RUNBOOK Identificação de vulnerabilidades com OpenVAS

De wikiti
Ir para navegação Ir para pesquisar


Analisar vulnerabilidades com OpenVAS (Open Vulnerability Assessment System)

Versão: 1.1

Data: 20/05/2025

Autor: reginaldo.lopes@unesp.br

Política: Art. 32 / Art. 36 Política de Segurança Cibernética

O que é

O OpenVAS (Open Vulnerability Assessment System) é uma ferramenta de código aberto para análise de vulnerabilidades de segurança. Ele realiza a varredura em sistemas e redes para identificar possíveis falhas de segurança e gerar relatórios detalhados sobre os riscos encontrados.

Por que usar?

  1. Detecção de vulnerabilidades: Identifica falhas de segurança em sistemas, aplicações e redes.
  2. Relatórios detalhados: Fornece informações sobre as vulnerabilidades encontradas e suas possíveis consequências.
  3. Código aberto: Sem custo de licença, podendo ser personalizado conforme a necessidade.
  4. Compatibilidade: Suporta uma ampla gama de protocolos e sistemas operacionais.

Instalação

O OpenVAS pode ser implantado usando Docker, o que facilita a configuração e a manutenção.

Instalação do Docker

curl -sSL https://get.docker.com/ | sh 
systemctl start docker
systemctl enable docker

Instalação do compose

curl -L "https://github.com/docker/compose/releases/download/v5.5.1/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose && \
chmod +x /usr/local/bin/docker-compose

Greenbone

Requisitos

  • Minimal:
    • CPU Cores: 2
    • Random-Access Memory: 4GB
    • Hard Disk: 20GB free
  • Recommended:
    • CPU Cores: 4
    • Random-Access Memory: 8GB
    • Hard Disk: 60GB free

Requisitos

Instalação do Ubuntu server 24.04

Passo 1: Instalação do Ubuntu server 24.04

Ubuntu

Passo 2: Atualizar o sistema 

sudo apt update && sudo apt upgrade -y

Subindo Greenbone

Greebone instalação oficial 

mkdir /srv/openvas && cd /srv/openvas && touch docker-compose.yml

Copie o código a seguir e adicione no arquivo docker-compose.yml 

name: greenbone-community-edition

services:
  vulnerability-tests:
    image: registry.community.greenbone.net/community/vulnerability-tests
    environment:
      FEED_RELEASE: "24.10"
    volumes:
      - vt_data_vol:/mnt

  notus-data:
    image: registry.community.greenbone.net/community/notus-data
    volumes:
      - notus_data_vol:/mnt

  scap-data:
    image: registry.community.greenbone.net/community/scap-data
    volumes:
      - scap_data_vol:/mnt

  cert-bund-data:
    image: registry.community.greenbone.net/community/cert-bund-data
    volumes:
      - cert_data_vol:/mnt

  dfn-cert-data:
    image: registry.community.greenbone.net/community/dfn-cert-data
    volumes:
      - cert_data_vol:/mnt
    depends_on:
      - cert-bund-data

  data-objects:
    image: registry.community.greenbone.net/community/data-objects
    environment:
      FEED_RELEASE: "24.10"
    volumes:
      - data_objects_vol:/mnt

  report-formats:
    image: registry.community.greenbone.net/community/report-formats
    environment:
      FEED_RELEASE: "24.10"
    volumes:
      - data_objects_vol:/mnt
    depends_on:
      - data-objects

  gpg-data:
    image: registry.community.greenbone.net/community/gpg-data
    volumes:
      - gpg_data_vol:/mnt

  redis-server:
    image: registry.community.greenbone.net/community/redis-server
    restart: on-failure
    volumes:
      - redis_socket_vol:/run/redis/

  pg-gvm:
    image: registry.community.greenbone.net/community/pg-gvm:stable
    restart: on-failure
    volumes:
      - psql_data_vol:/var/lib/postgresql
      - psql_socket_vol:/var/run/postgresql

