Configure https traffic on GSA

[jozb]

I have internal PKI deployed which gives me private key with certificate.

I need to know how can I configure to use https on this platform

[Eero]

@jozb for example you can use nginx as ssl proxy

see my other message for nginx example

Fail to start gvmd service

I follow this guide https://greenbone.github.io/docs/latest/22.4/source-build/index.html to install into Ubuntu 22.04. But during the process the command to start the gvmd service failed with the below error Aug 12 08:13:11 openvas systemd[1]: gvmd.service: Can’t open PID file /run/gvmd/gvmd.pid (yet?) after start: Operation not permitted Aug 12 08:14:41 openvas systemd[1]: gvmd.service: start operation timed out. Terminating. Aug 12 08:14:41 openvas systemd[1]: gvmd.service: Failed with res…

Eero

[joebeasley]

You need to modify the startup script to use SSL.

[Eero]

@joebeasley its easier to use nginx as ssl reverse proxy

https://raw.githubusercontent.com/EeroV/openvas-gvm/main/files/default

Eero

[joebeasley]

@Eero The question asked how to enable SSL. That is the question I answered. I did not assume the OP knew how to use nginx.

[jozb]

@joebeasley , You helped me. Thanks so much… good explanation through the video. I will be happy to see more configs to the channel. Thanks Again

[cfi]

For the records there are also various existing topics in this portal on how to configure SSL/TLS in gsad:

Secure Frontend Webinterface (GSAD) with Let's Encrypt SSL/HTTPS certificate

Sorry but this is not helping at all, you need to supply the Let´s encrypt certificates direct to the GSAd and you can spare the complete NGINX and SystemD voodoo. Please keep it stupid and simple. Just supply GSAD with the Let´s encrypt private Key and Certificate that´s it. -k, --ssl-private-key= Use as the private key for HTTPS -c, --ssl-certificate= Use as the certificate for HTTPS In many cased it would be: “/etc/letsencrypt/live//cert.pem” for the certificate “-c…

SSL Certificates not working

I’m trying to put my owns ssl certificates at the web interface but its not working. I’m using this commands before reboot: gsad --ssl-certificate=/pathtomy/file.crt gsad --ssl-private-key=/pathtomy/file.key I tryed using gsad -c and gsad -k too. When I enter at https://localhost:443 the certificate is the same it doesn’t change. What is happening? Thanks!!

The relevant command line parameters which needs to be passed to gsad when starting it up (e.g. in the related systemd file) are:

  -k, --ssl-private-key=<file>           Use <file> as the private key for HTTPS
  -c, --ssl-certificate=<file>           Use <file> as the certificate for HTTPS

[v3rtx]

@joebeasley

You need to modify the startup script to use SSL.

Hi @joebeasley I really appreciate your guide. I followed it step by step (after generating key, csr and cert), but the gsad service seems it don’t want to run. I have self-signed cert. I have following logs in /var/log:

gsad main:MESSAGE:2022-08-23 12h28.44 utc:1591243: Starting GSAD version 22.04.0
gsad main:CRITICAL:2022-08-23 12h28.44 utc:1591244: main: start_https_daemon failed!

My /etc/systemd/system/gsad.service looks like that:

[Unit]
Description=Greenbone Security Assistant daemon (gsad)
Documentation=man:gsad(8) https://www.greenbone.net
After=network.target gvmd.service
Wants=gvmd.service

[Service]
Type=forking
User=gvm 
Group=gvm 
RuntimeDirectory=gsad 
RuntimeDirectoryMode=2775 
PIDFile=/run/gsad/gsad.pid
ExecStart=/usr/local/sbin/gsad --listen=0.0.0.0 --port=9392 --no-redirect --ssl-private-key=/etc/gvm/fd.key --ssl-certificate=/etc/gvm/fd.crt
Restart=always 
TimeoutStopSec=10 

[Install] 
WantedBy=multi-user.target 
Alias=greenbone-security-assistant.service

Please provide me with some help here, it would be great:)

[joebeasley]

Stop gsad. "systemctl stop gsad.

Make sure gvm has access to gsad.pid.

Make sure gvm has access to the SSL cert files.

Run “systemctl daemon-reload” after making changes to gsad.service.

Start gsad. “systemctl start gsad”.

[v3rtx]

I’ve done that, unfortunately it doesn’t work:(

[joebeasley]

More logging info needed.

Try running your start line from the command line. It should give more output.

user@host: sudo -u gvm /usr/local/sbin/gsad --listen=0.0.0.0 --port=9392 --no-redirect --ssl-private-key=/etc/gvm/fd.key --ssl-certificate=/etc/gvm/fd.crt

** Also check the logs in /var/log/gvm

[v3rtx]

It looks like that:

In the /var/log/gvm:

gsad main:MESSAGE:2022-08-24 09h09.10 utc:1648913: Starting GSAD version 22.04.0
gsad main:CRITICAL:2022-08-24 09h09.10 utc:1648914: main: Could not write PID file.

Uhm, I don’t know why privileges are not alright here…

[bricks]

If you start gsad manually and not via systemd you need to ensure that /run/gsad (for releases >= 21.4.4) exists and has the required permissions.

[v3rtx]

@bricks

/run/gsad

Well, I don’t have such dir:

xzy@OV:/var/log/gvm$ cd /run/gsad
-bash: cd: /run/gsad: No such file or directory

Do I have to create one?

[Eero]

@v3rtx yes.

Eero

[jozb]

@v3rtx Check my config and I managed to have https, try to compare with what you have and change it as I have to see If you will resolve the issue.

[v3rtx]

@bricks @Eero now I have the right dir and privileges, but gsad with the https config is not working

- @jozb

[Eero]

@v3rtx well. I prefer nginx as ssl proxy…

Eero

[v3rtx]

well I think I’ll better do that

[Eero]

@v3rtx as Nginx is very simple as ssl reverse proxy. It just works.

Eero