{"id":5570,"date":"2020-04-23T23:38:01","date_gmt":"2020-04-23T20:38:01","guid":{"rendered":"https:\/\/kifarunix.com\/?p=5570"},"modified":"2024-03-14T20:11:40","modified_gmt":"2024-03-14T17:11:40","slug":"install-and-setup-gvm-11-on-ubuntu-20-04","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/install-and-setup-gvm-11-on-ubuntu-20-04\/","title":{"rendered":"Install and Setup GVM 11 on Ubuntu 20.04"},"content":{"rendered":"\n
In this guide, we are going to learn how to install and setup GVM 11<\/a> on Ubuntu 20.04. G<\/strong>reenbone V<\/strong>ulnerability M<\/strong>anagement (GVM)<\/a>, was previously known as OpenVAS, is a network security scanner which provides a set of network vulnerability tests (NVTs) to detect security loopholes in systems and applications. As of this writing, GVM 11 is the current stable release<\/a>.<\/p>\n\n\n\n Well, GVM 11 was set to retire by end of 2020. Try to new GVM 20.08 by following the links below;<\/p>\n\n\n\n Install and setup GVM 20.08 on Debian 10<\/a><\/p>\n\n\n\n Install and Setup GVM 20.08 on Ubuntu 20.04<\/a><\/p>\n\n\n\n In this demo, we will be building GVM 11 on Ubuntu 20.04 from source code. As such, below are the system requirements I would personally recommend.<\/p>\n\n\n\n These requirements will vary depending on your use cases, however. Just be sure to give “enough”.<\/p>\n\n\n\n To begin with, update and upgrade your system packages;<\/p>\n\n\n\n In this demo, we are going to run GVM as a non privileged system user. As such, we are going to create Create the GVM user directory as specified by option In order to successfully build GVM 11 on Ubuntu 20.04, you need to install a number of required dependencies and build tools.<\/p>\n\n\n\n Next, install Yarn JavaScript package manager<\/p>\n\n\n\n GVM 11 has dropped support for sqlite3 and it currently support only PostgreSQL as the backend database. Therefore, you need to install PostgreSQL on Ubuntu 20.04;<\/p>\n\n\n\n Once the installation is done, create the PostgreSQL user and database for Greenbone Vulnerability Management Daemon (gvmd). Note that the database and user should be created as PostgreSQL user, postgres<\/strong>.<\/p>\n\n\n\n Grant PostgreSQL User DBA Roles<\/p>\n\n\n\n Once that is done, restart PostgreSQL;<\/p>\n\n\n\n There are different tools required to install GVM 11. These include;<\/p>\n\n\n\n Every component has README.md<\/strong> and a INSTALL.md<\/strong> file that explains how to build and install it.<\/p>\n\n\n\n Since we are running GVM as non-privileged user, gvm, then we will install all the GVM configuration files and libraries under, Update the PATH environment variable on Add GVM library path to Switch to GVM user, gvm and create a temporary directory to store GVM source files.<\/p>\n\n\n\n Navigate to temporary directory created above and run the subsequent commands to clone the GVM github branch files.<\/p>\n\n\n\n Once the source files are in place, proceed to build and install GVM on Ubuntu 20.04.