---
title: "Self-hosted vulnerability scanning: OpenVAS 8 and Seccubus"
date: "2015-07-17"
path: "/177-self-hosted-vulnerability-scanning-openvas-8-and-seccubus.html"
section: "/ramblings"
description: "Building OpenVAS 8 from source on Debian 8 and running scheduled, diffable scans through Seccubus."
---

This is a Debian 8.1 build from 2015. At the time there was no convenient package for OpenVAS 8, so it meant compiling the whole stack from source. The commands below are kept as they were. If you want vulnerability scanning today, jump to the note at the end first.

## Build dependencies

OpenVAS is several components that build in sequence, and they pull in a long list of development libraries. Install them all up front:

```bash
apt-get install -y build-essential devscripts dpatch libassuan-dev \
 libglib2.0-dev libgpgme11-dev libpcre3-dev libpth-dev libwrap0-dev libgmp-dev libgmp3-dev \
 quilt cmake pkg-config libssh-dev libpcap-dev uuid-dev bison libksba-dev \
 doxygen libsql-translator-perl xmltoman sqlite3 libsqlite3-dev wamerican redis-server libhiredis-dev libsnmp-dev \
 libmicrohttpd-dev libxml2-dev libxslt1-dev xsltproc libssh2-1-dev libldap2-dev autoconf \
 libpopt-dev heimdal-dev heimdal-multidev gnutls-bin libgnutls28-dev snmp
```

A scan is only as useful as the tools behind it, so add the common security helpers OpenVAS can call out to:

```bash
apt-get install nmap ike-scan nsis
```

PDF reports need a LaTeX toolchain. It is about 100 MB of packages, so only install it if you actually want PDF output:

```bash
apt-get install texlive-latex-base
```

## Redis socket

The scanner talks to redis over a unix socket. Back up the config, then add the socket line:

```bash
cp /etc/redis/redis.conf /etc/redis/redis.orig
```

Add this to the bottom of `/etc/redis/redis.conf`:

```text
unixsocket /tmp/redis.sock
```

Restart it:

```bash
service redis-server restart
```

## Fetch and unpack the sources

These are the OpenVAS 8 release tarballs from the project's download server. Grab the libraries, scanner, manager, GSA (the web front end), the CLI and the SMB module:

```bash
cd /usr/local/src
wget --no-check-certificate https://wald.intevation.org/frs/download.php/1975/openvas-smb-1.0.1.tar.gz
wget --no-check-certificate https://wald.intevation.org/frs/download.php/2015/openvas-libraries-8.0.1.tar.gz
wget --no-check-certificate https://wald.intevation.org/frs/download.php/2016/openvas-scanner-5.0.1.tar.gz
wget --no-check-certificate https://wald.intevation.org/frs/download.php/2017/openvas-manager-6.0.1.tar.gz
wget --no-check-certificate https://wald.intevation.org/frs/download.php/1987/openvas-cli-1.4.0.tar.gz
wget --no-check-certificate https://wald.intevation.org/frs/download.php/2018/greenbone-security-assistant-6.0.1.tar.gz
```

Unpack them all in one go:

```bash
find . -name \*.gz -exec tar zxvfp {} \;
```

## Build order

The pieces depend on each other, so build them in this order: SMB, libraries, scanner, then the manager. Each one is a standard out-of-tree cmake build:

```bash
cd openvas-smb* && mkdir build && cd build && cmake .. && make && make install && cd /usr/local/src
cd openvas-libraries-* && mkdir build && cd build && cmake .. && make && make install && cd /usr/local/src
cd openvas-scanner-* && mkdir build && cd build && cmake .. && make && make install && cd /usr/local/src
```

Reload the linker cache so the freshly installed libraries are found:

```bash
ldconfig
```

Create the server certificate, pull down the network vulnerability tests, and start the scanner daemon:

```bash
openvas-mkcert
openvas-nvt-sync
openvassd
```

Loading the NVTs takes a while on first run. Watch for the scanner to report it is ready:

```bash
watch "ps -ef | grep openvassd"
```

You are waiting for the "Waiting for incoming connections" line. Once it appears, build the manager:

```bash
cd openvas-manager-* && mkdir build && cd build && cmake .. && make && make install && cd /usr/local/src
```

## Feeds and database

The SCAP feed has one oversized XML file that breaks the sync unless it is split. Edit `/usr/local/sbin/openvas-scapdata-sync` and make sure this is set:

```text
SPLIT_PART_SIZE=20480
```

Then sync the SCAP and CERT data and create the client certificate:

```bash
openvas-scapdata-sync
openvas-certdata-sync
openvas-mkcert-client -n -i
```

Build the database and create your admin user. The command prints a generated password once, so write it down:

```bash
openvasmd --rebuild --progress
openvasmd --create-user=admin --role=Admin
```

## CLI, web UI and first start

```bash
cd openvas-cli-* && mkdir build && cd build && cmake .. && make && make install && cd /usr/local/src
cd greenbone-security-assistant-* && mkdir build && cd build && cmake .. && make && make install && cd /usr/local/src
```

Start the stack. For a first look I run GSA in HTTP-only mode; put it behind a proper TLS proxy before anything real:

```bash
openvasmd --rebuild --progress && openvasmd && gsad --http-only
```

Finally, confirm the whole thing hangs together:

```bash
./openvas-check-setup --v8 --server
```

There are community init scripts that wrap the manager, scanner and GSA as proper services so they come back after a reboot; grab those rather than leaving the daemons running by hand.

## Seccubus for scheduled, diffable scans

OpenVAS tells you what is wrong today. What you usually want is what *changed* since the last scan. Seccubus runs scanners on a schedule and shows you the delta, so you are triaging new findings instead of re-reading the whole report every time.

Install the prerequisites:

```bash
apt-get install apache2 mysql-server libxml-simple-perl ruby
```

Grab the release `.deb` from the project and install it:

```bash
wget https://github.com/schubergphilis/Seccubus_v2/releases/download/2.14/seccubus_2.14.B262_all.deb
dpkg -i seccubus_2.14.B262_all.deb
```

Create the database. Keep the name consistent, as Seccubus is case-sensitive about it, and use a real password rather than the placeholder here:

```sql
create database Seccubus;
grant all privileges on Seccubus.* to seccubus@localhost identified by 'CHANGE_ME';
flush privileges;
```

Put the same database details into `/etc/seccubus/config.xml`, then import the schema and seed data:

```bash
mysql -u seccubus -p Seccubus < /var/lib/seccubus/structure_v6.mysql
mysql -u seccubus -p Seccubus < /var/lib/seccubus/data_v6.mysql
```

From there you add OpenVAS as a scanner in the Seccubus config, point a scan at a target range, and let it run on a cron. Each run is compared against the last, and anything new is flagged.

## Today

OpenVAS 8 is long obsolete and this from-source build is only of historical interest. The project became Greenbone Vulnerability Management (GVM), and the maintained community version is the Greenbone Community Edition, distributed as packages and containers rather than a manual compile. Seccubus v2 is likewise archived. If you want the "diff my scans over time" workflow now, that scheduling and comparison is built into the Greenbone manager itself, so you no longer need a separate front end for it.