OpenVAS Vulnerability Scanning Basic tutorial Connection OpenVAS Service

OpenVAS Vulnerability Scanning Basics Tutorial Connection OpenVAS Service Connection OpenVAS Service

When the user installs and configures the OpenVAS tool, the user can connect to the server using a different client. Then, a vulnerability scan is implemented on the target host. In this tutorial, you will connect to the OpenVAS service using the simplest browser client. Because it is not only easy to use this method, but users can connect to the server in any system. If you use other methods, you need to install the OpenVAS client program separately on the client. This section describes the ways to connect and manage OpenVAS services.

Start the OpenVAS service

Because the OpenVAS is based on the C/s (client/server), b/S (browser/server) architecture to work. Therefore, if you want to use the tool, you must start the OpenVAS service before the client can connect and use. The following describes how to start the OpenVAS service.

1. Start the service

Typically, after the plug-in is updated, several programs corresponding to the OpenVAS service are started. Therefore, the user can use the netstat command to see if the service has started before starting the service. By default, the OpenVAS service listens on 9390, 9391, and 93,923 ports. Therefore, the user can execute the following command:

• [Email protected]:~# netstat-antp | grep 939*
• Active Internet connections (servers and established)
• Proto recv-q send-q Local address Foreign address State Pid/program Name
• TCP 0 0 127.0.0.1:9390 0.0.0.0:* LISTEN 24705/openvasmd
• TCP 0 0 127.0.0.1:9391 0.0.0.0:* LISTEN 24690/openvassd:wa
• TCP 0 0 127.0.0.1:9392 0.0.0.0:* LISTEN 24718/gsad

From the output information, you can see that the three ports beginning with 939 have been monitored, and the host address of the listener is 127.0.0.1. This means that the OpenVAS service is started and allows only the local loopback address 127.0.0.1 access. If you do not see the above information output, it indicates that the service did not start. At this point, the user can start the service using the Openvas-start command, as follows:

• [Email protected]:~# Openvas-start
• Starting OpenVas Services
• Starting Greenbone Security Assistant:gsad.
• Starting OpenVAS SCANNER:OPENVASSD.
• Starting OpenVAS Manager:openvasmd.

Seeing the above information indicates that the OpenVAS service started successfully. If the OpenVAS service is already started, an error will occur when executing the above command. As shown below:

• Starting OpenVas Services
• Starting Greenbone Security Assistant:error.
• Starting OpenVAS Scanner:error.
• Starting OpenVAS Manager:error.

From the output information, you can see that the three programs for the OpenVAS service are displayed as error (errors).

2. Stop the Service

When a user modifies some configurations, it is often necessary to restart the service for the configuration to take effect. Therefore, before restarting the service, the service must first be stopped before it can be restarted. To stop the OpenVAS service, execute the command as follows:

• [Email protected]:~# openvas-stop
• Stopping OpenVas Services
• Stopping Greenbone Security Assistant:gsad.
• Stopping OpenVAS SCANNER:OPENVASSD.
• Stopping OpenVAS manager:openvasmd.

From the output information, you can see that the OpenVAS related services have been stopped. Then execute the openvas-start command to restart the OpenVAS service.

Tip: Use the openvas-stop or Openvas-start command to stop or start three programs in the OpenVAS service at the same time, namely Greenbone Security Assistant, OpenVAS scanner, and OpenVAS Manager. If a user wants to start or stop a single service, it can be implemented using the service command. Where the syntax format is as follows:

• Service [name] Start|stop

Among them, the above three programs respectively corresponding service name is Greenbone-security-assistant, Openvas-scanner and Openvas-manager.

OpenVAS Connection Service

When the OpenVAS service is successfully started, the user can connect to the service and scan it. According to the previous introduction, users know that OpenVAS has three different client programs, namely the OpenVAS command line interface, the Greenbone installation assistant, and the Greenbone desktop suite. Also, the client can be used with any operating system. In Kali Linux, the Greenbone installation Assistant is installed by default. Therefore, the user can connect to the OpenVAS service through the browser in any operating system. The methods for connecting services are described below.

