Script install OpenVAS 8, DB Redis and Debian 8.1 (Jessie) x86_64

Publicado por firebits em dezembro 11, 2015

#!/bin/bash
#OpenVAS 8
#version 8.0.4
#Debian 8.1
#Script
#Mauro Risonho de Paula Assumpção aka firebits mauro.risonho@gmail.com
#11.12.2015 17:51:03

apt-get install -y build-essential devscripts dpatch libassuan-dev libglib2.0-dev libgpgme11-dev libpcre3-dev libpth-dev libwrap0-dev libgmp-dev libgmp3-dev libgpgme11-dev libpcre3-dev libpth-dev quilt cmake pkg-config libssh-dev libglib2.0-dev libpcap-dev libgpgme11-dev uuid-dev bison libksba-dev doxygen sqlfairy xmltoman sqlite3 libsqlite3-dev wamerican redis-server libhiredis-dev libsnmp-dev libmicrohttpd-dev libxml2-dev libxslt1-dev xsltproc libssh2-1-dev libldap2-dev autoconf nmap libgnutls28-dev libpopt-dev heimdal-dev heimdal-multidev libpopt-dev mingw32 texlive-full rpm alien nsis rsync python2.7 python-setuptools

cp /etc/redis/redis.conf /etc/redis/redis.orig
echo “unixsocket /tmp/redis.sock” >> /etc/redis/redis.conf
service redis-server restart

mkdir openvas8
cd openvas8/

find | grep “.tar.gz$” | xargs -i tar zxvfp ‘{}’

###############################################

cd openvas-smb*
mkdir build
cd build/
cmake ..
make
make doc-full
make install
cd ../../

cd openvas-libraries-*
mkdir build
cd build
cmake ..
make
make doc-full
make install
cd ../../

cd openvas-scanner-*
mkdir build
cd build/
cmake ..
make
make doc-full
make install
cd ../../

cd openvas-manager-*
mkdir build
cd build/
cmake ..
make
make doc-full
make install
cd ../../

cd openvas-cli-*
mkdir build
cd build/
cmake ..
make
make doc-full
make install
cd ../../

cd greenbone-security-assistant-*
mkdir build
cd build/
cat ../src/xslt_i18n.h | sed ‘s///’ > test; cat test > ../src/xslt_i18n.h
cmake ..
make
make doc-full
make install
cd ../../

###

cd ospd-1*
python setup.py install –prefix=/usr/local
cd ../

cd ospd-ancor-*
python setup.py install –prefix=/usr/local
cd ../

cd ospd-debsecan-*
python setup.py install –prefix=/usr/local
cd ../

cd ospd-ovaldi-*
python setup.py install –prefix=/usr/local
cd ../

cd ospd-paloalto-*
python setup.py install –prefix=/usr/local
cd ../

cd ospd-w3af-*
python setup.py install –prefix=/usr/local
cd ../

cd ospd-acunetix-*
python setup.py install –prefix=/usr/local
cd ../

cd ospd-ikescan-*
python setup.py install –prefix=/usr/local
cd ../

cd ospd-ikeprobe-*
python setup.py install –prefix=/usr/local
cd ../

cd ospd-ssh-keyscan-*
python setup.py install –prefix=/usr/local
cd ../

cd ospd-netstat-&
python setup.py install –prefix=/usr/local
cd ../

#reload libraries
ldconfig

###############################################

#create cert
openvas-mkcert
openvas-mkcert-client -n -i

#create user
openvasmd –create-user=admin –role=Admin && openvasmd –user=admin –new-password=admin
#(write down the password)

####

echo ‘#!/bin/bash’ > /usr/local/sbin/openvas-update
echo ‘/usr/local/sbin/openvas-nvt-sync’ >> /usr/local/sbin/openvas-update
echo ‘/usr/local/sbin/openvas-scapdata-sync’ >> /usr/local/sbin/openvas-update
echo ‘/usr/local/sbin/openvas-certdata-sync’ >> /usr/local/sbin/openvas-update
chmod +x /usr/local/sbin/openvas-update

echo ‘#!/bin/bash’ > /usr/local/sbin/openvas-start
echo ‘/usr/local/sbin/openvasmd –rebuild’ >> /usr/local/sbin/openvas-start
echo ‘/usr/local/sbin/openvasmd’ >> /usr/local/sbin/openvas-start
echo ‘/usr/local/sbin/openvassd’ >> /usr/local/sbin/openvas-start
echo ‘/usr/local/sbin/gsad’ >> /usr/local/sbin/openvas-start
chmod +x /usr/local/sbin/openvas-start

