Kali Linux安装GVM 20.8（前OpenVas）

Kali Linux安装GVM 20.08（前OpenVas）

因为OpenVas此后正式变更为GVM后，我决定重新安装GVM，最新版本20.08.
参考链接：GVM安装教程

部分前提：

1、具有sudo特权的普通用户。
2、根用户
3、名为gvm的非特权用户
4、安装的前缀是/ opt / gvm

安装要求：

sudo apt update ;\sudo apt -y dist-upgrade ;\sudo apt -y autoremove ;\sudo apt install -y software-properties-common ;\sudo apt install -y cmake pkg-config libglib2.0-dev libgpgme-dev libgnutls28-dev uuid-dev libssh-gcrypt-dev \
libldap2-dev doxygen graphviz libradcli-dev libhiredis-dev libpcap-dev bison libksba-dev libsnmp-dev \
gcc-mingw-w64 heimdal-dev libpopt-dev xmltoman redis-server xsltproc libical-dev postgresql \
postgresql-contrib postgresql-server-dev-all gnutls-bin nmap rpm nsis curl wget fakeroot gnupg \
sshpass socat snmp smbclient libmicrohttpd-dev libxml2-dev gettext rsync xml-twig-tools \
python3-paramiko python3-lxml python3-defusedxml python3-pip python3-psutil virtualenv vim git ;\sudo apt install -y texlive-latex-extra --no-install-recommends ;\sudo apt install -y texlive-fonts-recommended ;\curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add - ;\echo "deb https://dl.yarnpkg.com/debian/ stable main" | sudo tee /etc/apt/sources.list.d/yarn.list ;\sudo apt update ;\sudo apt -y install yarn（***注意，这里在安装依赖包的时候，我遇到了“python-polib”无法安装的问题，后面我单独使用pip3 install python-polib 命令安装***）

创建用户（这个里创建的是GVM用户）

echo 'export PATH="$PATH:/opt/gvm/bin:/opt/gvm/sbin:/opt/gvm/.local/bin"' | sudo tee -a /etc/profile.d/gvm.sh ;\sudo chmod 0755 /etc/profile.d/gvm.sh ;\source /etc/profile.d/gvm.sh ;\sudo bash -c 'cat << EOF > /etc/ld.so.conf.d/gvm.conf
# gmv libs location
/opt/gvm/lib
EOF'sudo mkdir /opt/gvm ;\sudo adduser gvm --disabled-password --home /opt/gvm/ --no-create-home --gecos '' ;\sudo usermod -aG redis gvm  # This is for ospd-openvas can connect to redis.sock.. If you have a better idea here, pls write in the comments :) ;\sudo chown gvm:gvm /opt/gvm/ ;\sudo su - gvmmkdir src ;\cd src ;\export PKG_CONFIG_PATH=/opt/gvm/lib/pkgconfig:$PKG_CONFIG_PATH

下载资料

git clone -b gvm-libs-20.08 --single-branch  https://github.com/greenbone/gvm-libs.git ;\
git clone -b openvas-20.08 --single-branch https://github.com/greenbone/openvas.git ;\
git clone -b gvmd-20.08 --single-branch https://github.com/greenbone/gvmd.git ;\
git clone -b master --single-branch https://github.com/greenbone/openvas-smb.git ;\
git clone -b gsa-20.08 --single-branch https://github.com/greenbone/gsa.git ;\
git clone -b ospd-openvas-20.08 --single-branch  https://github.com/greenbone/ospd-openvas.git ;\
git clone -b ospd-20.08 --single-branch https://github.com/greenbone/ospd.git

安装gvm-libs

cd gvm-libs ;\export PKG_CONFIG_PATH=/opt/gvm/lib/pkgconfig:$PKG_CONFIG_PATH ;\mkdir build ;\cd build ;\cmake -DCMAKE_INSTALL_PREFIX=/opt/gvm .. ;\make ;\make doc ;\make install ;\cd /opt/gvm/src

配置并构建openvas-smb

cd openvas-smb ;\export PKG_CONFIG_PATH=/opt/gvm/lib/pkgconfig:$PKG_CONFIG_PATH ;\mkdir build ;\cd build/ ;\cmake -DCMAKE_INSTALL_PREFIX=/opt/gvm .. ;\make ;\make install ;\cd /opt/gvm/src

配置和构建扫描仪

cd openvas ;\export PKG_CONFIG_PATH=/opt/gvm/lib/pkgconfig:$PKG_CONFIG_PATH ;\mkdir build ;\cd build/ ;\cmake -DCMAKE_INSTALL_PREFIX=/opt/gvm .. ;\make ;\make doc ;\make install ;\cd /opt/gvm/src

