Self-hosted vulnerability scanning: OpenVAS 8 and Seccubus
This is a Debian 8.1 build from 2015. At the time there was no convenient package for OpenVAS 8, so it meant compiling the whole stack from source. The commands below are kept as they were. If you want vulnerability scanning today, jump to the note at the end first.
Build dependencies
OpenVAS is several components that build in sequence, and they pull in a long list of development libraries. Install them all up front:
apt-get install -y build-essential devscripts dpatch libassuan-dev \
libglib2.0-dev libgpgme11-dev libpcre3-dev libpth-dev libwrap0-dev libgmp-dev libgmp3-dev \
quilt cmake pkg-config libssh-dev libpcap-dev uuid-dev bison libksba-dev \
doxygen libsql-translator-perl xmltoman sqlite3 libsqlite3-dev wamerican redis-server libhiredis-dev libsnmp-dev \
libmicrohttpd-dev libxml2-dev libxslt1-dev xsltproc libssh2-1-dev libldap2-dev autoconf \
libpopt-dev heimdal-dev heimdal-multidev gnutls-bin libgnutls28-dev snmp
A scan is only as useful as the tools behind it, so add the common security helpers OpenVAS can call out to:
apt-get install nmap ike-scan nsis
PDF reports need a LaTeX toolchain. It is about 100 MB of packages, so only install it if you actually want PDF output:
apt-get install texlive-latex-base
Redis socket
The scanner talks to redis over a unix socket. Back up the config, then add the socket line:
cp /etc/redis/redis.conf /etc/redis/redis.orig
Add this to the bottom of /etc/redis/redis.conf:
unixsocket /tmp/redis.sock
Restart it:
service redis-server restart
Fetch and unpack the sources
These are the OpenVAS 8 release tarballs from the project's download server. Grab the libraries, scanner, manager, GSA (the web front end), the CLI and the SMB module:
cd /usr/local/src
wget --no-check-certificate https://wald.intevation.org/frs/download.php/1975/openvas-smb-1.0.1.tar.gz
wget --no-check-certificate https://wald.intevation.org/frs/download.php/2015/openvas-libraries-8.0.1.tar.gz
wget --no-check-certificate https://wald.intevation.org/frs/download.php/2016/openvas-scanner-5.0.1.tar.gz
wget --no-check-certificate https://wald.intevation.org/frs/download.php/2017/openvas-manager-6.0.1.tar.gz
wget --no-check-certificate https://wald.intevation.org/frs/download.php/1987/openvas-cli-1.4.0.tar.gz
wget --no-check-certificate https://wald.intevation.org/frs/download.php/2018/greenbone-security-assistant-6.0.1.tar.gz
Unpack them all in one go:
find . -name \*.gz -exec tar zxvfp {} \;
Build order
The pieces depend on each other, so build them in this order: SMB, libraries, scanner, then the manager. Each one is a standard out-of-tree cmake build:
cd openvas-smb* && mkdir build && cd build && cmake .. && make && make install && cd /usr/local/src
cd openvas-libraries-* && mkdir build && cd build && cmake .. && make && make install && cd /usr/local/src
cd openvas-scanner-* && mkdir build && cd build && cmake .. && make && make install && cd /usr/local/src
Reload the linker cache so the freshly installed libraries are found:
ldconfig
Create the server certificate, pull down the network vulnerability tests, and start the scanner daemon:
openvas-mkcert
openvas-nvt-sync
openvassd
Loading the NVTs takes a while on first run. Watch for the scanner to report it is ready:
watch "ps -ef | grep openvassd"
You are waiting for the "Waiting for incoming connections" line. Once it appears, build the manager:
cd openvas-manager-* && mkdir build && cd build && cmake .. && make && make install && cd /usr/local/src
Feeds and database
The SCAP feed has one oversized XML file that breaks the sync unless it is split. Edit /usr/local/sbin/openvas-scapdata-sync and make sure this is set:
SPLIT_PART_SIZE=20480
Then sync the SCAP and CERT data and create the client certificate:
openvas-scapdata-sync
openvas-certdata-sync
openvas-mkcert-client -n -i
Build the database and create your admin user. The command prints a generated password once, so write it down:
openvasmd --rebuild --progress
openvasmd --create-user=admin --role=Admin
CLI, web UI and first start
cd openvas-cli-* && mkdir build && cd build && cmake .. && make && make install && cd /usr/local/src
cd greenbone-security-assistant-* && mkdir build && cd build && cmake .. && make && make install && cd /usr/local/src
Start the stack. For a first look I run GSA in HTTP-only mode; put it behind a proper TLS proxy before anything real:
openvasmd --rebuild --progress && openvasmd && gsad --http-only
Finally, confirm the whole thing hangs together:
./openvas-check-setup --v8 --server
There are community init scripts that wrap the manager, scanner and GSA as proper services so they come back after a reboot; grab those rather than leaving the daemons running by hand.
Seccubus for scheduled, diffable scans
OpenVAS tells you what is wrong today. What you usually want is what changed since the last scan. Seccubus runs scanners on a schedule and shows you the delta, so you are triaging new findings instead of re-reading the whole report every time.
Install the prerequisites:
apt-get install apache2 mysql-server libxml-simple-perl ruby
Grab the release .deb from the project and install it:
wget https://github.com/schubergphilis/Seccubus_v2/releases/download/2.14/seccubus_2.14.B262_all.deb
dpkg -i seccubus_2.14.B262_all.deb
Create the database. Keep the name consistent, as Seccubus is case-sensitive about it, and use a real password rather than the placeholder here:
create database Seccubus;
grant all privileges on Seccubus.* to seccubus@localhost identified by 'CHANGE_ME';
flush privileges;
Put the same database details into /etc/seccubus/config.xml, then import the schema and seed data:
mysql -u seccubus -p Seccubus < /var/lib/seccubus/structure_v6.mysql
mysql -u seccubus -p Seccubus < /var/lib/seccubus/data_v6.mysql
From there you add OpenVAS as a scanner in the Seccubus config, point a scan at a target range, and let it run on a cron. Each run is compared against the last, and anything new is flagged.
Today
OpenVAS 8 is long obsolete and this from-source build is only of historical interest. The project became Greenbone Vulnerability Management (GVM), and the maintained community version is the Greenbone Community Edition, distributed as packages and containers rather than a manual compile. Seccubus v2 is likewise archived. If you want the "diff my scans over time" workflow now, that scheduling and comparison is built into the Greenbone manager itself, so you no longer need a separate front end for it.