{"id":19491,"date":"2017-04-04T06:03:05","date_gmt":"2017-04-03T22:03:05","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/04\/04\/%e5%9c%a8-centos-7-x-%e4%b8%8a%e5%ae%89%e8%a3%9d-openvas\/"},"modified":"2021-03-18T17:24:58","modified_gmt":"2021-03-18T09:24:58","slug":"%e5%9c%a8-centos-7-x-%e4%b8%8a%e5%ae%89%e8%a3%9d-openvas","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/04\/04\/%e5%9c%a8-centos-7-x-%e4%b8%8a%e5%ae%89%e8%a3%9d-openvas\/","title":{"rendered":"\u5728 CentOS 7.x \u4e0a\u5b89\u88dd OpenVAS"},"content":{"rendered":"

\u5b98\u65b9\u7db2\u7ad9\uff1a
http:\/\/www.openvas.org\/index.html<\/a> <\/p>\n

\u53c3\u8003\u7db2\u7ad9\uff1a
http:\/\/forums.atomicorp.com\/viewtopic.php?f=31&t=8047<\/a>
\u96fb\u8166\u7b46\u8a18\u672c: OpenVas8 on CentOS7<\/a>
\u5875\u4e16\u6d6e\u6c89\u8fd1\u5343\u79cb: Cent OS 7 Install OpenVAS 8<\/a>
OpenVAS6 – Itsmw<\/a>
TWNIC 2015\u96fb\u5b50\u5831<\/a>
Install OpenVAS on CentOS 7 \/ RHEL 7<\/a>
OpenVas – Itsmw<\/a><\/p>\n

1) Disable SELINUX.
Edit \/etc\/selinux\/config<\/span>, save and reboot
# sed -i ‘s\/SELINUX=enforcing\/SELINUX=disabled\/’ \/etc\/selinux\/config<\/span>
2) Add required packages
# yum install wget bzip2 texlive net-tools\u00a0<\/span>
3) Add Atomicorp repo
# wget -q -O – http:\/\/www.atomicorp.com\/installers\/atomic<\/span> <\/a>| sh<\/span>
Do you agree to these terms? (yes\/no) [Default: yes]<\/span> <\/p>\n

Configuring the [atomic] repo archive for this system<\/span> <\/p>\n

Installing the Atomic GPG keys: OK<\/span> <\/p>\n

Downloading atomic-release-1.0-21.el7.art.noarch.rpm: Preparing…\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ################################# [100%]<\/span>
Updating \/ installing…<\/span>
\u00a0\u00a0 1:atomic-release-1.0-21.el7.art\u00a0\u00a0\u00a0 ################################# [100%]<\/span>
OK<\/span> <\/p>\n

Enable repo by default? (yes\/no) [Default: yes]:<\/span> <\/p>\n

The Atomic repo has now been installed and configured for your system<\/span>
The following channels are available:<\/span>
\u00a0 atomic\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 – [ACTIVATED] – contains the stable tree of ART packages<\/span>
\u00a0 atomic-testing\u00a0 – [DISABLED]\u00a0 – contains the testing tree of ART packages<\/span>
\u00a0 atomic-bleeding – [DISABLED]\u00a0 – contains the development tree of ART packages<\/span> <\/p>\n

[@more@]4) Install OpenVAS
# yum update<\/span>
# yum install openvas <\/span>alien<\/span> <\/p>\n

5) edit \/etc\/redis.conf. Add\/uncomment the following
unixsocket \/tmp\/redis.sock
unixsocketperm 700
# cp \/etc\/redis.conf \/etc\/redis.conf.$(date +%F)<\/span>
# sed -i ‘s\/^# unixsocket\/unixsocket\/’ \/etc\/redis.conf<\/span> <\/p>\n