  gvmd:
    image: registry.community.greenbone.net/community/gvmd:stable
    restart: on-failure
    volumes:
      - gvmd_data_vol:/var/lib/gvm
      - scap_data_vol:/var/lib/gvm/scap-data/
      - cert_data_vol:/var/lib/gvm/cert-data
      - data_objects_vol:/var/lib/gvm/data-objects/gvmd
      - vt_data_vol:/var/lib/openvas/plugins
      - psql_data_vol:/var/lib/postgresql
      - gvmd_socket_vol:/run/gvmd
      - ospd_openvas_socket_vol:/run/ospd
      - psql_socket_vol:/var/run/postgresql
    depends_on:
      pg-gvm:
        condition: service_started
      scap-data:
        condition: service_completed_successfully
      cert-bund-data:
        condition: service_completed_successfully
      dfn-cert-data:
        condition: service_completed_successfully
      data-objects:
        condition: service_completed_successfully
      report-formats:
        condition: service_completed_successfully

  gsa:
    image: registry.community.greenbone.net/community/gsa:stable
    restart: on-failure
    ports:
      - 0.0.0.0:9392:80
    volumes:
      - gvmd_socket_vol:/run/gvmd
    depends_on:
      - gvmd
  # Sets log level of openvas to the set LOG_LEVEL within the env
  # and changes log output to /var/log/openvas instead /var/log/gvm
  # to reduce likelyhood of unwanted log interferences
  configure-openvas:
    image: registry.community.greenbone.net/community/openvas-scanner:stable
    volumes:
      - openvas_data_vol:/mnt
      - openvas_log_data_vol:/var/log/openvas
    command:
      - /bin/sh
      - -c
      - |
        printf "table_driven_lsc = yes\nopenvasd_server = http://openvasd:80\n" > /mnt/openvas.conf
        sed "s/127/128/" /etc/openvas/openvas_log.conf | sed 's/gvm/openvas/' > /mnt/openvas_log.conf
        chmod 644 /mnt/openvas.conf
        chmod 644 /mnt/openvas_log.conf
        touch /var/log/openvas/openvas.log
        chmod 666 /var/log/openvas/openvas.log

  # shows logs of openvas
  openvas:
    image: registry.community.greenbone.net/community/openvas-scanner:stable
    restart: on-failure
    volumes:
      - openvas_data_vol:/etc/openvas
      - openvas_log_data_vol:/var/log/openvas
    command:
      - /bin/sh
      - -c
      - |
        cat /etc/openvas/openvas.conf
        tail -f /var/log/openvas/openvas.log
    depends_on:
      configure-openvas:
        condition: service_completed_successfully

  openvasd:
    image: registry.community.greenbone.net/community/openvas-scanner:stable
    restart: on-failure
    environment:
      # `service_notus` is set to disable everything but notus,
      # if you want to utilize openvasd directly removed `OPENVASD_MODE`
      OPENVASD_MODE: service_notus
      GNUPGHOME: /etc/openvas/gnupg
      LISTENING: 0.0.0.0:80
    volumes:
      - openvas_data_vol:/etc/openvas
      - openvas_log_data_vol:/var/log/openvas
      - gpg_data_vol:/etc/openvas/gnupg
      - notus_data_vol:/var/lib/notus
    # enable port forwarding when you want to use the http api from your host machine
    # ports:
    #   - 127.0.0.1:3000:80
    depends_on:
      vulnerability-tests:
        condition: service_completed_successfully
      configure-openvas:
        condition: service_completed_successfully
      gpg-data:
        condition: service_completed_successfully
    networks:
      default:
        aliases:
          - openvasd

