RUNBOOK Identificação de vulnerabilidades com OpenVAS: mudanças entre as edições

De wikiti
Ir para navegação Ir para pesquisar
Sem resumo de edição
(Sem diferença)

Edição das 18h51min de 20 de maio de 2025


Analisar vulnerabilidades com OpenVAS (Open Vulnerability Assessment System)

O que é

O OpenVAS (Open Vulnerability Assessment System) é uma ferramenta de código aberto para análise de vulnerabilidades de segurança. Ele realiza a varredura em sistemas e redes para identificar possíveis falhas de segurança e gerar relatórios detalhados sobre os riscos encontrados.

Por que usar?

  1. Detecção de vulnerabilidades: Identifica falhas de segurança em sistemas, aplicações e redes.
  2. Relatórios detalhados: Fornece informações sobre as vulnerabilidades encontradas e suas possíveis consequências.
  3. Código aberto: Sem custo de licença, podendo ser personalizado conforme a necessidade.
  4. Compatibilidade: Suporta uma ampla gama de protocolos e sistemas operacionais.

Instalação

O OpenVAS pode ser implantado usando Docker, o que facilita a configuração e a manutenção.

Instalação do Docker

curl -sSL https://get.docker.com/ | sh 
systemctl start docker
systemctl enable docker

Instalação do compose

curl -L "https://github.com/docker/compose/releases/download/v2.12.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose && \
chmod +x /usr/local/bin/docker-compose

Greenbone

Requisitos

  • Minimal:
    • CPU Cores: 2
    • Random-Access Memory: 4GB
    • Hard Disk: 20GB free
  • Recommended:
    • CPU Cores: 4
    • Random-Access Memory: 8GB
    • Hard Disk: 60GB free

Requisitos

Instalação do Ubuntu server 22.04

Passo 1: Instalação do Ubuntu server 22.04

Ubuntu

Passo 2: Atualizar o sistema 

sudo apt update && sudo apt upgrade -y

Subindo Greenbone

Greebone instalação oficial 

mkdir /srv/openvas && cd /srv/openvas && touch docker-compose.yml

Copie o código a seguir e adicione no arquivo docker-compose.yml 

name: greenbone-community-edition

services:
  vulnerability-tests:
    image: registry.community.greenbone.net/community/vulnerability-tests
    environment:
      FEED_RELEASE: "24.10"
    volumes:
      - vt_data_vol:/mnt

  notus-data:
    image: registry.community.greenbone.net/community/notus-data
    volumes:
      - notus_data_vol:/mnt

  scap-data:
    image: registry.community.greenbone.net/community/scap-data
    volumes:
      - scap_data_vol:/mnt

  cert-bund-data:
    image: registry.community.greenbone.net/community/cert-bund-data
    volumes:
      - cert_data_vol:/mnt

  dfn-cert-data:
    image: registry.community.greenbone.net/community/dfn-cert-data
    volumes:
      - cert_data_vol:/mnt
    depends_on:
      - cert-bund-data

  data-objects:
    image: registry.community.greenbone.net/community/data-objects
    environment:
      FEED_RELEASE: "24.10"
    volumes:
      - data_objects_vol:/mnt

  report-formats:
    image: registry.community.greenbone.net/community/report-formats
    environment:
      FEED_RELEASE: "24.10"
    volumes:
      - data_objects_vol:/mnt
    depends_on:
      - data-objects

  gpg-data:
    image: registry.community.greenbone.net/community/gpg-data
    volumes:
      - gpg_data_vol:/mnt

  redis-server:
    image: registry.community.greenbone.net/community/redis-server
    restart: on-failure
    volumes:
      - redis_socket_vol:/run/redis/

  pg-gvm:
    image: registry.community.greenbone.net/community/pg-gvm:stable
    restart: on-failure
    volumes:
      - psql_data_vol:/var/lib/postgresql
      - psql_socket_vol:/var/run/postgresql

