guess it will not be possible to ask ISP - they do not know this.
I will try again tomorrow and send my v6IP via PN if this is O.K. for you.
Regarding NAT - i am using this since years / decades and never had such problems. But - in IT “never” is only true until sommething happens the first time
guess i will give up now.
I was told that my system is resetting the connection - (i do believe this due the log entry shown) my system (wireshark) is telling me the opposite.
Also - even the trial VM is unable to synch the feed…
Next i tried with a different access (normal is vodafone and zyxel, tryout was telekom and huawei) - still no persistent thread update.
sometimes the nvt’s worked but the system stopped the next step.
So i am not only confused but also at the end of what i could try.
here’s the result of my findings:
The idea that it is a problem with rsync and old bug can not be true as it does not work with the appliance.
The hardware and provider should not be the problem - i tested two different combinations.
My firwall can not be the cause - i tested directly behind the router.
IPv4 / NAT - i tested with IPv6 also without getting a solution.
I do know that it worked fine without problems in the previous version. The problems started after the update to the latest release
So all i can try is to install the previous release.
On the other hand it is still strange, that so many other people do have problems with the feed update …
so here’s my last try before giving up.
I made a fresh install of kali 2021.2 as predefined VM.
After “apt update && apt full-upgrade” i installed sudo apt install openvas gvm following this guideline: https://www.ntbrad.com/2020/12/08/kali-and-openvas-gvm-setup/
had a small problem with postgresql due to “locales” that was fixed soon. postgresql 13 was default and the only one installed.
Next was gvm-setup with this result:
└─$ sudo gvm-setup 1 ⨯
Creating openvas-scanner’s certificate files
[>] Creating database
CREATE ROLE
GRANT ROLE
CREATE EXTENSION
CREATE EXTENSION
[>] Migrating database
[>] Checking for admin user
[] Creating user admin for gvm
[] Please note the generated admin password
[] User created with password ‘xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx’.
[] Define Feed Import Owner
[>] Updating OpenVAS feeds
[*] Updating: NVT
At this point the system hang without any action.
So after some time i made a reboot and tried again. Still the same “hang” at the same position.
use iftop to check if there’s any action on the network but - nothing.
So to all using kali and having the same problems - i did not find any solution for this problem.
I just checked we had last day 340.000 feed syncs, so there must be something wrong at the infrastructure or your ISP. I suggest you contact your support and ask about CGN and real IPs ?
If its working for you, that’s awesome. The reason we’ve raised the issue is that its not working for us, could we possibly address that? I’m just not sure I’ll get anywhere by raising it with my ISP
Got the following error:
*] Updating NVT (Network Vulnerability Tests feed from Greenbone Security Feed/Community Feed)
rsync: [Receiver] failed to connect to feed.community.greenbone.net (45.135.106.143): Connection timed out (110)
rsync: [Receiver] failed to connect to feed.community.greenbone.net (2a0e:6b40:20:106:20c:29ff:fe7f:d2ae): Connection timed out (110)
rsync error: error in socket IO (code 10) at clientserver.c(137) [Receiver=3.2.3]
That is the address that was taking an error. I just commented out the /etc/hosts entry and reran the update and it worked this time. Mostly like that server is getting overloaded. Thanks for the insight.
That is for the power abusive user, if we got more then 10 connections from the same IP within 1 minute, they have to wait 24h. One IP parallel as well. That will prevent scans, internet scam, brute force on ssh as well abuse of our public feed services.
Here our block rule to be as transparent as possibe:
[..]
set denylist {
type ipv4_addr
size 65535
flags dynamic,timeout
timeout 1d
elements = {
[..]
ip protocol tcp ct state new,untracked limit rate over 10/minute add @denylist { ip saddr }
ip saddr @denylist drop
tcp dport 873 meter rsync1 size 65535 { ip saddr & 255.255.255.0 ct count over 3 } counter packets 0 bytes 0 reject with tcp reset
tcp dport 873 meter rsync2 size 65535 { ip saddr ct count over 1 } counter packets 1 bytes 64 reject with tcp reset
tcp dport 873 tcp flags syn / fin,syn,rst,ack counter packets 2792 bytes 165204 accept
That is good to know. I will have to let the students in my class know that the install may fail occasionally and they’ll have to keep trying the gvm-feed-update until it eventually works as was the case this morning.