echo ‘#!/bin/bash’ > /usr/local/sbin/openvas-kill
echo “ps aux | egrep \”(openvas.d|gsad)\” | awk ‘{print \$2}’ | xargs -i kill ‘{}'” >> /usr/local/sbin/openvas-kill
chmod +x /usr/local/sbin/openvas-kill

rclocal=`cat /etc/rc.local | grep -v “exit 0” | grep -v “openvas”`
echo “$rclocal” > /etc/rc.local
echo “date >> /var/log/openvas_init” >> /etc/rc.local
echo “echo ‘openvas init started’ >> /var/log/openvas_init” >> /etc/rc.local
echo “/usr/local/sbin/openvas-kill >> /var/log/openvas_init || /bin/true” >> /etc/rc.local
echo “/usr/local/sbin/openvas-start >> /var/log/openvas_init || /bin/true” >> /etc/rc.local
echo “echo ‘openvas init finished’ >> /var/log/openvas_init” >> /etc/rc.local
echo “exit 0” >> /etc/rc.local

####

/usr/local/sbin/openvas-kill
/usr/local/sbin/openvas-update
/usr/local/sbin/openvas-start

# check installation
wget https://svn.wald.intevation.org/svn/openvas/trunk/tools/openvas-check-setup –no-check-certificate
chmod 0755 openvas-check-setup
./openvas-check-setup –v8 –server

April 2nd, 2015 – OpenVAS-8 released: Charts, Quality of Detection and PostgreSQL-Support –

Publicado por firebits em maio 11, 2015

http://www.openvas.org/news_archive.html

Following the annual release cycle, the new generation of OpenVAS [1] has been released. The new version of the open framework for vulnerability scanning and management, OpenVAS-8, introduces a comprehensively extended and improved feature set. Advances and improvements were achieved in virtually all areas.

Highlights of this new release are the chart module for a variety of graphical representation, the Quality of Detection (QoD) concept and the optional support of PostgreSQL as database backend. Major advances were also achieved for the access control management: more roles, group admins and super-admin to name just a few. Notable as well is the introduction of the optional multi-scanner support via the new protocol OSP (OpenVAS Scanner Protocol) for which a growing number of servers is expected for the future. Last but not least, the OpenVAS Scanner now requires less ressources and uses redis[2] for the inter-process communication.

All in all OpenVAS-8 ships 28 new and improved features, accompanied with countless smaller changes. The systematic improvements and reliable release of one major update every twelve months once again underlines the position of OpenVAS as the most advanced Open Source solution for vulnerability management. The new version can be downloaded free and is available as Free Software under the GNU GPL license.

The company Greenbone Networks [3] develops and uses OpenVAS as a base for its appliance product family for vulnerability scanning and management. Together with the company SecPod [4] and the growing community, new vulnerability tests and feature improvements are developed on a daily basis. The German Federal Office for Information Security (BSI) [5] supports and utilizes OpenVAS, together with many other federal agencies, as part of their IT security framework.

Vulnerability Management:

Access Control:
The access control features were comprehensively extended.
Roles can now be dynamically configured.
New default roles “Monitor”, “Guest” and “Super Admin”.
New Permissions “Super” that allows for example to define an administrator for a group.
Results are now an explicit part of the scan management.
The new section “Results” under menu “Scan Management” offers an object management for all of the scan results in the database a user has permission for. In other words, searching and filtering for results is now possible independent of a scan report.
Solution Type:
NVTs are now associated with a solution type like for example “VendorFix”. This allows to group or identify NVTs or results where for example a simple solution exists or no solution is currently available.
The Feed content is updated over time to add a solution type for all of the NVTs. At the time of writing, 3.6% of the NVTs own a Solution Type.
Quality of Detection (QoD):
The QoD is a value between 0% and 100% describing the reliability of the executed vulnerability detection or product detection.
One of the main reasons to introduce this concept was to handle the challenge of potential vulnerabilities properly. The goal was to keep such in the results database but only visible on demand.
While the QoD range allows to express the quality pretty refined, in fact most of the test routines use a standard methodology. Therefore the QoD Types were introduced of which each is associated with a QoD value.
The Feed content is updated over time to add a QoD for all NVTs. Any NVT not explicitly assigned will apply 75% and therefore visible by default in order to not change the default behavior compared to OpenVAS-7. However, meanwhile any NVTs formerly requiring the “paranoid” setting in the scan configuration is now reporting always but stay invisible in the database until the user decides to view results with a lower quality of detection.
At the time of writing, 2.7% of the NVTs own a QoD Type.
New SecInfo object type “CERT-Bund” introduced: These are advisories published by the German federal CERT.
Vulnerability Scanning:

Credentials:
The public key of SSH credentials is not required anymore because it is extracted from the private key.
Credentials for ESXi target systems can now be configured directly with the Target object instead of in the Scan Configuration object.
When a task is requested to stop, the scanner will now be advised to switch immediately into the final phase of scanning. With OpenVAS-7 the scanner immediately stopped activity and did not return so far collected host details. With OpenVAS-8 this is now transferred to the the database.
Dropped support for pausing of tasks entirely (was removed from GUI before, now removed from OMP level).
OpenVAS Scanning Protocol (OSP):
This new protocol allows to control a vulnerability scanner. The main elements are to set parameters, start a scan and retrieve results. OSP is designed in the same way as OMP, therefore it is a non-permanent request-response connection based on XML.
It is possible to configure and control OSP-compliant Scanner via the user interface.
OpenVAS-8 offers some pilot OSP scanners in order to provide examples for this technology. Users and developers are encouraged to wrap more vulnerability scanner with OSP and provide feedback on missing features in the OSP protocol.
The OpenVAS Scanner itself is still OTP-based and the integration with OpenVAS Manager works like before with the slight difference that it is now possible to define more than one OpenVAS Scanner to be controlled by OpenVAS Manager.
This new concepts introduces various changes in the user interface but defaults are set to keep the same behavior as in OpenVAS-7 if user decides not to deal with OSP. In other words: OSP is entirely optional.
Graphical User Interface:

Dynamic charts are introduced, using the Javascript library “d3”. The first chart types (bar, donut, bubbles, line) are used for the SecInfo section in order to demonstrate some of the capabilities.
The chart objects allow to download the data as CSV table or SVG graphics. Also, a HTML table can be opened and some of the charts are interactive.
The underlying data aggregation technology is generically integrated into the protocol OMP. This allows to add more charts during the lifecycle of the OpenVAS release because no API changes are required.
For the SecInfo Management, a first dashboard is integrated which assembles four of the charts and can be configured individually.
The charting feature is entirely optional: Without enabling Javascript support in the browser no core functionality is lost. Also, the chart view can be collapsed so that only the traditional table view is shown.
Bulk actions are introduced. For example this allows to remove or download many objects within a single action.
The powerfilter was simplified to carry only the essential filter elements. The standard ones are displayed below and of course it is possible to apply any of them in the text entry field.
Timezones:
The configuration of timezones was changed so that now there is offered a drop down list of available timezones instead of a entry field for specifying the timezone in text form.
Users are now allowed to have multiple simultaneous sessions, as long as the sessions are on different browsers. Up-to OpenVAS-7, a second session always invalidated the previous one regardless of which browser is used.
For any web interface page, the duration of the backend operation will be shown at the bottom.
The filenames for downloads can now be configured via “My Settings”.
New wizard for modifying a task.
Protocols:

OMP now in version 6.0
The new OSP for controlling arbitrary scanners is at version 1.0.
The OTP protocol was further reduced. It is not recommended to use it to communicate with the OpenVAS Scanner because it will eventually be dropped in favor of OSP. For the time being OMP should be used to control a OpenVAS Scanner.
Architecture:

redis (mandatory):
The OpenVAS Scanner now uses a redis backend to share the knwoledge base among the scanning processes.
PostgreSQL (optional):
OpenVAS Manager now allows to use PostgreSQL as an alternative for the file-based SQLite. Everything should work, but this new database backend has seen little testing so far.
The OpenVAS development team is prepared to fix any issues promptly as it is desired to make this database eventually the new default backend.
openvas-smb (optional):
The new module “openvas-smb” is used for WMI support. This is the former externally maintained wmi client library. Since it was actually not maintained anymore, the module was cut down to the essentials and furnished with a “cmake” build environment.
OSP (optional):
For the new OSP, a base module “OSPd” written in Python is made available. The actual wrappers for vulnerability scanners are collected as “osp-scanners” and the name of the modules is prefixed with “OSPd-“. “OSPd” is a mandatory requirement for each OSP scanner module.
All sample OSP scanners are writtin in Python. Currently the C-library API only supports OSP client functionality, not server functionality.
The memory consumption of the OpenVAS Scanner was reduced by about 50%.
References:

[1] OpenVAS: http://www.openvas.org/
[2] redis: http://redis.io/
[3] Greenbone: http://www.greenbone.net/
[4] SecPod: http://www.secpod.com/
[5] BSI: https://www.bsi.bund.de//

@firebitsbr

VSLA – Virtual Security Labs Anywhere

Just another security.com site

Arquivo da tag: openvas

Script install OpenVAS 8, DB Redis and Debian 8.1 (Jessie) x86_64

April 2nd, 2015 – OpenVAS-8 released: Charts, Quality of Detection and PostgreSQL-Support –