<\/p>\n\n\n\n Note that we will install all GVM files and libraries to a non-standard location, Be sure to replace the path, Change to GVM libraries directory;<\/p>\n\n\n\n Create a build directory and change into it;<\/p>\n\n\n\n Configure the build;<\/p>\n\n\n\n Next, compile and install GVM libraries<\/p>\n\n\n\n Open Vulnerability Assessment Scanner (OpenVAS) is a full-featured scan engine that executes a continuously updated and extended feed of Network Vulnerability Tests (NVTs).<\/p>\n\n\n\n OpenVAS SMB provides modules for the OpenVAS Scanner to interface with Microsoft Windows Systems through the Windows Management Instrumentation API and a Build and install openvas-smb;<\/p>\n\n\n\n Build and install OpenVAS scanner;<\/p>\n\n\n\n Proceed to build and install openvas.<\/p>\n\n\n\n If you encounter the error, Once done, save and exit the file and rerun the installation<\/strong>.<\/p>\n\n\n\n The host scan information is stored temporarily on Redis server. The default configuration of Redis server is Switch back to privileged user and proceed.<\/p>\n\n\n\n To begin run the command below to create the cache to the installed shared libraries;<\/p>\n\n\n\n Next, copy OpenVAS scanner Redis configuration file, Update the ownership of the configuration.<\/p>\n\n\n\n Update the path to Redis unix socket on the Note, the Unix socket path is defined on Add gvm user to redis group;<\/p>\n\n\n\n You can also optimize Redis server itself improve the performance by making the following adjustments;<\/p>\n\n\n\n Increase the value of somaxconn in order to avoid slow clients connections issues.<\/p>\n\n\n\n Redis background save may fail under low memory condition. To avoid this, enable memory overcommit (man 5 proc)<\/strong>.<\/p>\n\n\n\n Reload sysctl variables created above.<\/p>\n\n\n\n To avoid creation of latencies and memory usage issues with Redis, disable Linux Kernel\u2019s support for Transparent Huge Pages (THP). To easily work around this, create a systemd service unit for this purpose.<\/p>\n\n\n\n Reload systemd configurations;<\/p>\n\n\n\n Start and enable this service to run on system boot.<\/p>\n\n\n\n Restart OpenVAS Redis server<\/p>\n\n\n\n A number of Network Vulnerability Tests (NVTs) require root privileges to perform certain operations. Since Also, update the Also, enable Update Network Vulnerability Tests feed from Greenbone Security Feed\/Community Feed using the The Next, update the NVTs as openvas user;<\/p>\n\n\n\n Once the update is done, you need to update Redis server with the same VT info from VT files;<\/p>\n\n\n\n Update GVM CERT and SCAP data from the feed servers;<\/p>\n\n\n\n Consider setting cron jobs to run the nvts, cert and scap data update scripts at your preferred frequency to pull updates from the feed servers.<\/p>\n\n\n\n Next, run the command below to generate certificates gvmd. Server certificates are used for authentication while client certificates are primarily used for authorization. More on Open Scanner Protocol (OSP) creates a unified interface for different security scanners and makes their control flow and scan results consistently available under the central Greenbone Vulnerability Manager service.<\/p>\n\n\n\nInstalling GVM 11 on Ubuntu 20.04<\/a><\/h2>\n\n\n\n
