wajdihajji / GVM-Deployment

Dockerised Greenbone Vulnerability Management components

GVM deployment

Introduction

This project proposes and implements the following deployment of Greenbone Vulnerability Management using Docker containers.

Docker images

The project builds the following docker images:

• Greenbone Vulnerability Manager versio built based on admirito's GVM PPA.
• PostgreSQL 12 Database with libgvm-pg-server built based on admirito's GVM PPA
• Greenbone Security Assistant built from https://github.com/greenbone/gsa.git.
• OpenVAS scanner built from https://github.com/greenbone/openvas.git.

Development

For testing and development, you can deploy the GVM components with docker-compose.

Run gvm-postgres, gvmd, gsad, openvas, and redis services:

docker-compose -f docker-compose.yml up

GSA dashboard will then be accessible on http://localhost:8080.

To run NVT data sync:

docker-compose -f docker-compose.yml -f nvt-sync.yml up 

To run SCAP data sync:

docker-compose -f docker-compose.yml -f scap-sync.yml up 

To run CERT data sync:

docker-compose -f docker-compose.yml -f cert-sync.yml up 

To add a remote OpenVAS scanner:

1. Generate certificates for the new scanner:

docker-compose -f docker-compose.yml -f scanner-certs.yml up 

2. Create the scanner container:

docker-compose -f docker-compose.yml -f remote-scanner.yml up 

3. Add the scanner to GVM:

$ docker exec -it gvm-deployment_gvmd_1 ./add-scanner.sh
Scanner Name: openvas-1
Scanner Host: openvas-1
Scanner Port [9390]:
Scanner Type [OpenVAS]:
Scanner CA certificate [/usr/var/lib/gvm/cacert.pem]:
Scanner public key [/usr/var/lib/gvm/cert.pem]:
Scanner private key [/usr/var/lib/gvm/key.pem]:
Adding scanner openvas-1...
md   main:MESSAGE:2020-10-09 16h15.55 utc:1349:    Greenbone Vulnerability Manager version 9.0.1 (DB revision 221)
md manage:   INFO:2020-10-09 16h15.55 utc:1349:    Creating scanner.
md manage:WARNING:2020-10-09 16h15.55 utc:1349: database must be initialised from scanner
util gpgme:MESSAGE:2020-10-09 16h16.01 utc:1349: Setting GnuPG dir to '/var/lib/gvm/gvmd/gnupg'
util gpgme:MESSAGE:2020-10-09 16h16.01 utc:1349: Using OpenPGP engine version '2.2.19'
Scanner created.

Production

To deploy GVM components in Kubernetes cluster for production, use the helm chart described in chart/README.

Resources

• https://github.com/admirito/gvm-containers