6) Restart Redis
# systemctl enable redis && systemctl restart redis<\/span>
# systemctl status redis<\/span>
\u25cf redis.service – Redis persistent key-value database<\/span>
\u00a0\u00a0 Loaded: loaded (\/usr\/lib\/systemd\/system\/redis.service; enabled; vendor preset: disabled)<\/span>
\u00a0 Drop-In: \/etc\/systemd\/system\/redis.service.d<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 mqlimit.conf<\/span>
\u00a0\u00a0 Active: active (running<\/span>) since \u56db 2017-02-09 15:16:46 CST; 40min ago<\/span>
\u00a0Main PID: 1030 (redis-server)<\/span>
\u00a0\u00a0 CGroup: \/system.slice\/redis.service<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 mq1030 \/usr\/bin\/redis-server 127.0.0.1:6379<\/span> <\/p>\n

\u00a02\u6708 09 15:16:46 localhost.localdomain systemd[1]: Started Redis persistent key-value database.<\/span>
\u00a02\u6708 09 15:16:46 localhost.localdomain systemd[1]: Starting Redis persistent key-value database…<\/span> <\/p>\n

7) openvas-setup
follow instructions. If rsync throws error, check that your network allows outgoing TCP 873 to internet <\/p>\n

# \/usr\/bin\/openvas-setup<\/span>
Openvas Setup, Version: 1.0<\/span> <\/p>\n

Step 1: Update NVT, CERT, and SCAP data<\/span>
Please note this step could take some time.<\/span>
Once completed, this will be updated automatically every 24 hours<\/span> <\/p>\n

Select download method<\/span>
* wget (NVT download only)<\/span>
* curl (NVT download only)<\/span>
* rsync<\/span> <\/p>\n

\u00a0 Note: If rsync requires a proxy, you should define that before this step.<\/span>
Downloader [Default: rsync]<\/span>
Updating NVTs….<\/span>
[i] This script synchronizes an NVT collection with the ‘OpenVAS NVT Feed’.<\/span>
[i] The ‘OpenVAS NVT Feed’ is provided by ‘The OpenVAS Project’.<\/span>
[i] Online information about this feed: ‘http:\/\/www.openvas.org\/openvas-nvt-feed.html’.<\/span>
[i] NVT dir: \/var\/lib\/openvas\/plugins<\/span>
[w] Could not determine feed version.<\/span>
[i] rsync is not recommended for the initial sync. Falling back on http.<\/span>
[i] Will use wget<\/span>
[i] Using GNU wget: \/usr\/bin\/wget<\/span>
[i] Configured NVT http feed: http:\/\/www.openvas.org\/openvas-nvt-feed-current.tar.bz2<\/span>
[i] Downloading to: \/tmp\/openvas-nvt-sync.Q53foiaQhA\/openvas-feed-2017-02-09-1275.tar.bz2<\/span>
–2017-02-09 15:26:23–\u00a0 http:\/\/www.openvas.org\/openvas-nvt-feed-current.tar.bz2<\/span>
\u6b63\u5728\u67e5\u627e\u4e3b\u6a5f www.openvas.org (www.openvas.org)… 5.9.98.186<\/span>
\u6b63\u5728\u9023\u63a5 www.openvas.org (www.openvas.org)|5.9.98.186|:80… \u9023\u4e0a\u4e86\u3002<\/span>
\u5df2\u9001\u51fa HTTP \u8981\u6c42\uff0c\u6b63\u5728\u7b49\u5019\u56de\u61c9… 200 OK<\/span>
\u9577\u5ea6: 28323931 (27M) [application\/x-bzip2]<\/span>
Saving to: \u2018\/tmp\/openvas-nvt-sync.Q53foiaQhA\/openvas-feed-2017-02-09-1275.tar.bz2\u2019<\/span> <\/p>\n

Step 2: Configure GSAD<\/span>
The Greenbone Security Assistant is a Web Based front end<\/span>
for managing scans. By default it is configured to only allow<\/span>
connections from localhost.<\/span> <\/p>\n

Allow connections from any IP? [Default: yes]<\/span>
Redirecting to \/bin\/systemctl restart\u00a0 gsad.service<\/span> <\/p>\n