  gvmd:
    image: registry.community.greenbone.net/community/gvmd:stable
    restart: on-failure
    volumes:
      - gvmd_data_vol:/var/lib/gvm
      - scap_data_vol:/var/lib/gvm/scap-data/
      - cert_data_vol:/var/lib/gvm/cert-data
      - data_objects_vol:/var/lib/gvm/data-objects/gvmd
      - vt_data_vol:/var/lib/openvas/plugins
      - psql_data_vol:/var/lib/postgresql
      - gvmd_socket_vol:/run/gvmd
      - ospd_openvas_socket_vol:/run/ospd
      - psql_socket_vol:/var/run/postgresql
    depends_on:
      pg-gvm:
        condition: service_started
      scap-data:
        condition: service_completed_successfully
      cert-bund-data:
        condition: service_completed_successfully
      dfn-cert-data:
        condition: service_completed_successfully
      data-objects:
        condition: service_completed_successfully
      report-formats:
        condition: service_completed_successfully

  gsa:
    image: registry.community.greenbone.net/community/gsa:stable
    restart: on-failure
    ports:
      - 0.0.0.0:9392:80
    volumes:
      - gvmd_socket_vol:/run/gvmd
    depends_on:
      - gvmd
  # Sets log level of openvas to the set LOG_LEVEL within the env
  # and changes log output to /var/log/openvas instead /var/log/gvm
  # to reduce likelyhood of unwanted log interferences
  configure-openvas:
    image: registry.community.greenbone.net/community/openvas-scanner:stable
    volumes:
      - openvas_data_vol:/mnt
      - openvas_log_data_vol:/var/log/openvas
    command:
      - /bin/sh
      - -c
      - |
        printf "table_driven_lsc = yes\nopenvasd_server = http://openvasd:80\n" > /mnt/openvas.conf
        sed "s/127/128/" /etc/openvas/openvas_log.conf | sed 's/gvm/openvas/' > /mnt/openvas_log.conf
        chmod 644 /mnt/openvas.conf
        chmod 644 /mnt/openvas_log.conf
        touch /var/log/openvas/openvas.log
        chmod 666 /var/log/openvas/openvas.log

  # shows logs of openvas
  openvas:
    image: registry.community.greenbone.net/community/openvas-scanner:stable
    restart: on-failure
    volumes:
      - openvas_data_vol:/etc/openvas
      - openvas_log_data_vol:/var/log/openvas
    command:
      - /bin/sh
      - -c
      - |
        cat /etc/openvas/openvas.conf
        tail -f /var/log/openvas/openvas.log
    depends_on:
      configure-openvas:
        condition: service_completed_successfully

  openvasd:
    image: registry.community.greenbone.net/community/openvas-scanner:stable
    restart: on-failure
    environment:
      # `service_notus` is set to disable everything but notus,
      # if you want to utilize openvasd directly removed `OPENVASD_MODE`
      OPENVASD_MODE: service_notus
      GNUPGHOME: /etc/openvas/gnupg
      LISTENING: 0.0.0.0:80
    volumes:
      - openvas_data_vol:/etc/openvas
      - openvas_log_data_vol:/var/log/openvas
      - gpg_data_vol:/etc/openvas/gnupg
      - notus_data_vol:/var/lib/notus
    # enable port forwarding when you want to use the http api from your host machine
    # ports:
    #   - 127.0.0.1:3000:80
    depends_on:
      vulnerability-tests:
        condition: service_completed_successfully
      configure-openvas:
        condition: service_completed_successfully
      gpg-data:
        condition: service_completed_successfully
    networks:
      default:
        aliases:
          - openvasd

