Trying out GVM10-beta1 on Ubuntu 18.04 "instructions"

falk · October 9, 2018, 8:01pm

Hi,

I tried out and did a write-up of what I did when installing GVM10-beta1.
Pretty straight forward like the “old” OpenVas9

If someone is interested here are the little howto.
https://sadsloth.net/post/install-gvm10beta1/

This will be a (planned as) ongoing test with more of the packages installed from src…

–
Regards Falk

bricks · October 10, 2018, 6:09am

Thanks for sharing I am curious did you found any pros, cons, obstacles, cool new stuff, … in the new version?

Btw. when using Ubuntu 18.04 you don’t need to add the nodesource apt repo. Ubuntu 18.04 already provides an up to date nodejs version https://packages.ubuntu.com/bionic/nodejs Just run apt install nodejs

falk · October 10, 2018, 6:39am

Hi,

gvmd and openvassd seems more streamlined than “before”.
But I haven’t really done any large jobs yet.

And thanks for the node heads up. I am so used to add nodesource when using 16.04 so I didn’t even try

I’m really interested to see what the postgre things in 10 could give us.

So hopefully that will be a task for today

–
Regards Falk

cfi · October 10, 2018, 7:42am

Really great, thanks for posting this howto.

Related to the redis config you could also have a look at the following documentation:

github.com

greenbone/openvas-scanner/blob/v6.0+beta1/doc/redis_config.txt

= Redis KB server =

== Presentation ==
Redis (http://redis.io) is used to store and access the KB. Scans won't run if
they cannot access the server and might be significantly slowed down if redis is
not properly configured.

The feature has been developed with neither cluster mode nor replication
enabled. Redis 2.4 and 2.6 are supported. Versions 2.6 and higher are
recommended.


== Connection ==
OpenVAS can currently only access redis via a unix socket. This choice has been
made for the sake of speed and security. No authentication is supported yet, we
rely on filesystem permissions to protect the KBs.

The path to the unix socket is '/tmp/redis.sock' by default, and can be changed
using the 'kb_location' parameter.

This file has been truncated. show original

as well as the related OpenVAS/GVM changes to the redis configs shown here:

falk · October 10, 2018, 3:15pm

Thanks for the diskussion and tips!

I have updated the page.
Nothing fancy with startup daemons and such…

Something seems strange with the installation thou.
I’m going to run some tests and try get some debug logging going.

The scan “stalls” at 1% and nothing seems to happen after that.
The only thing that happens is that openvassd is going 100% on one core with:
openvassd: Serving /usr/local/var/run/openvassd.sock

And redis-monitor shows this.

1539184255.542899 [2 unix:/var/run/redis/redis-server.sock] "PING"
1539184255.543086 [2 unix:/var/run/redis/redis-server.sock] "FLUSHDB"
1539184255.543218 [2 unix:/var/run/redis/redis-server.sock] "SELECT" "0"
1539184255.543341 [0 unix:/var/run/redis/redis-server.sock] "HDEL" "GVM.__GlobalDBIndex" "2"
1539184255.543548 [0 unix:/var/run/redis/redis-server.sock] "HEXISTS" "GVM.__GlobalDBIndex" "1"
1539184255.543675 [0 unix:/var/run/redis/redis-server.sock] "SELECT" "1"
1539184255.543788 [1 unix:/var/run/redis/redis-server.sock] "SRANDMEMBER" "nvticache10"
1539184258.544853 [0 unix:/var/run/redis/redis-server.sock] "HSETNX" "GVM.__GlobalDBIndex" "1" "1"
1539184258.545147 [0 unix:/var/run/redis/redis-server.sock] "HSETNX" "GVM.__GlobalDBIndex" "2" "1"
1539184258.545307 [0 unix:/var/run/redis/redis-server.sock] "SELECT" "2"
1539184258.545469 [2 unix:/var/run/redis/redis-server.sock] "PING"

And for the moment I can’t find log_whole_attack in the scan config,
So this will be continued

–
Regards Falk

falk · October 10, 2018, 3:49pm

Updates before changing location

The openvassd seems to freeze after a few seconds.

Two tries and the last non redis log in openvassd.log:

sd main:MESSAGE:2018-10-10 15h44.28 utc:23843: Plugin 2009/secpod_ms_directx_code_exec_vuln.nasl is deprecated. It will neither loaded nor launched.

And a strace on the running task openvassd stops on both tries:

write(3, “*2\r\n$11\r\nSRANDMEMBER\r\n$33\r\nfilen”…, 62) = 62
read(3, “$28\r\n1.3.6.1.4.1.25623.1.0.90001”…, 16384) = 35

–
Regards Falk

cfi · October 11, 2018, 6:21am

Hi,

seems there where no new beta releases in between which includes the fix discussed e.g. here: Community feed unusable - Greenbone Community Edition - Greenbone Community Forum or in various other threads.

The log_whole_attack isn’t available anymore from within a scan config since version 5.1.2 of the scanner:

The preference log_whole_attack is now an scanner-only preference.

Release OpenVAS Scanner v5.1.2 · greenbone/openvas-scanner · GitHub

falk · October 11, 2018, 12:02pm

Aah, now I remembered that one…
I looked in the commit to see if I could merge it, but the 6.x branch seems to be lots of refactoring.
And that really above my c++ knowledge to make anything out of it

I’ll wait for the next beta and continue then

Is this now a “global config setting” in openvassd.conf?

–
Regards Falk

cfi · October 11, 2018, 1:50pm

Not exactly

It was always a “global config setting” within the openvassd.conf but was provided (probably accidentally) on a per scan config base due to a typo within the code base: