Openvas: di ubuntu - Revision history

Onnowpurbo: /* Step 3: Install OpenVAS */

2018-05-17T23:02:26Z

Step 3: Install OpenVAS

← Older revision		Revision as of 23:02, 17 May 2018
Line 39:		Line 39:
	sudo systemctl start openvas-manager		sudo systemctl start openvas-manager
	sudo systemctl start openvas-gsa		sudo systemctl start openvas-gsa

			Men-stop dengan perintah

			sudo systemctl stop openvas-scanner
			sudo systemctl stop openvas-manager
			sudo systemctl stop openvas-gsa

	==Step 4: Buka Firewall==		==Step 4: Buka Firewall==

Onnowpurbo: /* Step 3: Install OpenVAS */

2018-05-17T22:48:19Z

Step 3: Install OpenVAS

← Older revision		Revision as of 22:48, 17 May 2018
Line 31:		Line 31:
	sudo add-apt-repository ppa:mrazavi/openvas		sudo add-apt-repository ppa:mrazavi/openvas
	sudo apt update		sudo apt update
	sudo apt install openvas		sudo apt -y install openvas

	Setelah OpenVAS di instalasi.		Setelah OpenVAS di instalasi.

Onnowpurbo: /* Step 5: Access OpenVAS web interface */

2018-05-17T22:46:55Z

Step 5: Access OpenVAS web interface

← Older revision		Revision as of 22:46, 17 May 2018
Line 46:		Line 46:
	sudo ufw allow https		sudo ufw allow https

	==Step 5: ~~Access~~ OpenVAS ~~web interface~~==		==Step 5: Akses OpenVAS Web Interface==

	~~Before accessing OpenVAS~~, ~~you will need to~~ update ~~its~~ vulnerability ~~database.~~		Sebelum di akses, update vulnerability

	sudo openvas-nvt-sync		sudo openvas-nvt-sync

	~~Once the~~ database ~~is up~~-~~to-date~~, ~~open your web~~ browser ~~and type the URL https://192.168.15.110/. On the login page, provide the default username (admin) and password (admin). After logging in, you will be presented with the OpenVAS dashboard.~~		Setelah database ter-update, buka browser ke

	~~If you want to change the~~ admin ~~user's~~ password ~~from command line~~, ~~run the following command:~~		https://ip-address-server-openvas/

			Default username & password

			admin
			admin

			Untuk mengubah username & password,

	sudo openvasmd --user=admin --new-password=<new-password>		sudo openvasmd --user=admin --new-password=<new-password>

	~~Congratulations! You have successfully installed OpenVAS on your Ubuntu 16.04 server.~~

Onnowpurbo: /* Step 4: Allow OpenVAS through the system firewall */

2018-05-17T22:44:38Z

Step 4: Allow OpenVAS through the system firewall

← Older revision		Revision as of 22:44, 17 May 2018
Line 40:		Line 40:
	sudo systemctl start openvas-gsa		sudo systemctl start openvas-gsa

	==Step 4: ~~Allow OpenVAS through the system firewall~~==		==Step 4: Buka Firewall==

	~~By default, OpenVAS runs on~~ port 443~~, so you will need to allow this port through the UFW firewall.~~		Jika dibutuhkan buka firewall UFW melalui port 443

	sudo ufw allow https		sudo ufw allow https

Onnowpurbo at 22:42, 17 May 2018

2018-05-17T22:42:58Z

← Older revision		Revision as of 22:42, 17 May 2018
Line 10:		Line 10:
	* Server memiliki rsync		* Server memiliki rsync

	==Step 1: Update ~~the system~~==		==Step 1: Update System==

	~~First, update your~~ system ~~to the latest stable version by running the following commands:~~		Update system

	sudo apt~~-get~~ update -y		sudo apt update -y
	sudo apt-get upgrade -y		sudo apt-get upgrade -y
	sudo reboot		sudo reboot

	==Step 2: Install ~~required dependencies~~==		==Step 2: Install dependency==

	~~Before installing OpenVAS, you will need to install its required dependencies. To install them, run the following command:~~		Install

	sudo apt~~-get~~ install python-software-properties		sudo apt install python-software-properties sqlite3