修复Redis默认的Openvas安装

（***注意：这里一定要切换为root用户，此前上面一直用的是gvm用户***）su root

接下来依次执行下面命令：

export LC_ALL="C" ;\
ldconfig ;\
cp /etc/redis/redis.conf /etc/redis/redis.orig ;\
cp /opt/gvm/src/openvas/config/redis-openvas.conf /etc/redis/ ;\
chown redis:redis /etc/redis/redis-openvas.conf ;\
echo "db_address = /run/redis-openvas/redis.sock" > /opt/gvm/etc/openvas/openvas.conf ;\
systemctl enable redis-server@openvas.service ;\
systemctl start redis-server@openvas.service
sysctl -w net.core.somaxconn=1024
sysctl vm.overcommit_memory=1echo "net.core.somaxconn=1024"  >> /etc/sysctl.conf
echo "vm.overcommit_memory=1" >> /etc/sysctl.conf
cat << EOF > /etc/systemd/system/disable-thp.service
[Unit]
Description=Disable Transparent Huge Pages (THP)[Service]
Type=simple
ExecStart=/bin/sh -c "echo 'never' > /sys/kernel/mm/transparent_hugepage/enabled && echo 'never' > /sys/kernel/mm/transparent_hugepage/defrag"[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload ;\
systemctl start disable-thp ;\
systemctl enable disable-thp ;\
systemctl restart redis-server

由于将使用sudo从ospd-openvas进程启动openvas，因此在sudoers文件中需要下一个配置：

visudo

编辑secure_path行：添加后面的：“:/snap/bin:/opt/gvm/sbin”

Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin:/opt/gvm/sbin"

添加此行以允许创建的gvm用户以root权限启动openvas。：

### Allow the user running ospd-openvas, to launch openvas with root permissions
gvm ALL = NOPASSWD: /opt/gvm/sbin/openvas
gvm ALL = NOPASSWD: /opt/gvm/sbin/gsad

注意：然后从root shell退出，并返回到gvm用户
这是root
请记住要从root更改为gvm用户.。
（这里我切换到gvm用户遇到了一个问题，我根据别人的文档创建的gvm用户，我忘了密码是啥，然后我就切换到root更改了gvm用户密码为gvm，这里要记住不要盲目复制，一定要注意！谨记，谨记！）

更新nvt

greenbone-nvt-sync

使用openvas在redis中上传插件

sudo openvas -u

（提示：这将需要一些时间，具体取决于您的硬件。
运行时，您可以使用大量cpu监视openvas和redis服务器进程。）

配置和构建管理器

cd gvmd ;\export PKG_CONFIG_PATH=/opt/gvm/lib/pkgconfig:$PKG_CONFIG_PATH ;\mkdir build ;\cd build/ ;\cmake -DCMAKE_INSTALL_PREFIX=/opt/gvm .. ;\make ;\make doc ;\make install ;\cd /opt/gvm/src

配置PostgreSQL

***注意：为此，我们将使用启用了sudo的用户。（不是root）***

sudo -u postgres bash
export LC_ALL="C"
createuser -DRS gvm
createdb -O gvm gvmdpsql gvmd
create role dba with superuser noinherit;
grant dba to gvm;
create extension "uuid-ossp";
create extension "pgcrypto";
exit
exit

注意：这里有报错的话：

解决办法：“重启数据库：systemctl restart postgresql”

 然后退出这个具有root权限的用户shell。

修复证书

记住要从sudo用户更改为gvm用户

gvm-manage-certs -a

创建管理员用户

gvmd --create-user=admin --password=admin

配置和更新提要

找出您新创建的管理员的uuid：

gvmd --get-users --verbose
admin 41f853e4-fecf-423f-85b7-18fa3396bac5 ««« This uuid

然后使用上面的uuid修改gvmd设置：

gvmd --modify-setting 78eceaec-3385-11ea-b237-28d24461215b --value 41f853e4-fecf-423f-85b7-18fa3396bac5

依次运行这些命令：

greenbone-feed-sync --type GVMD_DATA
greenbone-feed-sync --type SCAP
greenbone-feed-sync --type CERT

配置并安装gsa

cd gsa ;\export PKG_CONFIG_PATH=/opt/gvm/lib/pkgconfig:$PKG_CONFIG_PATH ;\mkdir build ;\cd build/ ;\cmake -DCMAKE_INSTALL_PREFIX=/opt/gvm .. ;\make ;\make doc ;\make install ;\touch /opt/gvm/var/log/gvm/gsad.log ;\cd /opt/gvm/src

