SUSE & openSUSE

OpenVAS, Open Vulnerability Assessment Server is a free opensource  vulnerability assessment software released under GNU GPL lincese. OpenVAS is a fork of Nessus Vulnerability assessment software. Similar to the Plugin sets in Nessus, OpenVAS provides free Network Vulnerability Tests plugins that can be updated regularly.

OpenVAS needs for components installed on the server end namely

OpenVAS-Server: Core component of OpenVAS, which contains the functionality used for scanning a large number of target servers at a high speed.

OpenVAS-Libraries: This module contains functionality used by OpenVAS-Server.

OpenVAS-LibNASL: The NVTs are written in the “Nessus Attack Scripting Language” (NASL). This module contains the functionality needed by OpenVAS-Server to interface with NASL.

OpenVAS-Plugins: This module contains a base set of NVTs.

and then there is a OpenVAS Client to access the Open VAS server and run the scans.

The latest versions of OpenVAS do not have packages for any Linux Distribution. However, the previous versions of all the above components have the RPMs for openSuSE 10.2. I have to choose to use the source for the latest versions to install OpenVAS on my openSUSE 11.0

Install Pre-Requisites

Before we proceed to install the OpenVAS server, lets install the pre-requisites to successfully compile the OpenVAS Server components.

opensuse11:~ # yast2 -i gnutls libgnutls-devel pcap libpcap-devel bison gtk2-devel

Install OpenVAS Libraries

Download OpenVAS Libraries as follows

opensuse11:~ # wget http://wald.intevation.org/frs/download.php/467/openvas-libraries-1.0.2.tar.gz

Uncompress and untar the downloaded files

opensuse11:~ # tar -zxvf openvas-libraries-1.0.2.tar.gz

Change directory, compile and install OpenVAS Libraries

opensuse11:~ # cd openvas-libraries-1.0.2

opensuse11:/openvas-libraries-1.0.2 # ./configure && make

opensuse11:/openvas-libraries-1.0.2 # make all

Add /usr/local/lib to /etc/ld.so.conf

opensuse11:/openvas-libraries-1.0.2 # vi /etc/ld.so.conf

and add the following line if it doesn’t exist

/usr/local/lib

Run ldconfig

opensuse11:/openvas-libraries-1.0.2 # ldconfig

This should install the OpenVAS libraries on your system.

Install OpenVAS libNASL

Download OpenVAS Libraries as follows

opensuse11:~ # wget http://wald.intevation.org/frs/download.php/468/openvas-libnasl-1.0.1.tar.gz

Uncompress and untar the downloaded files

opensuse11:~ # tar -zxvf openvas-libnasl-1.0.1.tar.gz

Change directory, compile and install OpenVAS Libraries

opensuse11:~ # cd openvas-libnasl-1.0.1

opensuse11:/openvas-libnasl-1.0.1 # ./configure && make

opensuse11:/openvas-libnasl-1.0.1 # make all

This installs libNASL on openSUSE.

Download and Install OpenVAS Server

The latest version of OpenVAS Server available for download has a problem with adding users to the system and this is fixed in the newer version on SVN. Hence, here we use the version from SVN instead of using the stable version available from download:

If you do not already have SVN installed, install as follows:

opensuse11:~ # yast2 -i subversion

Download the latest version from the SVN as follows:

opensuse11:~ # svn checkout https://svn.wald.intevation.org/svn/openvas/trunk/openvas-server

This downloads the files to openvas-server under the current directory. Change to the directory compile and install as follows

opensuse11:~ # cd openvas-server

opensuse11:/openvas-server # ./configure && make

opensuse11:/openvas-server # make install

That installs OpenVAS Server.

Download & Install OpenVAS Plugins

opensuse11:~ # wget http://wald.intevation.org/frs/download.php/464/openvas-plugins-1.0.2.tar.gz

Uncompress and untar the downloaded files

opensuse11:~ # tar -zxvf openvas-plugins-1.0.2.tar.gz

Change directory, compile and install OpenVAS Libraries

opensuse11:~ # cd openvas-plugins-1.0.2

opensuse11:/openvas-plugins-1.0.2 # ./configure && make

opensuse11:/openvas-plugins-1.0.2 # make all

That downloads and installs the latest plugins on your openSUSE.