	~~Next, you will also need to install SQLite for OpenVAS manager:~~

	~~sudo apt-get install~~ sqlite3


	==Step 3: Install OpenVAS==		==Step 3: Install OpenVAS==

	~~By default, the OpenVAS package is not available in the Ubuntu 16.04 repository, so you will need to add OpenVAS PPA to your system's repository list.~~		Tambahkan OpenVAS PPA & install openvas

	~~Add the~~ OpenVAS PPA.

	sudo add-apt-repository ppa:mrazavi/openvas		sudo add-apt-repository ppa:mrazavi/openvas
	sudo apt~~-get~~ update		sudo apt update
			sudo apt install openvas
	~~Finally, install OpenVAS.~~

	sudo apt~~-get~~ install openvas

	~~Once~~ OpenVAS ~~has finished installing, start the~~ OpenVAS ~~service with the following commands~~:		Setelah OpenVAS di instalasi.
			Jalankan OpenVAS menggunakan perintah:

	sudo systemctl start openvas-scanner		sudo systemctl start openvas-scanner

Onnowpurbo at 22:39, 17 May 2018

2018-05-17T22:39:40Z

← Older revision		Revision as of 22:39, 17 May 2018
Line 1:		Line 1:
	~~==Introduction==~~		OpenVAS adalah open source suite yang dapat digunakan untuk men-scan kerentanan dan manajemen kerentanan. OpenVAS adalah singkatan dari Open Vulnerability Assessment System. OpenVAS adalah alternatif yang sangat baik bagi pen-scan keamanan komersial seperti Nessus, QualysGuard, dll. OpenVAS dibagi menjadi tiga bagian: OpenVAS Scanner, OpenVAS Manager, dan OpenVAS CLI.

	OpenVAS ~~is an open source suite that can be used for vulnerability scanning and vulnerability management. It stands for Open~~ Vulnerability ~~Assessment System~~. ~~OpenVAS is an excellent alternative to commercial security scanners such as Nessus, QualysGuard, etc. OpenVAS is divided into three parts: OpenVAS Scanner, OpenVAS Manager, and OpenVAS CLI~~.		Disini akan di perlihatkan cara instalasi OpenVAS Vulnerability Scanner di Ubuntu 16.04.

	~~In this tutorial, I will explain how to install OpenVAS Vulnerability Scanner on Ubuntu 16.04.~~		==Prasyarat==

	~~==Prerequisites==~~		* Ubuntu Server 16.04 kosong.
			* User di server tersebut dengan kemampuan sudo.
	* ~~A newly deployed Vultr~~ Ubuntu 16.04 ~~server instance~~.		* Server memiliki IP statik.
	* ~~A non-root user with~~ sudo ~~privileges setup on your server~~.		* Server memiliki rsync
	* ~~A static~~ IP ~~address of 192.168.15.110 configured on your system~~.
	* ~~The~~ rsync ~~package must be installed~~

	==Step 1: Update the system==		==Step 1: Update the system==

Onnowpurbo at 22:17, 17 May 2018

2018-05-17T22:17:40Z

Show changes

Onnowpurbo at 12:24, 15 February 2017

2017-02-15T12:24:58Z

Show changes

Onnowpurbo: Created page with "How To Use OpenVAS to Audit the Security of Remote Systems on Ubuntu 12.04 PostedJanuary 27, 2014 134.1k views Security Ubuntu Introduction An important aspect of server secu..."

2017-02-15T12:23:09Z

Created page with "How To Use OpenVAS to Audit the Security of Remote Systems on Ubuntu 12.04 PostedJanuary 27, 2014 134.1k views Security Ubuntu Introduction An important aspect of server secu..."

New page

How To Use OpenVAS to Audit the Security of Remote Systems on Ubuntu 12.04
PostedJanuary 27, 2014 134.1k views Security Ubuntu
Introduction

An important aspect of server security is being proactive about security screening. If you expose any services to the internet, penetration testing is essential to ensure that you are not vulnerable to known threats.

The Open Vulnerability Assessment System, known more commonly as OpenVAS, is a suite of tools that work together to run tests against client computers using a database of known exploits and weaknesses. The goal is to learn about how well your servers are guarded against known attack vectors.