Prerequisites<\/h3>\n\n\n\n
\n
Run System Update<\/h3>\n\n\n\n
apt update<\/code><\/pre>\n\n\n\n
apt upgrade<\/code><\/pre>\n\n\n\n
Create GVM User<\/a><\/h3>\n\n\n\n
gvm<\/strong><\/code> user and group.<\/p>\n\n\n\n
useradd -r -d \/opt\/gvm -c \"GVM User\" -s \/bin\/bash gvm<\/code><\/pre>\n\n\n\n
-d<\/code> in the command above and set the user and group ownership to
gvm<\/code>.<\/p>\n\n\n\n
mkdir \/opt\/gvm<\/code><\/pre>\n\n\n\n
chown gvm:gvm \/opt\/gvm<\/code><\/pre>\n\n\n\n
Install Required Build Tools<\/a><\/h3>\n\n\n\n
apt install gcc g++ make bison flex libksba-dev curl redis libpcap-dev \\\ncmake git pkg-config libglib2.0-dev libgpgme-dev nmap libgnutls28-dev uuid-dev \\\nlibssh-gcrypt-dev libldap2-dev gnutls-bin libmicrohttpd-dev libhiredis-dev \\\nzlib1g-dev libxml2-dev libradcli-dev clang-format libldap2-dev doxygen \\\ngcc-mingw-w64 xml-twig-tools libical-dev perl-base heimdal-dev libpopt-dev \\\nlibsnmp-dev python3-setuptools python3-paramiko python3-lxml python3-defusedxml python3-dev gettext python3-polib xmltoman \\\npython3-pip texlive-fonts-recommended texlive-latex-extra --no-install-recommends xsltproc<\/code><\/pre>\n\n\n\n
Install Yarn on Ubuntu 20.04<\/a><\/h4>\n\n\n\n
curl -sS https:\/\/dl.yarnpkg.com\/debian\/pubkey.gpg | apt-key add -<\/code><\/pre>\n\n\n\n
echo \"deb https:\/\/dl.yarnpkg.com\/debian\/ stable main\" | tee \/etc\/apt\/sources.list.d\/yarn.list<\/code><\/pre>\n\n\n\n
apt update<\/code><\/pre>\n\n\n\n
apt install yarn -y<\/code><\/pre>\n\n\n\n
Install PostgreSQL on#install-postgresql-ubuntu20.04<\/a> Ubuntu 20.04<\/h4>\n\n\n\n
apt install postgresql postgresql-contrib postgresql-server-dev-all<\/code><\/pre>\n\n\n\n
Create PostgreSQL User and Database<\/a><\/h4>\n\n\n\n
sudo -Hiu postgres\ncreateuser gvm\ncreatedb -O gvm gvmd<\/code><\/pre>\n\n\n\n
psql gvmd\ncreate role dba with superuser noinherit;\ngrant dba to gvm;\ncreate extension \"uuid-ossp\";\n\\q\nexit<\/code><\/pre>\n\n\n\n
systemctl restart postgresql<\/code><\/pre>\n\n\n\n
systemctl enable postgresql<\/code><\/pre>\n\n\n\n
Building GVM 11 from Source Code<\/a><\/h3>\n\n\n\n
\n
\/opt\/gvm<\/strong><\/code>.<\/p>\n\n\n\n
\/etc\/environment<\/strong><\/code>, to include the GVM binary path such that it looks like;<\/p>\n\n\n\n
vim \/etc\/environment<\/code><\/pre>\n\n\n\n
PATH=\"\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/bin:\/usr\/games:\/usr\/local\/games:\/opt\/gvm\/bin:\/opt\/gvm\/sbin:\/opt\/gvm\/.local\/bin<\/strong>\"<\/code><\/pre>\n\n\n\n
\/etc\/ld.so.conf.d<\/strong><\/code>. <\/p>\n\n\n\n
echo \"\/opt\/gvm\/lib\" > \/etc\/ld.so.conf.d\/gvm.conf<\/code><\/pre>\n\n\n\n
Build and Install GVM 11<\/h4>\n\n\n\n
su - gvm<\/code><\/pre>\n\n\n\n
mkdir \/tmp\/gvm-source<\/code><\/pre>\n\n\n\n
Download GVM Source Files<\/a><\/h4>\n\n\n\n
cd \/tmp\/gvm-source<\/code><\/pre>\n\n\n\n
