Hello, I would like to report that on Kali Linux, yesterday’s update of the greenbone-security-assistant package to version 28.3.0-0kali1 causes issues with accessing the web interface, resulting in an “unable to connect to server” error. Downgrading to version 26.17.0-0kali1 restores normal functionality; therefore, there is an issue with the 28.3.0-0kali1 package that requires a fix. Best regards.
2 Likes
Hello,
the Kali packages are not provided / maintained by Greenbone so you usually would need to raise an issue with the Kali packaging team here:
@kapa works for me; anyway latest kali is using
dpkg -l | grep -i greenbone-security-assistant
ii greenbone-security-assistant 26.17.0-0kali1 all remote network security auditor - web interface
apt-cache madison greenbone-security-assistant
greenbone-security-assistant | 26.17.0-0kali1 | mirror+file:/etc/apt/mirrors/kali.list kali-last-snapshot/non-free amd64 Packages
apt list -a greenbone-security-assistant
greenbone-security-assistant/kali-last-snapshot,now 26.17.0-0kali1 all [installed,automatic]
version that you mentioned is not even available?
Eero
1 Like
Following yesterday’s downgrade, this is the situation this morning:
dpkg -l | grep -i greenbone-security-assistant
ii greenbone-security-assistant 26.17.0-0kali1 all remote network security auditor - web interface
apt-cache madison greenbone-security-assistant
greenbone-security-assistant | 28.3.0-0kali1 | Index of / kali-rolling/non-free amd64 Packages
apt list -a greenbone-security-assistant
greenbone-security-assistant/kali-rolling 28.3.0-0kali1 all [upgradable from: 26.17.0-0kali1]
greenbone-security-assistant/now 26.17.0-0kali1 all [installed,upgradable to: 28.3.0-0kali1]
apticron tells me this morning that these upgrades are available:
greenbone-feed-sync 25.5.0-1
greenbone-security-assistant 28.3.0-0kali1
openvas-scanner 23.51.0+ds-1
ospd-openvas 22.10.6-1
I’m not sure if performing these upgrades will cause the GSA/GSD web interface to crash again. Do you have any suggestions on how to proceed? Should I put these 4 packages Kali updates on “hold” until the issue is resolved? Thanks for any helpful advice.
@kapa well. just report bug to kali bug tracker and put hold. trying to reproduce issue..
Eero
report to bug tracker Kali done. thanx
@kapa please add this description:
greenbone-security-assistant 28.3.0-0kali1 allows an incompatible gsad version, causing login to fail with HTTP 404
Summary
Upgrading greenbone-security-assistant from 26.17.0-0kali1 to 28.3.0-0kali1 breaks web login when the installed server reports gsad 24.16.0~git.
The newer frontend uses POST /login, which this older gsad does not implement. The request returns HTTP 404, displayed as “Could not connect to server.”
The frontend package does not declare a minimum gsad version, allowing this incompatible combination.
Environment
-
Installation method: Kali Linux packages
-
Working frontend:
greenbone-security-assistant 26.17.0-0kali1 -
Failing frontend:
greenbone-security-assistant 28.3.0-0kali1 -
Server runtime version:
gsad 24.16.0~git -
Manager socket:
/run/gvmd/gvmd.sock -
gsad process user/group:
_gvm:_gvm
Steps to reproduce
-
Run gsad 24.16.0 with a working gvmd connection and valid credentials.
-
Confirm web login works with
greenbone-security-assistant 26.17.0-0kali1. -
Install
greenbone-security-assistant 28.3.0-0kali1, retaining the same gsad version. -
Load the updated frontend and attempt to sign in.
-
Inspect the browser’s network requests.
Actual result
The UI displays “Could not connect to server.”
Observed responses:
| Request | Status |
|---|---|
POST /login |
404 |
| undefined | ---- |
GET /gmp?cmd=get_settings |
401 |
| undefined | ---- |
The unauthorized response contains:
<message>Token missing or bad. Please login again.</message>
A response also sets GSAD_SID=0, clearing the session cookie.
Using frontend version 26.17.0-0kali1 restores working login.
Expected result
Installing or upgrading the frontend should enforce compatibility with a locally installed gsad. An incompatible combination should require a server upgrade or be rejected by the package manager.
Diagnostics
gvmd is listening on its socket, and communication as _gvm succeeds:
sudo -u _gvm gvm-cli socket \
--socketpath /run/gvmd/gvmd.sock \
--xml '<get_version/>'
After entering the credentials:
<get_version_response status="200" status_text="OK"><version>22.7</version></get_version_response>
Here, 22.7 is the GMP protocol version.
Source analysis
Both Kali source packages were downloaded, their archive SHA-256 checksums verified against their .dsc files, and their authentication code and packaging compared.
Login endpoint changed
In src/gmp/commands/login.ts:
-
26.17.0: sends credentials to
/gmpwithcmd=login. -
28.3.0: sends credentials directly to
/login.
The change is in GSA commit 7b7514e. Its commit message explicitly requires the server changes in gsad PR #403.
In gsad 24.16.0, src/gsad_http_handle_request.c has no POST authentication handler for /login; unmatched POST requests return 404. The frontend maps this status to the displayed connection error.
Additional compatibility requirement
The newer frontend also expects session duration information rather than the older absolute session-expiry timestamp.
The GSA 28.0.0 release notes explicitly require gsad >= 27.0.0.
Missing package relationship
In both Kali source versions, debian/control declares:
Depends: ${misc:Depends}
There is no versioned dependency or incompatibility declaration covering gsad.
Suggested fix
Add an appropriate versioned package relationship enforcing compatibility with gsad >= 27.0.0 for GSA 28.x.
Depending on whether the frontend package is intended to support installations without a local gsad, this could be a versioned dependency or a Breaks relationship against older gsad packages.
Workaround
Keep greenbone-security-assistant 26.17.0-0kali1 with the existing server, or upgrade gsad and its required dependencies to versions compatible with GSA 28.3.0.
Ok, Thanks
I would suggest to keep the discussion at the Kali bug tracker as it was confirmed that this is an issue in the Kali packaging only (due to incompatible new and older versions of different components packages):
my unofficial fixes: netseevol/openvas-gsad-fixes-kali
Eero
Many thanx 
@kapa test or wait official fix. report me back, if this works.
Eero
Given how critical our use case is, I’d prefer to wait for the official fix. If I can, I’ll test your fix on another host over the next few days and let you know if it works. Thanks for the support.
Thanks, downgrading greenbone-security-assistant package to 26.17.0-0kali1 resolved issue.
1 Like
@kapa works on my machine.
Eero
@kapa Because Kali packages seem to break on a regular basis, I’ll probably need to start maintaining my own packages. On the upside, that would also allow me to use newer versions much sooner.
Eero
tahnxs for your help/support
As far as I can tell, the OpenVAS packages in Kali have only one maintainer, and they seem to make their way into the distribution with minimal testing.
Eero
Yeah, unfortunately, there have been some issues with updates in the past. Let’s hope that doesn’t happen in the future!