OpenVAS / Greenbone: vulnerability scanner

Introduction

Greenbone Vulnerability Manager (GVM), formerly OpenVAS, is the open-source vulnerability scanner reference. It identifies:

• CVE (Common Vulnerabilities and Exposures)
• Weak configurations (SSL/TLS, SSH, services)
• Obsolete versions of exposed software
• Default passwords
• Wrong permissions

Over 100,000 tests (NVT) maintained daily by Greenbone.

Prerequisites

• Linux VPS Debian / Ubuntu
• 4 GB RAM minimum, 8 GB recommended
• 30 GB disk
• Root access

Step 1: Install via Docker (recommended)

Native install is heavy. Use Docker:

sudo mkdir -p /opt/greenbone
cd /opt/greenbone
curl -O https://greenbone.github.io/docs/latest/_static/docker-compose-22.4.yml
mv docker-compose-22.4.yml docker-compose.yml
sudo docker compose up -d

Initial startup takes 30-60 min (NVT feeds download).

Monitor:

sudo docker compose logs -f

Wait for "User created".

Step 2: Get admin password

sudo docker compose logs gvmd | grep "User created with password"

Note the admin user and password.

Step 3: Web access

sudo docker compose ps

Port 9392 is exposed. Open https://VPS_IP:9392.

⚠️ Self-signed cert: accept warning.

Login admin + password.

Step 4: First scan

1. Configuration → Targets → New Target
2. Name: prod-vps
3. Hosts: IP or hostname
4. Port List: All IANA assigned TCP
5. Create

Then:

1. Scans → Tasks → New Task
2. Name: Scan prod-vps
3. Scan Targets: prod-vps
4. Scan Config: Full and fast
5. Create then Start

Scan lasts 1-3 hours.

Step 5: Read the report

Once done, Scans → Reports → click latest run.

Vulnerabilities by severity:

• High (>= 7.0 CVSS): fix immediately
• Medium (4.0-6.9): fix within 30 days
• Low (< 4.0): fix when possible
• Log: informational

Each vulnerability shows: CVE, CVSS score, proposed solution, exploit availability.

Step 6: Authenticated scan (deeper)

1. Configuration → Credentials → New Credential
2. Type: Username + SSH Key
3. Username: root
4. SSH Key Private: paste key
5. Create

Add credentials to target:

1. Targets → edit
2. SSH Credentials: select
3. SSH Port: 22

Re-run scan: lists vulnerable installed packages too.

Step 7: Scheduled scans

1. Configuration → Schedules → New Schedule
2. Recurrence: weekly, monthly
3. Create

On your task:

1. Tasks → edit
2. Schedule: select
3. Save

Step 8: Email notifications

1. Configuration → Alerts → New Alert
2. Event: Task run status changed
3. Condition: Severity at least 7.0
4. Method: Email
5. Create

Link alert to task → email on each new High.

Step 9: Feed maintenance

sudo docker compose exec gvmd gvmd --feed-status
sudo docker compose restart gvmd
sudo docker compose exec ospd-openvas greenbone-nvt-sync

Step 10: Performance

• Use Scan Config: Discovery for quick scans
• Limit port range
• Disable unneeded NVTs

Step 11: Export reports

PDF (management), CSV (Excel), XML (SIEM), LaTeX (pentest).

Step 12: API and automation

sudo apt install -y python3-gvm gvm-tools
gvm-cli socket --xml "<get_tasks/>"

Troubleshooting

"ERR_CONNECTION_REFUSED"

sudo docker compose ps
sudo docker compose logs gsa

Check gsa is UP and port 9392 open.

Login fails

sudo docker compose exec gvmd gvmd --user=admin --new-password=newpass

Scan stays "Queued"

sudo docker compose logs ospd-openvas

Often feed update in progress. Wait.

"Could not connect to scanner"

sudo docker compose restart ospd-openvas

Extremely slow scan

Reduce scan config or parallel targets in Settings.

Useful commands

sudo docker compose ps
sudo docker compose logs -f gvmd
sudo docker compose logs -f ospd-openvas
sudo docker compose pull && sudo docker compose up -d
sudo docker compose down -v        # full reset
sudo docker compose exec gvmd gvmd --backup

Conclusion

Greenbone gives you:

• Quick identification of known vulns on your infra
• Detailed reports to prioritize patches
• Scheduled scans without intervention
• Near real-time CVE coverage

Going further:

• Combine with Lynis for Linux config audit
• Use Nuclei for targeted quick scans
• Adopt Wazuh for SIEM + detection

Resources

• Official docs: https://greenbone.github.io/docs/
• Docker image: https://hub.docker.com/u/greenbone
• Community forum: https://forum.greenbone.net
• Feeds: https://www.greenbone.net/en/feed-comparison/