Ossim 中漏洞扫描详解

Openvas是一套开源漏洞扫描系统，如果手动搭建需要复杂的过程，花费不少人力和时间成本，因为它是套免费的漏洞扫描系统，功能上不逊色于商业版的漏洞扫描器，受到不少用户的青睐，下表对比了NeXpose、RSAS和启明的漏洞扫描器的主要功能。

有了以上背景之后，下文主要针对OSSIM平台下如何以图形化方式操作漏洞扫描的过程。

准备工作：首先确保没有运行的扫描进程和任务

扫描漏洞同时升级漏洞库会导致升级失败。

第一步：同步插件

#openvas-nvt-sync

[i] This script synchronizes an NVT collection with the 'OpenVAS NVT Feed'.

[i] The 'OpenVAS NVT Feed' is provided by 'The OpenVAS Project'.

[i] Online information about this feed: 'http://www.openvas.org/openvas-nvt-feed.html'.

[i] NVT dir: /var/lib/openvas/plugins

[i] Will use rsync

[i] Using rsync: /usr/bin/rsync

[i] Configured NVT rsync feed: rsync://feed.openvas.org:/nvt-feed

OpenVAS feed server - http://www.openvas.org/

This service is hosted by Intevation GmbH - http://intevation.de/

All transactions are logged.

Please report synchronization problems to openvas-feed@intevation.de.

If you have any other questions, please use the OpenVAS mailing lists

or the OpenVAS IRC chat. See http://www.openvas.org/ for details.

receiving incremental file list

deleting gb_openssl_38562.nasl.asc

deleting gb_openssl_38562.nasl

./

COPYING

588 100%  574.22kB/s    0:00:00 (xfer#1, to-check=13347/13355)

COPYING.GPLv2

18002 100%   17.17MB/s    0:00:00 (xfer#2, to-check=13346/13355)

COPYING.files

1819904 100%    1.77MB/s    0:00:00 (xfer#3, to-check=13345/13355)

DDI_Directory_Scanner.nasl

32957 100%   32.74kB/s    0:00:00 (xfer#4, to-check=13342/13355)

DDI_Directory_Scanner.nasl.asc

198 100%    0.20kB/s    0:00:00 (xfer#5, to-check=13341/13355)

... ...

同步数万个插件时间比较长，消耗资源不大，可以去喝杯咖啡啦，或者了解一下插件的组成。

表1 Openvas主要脚本分类及分布情况

规则名称数量备注

IIS_frontpage_DOS_2.nasl1

phpbb8

RA_ssh_detect

RA_www_css

RA_www_detect3

RHSA_2009_03**279Redhat Security Advisory

3com_switches1

weblogic*3

cisco_ids

cisco_***

ciscoworks16

awstats4

apache23

DDI30

EZ_hotscripts3

anti_nessus1

basilix8

bluecoat1

bugbear3

bugzilla9

ca_unicenter2

cacti5

calendar3

Spoll_7_5_sql_injection2

avaya_switches1

citrix8

clamav2

CUPS12

cutenews12

checkpoint6

cheopsNG4

cvstrac24

DB24

deb_*.nasl2595Debian Linux

DNS5

deluxeBB3

eftp3

ls exchange*

exchange2

fcore684

find_service5

fortigate1

freebsd2009

ftp30

gb_CESA1528

gb_RHSA871

gb_adobe167

gb_apple70

gb_baofeng_storm3

gb_bpsoft3

gb_clamav16

gb_ccproxy2

gb_clamav16

gb_fedora4679

gb_google162

gb_hp_ux242HP-UNIX

gb_ibm_db227

gb_ibm_websphere8

gb_ibm_tivoli5

gb_ibm_was16

gb_ibm_lotus10

gb_mandriva1684

gb_java2

gb_kaspersky6

gb_google_chrome153

gb_foxmail2

gb_fsecure7

gb_ms155Windows相关

gb_ubuntu1261

gb_samba12

gb_sun_java35

gb_wireshark87

glsa1727

gb_vmware41

IIS20

lotus5

ipswitch5

mysql5

gb_nmap187

nortel7

nagios5

openssh4

oscommerce5

postgresql5

phpgroupware12

phpmyadmin7

phpbb8

smb52

sendmail15

suse65

ssh11

smtp9

Ubuntu179

tomcat6

tftp11

wu_ftpd6

第二步：更新插件(做这一步操作，建议在轻负载下进行)

#perl /usr/share/ossim/scripts/vulnmeter/updateplugins.pl migrate            /* 比较消耗CPU和磁盘I/O  */

2015-09-07 07:27:33   Framework profile has been found...

2015-09-07 07:27:33   Deleting all tasks in 192.168.11.150 ...

2015-09-07 07:27:33   updateplugins: configured to not updateplugins

2015-09-07 07:27:33   updateplugins: configured to not repair DB

2015-09-07 07:27:33   BEGIN  - DUMP PLUGINS

2015-09-07 07:29:01   FINISH - DUMP PLUGINS [ Process took 88 seconds ]

2015-09-07 07:29:01   BEGIN  - IMPORT PLUGINS

2015-09-07 07:30:00   FINISH - IMPORT PLUGINS [ 40473 plugins - Process took 59 seconds ]

2015-09-07 07:30:00   BEGIN  - UPDATE CATEGORIES

2015-09-07 07:30:00   FINISH - UPDATE CATEGORIES [ Process took 0 seconds ]

2015-09-07 07:30:00   BEGIN  - UPDATE FAMILIES

2015-09-07 07:30:00   FINISH - UPDATE FAMILIES [ Process took 0 seconds ]

2015-09-07 07:30:00   BEGIN  - UPDATE OPENVAS_PLUGINS

2015-09-07 07:30:03   FINISH - UPDATE OPENVAS_PLUGINS [ Process took 3 seconds ]

2015-09-07 07:30:03   BEGIN  - UPDATE NESSUS_PREFERENCES

2015-09-07 07:30:03   show tables like "vuln_nessus_preferences_defaults"

2015-09-07 07:30:03   updateprefs: Getting plugin preferences

2015-09-07 07:30:05   FINISH - UPDATE NESSUS_PREFERENCES [ Process took 2 seconds ]

2015-09-07 07:30:06   Creating Deep profile...

2015-09-07 07:30:06   Filling categories...............

2015-09-07 07:30:06   Done

2015-09-07 07:30:06   Filling families.............................................................

2015-09-07 07:30:06   Done

2015-09-07 07:30:06   Filling plugins...

2015-09-07 07:30:13   Filling preferences in Alienvault DB...

2015-09-07 07:30:14   Done

2015-09-07 07:30:14   Deep profile inserted

2015-09-07 07:30:15   Creating Default profile...

2015-09-07 07:30:15   Filling categories...............

2015-09-07 07:30:15   Done

2015-09-07 07:30:15   Filling families.............................................................

2015-09-07 07:30:15   Done

2015-09-07 07:30:15   Filling plugins...

2015-09-07 07:30:23   Filling preferences in Alienvault DB...

2015-09-07 07:30:24   Done

2015-09-07 07:30:24   Default profile inserted

2015-09-07 07:30:24   Creating Ultimate profile...

2015-09-07 07:30:24   Filling categories...............

2015-09-07 07:30:24   Done

2015-09-07 07:30:24   Filling families.............................................................

2015-09-07 07:30:24   Done

2015-09-07 07:30:24   Filling plugins...

2015-09-07 07:30:32   Filling preferences in Alienvault DB...

2015-09-07 07:30:33   Done

2015-09-07 07:30:33   Ultimate profile inserted

2015-09-07 07:30:33   BEGIN  - UPDATE PORT SCANNER

2015-09-07 07:30:35   FINISH - UPDATE PORT SCANNER [ Process took 2 seconds ]

Updating plugin_sid vulnerabilities scanner ids

plugins fetched

Updating...

Script id:94151, Name:IT-Grundschutz M4.288: Sichere Administration von VoIP-Endger?ten, Priority:0

Script id:703073, Name:Debian Security Advisory DSA 3073-1 (libgcrypt11 - security update), Priority:1

Script id:804624, Name:Adobe Reader Plugin Signature Bypass Vulnerability (Windows), Priority:2

Script id:868149, Name:Fedora Update for kernel FEDORA-2014-9959, Priority:5

Script id:95048, Name:IT-Grundschutz M5.145: Sicherer Einsatz von CUPS, Priority:0

Script id:842216, Name:Ubuntu Update for linux USN-2616-1, Priority:4

Script id:105036, Name:Open××× Detection, Priority:0

Script id:868005, Name:Fedora Update for audacious-plugins FEDORA-2014-8183, Priority:1

Script id:869350, Name:Fedora Update for springframework FEDORA-2015-6862, Priority:5

… …

Script id:105084, Name:Multiple ManageEngine Products  Arbitrary File Upload Vulnerability, Priority:3

Script id:867751, Name:Fedora Update for python-keystoneclient FEDORA-2014-5555, Priority:3

Script id:882209, Name:CentOS Update for nss CESA-2015:1185 centos6, Priority:2

Script id:842209, Name:Ubuntu Update for libmodule-signature-perl USN-2607-1, Priority:5

经过一刻钟等待终于更新完成。注意，该过程需要一气呵成，中途不能强制退出。

下面用时间轴表示每个步骤的演进顺序和所花费的时间，如下图所示。从某日的00:34:34开始到00:38:50结束的过程。

如果有些用户不习惯在CLI下操作升级命令，这一工作同样可以在WebUI中完成。

第三步：验证更新

我们看到最后一行显示总数为40473，这个数值和下载的插件数量一直，代表升级完成。

第四步：开始漏洞扫描-定制策略

首先扫描资产，建立资源池，这里就不详细介绍。在OSSIM系统里默认定义了三种策略，默认为Default,该策略最为常用。

如果需要更改策略，请点击CREATE NEW PROFILE按钮。

接着开始扫描，填写任务名称，选择Sensor,选择策略，选择资源池内的主机，最后点击新建任务按钮。

扫描准备

漏洞扫描时那些进程最繁忙？

Htop是Linux系统中的一个互动的进程查看工具，该命令可以帮助管理员了解扫描发生的变化。#htop  -d 50

一次扫描多少机器合适？

如果所监控网段服务器数量超过25台，这里假设是100台，那么至少分4次扫描，例如直接输入“192.168.11.0/24”，这样表示一个网段，那么OSSIM系统负载将会明显增大，扫描等待时间明显延长，可能会长达数天，直到超过一个计划任务的周期，这样可能造成一个恶性循环，直到拖垮整个系统。

进过300多分钟都没有结束的任务最后逃脱不了失败的命运。

扫描结果分析

不过在分析时，谈到“过时”的漏洞问题，在一些古老些操作系统Windows NT/2000、Solaris7/8、Linux(2.2、2.4内核)曾经存在的那些系统漏洞、网络服务器漏洞，在现代系统中已经绝迹，受影响系统已经被修复，这种漏洞变得没有任何价值。对这些系统进行漏洞扫描变得没有意义。