git clone -b gvm-libs-11.0 https:\/\/github.com\/greenbone\/gvm-libs.git<\/code><\/pre>\n\n\n\n
git clone https:\/\/github.com\/greenbone\/openvas-smb.git<\/code><\/pre>\n\n\n\n
git clone -b openvas-7.0 https:\/\/github.com\/greenbone\/openvas.git<\/code><\/pre>\n\n\n\n
git clone -b ospd-2.0 https:\/\/github.com\/greenbone\/ospd.git<\/code><\/pre>\n\n\n\n
git clone -b ospd-openvas-1.0 https:\/\/github.com\/greenbone\/ospd-openvas.git<\/code><\/pre>\n\n\n\n
git clone -b gvmd-9.0 https:\/\/github.com\/greenbone\/gvmd.git<\/code><\/pre>\n\n\n\n
git clone -b gsa-9.0 https:\/\/github.com\/greenbone\/gsa.git<\/code><\/pre>\n\n\n\n
gvm@ubuntu20:\/tmp\/gvm-source$ ls\ngsa gvmd gvm-libs openvas openvas-smb ospd ospd-openvas<\/strong><\/code><\/pre>\n\n\n\n
\/opt\/gvm<\/code>. As such, you need to set the
PKG_CONFIG_PATH<\/code> environment variable to the location of your pkg-config
files before configuring:<\/p>\n\n\n\nexport PKG_CONFIG_PATH=\/opt\/gvm\/lib\/pkgconfig:$PKG_CONFIG_PATH<\/code><\/pre>\n\n\n\n
\/opt\/gvm<\/strong><\/code>, accordingly.<\/p>\n\n\n\n
Build and Install GVM 11 Libraries<\/a><\/h4>\n\n\n\n
cd gvm-libs<\/code><\/pre>\n\n\n\n
mkdir build\ncd build<\/code><\/pre>\n\n\n\n
cmake .. -DCMAKE_INSTALL_PREFIX=\/opt\/gvm<\/code><\/pre>\n\n\n\n
make<\/code><\/pre>\n\n\n\n
make install<\/code><\/pre>\n\n\n\n
Build and Install OpenVAS scanner and OpenVAS SMB<\/a><\/h4>\n\n\n\n
winexe<\/code> binary to execute processes remotely on that system.<\/p>\n\n\n\n
cd ..\/..\/openvas-smb\/\nmkdir build\ncd build\ncmake .. -DCMAKE_INSTALL_PREFIX=\/opt\/gvm\nmake\nmake install<\/code><\/pre>\n\n\n\n
cd ..\/..\/openvas<\/code><\/pre>\n\n\n\n
mkdir build\ncd build\ncmake .. -DCMAKE_INSTALL_PREFIX=\/opt\/gvm\nmake\nmake install<\/code><\/pre>\n\n\n\n
...error: \u2018pcap_lookupdev\u2019 is deprecated: use 'pcap_findalldevs'...<\/strong><\/code> while compiling openvas, edit the
CMakeLists.txt<\/strong><\/code> file and replace the line as shown below.<\/p>\n\n\n\n
vim ..\/..\/openvas\/CMakeLists.txt<\/code><\/pre>\n\n\n\n
...\n#set (CMAKE_C_FLAGS_DEBUG \"${CMAKE_C_FLAGS_DEBUG} ${COVERAGE_FLAGS}\")\nset (CMAKE_C_FLAGS_DEBUG \"${CMAKE_C_FLAGS_DEBUG} -Werror -Wno-error=deprecated-declarations\")<\/strong>\n...<\/code><\/pre>\n\n\n\n
Configuring OpenVAS Scanner<\/a><\/h4>\n\n\n\n
\/etc\/redis\/redis.conf<\/code>.<\/p>\n\n\n\n
exit<\/code><\/pre>\n\n\n\n
ldconfig<\/code><\/pre>\n\n\n\n
redis-openvas.conf<\/code>, to the same Redis config directory;<\/p>\n\n\n\n
cp \/tmp\/gvm-source\/openvas\/config\/redis-openvas.conf \/etc\/redis\/<\/code><\/pre>\n\n\n\n
chown redis:redis \/etc\/redis\/redis-openvas.conf<\/code><\/pre>\n\n\n\n
\/opt\/gvm\/etc\/openvas\/openvas.conf<\/code> using the
db_address<\/code><\/strong> parameter as follows;<\/p>\n\n\n\n
echo \"db_address = \/run\/redis-openvas\/redis.sock<\/strong><\/strong>\" > \/opt\/gvm\/etc\/openvas\/openvas.conf<\/code><\/pre>\n\n\n\n
\/etc\/redis\/redis-openvas.conf<\/code> file.<\/p>\n\n\n\n
chown gvm:gvm \/opt\/gvm\/etc\/openvas\/openvas.conf<\/code><\/pre>\n\n\n\n