In this guide, we will install the OpenVAS suite on an Ubuntu 12.04 VPS. We can then use this system to scan itself and other servers.
Add the OpenVAS PPA and Install Software

Although there are some OpenVAS components in Ubuntu's default repositories, we will use a PPA that maintains updated versions of the packages.

To begin with, we need to install the python-software-properties package, which will allow us to work with PPAs easily.

sudo apt-get update
sudo apt-get install python-software-properties

We can then add the newest stable version to our system:

sudo add-apt-repository ppa:openvas/openvas6

We need to rebuild the apt database to gather information about the packages available through our new PPA. Afterwards, we can install the needed software:

sudo apt-get update
sudo apt-get install openvas-manager openvas-scanner openvas-administrator openvas-cli greenbone-security-assistant sqlite3 xsltproc texlive-latex-base texlive-latex-extra texlive-latex-recommended htmldoc alien rpm nsis fakeroot

This will download and install the components that are necessary to get us started.
Initial Configuration

We can create SSL certificates for OpenVAS using a wrapper utility that is included by default. We need to call this with administrative privileges so that it can be placed in a restricted portion of the file system.

sudo openvas-mkcert

You will be asked a number of questions that will help you build a certificate file for use with this server.

Most of the questions, you can just type ENTER to accept the default values. This is mainly for your own use, so input the values you would like to use.

Next, we will create another certificate. This time, we will create a client certificate for a user named "om" this stands for OpenVAS Manager. We don't need any specific information for the client portion, so we will tell it to configure things automatically and install the certificates in the needed places:

sudo openvas-mkcert-client -n om -i

Build the Database Information

Now that we have our certificates installed, we can begin building our database so that our local tools are aware of different kinds of threats and vulnerabilities.

Update the network vulnerability tests database by issuing this command:

sudo openvas-nvt-sync

This will download the latest definitions to your local machine.

To continue we'll need to stop the manager and scanner applications so that we can call the commands without a conflict momentarily.

Stop both of these services by typing:

sudo service openvas-manager stop
sudo service openvas-scanner stop

Now, we can start the scanner application without the parameters found in the init file that are usually called. During this first run, OpenVAS will need to download and sync a lot of data. This will take quite awhile:

sudo openvassd

Once this is finished, you'll have to rebuild the database generated by the scanner by typing:

sudo openvasmd --rebuild

Next, we will download and update our security content automation protocol data. This is known as "SCAP" data. This is another database that OpenVAS checks against for our security tests.

sudo openvas-scapdata-sync

This will be another long wait. It downloads some general files and then updates them in the database.

We will then run a similar sync operation for the cert data:

sudo openvas-certdata-sync

Running this command for the first time, you might see some errors. They may look something like this:

Error: no such table: meta

This is because the Ubuntu package is actually missing some files that are packaged in some other versions.

We can get these from an RPM package for the manager component. Type this to download it to your home directory:

cd
wget http://www6.atomicorp.com/channels/atomic/fedora/18/i386/RPMS/openvas-manager-4.0.2-11.fc18.art.i686.rpm

Now that we have the file downloaded, we can extract and expand the directory structure present within the RPM. We can do this by typing:

rpm2cpio openvas* | cpio -div

We will create a directory for our new files in a place where OpenVAS will find them. We will then move the files into that directory:

sudo mkdir /usr/share/openvas/cert
sudo cp ./usr/share/openvas/cert/* /usr/share/openvas/cert

Now, we can safely run the cert syncing command again, and it should complete as expected this time:

sudo openvas-certdata-sync

Afterwards, we can delete the extracted RPM data and directories from our home directory:

rm -rf ~/openvas* ~/usr ~/etc

Set Up OpenVAS User and Ports

To sign into our service, we will need a user. We can create one with the OpenVAS administrator component.

Here, we will create a user called "admin" with the role of administrator. You will be asked to provide a password to use for the new account:

sudo openvasad -c add_user -n admin -r Admin

You will be informed that the user has been granted unlimited access.

Next, we need to change the way one of our components starts up. The Greenbone Security Assistant component is a web-based interface to the tools we have installed.

By default, the interface is only accessible from the local computer. Since we are installing the OpenVAS suite on a remote server, we won't be able to access the web interface with these settings. We need to make it accessible from the internet.

