001. OpenVAS 5 Installation on CentOS 6.2

Disclaimer: The following information is provided with no representation or warranty of any kind either express or implied. You may use it freely at your own risk, and no one else will be liable for any damages arising out of such usage.

OS: CentOS 6.2 32bit
Hardware: Virtual Machine (VirtualBox 4.1.14)
OpenVAS: 5

About

OpenVAS is an opensource vulnerability network scanner. OpenVAS let you scan your network for vulnerabilities and create a report on your network status.

Prerequisite

• Disable SELINUX

vi /etc/selinux/config

...
SELINUX=disabled
...

• Install wget

yum install wget -y

• Update your Operating System and reboot

yum update -y 
reboot

OpenVAS Installation

• Install atomic repository

wget -q -O - http://www.atomicorp.com/installers/atomic |sh

Atomic Archive installer, version 2.0.3

BY INSTALLING THIS SOFTWARE AND BY USING ANY AND ALL SOFTWARE
PROVIDED BY ATOMICORP LIMITED YOU ACKNOWLEDGE AND AGREE:

THIS SOFTWARE AND ALL SOFTWARE PROVIDED IN THIS REPOSITORY IS
PROVIDED BY ATOMICORP LIMITED AS IS, IS UNSUPPORTED AND ANY
EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ATOMICORP LIMITED, THE
COPYRIGHT OWNER OR ANY CONTRIBUTOR TO ANY AND ALL SOFTWARE PROVIDED
BY OR PUBLISHED IN THIS REPOSITORY BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
OF THE POSSIBILITY OF SUCH DAMAGE.

Do you agree to these terms? (yes/no) [Default: yes]
ENTER

Installing the Atomic GPG key: OK
Downloading atomic-release-1.0-14.el6.art.noarch.rpm: OK

The Atomic Rocket Turtle archive has now been installed and configured for your system
The following channels are available:
  atomic          - [ACTIVATED] - contains the stable tree of ART packages
  atomic-testing  - [DISABLED]  - contains the testing tree of ART packages
  atomic-bleeding - [DISABLED]  - contains the development tree of ART packages

• Install OpenVAS

yum install openvas -y

• Run openvas-setup to configure OpenVAS

openvas-setup

Openvas Setup, Version: 0.1

Step 1: Update NVT's
Please note this step could take some time.
Once completed, NVT's will be updated automatically every 24 hours

Updating NVTs....
Stopping openvas-scanner:                                  [  OK  ]
Starting openvas-scanner:
                                                           [  OK  ]
Updating OpenVAS Manager database....

Step 2: Configure GSAD
The Greenbone Security Assistant is a Web Based front end
for managing scans. By default it is configured to only allow
connections from localhost.

Allow connections from any IP? [Default: yes] Stopping gree[  OK  ]curity-assistant:
Starting greenbone-security-assistant:                     [  OK  ]

Step 3: Choose the GSAD admin users password.
The admin user is used to configure accounts,
Update NVT's manually, and manage roles.

Enter password: enter password for admin user
ENTER

ad   main:MESSAGE:3223:2012-01-19 11h09.05 IST: No rules file provided, the new user will have no restrictions.
ad   main:MESSAGE:3223:2012-01-19 11h09.05 IST: User admin has been successfully created.

Step 4: Create a user

Using /var/tmp as a temporary file holder.

Add a new openvassd user
---------------------------------

Login : humus
ENTER

Authentication (pass/cert) [pass] :
ENTER

Login password : enter user password
ENTER

Login password (again) : enter user password again
ENTER

User rules
---------------
openvassd has a rules system which allows you to restrict the hosts that humus has the right to test.
For instance, you may want him to be able to scan his own host only.

Please see the openvas-adduser(8) man page for the rules syntax.

Enter the rules for this user, and hit ctrl-D once you are done:
(the user can have an empty rules set)
ctrl-D

Login             : humus
Password          : ***********

Rules             :

Is that ok? (y/n) [y]
ENTER

Setup complete, you can now access GSAD at:

https://:9392

• Start OpenVAS administrator

/etc/init.d/openvas-administrator start

• Download openvas-check-setup script and check OpenVAS setup

cd /usr/local/src/
wget https://svn.wald.intevation.org/svn/openvas/trunk/tools/openvas-check-setup -O openvas-check-setup.sh --no-check-certificate
chmod +x openvas-check-setup.sh
./openvas-check-setup.sh --server

• Open Greenbone Security Assistent port in linux firewall

vi /etc/sysconfig/iptables

...
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 9392 -j ACCEPT  
...

service iptables restart

• Connect to OpenVAS server
  • Using a web browser browse to https://openvas_server_IP:9392

That’s it. OpenVAS server installation completed. You can create new scans on your network and schdule them to run frequently and check their reports.

For more information on OpenVAS visit http://www.openvas.org