usermod -aG redis gvm<\/code><\/pre>\n\n\n\n
echo \"net.core.somaxconn = 1024\" >> \/etc\/sysctl.conf<\/code><\/pre>\n\n\n\n
echo 'vm.overcommit_memory = 1' >> \/etc\/sysctl.conf<\/code><\/pre>\n\n\n\n
sysctl -p<\/code><\/pre>\n\n\n\n
vim \/etc\/systemd\/system\/disable_thp.service<\/code><\/pre>\n\n\n\n
[Unit]\nDescription=Disable Kernel Support for Transparent Huge Pages (THP)\n\n[Service]\nType=simple\nExecStart=\/bin\/sh -c \"echo 'never' > \/sys\/kernel\/mm\/transparent_hugepage\/enabled && echo 'never' > \/sys\/kernel\/mm\/transparent_hugepage\/defrag\"\n\n[Install]\nWantedBy=multi-user.target<\/code><\/pre>\n\n\n\n
systemctl daemon-reload<\/code><\/pre>\n\n\n\n
systemctl enable --now disable_thp<\/code><\/pre>\n\n\n\n
systemctl enable --now redis-server@openvas<\/code><\/pre>\n\n\n\n
openvas<\/code> is launched from an
ospd-openvas<\/code> process, via sudo, add the line below to sudoers file to ensure that the
gvm<\/code> user used in this demo can run the openvas with elevated rights using passwordless sudo.<\/p>\n\n\n\n
echo \"gvm ALL = NOPASSWD: \/opt\/gvm\/sbin\/openvas\" > \/etc\/sudoers.d\/gvm<\/code><\/pre>\n\n\n\n
secure_path<\/strong><\/code> to include the GVM
\/sbin<\/code> paths,
\/opt\/gvm\/sbin<\/strong><\/code>.<\/p>\n\n\n\n
visudo<\/code><\/pre>\n\n\n\n
Defaults secure_path=\"\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/bin:\/snap\/bin:\/opt\/gvm\/sbin<\/strong>\"<\/code><\/pre>\n\n\n\n
gvm<\/code> user to run GSA web application daemon,
gsad<\/code>, with passwordless sudo.<\/p>\n\n\n\n
echo \"gvm ALL = NOPASSWD: \/opt\/gvm\/sbin\/gsad\" >> \/etc\/sudoers.d\/gvm<\/code><\/pre>\n\n\n\n
Update NVTs<\/h4>\n\n\n\n
greenbone-nvt-sync<\/code> command.<\/p>\n\n\n\n
greenbone-nvt-sync<\/code> command must not<\/strong> be executed as privileged user root, hence switch back to GVM user we created above and update the NVTs.<\/p>\n\n\n\n
su - gvm<\/code><\/pre>\n\n\n\n
greenbone-nvt-sync<\/code><\/pre>\n\n\n\n
sudo openvas --update-vt-info<\/code><\/pre>\n\n\n\n
Build and Install Greenbone Vulnerability Manager<\/a><\/h4>\n\n\n\n
export PKG_CONFIG_PATH=\/opt\/gvm\/lib\/pkgconfig:$PKG_CONFIG_PATH<\/code><\/pre>\n\n\n\n
cd \/tmp\/gvm-source\/gvmd\nmkdir build\ncd build\ncmake .. -DCMAKE_INSTALL_PREFIX=\/opt\/gvm\nmake\nmake install<\/code><\/pre>\n\n\n\n
Build and Install Greenbone Security Assistant<\/a><\/h4>\n\n\n\n
cd ..\/..\/gsa\nmkdir build\ncd build\ncmake .. -DCMAKE_INSTALL_PREFIX=\/opt\/gvm\nmake\nmake install<\/code><\/pre>\n\n\n\n
greenbone-scapdata-sync\ngreenbone-certdata-sync<\/code><\/pre>\n\n\n\n
man gvm-manage-certs<\/strong><\/code>.<\/p>\n\n\n\n
gvm-manage-certs -a<\/code><\/pre>\n\n\n\n
Build and Install OSPd and OSPd-OpenVAS<\/a><\/h4>\n\n\n\n
export PKG_CONFIG_PATH=\/opt\/gvm\/lib\/pkgconfig:$PKG_CONFIG_PATH<\/code><\/pre>\n\n\n\n
mkdir -p \/opt\/gvm\/lib\/python3.8\/site-packages\/\nexport PYTHONPATH=\/opt\/gvm\/lib\/python3.8\/site-packages\ncd \/tmp\/gvm-source\/ospd\npython3 setup.py install --prefix=\/opt\/gvm<\/code><\/pre>\n\n\n\n