开放式开放源码软件

安装virtualenv：
在这之前要先安装好python3.7，因为这kali预装的是只有python2的。至于python3安装，教程很多，这里就不赘述了。

cd /opt/gvm/src ;\
export PKG_CONFIG_PATH=/opt/gvm/lib/pkgconfig:$PKG_CONFIG_PATH ;\
virtualenv --python python3.7  /opt/gvm/bin/ospd-scanner/ ;\
source /opt/gvm/bin/ospd-scanner/bin/activate

安装ospd：

mkdir /opt/gvm/var/run/ospd/ ;\
cd ospd ;\
pip3 install . ;\
cd /opt/gvm/src

安装ospd-openvas：

cd ospd-openvas ;\
pip3 install . ;\
cd /opt/gvm/src

创建启动脚本

注意：以root身份运行这些命令

cat << EOF > /etc/systemd/system/gvmd.service
[Unit]
Description=Open Vulnerability Assessment System Manager Daemon
Documentation=man:gvmd(8) https://www.greenbone.net
Wants=postgresql.service ospd-openvas.service
After=postgresql.service ospd-openvas.service[Service]
Type=forking
User=gvm
Group=gvm
PIDFile=/opt/gvm/var/run/gvmd.pid
WorkingDirectory=/opt/gvm
ExecStart=/opt/gvm/sbin/gvmd --osp-vt-update=/opt/gvm/var/run/ospd.sock
ExecReload=/bin/kill -HUP $MAINPID
KillMode=mixed
Restart=on-failure
RestartSec=2min
KillMode=process
KillSignal=SIGINT
GuessMainPID=no
PrivateTmp=true[Install]
WantedBy=multi-user.target
EOF
cat << EOF > /etc/systemd/system/gsad.service
[Unit]
Description=Greenbone Security Assistant (gsad)
Documentation=man:gsad(8) https://www.greenbone.net
After=network.target
Wants=gvmd.service[Service]
Type=forking
PIDFile=/opt/gvm/var/run/gsad.pid
WorkingDirectory=/opt/gvm
ExecStart=/opt/gvm/sbin/gsad --drop-privileges=gvm
Restart=on-failure
RestartSec=2min
KillMode=process
KillSignal=SIGINT
GuessMainPID=no
PrivateTmp=true[Install]
WantedBy=multi-user.target
EOF
cat << EOF > /etc/systemd/system/ospd-openvas.service
[Unit]
Description=Job that runs the ospd-openvas daemon
Documentation=man:gvm
After=network.target redis-server@openvas.service
Wants=redis-server@openvas.service[Service]
Environment=PATH=/opt/gvm/bin/ospd-scanner/bin:/opt/gvm/bin:/opt/gvm/sbin:/opt/gvm/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
Type=forking
User=gvm
Group=gvm
WorkingDirectory=/opt/gvm
PIDFile=/opt/gvm/var/run/ospd-openvas.pid
ExecStart=/opt/gvm/bin/ospd-scanner/bin/python /opt/gvm/bin/ospd-scanner/bin/ospd-openvas --pid-file /opt/gvm/var/run/ospd-openvas.pid --unix-socket=/opt/gvm/var/run/ospd.sock --log-file /opt/gvm/var/log/gvm/ospd-scanner.log --lock-file-dir /opt/gvm/var/run/ospd/
Restart=on-failure
RestartSec=2min
KillMode=process
KillSignal=SIGINT
GuessMainPID=no
PrivateTmp=true[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload ;\
systemctl enable gvmd ;\
systemctl enable gsad ;\
systemctl enable ospd-openvas ;\
systemctl start gvmd ;\
systemctl start gsad ;\
systemctl start ospd-openvas

检查服务是否已启动并正在运行：

systemctl status gvmd
systemctl status gsad
systemctl status ospd-openvas

退出root shell。

修改您的默认扫描仪

注意：以用户gvm的身份获取默认扫描仪UUID。请记住要从root更改为gvm用户。

(ospd-scanner) gvm@localhost:/opt/gvm/src$ gvmd --get-scanners
08b69003-5fc2-4037-a479-93b440211c73  OpenVAS  /var/run/ospd/ospd.sock  0  OpenVAS Default «««««««««« THIS UUID
6acd0832-df90-11e4-b9d5-28d24461215b  CVE    0  CVE

然后修改扫描仪：

(ospd-scanner) gvm@localhost:/opt/gvm/src$ gvmd --modify-scanner=08b69003-5fc2-4037-a479-93b440211c73 --scanner-host=/opt/gvm/var/run/ospd.sock
Scanner modified.

好了，到此算是告一段落。
现在，您可以将浏览器指向GSA https：// ipnumberofyourserver 并登录。