Create OpenVAS SSL Certifcate

Create a OpenVAS Server SSL certifcate as follows:

opensuse11:~ # openvas-mkcert
——————————————————————————-
Creation of the OpenVAS SSL Certificate
——————————————————————————-

This script will now ask you the relevant information to create the SSL certificate of OpenVAS.
Note that this information will *NOT* be sent to anybody (everything stays local), but anyone with the ability to connect to your OpenVAS daemon will be able to retrieve this information.

CA certificate life time in days [1460]:
Server certificate life time in days [365]:
Your country (two letter code) [FR]: GB
Your state or province name [none]: London
Your location (e.g. town) [Paris]: London
Your organization [OpenVAS Users United]: SuseGeek

——————————————————————————-
Creation of the OpenVAS SSL Certificate
——————————————————————————-

Congratulations. Your server certificate was properly created.

/usr/local/etc/openvas/openvasd.conf updated
The following files were created:

. Certification authority:
Certificate = /usr/local/com/openvas/CA/cacert.pem
Private key = /usr/local/var/lib/openvas/CA/cakey.pem

. OpenVAS Server :
Certificate = /usr/local/com/openvas/CA/servercert.pem
Private key = /usr/local/var/lib/openvas/CA/serverkey.pem

Press [ENTER] to exit

Add user to OpenVAS Server

To add a OpenVAS server

opensuse11:~ # openvas-adduser
Using /var/tmp as a temporary file holder.

Add a new openvasd user
———————————
Login : openvasadmin
Authentication (pass/cert) [pass] :
Login password :
Login password (again) :

User rules
—————
openvasd has a rules system which allows you to restrict the hosts that openvsduser has the right to test.
For instance, you may want him to be able to scan his own host only.

Please see the openvas-adduser(8) man page for the rules syntax.

Enter the rules for this user, and hit ctrl-D once you are done:
(the user can have an empty rules set)

Login             : openvasadmin
Password          : ***********

Rules             :

Is that ok? (y/n) [y] y
user added.

To remove a user at a later time use,

opensuse11:~ # openvas-rmuser <username>

Update the Network Vulnerability Test plugins

opensuse11:~ # openvas-nvt-sync

This syncs the NVT plugins to the latest on OpenVAS.

That’s all done.

Start OpenVAS Server

To start the OpenVAS server

opensuse11:~ # openvasd -D

To check if OpenVAS server is running

opensuse11:/usr/local # ps -ef | grep openvas
root     13519     1  0 20:26 ?        00:00:00 openvasd: serving 127.0.0.1
root     15002     1  0 20:42 ?        00:00:00 openvasd: waiting for incoming connections

The OpenVAS server starts and runs listening on TCP port 1241.

Install the OpenVAS Client

opensuse11:~ # wget http://wald.intevation.org/frs/download.php/466/openvas-client-1.0.4.tar.gz

Uncompress and untar the downloaded files

opensuse11:~ # tar -zxvf openvas-client-1.0.4.tar.gz

Change directory, compile and install OpenVAS Libraries

opensuse11:~ # cd openvas-client-1.0.4

opensuse11:/openvas-client-1.0.4 # ./configure && make

opensuse11:/openvas-client-1.0.4 # make all

This installs the OpenVAS Client under /usr/local/bin/.

To start the OpenVAS Client,

opensuse11:~ # OpenVAS-Client &

This launches the GUI. From File menu click Connect or use the “Connect” icon to connect to the server.
Enter the username and password that we just created to logon to the OpenVAS Server. Thats it you are logged.

Select or unselect your required plugins and click File – “Scan Assistant”. This will walk you through a small wizard to scan a target network or IP Addres s or a host (localhost here).

Once the scan is complete, checkout the report and you can see whats OpenVAS has found for you. You can use this client to connect to Nessus server as well.

Some useful paths and files:

Binaries

/usr/local/bin
/usr/local/sbin

Configs

/usr/local/etc/openvas

PIDs and logs

/usr/local/var

User accounts

/var/lib/openvas

A great tool and great alternative for the well known Nessus Vulnerability Assesment Scanner. To visit the homepage of OpenVAS, click here