Step 3: Choose the GSAD admin users password.<\/span>
The admin user is used to configure accounts,<\/span>
Update NVT’s manually, and manage roles.<\/span> <\/p>\n

Enter administrator username [Default: admin] :<\/span>
Enter Administrator Password:<\/span>
Verify Administrator Password:<\/span> <\/p>\n

Redirecting to \/bin\/systemctl start\u00a0 redis.service<\/span> <\/p>\n

Setup complete, you can now access GSAD at:<\/span>
\u00a0 https:\/\/<IP>:9392<\/span> <\/p>\n

Created symlink from \/etc\/systemd\/system\/multi-user.target.wants\/openvas-scanner.service to \/usr\/lib\/systemd\/system\/openvas-scanner.service.<\/span>
Created symlink from \/etc\/systemd\/system\/multi-user.target.wants\/openvas-manager.service to \/usr\/lib\/systemd\/system\/openvas-manager.service.<\/span>
Created symlink from \/etc\/systemd\/system\/multi-user.target.wants\/gsad.service to \/usr\/lib\/systemd\/system\/gsad.service.<\/span> <\/p>\n

8 ) To access OV-8 from network, either disable firewall or add exception for tcp 9392
# firewall-cmd –permanent –zone=public –add-port=9392\/tcp<\/span>
# firewall-cmd –reload<\/span> <\/p>\n

Go to https:\/\/<IP-ADDRESS>:9392<\/a> and login. <\/p>\n

\"\" <\/a> <\/p>\n

\"\" <\/a> <\/p>\n

[Optional] : Greenbone Security Assistant (GSAD)
For those who wants to install proper SSL cert. Download certificate and key file to your CentOS box. I place them inside \/etc\/openvas\/ssl.
Edit \/etc\/sysconfig\/gsad and modify the OPTIONS tag e.g. <\/p>\n

OPTIONS=”–ssl-certificate=\/etc\/openvas\/ssl\/openvas.crt –ssl-private-key=\/etc\/openvas\/ssl\/openvas.key” <\/p>\n

Restart gsad
systemctl restart gsad <\/p>\n

Those who wants stronger ciphers can will need to add gnutls-priorities, e.g.
OPTIONS=”–ssl-certificate=\/etc\/openvas\/ssl\/openvas.crt –ssl-private-key=\/etc\/openvas\/ssl\/openvas.key –gnutls-priorities=SECURE128:+SECURE192:-VERS-TLS-ALL:+VERS-TLS1.2″ <\/p>\n

(See explanation at http:\/\/gnutls.org\/manual\/html_node\/Priority-Strings.html<\/a>)<\/p>\n

# openvas-check-setup<\/span>
openvas-check-setup 2.3.7<\/span>
\u00a0 Test completeness and readiness of OpenVAS-8<\/span>
\u00a0 (add ‘–v6’ or ‘–v7’ or ‘–v9’<\/span>
\u00a0\u00a0 if you want to check for another OpenVAS version)<\/span><\/p>\n

\u00a0 Please report us any non-detected problems and<\/span>
\u00a0 help us to improve this check routine:<\/span>
\u00a0 http:\/\/lists.wald.intevation.org\/mailman\/listinfo\/openvas-discuss<\/span><\/p>\n

\u00a0 Send us the log-file (\/tmp\/openvas-check-setup.log) to help analyze the problem.<\/span><\/p>\n

\u00a0 Use the parameter –server to skip checks for client tools<\/span>
\u00a0 like GSD and OpenVAS-CLI.<\/span><\/p>\n

