS password type the following as root
- openvasmd --user=admin --new-password=password
3: If you receive an error while creating user credentials verify that the following directory exists
- /var/lib/openvas/gnupg
- If the above directory does not exist create it by typing on the server as root.
- root@kali:~# mkdir /var/lib/openvas/gnupg

Running Script¶

NA

Dependencies¶

Linux / Ubuntu

Other available tools¶

N/A

References¶

N/A