  ospd-openvas:
    image: registry.community.greenbone.net/community/ospd-openvas:stable
    restart: on-failure
    hostname: ospd-openvas.local
    cap_add:
      - NET_ADMIN # for capturing packages in promiscuous mode
      - NET_RAW # for raw sockets e.g. used for the boreas alive detection
    security_opt:
      - seccomp=unconfined
      - apparmor=unconfined
    command:
      [
        "ospd-openvas",
        "-f",
        "--config",
        "/etc/gvm/ospd-openvas.conf",
        "--notus-feed-dir",
        "/var/lib/notus/advisories",
        "-m",
        "666",
      ]
    volumes:
      - gpg_data_vol:/etc/openvas/gnupg
      - vt_data_vol:/var/lib/openvas/plugins
      - notus_data_vol:/var/lib/notus
      - ospd_openvas_socket_vol:/run/ospd
      - redis_socket_vol:/run/redis/
      - openvas_data_vol:/etc/openvas/
      - openvas_log_data_vol:/var/log/openvas
    depends_on:
      redis-server:
        condition: service_started
      gpg-data:
        condition: service_completed_successfully
      vulnerability-tests:
        condition: service_completed_successfully
      configure-openvas:
        condition: service_completed_successfully

  gvm-tools:
    image: registry.community.greenbone.net/community/gvm-tools
    volumes:
      - gvmd_socket_vol:/run/gvmd
      - ospd_openvas_socket_vol:/run/ospd
    depends_on:
      - gvmd
      - ospd-openvas

volumes:
  gpg_data_vol:
  scap_data_vol:
  cert_data_vol:
  data_objects_vol:
  gvmd_data_vol:
  psql_data_vol:
  vt_data_vol:
  notus_data_vol:
  psql_socket_vol:
  gvmd_socket_vol:
  ospd_openvas_socket_vol:
  redis_socket_vol:
  openvas_data_vol:
  openvas_log_data_vol:

Baixe as imagens do docker 

docker-compose pull

Execute o container 

docker-compose up -d

Caso prefira um script com todos os comandos necessários para usar o docker: 

touch /srv/openvas/openvas.sh && chmod +x /srv/openvas/openvas.sh

#!/bin/sh
### BEGIN INFO
# Reginaldo.lopes 28/04/2025
# https://greenbone.github.io/docs/latest/22.4/container/workflows.html 
### END INFO


case "$1" in

# UP
up_openvas)
echo "Iniciando ...                     [ OK ]"
docker-compose -f /srv/openvas/docker-compose.yml up -d
echo "Iniciado 🚀                       [ OK ]"
;;

# DOWN
down_openvas)
echo "Desligando ...                    [ OK ]"
docker-compose -f /srv/openvas/docker-compose.yml down
echo "Desligado                         [ OK ]"
;;

# RESTART
restart_openvas)
 $0 down_openvas
 sleep 2
 $0 up_openvas
;;

# LOGS
logs_openvas)
docker-compose -f /srv/openvas/docker-compose.yml logs -f
;;


*)
echo " "
echo "Usage: \e[1;32m docker [OPTIONS] \e[0m"
echo " "
echo "Options: "
echo " "
echo "\e[0;32m OPENVAS: \e[0m"
echo "   - up_openvas             Iniciar o OpenVAS"
echo "   - down_openvas           Parar o OpenVAS"
echo "   - restart_openvas        Reiniciar o OpenVAS"
echo "   - logs_openvas           Ver logs do OpenVAS"
echo " "
echo "\e[0;32m Examplo de uso: [OPTIONS] \e[0m"
echo "   - /srv/openvas/openvas.sh up_openvas"
echo "   - /srv/openvas/openvas.sh down_openvas"
echo "   - /srv/openvas/openvas.sh restart_openvas"
echo "   - /srv/openvas/openvas.sh logs_openvas"
echo "SEE THE MAN PAGE (https://www.openvas.org/) FOR MORE INFORMATIONS"
;;
esac

Execute o script sem argumento para verificar o funcionamento. 

/srv/openvas/openvas.sh

Adicionar senha de admin 

docker compose -f /srv/openvas/docker-compose.yml exec -u gvmd gvmd gvmd --user=admin --new-password='sua$senha#aqu1'

Acesso

  • Acesse o http://<SERVIDOR>:9392/login

Referências

Install Greenbone

Docker

Disponível em “https://wiki-ti.unesp.br/index.php?title=RUNBOOK_Identificação_de_vulnerabilidades_com_OpenVAS&oldid=1275”