1. Set the address of the OpenVAS server

OpenVAS service in the default configuration, only the 127.0.0.1 (local loopback address) is allowed to connect to the service. That is, other clients cannot log on. If the user wants another client to log on, the Gsa_address configuration item in the OpenVAS configuration file needs to be modified. Where the OpenVAS service's master profile is saved by default in/etc/default/greenbone-security-assistant. Open the file with the VI editor and see the contents of the Gsa_address configuration entry as follows:

• [Email protected]:~# vi/etc/default/greenbone-security-assistant
• gsa_address=127.0.0.1

At this point, the user only need to change 127.0.0.1 to the address of the native Ethernet interface. For example, the Ethernet interface address for this machine is 192.168.1.108, then the content of the modification is as follows:

• gsa_address=192.168.1.108

After you modify the above, save and exit the configuration. Then, restart the OpenVAS service for the configuration to take effect.

Some of the default settings for the OpenVAS service are set in the Greenbone-security-assistant file, such as the default port, address, certificate, and so on. Here are a few additional configuration items, as follows:

• gsa_port=9392 #GSA默认监听的端口
• #GSA_SSL_PRIVATE_KEY = #指定GSA私钥文件
• #GSA_SSL_CERTIFICATE = #指定GSA证书
• #GSA_REDIRECT =1 #设置HTTP重定向
• #GSA_REDIRECT_PORT =9394 #GSA重定向监听的端口
• manager_address=127.0.0.1 #OpenVAS管理服务默认监听的地址
• MANAGER_PORT=9390 # OpenVAS Management Service default listener port

The above is an introduction to several configuration items. Where the configuration item is preceded by a "#" sign, it means that the configuration item is disabled. If the user needs to set these configuration items, remove the "#" symbol. Also, the user can reset the new address or port.

2. Connecting the OpenVAS server

"Example 1-2" connects the OpenVAS service. The procedure is as follows:

(1) Enter the Https://IP address in the browser's address bar: 9392/address, you can log into the OpenVAS server. The IP address here is the address specified by the Gsa_address configuration entry, and 9392 refers to the port that the OpenVAS service listens to by default, which is the value of the Gsa_port configuration item. If the user is set to a different port, the address entered here is the port specified by the user. Upon successful login, the connection is not trusted interface, 1.2 is shown.

Note: When you connect the OpenVAS service, you are using HTTPS instead of HTTP when you enter the address.

Figure 1.2 Untrusted Links

(2) This interface shows that the connection accessed in the browser is not trusted. This is because the connection uses the HTTPS protocol and does not have the correct certificate provided. In the interface click the I understand the risks command, the interface shown in 1.3 will be displayed.

(3) The interface prompts for the risk of access to the connection. If you are sure that the connection to the access is not a problem, click the Add Exception button to add the exception, as shown in 1.4.

Figure 1.3 Risk information Figure 1.4 Adding an exception

(4) The interface shows the connection information to which you want to add an exception. At this point, click the Confirm Security execption (Confirm safety Exception) button to confirm that you want to trust the connection. After the connection is trusted, the interface shown in 1.5 is displayed.

Figure 1.5 OpenVAS Login Interface

(5) The interface is the login interface of the OpenVAS service, and the user name and password can be entered in the interface to log into the service. The username here is the Admin user that was created automatically when OpenVAS was previously configured, with a password of 123456. After entering your user name and password, click the login button to log in to the OpenVAS service. After the service is successfully logged in, the interface shown in 1.6 will be displayed.

Figure 1.6 OpenVAS Main interface

Tip: From this interface you can see that the content displayed is in English. This is because the Kali Linux system is an English version of the system. If the user is using a Chinese version of the system (such as Windows 7, Android devices, etc.), the content displayed after landing is Chinese.

(6) If you see the content displayed in this interface, you have successfully signed in to the OpenVAS service.

Note: When you restart the system, you will need to restart the service if you want to use the OpenVAS tool. Otherwise, you cannot log on to the server. If an error occurs when the service is started, it is good to resynchronize the database with the Openvas-setup command, and the related services are started automatically.

This article is selected from: OpenVAS Vulnerability Scanning Basic Tutorial University bully internal information, reproduced please indicate the source, respect the technology respect it people!

OpenVAS Vulnerability Scanning Basic tutorial Connection OpenVAS Service