Step 1: Checking OpenVAS Scanner …<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: OpenVAS Scanner is present in version 5.0.7.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: OpenVAS Scanner CA Certificate is present as \/var\/lib\/openvas\/CA\/cacert.pem.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: redis-server is present in version v=3.0.7.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: scanner (kb_location setting) is configured properly using the redis-server socket: \/tmp\/redis.sock<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: redis-server is running and listening on socket: \/tmp\/redis.sock.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: redis-server configuration is OK and redis-server is running.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: NVT collection in \/var\/lib\/openvas\/plugins contains 51765 NVTs.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 WARNING: Signature checking of NVTs is not enabled in OpenVAS Scanner.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SUGGEST: Enable signature checking (see http:\/\/www.openvas.org\/trusted-nvts.html).<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: The NVT cache in \/var\/cache\/openvas contains 51765 files for 51765 NVTs.<\/span>
Step 2: Checking OpenVAS Manager …<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: OpenVAS Manager is present in version 6.0.9.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: OpenVAS Manager client certificate is present as \/var\/lib\/openvas\/CA\/clientcert.pem.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: OpenVAS Manager database found in \/var\/lib\/openvas\/mgr\/tasks.db.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: Access rights for the OpenVAS Manager database are correct.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: sqlite3 found, extended checks of the OpenVAS Manager installation enabled.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: OpenVAS Manager database is at revision 146.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: OpenVAS Manager expects database at revision 146.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: Database schema is up to date.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: OpenVAS Manager database contains information about 51765 NVTs.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: At least one user exists.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: OpenVAS SCAP database found in \/var\/lib\/openvas\/scap-data\/scap.db.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: OpenVAS CERT database found in \/var\/lib\/openvas\/cert-data\/cert.db.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: xsltproc found.<\/span>
Step 3: Checking user configuration …<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 WARNING: Your password policy is empty.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SUGGEST: Edit the \/etc\/openvas\/pwpolicy.conf file to set a password policy.<\/span>
Step 4: Checking Greenbone Security Assistant (GSA) …<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: Greenbone Security Assistant is present in version 6.0.11.<\/span>
Step 5: Checking OpenVAS CLI …<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: OpenVAS CLI version 1.4.5.<\/span>
Step 6: Checking Greenbone Security Desktop (GSD) …<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SKIP: Skipping check for Greenbone Security Desktop.<\/span>
Step 7: Checking if OpenVAS services are up and running …<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: netstat found, extended checks of the OpenVAS services enabled.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: OpenVAS Scanner is running and listening on all interfaces.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: OpenVAS Scanner is listening on port 9391, which is the default port.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: OpenVAS Manager is running and listening on all interfaces.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: OpenVAS Manager is listening on port 9390, which is the default port.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: Greenbone Security Assistant is listening on port 9392, which is the default port.<\/span>
Step 8: Checking nmap installation …<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 WARNING: Your version of nmap is not fully supported: 6.47<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SUGGEST: You should install nmap 5.51 if you plan to use the nmap NSE NVTs.<\/span>
Step 10: Checking presence of optional tools …<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: pdflatex found.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: PDF generation successful. The PDF report format is likely to work.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: ssh-keygen found, LSC credential generation for GNU\/Linux targets is likely to work.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: rpm found, LSC credential package generation for RPM based targets is likely to work.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 WARNING: Could not find alien binary, LSC credential package generation for DEB based targets will not work.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SUGGEST: Install alien.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: nsis found, LSC credential package generation for Microsoft Windows targets is likely to work.<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OK: SELinux is disabled.<\/span><\/p>\n

It seems like your OpenVAS-8 installation is OK.<\/span><\/p>\n

If you think it is not OK, please report your observation<\/span>
and help us to improve this check routine:<\/span>
http:\/\/lists.wald.intevation.org\/mailman\/listinfo\/openvas-discuss<\/span>
Please attach the log-file (\/tmp\/openvas-check-setup.log) to help us analyze the problem.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

\u5b98\u65b9\u7db2\u7ad9\uff1a http:\/\/www.openvas.org\/index.html \u53c3\u8003\u7db2\u7ad9\uff1a http:\/\/fo … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008\u5728 CentOS 7.x \u4e0a\u5b89\u88dd OpenVAS\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[117,193],"tags":[],"class_list":["post-19491","post","type-post","status-publish","format-standard","hentry","category-c-78462","category-c-105012"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["685478"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19491"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=19491"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19491\/revisions"}],"predecessor-version":[{"id":21008,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19491\/revisions\/21008"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=19491"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=19491"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=19491"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}