Open the following file with root privileges in your preferred text editor:

sudo nano /etc/default/greenbone-security-assistant

Near the top, you should see a parameter that specifies the address that the web interface will listen on. We need to change the value from 127.0.0.1 to the public IP address of your VPS. This will let it listen to connections from the internet, and we will be able to connect:

GSA_ADDRESS=your_server_IP_address

Save and close the file when you have made the above modification.
Start Up the Services

We will now start up the services that we have been configuring. Most of them are already running in some capacity, but we will have to restart them to make sure that they use the new information we have been gathering.

Start by killing all of the running OpenVAS scanner processes:

sudo killall openvassd

It can take up to 15 or 20 seconds for the process to actually be killed. You can check if there are processes still running by issuing:

ps aux | grep openvassd | grep -v grep

If anything is returned, then your processes have not finished yet and you should continue to wait.

Once the process exits completely, you can begin starting all of your services again:

sudo service openvas-scanner start
sudo service openvas-manager start
sudo service openvas-administrator restart
sudo service greenbone-security-assistant restart

Each of these may take a bit of time to start up.
Access the Web Interface and Run Some Tests

Once the services have all started, you use your web browser to access the Greenbone Security Assistant web interface.

To access this, you must precede the address of your server with https://. You then enter either the domain name or IP address of your server followed by :9392.

https://server_domain_or_IP:9392

You will be presented with a scary looking warning screen telling you that the certificate is not signed by someone that your browser trusts by default:

OpenVAS security warning

This is expected and not a problem. You should click on the "Proceed anyway" button to continue.

Next, you will be presented with the login screen:

OpenVAS login screen

You will need to enter the username and password you configured earlier. For this guide, the username was "admin".

Once you sign in, you will be immediately greeted by a quick start wizard, which will allow you to run a default scan against a target computer right away:

OpenVAS startup wizard

A good choice is to run against another server that you own. It is important to not run these scans against targets that are not under your control, because they may look like potential attacks to other users.

Enter the IP address of the computer you wish to test against and click the "Start Scan" button to begin.

The page will update as the scan progresses and you can also refresh the page manually to track the progress:

OpenVAS scan progress

When the scan is complete (or even before if you want to review the information as it is coming in), you can click on the purple magnifying glass icon to see the results of the scan. It is normal for the scan to rest on 98% for a while before completing:

OpenVAS magnifying glass

You will be taken to an overview of the scan results. Note that the immediate scan that we have completed is not the most in-depth scan we have available.

OpenVAS scan results

At the bottom, you can see the report that OpenVAS created telling us of potential vulnerabilities in the system we scanned. We can see that the "Threat" level has been categorized as "Medium".

This means that at least one vulnerability has been found in the system of the rating of "medium". We can find out more by clicking on the magnifying glass again.

This will take us to a full report of the findings. In the top portion, you have the option to download the results in various formats:

OpenVAS scan download

In the middle section, we can filter the results. By default, the interface will only show threats marked "high" or "medium". On your first time through, you should probably check all of the boxes under the "Threat" category. Click "Apply" to implement this:

OpenVAS filtering

The bottom section tells us about the specific items that were found. If you selected all of the boxes above, you will see some informational messages about open ports and similar findings.

The threats will be color-coded to match their button color. For instance, this is our medium threat:

OpenVas medium threat

This warning tells us that our target responds to timestamp requests. These requests can let an attacker know how long the host has been online continuously. This could let an attacker know that the host is vulnerable to any recent exploits.

As you can see, the report also includes information about how to address the issue.
Conclusion

You should now have a fully functional OpenVAS server set up to scan your hosts. This can help you spot vulnerabilities and highlight areas to focus on when you are tightening up security.

We have only shown a bare minimum of the functionality of the OpenVAS security suite. Among other tasks, you can easily schedule scans, automatically generate reports, and email alerts when certain threat levels are generated. Explore the Greenbone Security Assistant interface and take advantage of the great built-in help system to learn more about your options.
By Justin Ellingwood

==Referensi==

* https://www.digitalocean.com/community/tutorials/how-to-use-openvas-to-audit-the-security-of-remote-systems-on-ubuntu-12-04