netizensoc/openvas-scanner repository overview

Visit our Website: https://www.netizen.net⁠

⁠Remote OpenVAS Docker Image

⁠Latest Version: 23.35.3

This docker container is designed for use with our GVM docker image located here: GVM-Docker⁠. The remote scanner doesn't contain any web front. It has been designed as a remote scanner that is controlled by a Master GVM Docker Container. The image uses the latest version of OpenVAS and GVM. Netizen continues to make improvements to the software for the stability and functionality of the suite. This container supports AMD 64-bit and ARM 64-bit Linux-based operating systems and Docker Desktop for Windows using WSL 2

⁠Table of Contents

• Requirements⁠
• Linux Installation Instructions⁠
• Windows Installation Instruction⁠
• Upgrade Instructions⁠
• Docker Tags⁠
• Estimated Hardware Requirements⁠
• About⁠

⁠Requirements

• The GVM Docker Container (Master System) has the SSHD option set to true.
• The proper communication port for SSH (default port 2222) is open for access.
• The IP address of the GVM Controller.

If one of the first two requirements above is missing, you will need to follow the installation instructions in the GVM-Docker⁠ to enable remote scanner management. To get your IP address on the Master Scanner, type "ip addr" in the command line or terminal.

⁠Installation Instructions

⁠Docker System Installation (Linux AMD/ARM 64-bit Only)

1. Install the required packages, docker, and docker-compose on your Linux system.

sudo apt update
sudo apt install -y apt-transport-https ca-certificates curl software-properties-common docker.io docker-compose-v2

1. Create a directory and download the docker-compose.yml file from GitHub. ${USER} is the username of the user(s).

mkdir /home/$USER/docker/gvm-docker
cd /home/$USER/docker/gvm-docker
wget https://raw.githubusercontent.com/NetizenCorp/OpenVAS-Docker/main/docker-compose.yml

1. Modify the docker-compose.yml file using your preferred editor (nano or vim)

nano docker-compose.yml

1. Edit the yml file with your preferences.

services:
    gvm:
        image: netizensoc/openvas-scanner:[latest|dev|dev-arm] # PICK A VERSION AND REMOVE BRACKETS BEFORE COMPOSING. Latest is the stable image. Dev is the development image for AMD64 Systems. Dev-Arm is the development image for ARM64 Systems.
        volumes:
          - scanner:/data               # DO NOT MODIFY unless establishing the external docker drive
        environment:
          - MASTER_ADDRESS=[Enter IP]   # IP or Hostname of the GVM Master container. REMOVE BRACKETS BEFORE COMPOSING.
          - MASTER_PORT=2222            # SSH server port from the GVM container. Make sure the port matches the GVM master port that was configured.
        restart: unless-stopped # Remove if you're using it for penetration testing or one-time scans. Only use if using for production/continuous scanning
	 	hostname: ospd-openvas.local
        cap_add:
          - NET_ADMIN # for capturing packages in promiscuous mode
          - NET_RAW # for raw sockets e.g. used for the boreas alive detection
        security_opt:
          - seccomp=unconfined
          - apparmor=unconfined
        logging:
          driver: "json-file"
          options:
            max-size: "1k"
            max-file: "3"
volumes:
    scanner:

1. Next, it's time to stand up the docker image using docker-compose.

sudo docker compose up -d # The -d option is for a detached docker image

1. Watch the scanner logs for the "Scanner id" and Public key Note: this assumes you've named your container "scanner"

sudo docker container ls # Lists the current containers running on the system. Look under the Names column for the container name. Ex: gvm-docker_gvm_1
sudo docker logs -f [OpenVAS container name]

Example output:

-------------------------------------------------------
Scanner id: df5tt4csny
Public key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPbE8p5zxOoPFPDiE9BCxcRd1jCVaRfOO92BO5hIfdqi df5cy5csnp
Master host key (Check that it matches the public key from the master): [192.168.1.150]:2222 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5A55AIMHHl4neiOBuBfCPQtJp/WQuyb6xVIrgmVp3U/A7qmev
-------------------------------------------------------

1. On the host with the GVM server container, run the following command:

docker exec -it [GVM Container Name] /add-scanner.sh

This will prompt you for your scanner name, "Scanner id", and Public Key

Scanner Name: This can be anything you want

Scanner ID: generated id from remote openvas scanner Scanner

public key: private key from scanner

You will receive a confirmation that the scanner has been added

1. Login to the GVM server web interface and navigate to Configuration -> Scanners to see the scanner you just added.

2. You can click the shield icon next to the scanner to verify the scanner connectivity. If it says Scanner Unavailable, restart the OpenVAS remote docker container with the following command:

sudo docker container restart [OpenVAS container name]

⁠Docker System Installation (Windows WSL2 AMD 64-bit Only)

1. Install Docker Desktop for Windows and the required packages for docker, docker-compose, and WSL 2 on your Windows system. You can download the application at https://www.docker.com/products/docker-desktop/⁠

2. Follow the usual installation instructions to install Docker Desktop. Depending on which version of Windows you are using, Docker Desktop may prompt you to turn on WSL 2 during installation. Read the information displayed on the screen and turn on the WSL 2 feature to continue.

3. After installing Docker Desktop and before activating WSL2, you must create a .wslconfig file under your C:\Users<Username>\ directory or modify the existing file with the text below. Please configure the file based on your system specs or VM requirements.

# Settings apply across all Linux distros running on WSL 2
[wsl2]

# Limits VM memory to use no more than 4 GB, this can be set as whole numbers using GB or MB
memory=4GB 

# Sets the VM to use two virtual processors
processors=2

# Network Setting
networkingMode=mirrored

# Specify a custom Linux kernel to use with your installed distros. The default kernel used can be found at https://github.com/microsoft/WSL2-Linux-Kernel
# kernel=C:\\temp\\myCustomKernel

# Sets additional kernel parameters, in this case enabling older Linux base images such as Centos 6
# kernelCommandLine = vsyscall=emulate

# Sets amount of swap storage space to 8GB, default is 25% of available RAM
swap=8GB

# Sets swapfile path location, default is %USERPROFILE%\AppData\Local\Temp\swap.vhdx
swapfile=C:\\temp\\wsl-swap.vhdx

# Disable page reporting so WSL retains all allocated memory claimed from Windows and releases none back when free
pageReporting=false

# Turn on default connection to bind WSL 2 localhost to Windows localhost. Setting is ignored when networkingMode=mirrored
localhostforwarding=true

# Disables nested virtualization
nestedVirtualization=false

# Turns on output console showing contents of dmesg when opening a WSL 2 distro for debugging
debugConsole=true

# Enable experimental features
[experimental]
sparseVhd=true

1. Start Docker Desktop from the Windows Start menu.

2. Navigate to Settings.

3. From the General tab, select Use WSL 2 based engine..

4. If you have installed Docker Desktop on a system that supports WSL 2, this option is turned on by default.

5. Select Apply & Restart.

6. Create a directory under your Documents folder and name it whatever you like.

7. Navigate to https://github.com/NetizenCorp/OpenVAS-Docker/blob/main/docker-compose.yml⁠ and download the docker-compose.yml raw file from GitHub. After downloading it, copy it into the directory you created in the Documents folder.

8. Next, you will modify the docker-compose.yml file using your preferred editor (NotePad, NotePad++, etc).

Edit and save the yml file with your preferences. NOTE: Netizen is not responsible for any breach if the user fails to change the default username and passwords. Make sure to store your passwords in a secure password manager.

services:
    gvm:
        image: netizensoc/openvas-scanner:[latest|dev|dev-arm] # PICK A VERSION AND REMOVE BRACKETS BEFORE COMPOSING. Latest is the stable image. Dev is the development image for AMD64 Systems. Dev-Arm is the development image for ARM64 Systems.
        volumes:
          - scanner:/data               # DO NOT MODIFY unless establishing the external docker drive
        environment:
          - MASTER_ADDRESS=[Enter IP]   # IP or Hostname of the GVM Master container. REMOVE BRACKETS BEFORE COMPOSING.
          - MASTER_PORT=2222            # SSH server port from the GVM container. Make sure the port matches the GVM master port that was configured.
        restart: unless-stopped # Remove if you're using it for penetration testing or one-time scans. Only use if using for production/continuous scanning
		hostname: ospd-openvas.local
        cap_add:
          - NET_ADMIN # for capturing packages in promiscuous mode
          - NET_RAW # for raw sockets e.g. used for the boreas alive detection
        security_opt:
          - seccomp=unconfined
          - apparmor=unconfined
        logging:
          driver: "json-file"
          options:
            max-size: "1k"
            max-file: "3"
volumes:
    scanner:

1. It's time to stand up the docker image using docker-compose. Open your command prompt, navigate to the directory with the docker-compose.yml file, and type the following to create/execute the image.

docker compose up -d # The -d option is for a detached docker image

1. Watch the scanner logs for the "Scanner id" and Public key Note: this assumes you've named your container "scanner"

docker container ls # Lists the current containers running on the system. Look under the Names column for the container name. Ex: gvm-docker_gvm_1
docker logs -f [OpenVAS container name]

Example output:

-------------------------------------------------------
Scanner id: df5tt4csny
Public key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPbE8p5zxOoPFPDiE9BCxcRd1jCVaRfOO92BO5hIfdqi df5cy5csnp
Master host key (Check that it matches the public key from the master): [192.168.1.150]:2222 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5A55AIMHHl4neiOBuBfCPQtJp/WQuyb6xVIrgmVp3U/A7qmev
-------------------------------------------------------

1. On the host with the GVM server container, run the following command:

docker exec -it [GVM container name] /add-scanner.sh

This will prompt you for your scanner name, "Scanner id", and Public Key

Scanner Name: This can be anything you want

Scanner ID: generated id from remote openvas scanner Scanner

public key: private key from scanner

You will receive a confirmation that the scanner has been added

1. Login to the GVM server web interface and navigate to Configuration -> Scanners to see the scanner you just added.

2. You can click the shield icon next to the scanner to verify the scanner connectivity. If it says Scanner Unavailable, restart the OpenVAS remote docker container with the following command:

docker container restart [OpenVAS container name]

⁠Upgrade Instructions (REMINDER: Always backup or take a snapshot of your data before executing the upgrade.)

1. Run the following commands to backup the scanner keys and known host files into the data drive.

sudo docker exec -it [container name] bash
mkdir /data/ssh/
cp -R /var/lib/gvm/.ssh/* /data/ssh/
cp /var/lib/gvm/.scannerid /data/scannerid

1. Verify that all the data exists and matches between locations. Once verified, exit the container.
2. Stop the container without deleting it

sudo docker-compose stop 

OR (if using docker compose V2)

sudo docker compose stop

1. Once Stopped, make a backup of your docker-compose.yml file and then pull the latest docker compose YAML file and update with your credentials from the backup file with your preferred editor.

cp docker-compose.yml docker-compose.yml.bk
wget https://raw.githubusercontent.com/NetizenCorp/OpenVAS-Docker/main/docker-compose.yml
nano docker-compose.yml

1. Once stopped, pull the latest image of GVM

sudo docker pull netizensoc/openvas-scanner:latest

1. For those updating from versions prior to 23.2.1, you will need to modify the YAML file to make the drive external. This will preserve the drive and prevent accidental deletion. You will need to get the name of the volume and modify the name of the volume in the YAML file. If you are upgrading from version 23.2.1 or later, you can skip to step 8.

sudo docker volume ls

Copy the volume name that is outputted and put it into the YAML file in each location the volume is referenced

DRIVER    VOLUME NAME
local     scanner

1. Open the YAML file to update the configuration and volume name that was copied. Verify everything is correct and pointing to the correct volume before executing.

### Update this section at the bottom of the file. Ensure that you updated the volume name near the top of the yaml file.
volumes:
    scanner:
	name: scanner # ADD THIS LINE
	external: true # ADD THIS LINE

1. Next, stand up the docker container to update the image.

sudo docker compose up -d

1. Once the image is up and running (all NVT's loaded), verify you have connectivity in the Master Scanner by clicking the Sheild under the Scanners page. Note if unable to connect you may need to reboot the master scanner and remote scanner images.

⁠Docker Tags

⁠Estimated Hardware Requirements

⁠About

Any Issues or Suggestions for the Project can be communicated via the issues⁠. Thanks.