  ospd-openvas:
    image: registry.community.greenbone.net/community/ospd-openvas:stable
    restart: on-failure
    hostname: ospd-openvas.local
    cap_add:
      - NET_ADMIN # for capturing packages in promiscuous mode
      - NET_RAW # for raw sockets e.g. used for the boreas alive detection
    security_opt:
      - seccomp=unconfined
      - apparmor=unconfined
    command:
      [
        "ospd-openvas",
        "-f",
        "--config",
        "/etc/gvm/ospd-openvas.conf",
        "--notus-feed-dir",
        "/var/lib/notus/advisories",
        "-m",
        "666",
      ]
    volumes:
      - gpg_data_vol:/etc/openvas/gnupg
      - vt_data_vol:/var/lib/openvas/plugins
      - notus_data_vol:/var/lib/notus
      - ospd_openvas_socket_vol:/run/ospd
      - redis_socket_vol:/run/redis/
      - openvas_data_vol:/etc/openvas/
      - openvas_log_data_vol:/var/log/openvas
    depends_on:
      redis-server:
        condition: service_started
      gpg-data:
        condition: service_completed_successfully
      vulnerability-tests:
        condition: service_completed_successfully
      configure-openvas:
        condition: service_completed_successfully

  gvm-tools:
    image: registry.community.greenbone.net/community/gvm-tools
    volumes:
      - gvmd_socket_vol:/run/gvmd
      - ospd_openvas_socket_vol:/run/ospd
    depends_on:
      - gvmd
      - ospd-openvas

volumes:
  gpg_data_vol:
  scap_data_vol:
  cert_data_vol:
  data_objects_vol:
  gvmd_data_vol:
  psql_data_vol:
  vt_data_vol:
  notus_data_vol:
  psql_socket_vol:
  gvmd_socket_vol:
  ospd_openvas_socket_vol:
  redis_socket_vol:
  openvas_data_vol:
  openvas_log_data_vol:

Baixe as imagens do docker 

docker-compose pull

Execute o container 

docker-compose up -d

Caso prefira um script com todos os comandos necessários para usar o docker: 

touch /srv/openvas/openvas.sh && chmod +x /srv/openvas/openvas.sh

#!/bin/sh
### BEGIN INFO
# Reginaldo.lopes 28/04/2025
# https://greenbone.github.io/docs/latest/22.4/container/workflows.html 
### END INFO


case "$1" in

# UP
up_openvas)
echo "Iniciando ...                     [ OK ]"
docker-compose -f /srv/openvas/docker-compose.yml up -d
echo "Iniciado 🚀                       [ OK ]"
;;

# DOWN
down_openvas)
echo "Desligando ...                    [ OK ]"
docker-compose -f /srv/openvas/docker-compose.yml down
echo "Desligado                         [ OK ]"
;;

# RESTART
restart_openvas)
 $0 down_openvas
 sleep 2
 $0 up_openvas
;;

# LOGS
logs_openvas)
docker-compose -f /srv/openvas/docker-compose.yml logs -f
;;


*)
echo " "
echo "Usage: \e[1;32m docker [OPTIONS] \e[0m"
echo " "
echo "Options: "
echo " "
echo "\e[0;32m OPENVAS: \e[0m"
echo "   - up_openvas             Iniciar o OpenVAS"
echo "   - down_openvas           Parar o OpenVAS"
echo "   - restart_openvas        Reiniciar o OpenVAS"
echo "   - logs_openvas           Ver logs do OpenVAS"
echo " "
echo "\e[0;32m Examplo de uso: [OPTIONS] \e[0m"
echo "   - /srv/openvas/openvas.sh up_openvas"
echo "   - /srv/openvas/openvas.sh down_openvas"
echo "   - /srv/openvas/openvas.sh restart_openvas"
echo "   - /srv/openvas/openvas.sh logs_openvas"
echo "SEE THE MAN PAGE (https://www.openvas.org/) FOR MORE INFORMATIONS"
;;
esac

Execute o script sem argumento para verificar o funcionamento. 

/srv/openvas/openvas.sh

Adicionar senha de admin 

docker compose -f /srv/openvas/docker-compose.yml exec -u gvmd gvmd gvmd --user=admin --new-password='sua$senha#aqu1'

Acesso

  • Acesse o http://<SERVIDOR>:9392/login

Fonte

Install Greenbone

Docker

Disponível em “https://wiki-ti.unesp.br/index.php?title=RUNBOOK_Identificação_de_vulnerabilidades_com_OpenVAS&oldid=950”