Exploring the OpenVAS vulnerability scanner
Scan Free
If you prefer to travel light and free, try OpenVAS, a GPLed fork of the Nessus scanning tool.
The Internet has become more dangerous over the years, with constantly changing threats and ever more sophisticated attackers. As have most security professionals, we have seen all manner of clever schemes designed to part businesses from their money and data. To help discover and manage threats, we rely heavily on free software tools. One of the most popular security tools is the Nessus vulnerability scanner by Tenable Network Security [1], which many have used to look for vulnerabilities on customer networks.
The decision by Tenable to change the licensing for commercial use was viewed with frustration by a number of security professionals. Prompted by the final announcement on Slashdot in October 2005 that Nessus would be closed source, Tim Brown made the decision to announce a fork. The result of that effort is OpenVAS [2], a free software fork of the Nessus vulnerability scanner predominantly licensed under the GPL.
At this time, OpenVAS has a thriving community, with contributions from both individuals and corporations from all over the world. The OpenVAS project is a member of Software in the Public Interest, a non-profit organization dedicated to helping organizations develop free software. A recent successful developers conference had 16 participants from four continents, and we have more than 13,000 vulnerability checks committed to our public SVN repository.
In this article, we describe the OpenVAS project and show how to use it to assess your network security systems.
OpenVAS Architecture
As with Nessus, OpenVAS follows a client-server model. A server component is responsible for scheduling and running scans, and a client component is used to configure scans and access the results. The server is normally installed on a Linux or Unix server, and the client is typically run from the administrator's own workstation. Currently, the client must be connected to the server for the entire duration of the scan; however, some of the developers are currently working on a new component that will support much more RESTful interfaces.
The Internet Assigned Numbers Authority officially assigned OpenVAS TCP port 9390. OpenVAS is a security-conscious project, and the connection to this port from an OpenVAS Client is always tunneled over SSL with strong ciphers to ensure that only the intended user can access the data generated by OpenVAS.
Advanced Plugin Preferences
In the Advanced Plugin Preferences area, additional parameters can be passed to modules that were configured earlier. For example, you can activate fragmented packets, NULL scans, and many other Nmap-specific parameters if Nmap is selected as the port scanner. Generally speaking, if additional configuration is necessary for any specific module of OpenVAS, the Advanced Plugin Preferences section is the place to seek answers.
Installation
OpenVAS is available in binary package form for most major Linux distributions, and you can get it from third-party repositories or obtain it directly from the OpenVAS website.
Some Linux distributions ship incompatible versions of the server and client. Version 1 clients are not compatible with version 2 servers. Keep this in mind when installing from your standard Linux distribution repository.
If you would prefer to compile the code yourself, you will find the source code at the OpenVAS website [2] – either in standard tarball form or via anonymous SVN. Compiling is not difficult, but you must compile the openvas-libraries module first. Be sure to meet the following dependencies when compiling: gpgme-devel, gcrypt-devel, gnutls-devel, glib2, glib2-devel, glib2-data, and Gtk+ 2.x (for the Gtk client).
The next step is to add the first OpenVAS user. The OpenVAS server implements user accounts independently of the operating system. (LDAP support is planned for a future version.) To add a user, simply run the openvas-useradd script
# openvas-adduser johndoe
and you will be prompted for rules to supply with the user information. These rules let you specify which nodes an OpenVAS user can and cannot scan. This feature protects some sensitive systems from being scanned without proper supervision.
The rules syntax is
accept|deny ip/mask default accept/deny
as in:
accept 192.168.1.0/24 default deny
The preceding rules allow the user to scan all systems in the 192.168.1.0 network but deny access to any other network. User settings are stored in the /var/lib/openvas/users/ directory.
Getting Started
As you will learn later in this article, OpenVAS uses plugins to define scanning scenarios. To update the plugins, simply run the following command:
# openvas-nvt-sync
If you run this command regularly, your plugins remain up to date. Without up-to-date plugins, the scanner will miss new vulnerabilities. After you run openvas-nvt-sync, restart the server.
If you installed from a binary package, use the service command to start the server. If you installed from source, start the server by typing:
PATH_TO_SERVER/openvasd -D
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
Canonical Bumps LTS Support to 12 years
If you're worried that your Ubuntu LTS release won't be supported long enough to last, Canonical has a surprise for you in the form of 12 years of security coverage.
-
Fedora 40 Beta Released Soon
With the official release of Fedora 40 coming in April, it's almost time to download the beta and see what's new.
-
New Pentesting Distribution to Compete with Kali Linux
SnoopGod is now available for your testing needs
-
Juno Computers Launches Another Linux Laptop
If you're looking for a powerhouse laptop that runs Ubuntu, the Juno Computers Neptune 17 v6 should be on your radar.
-
ZorinOS 17.1 Released, Includes Improved Windows App Support
If you need or desire to run Windows applications on Linux, there's one distribution intent on making that easier for you and its new release further improves that feature.
-
Linux Market Share Surpasses 4% for the First Time
Look out Windows and macOS, Linux is on the rise and has even topped ChromeOS to become the fourth most widely used OS around the globe.
-
KDE’s Plasma 6 Officially Available
KDE’s Plasma 6.0 "Megarelease" has happened, and it's brimming with new features, polish, and performance.
-
Latest Version of Tails Unleashed
Tails 6.0 is based on Debian 12 and includes GNOME 43.
-
KDE Announces New Slimbook V with Plenty of Power and KDE’s Plasma 6
If you're a fan of KDE Plasma, you'll be thrilled to hear they've announced a new Slimbook with an AMD CPU and the latest version of KDE Plasma desktop.
-
Monthly Sponsorship Includes Early Access to elementary OS 8
If you want to get a glimpse of what's in the pipeline for elementary OS 8, just set up a monthly sponsorship to help fund its continued existence.