Openvas 9 on Ubuntu Setup
Sysadmin Ramblings
Basic Installation
- Install Ubuntu 16.04LTS
Make sure you update your newly installed system with the latest patches – security updates.
- sudo apt-get update
- sudo apt-get upgrade
- sudo apt-get dist-upgrade
Openvas9 is available as a package for Ubuntu 14.04 and Ubuntu 16.04.
- sudo add-apt-repository ppa:mrazavi/openvas
- sudo apt-get update
- sudo apt-get install openvas9
Follow the prompts and answer yes for redis-server install.
Once installed, run updates on the NVT to ensure you have the latest vulnerability tests.
- sudo greenbone-nvt-sync
- sudo greenbone-scapdata-sync
- sudo greenbone-certdata-sync
The commands above may take a few minutes to run. Once complete restart the openvas services to ensure they use the updated tests.
- sudo /etc/init.d/openvas-manager restart
- sudo /etc/init.d/openvas-scanner restart
There are additional components required to fully utilise openvas, the best way to find out what is required is to download and use the openvas check tool. It can be downloaded here. Once downloaded run the application
- ./openvas-check-setup –v9
Once everything has been setup and you now have a fully functioning setup ,you can access the openvas server from your preferred brower @
- https://host-ip-address:4000
The default username/password is admin / admin however if the password is somehow set or you need to change the admin password to something more secure (preferable), use the following command to do so.
- sudo openvasmd –new-password=my_secure_password –user=admin
In order to run scans and properly identify vulnerabilities on your hosts / networks , its best to first setup the necessary credentials. Go to configuration -> credentails. Click on the star in the top left hand corner to create a new credential. You will need to setup Windows/SMB as well as Linux credentials for the different hosts within your organization. Regarding SMB users ive had success with and without the domain name in the username field.
Openvas – SSH Strong Ciphers
Its best practice to harden your ssh servers and this includes using strong ciphers. The documentation regarding openvas and strong ciphers or lack thereof threw me for a bit. I couldnt find anything that clearly identified the problem or assisted me in being able to run authenticated tests, so hopefully this will help you.
Whenever my authenticated checks failed, I noticed the following errors in my openvassd.messages file. “Failed to set SSH key type ‘ssh-ed25519‘”.
If you view /var/lib/openvas/plugins/ssh_fund.inc it indicates that for ed25519 you need to upgrade to libssh greater than 0.7.
Ubuntu 16.04 uses libssh0.6.3 , to successfully logon to ssh servers using secure ciphers it requires libssh0.7 and greater. There is a ppa available that upgrades to a later version of libssh, but unfortunately this didnt work for me. I needed to manually upgrade libssh, below is the steps i followed.
You need to ensure your system has git,cmake and a few other packages installed.
- sudo apt-get install git
- sudo apt-get install build-essential
- sudo apt-get install cmake
- sudo apt-get install zlib1g-dev
- sudo apt-get install libssl-dev
Next install libssh
- git clone git://git.libssh.org/projects/libssh.git libssh
- cd libssh
- mkdir build
- cd build
- cmake -DCMAKE_INSTALL_PREFIX=/usr ..
- make
- sudo make install
Link the default installed libssh binaries to the new installed ones
- cd /usr/lib/x86_64-linux-gnu
- rm libssh.so.4
- rm libssh_threads.so.4
- ln -s /usr/lib/libssh.so.4 libssh.so.4
- ln -s /usr/lib/libssh_threads.so.4 libssh_threads.so.4
Restart openvas scanner to ensure it uses the new binaries
- /etc/init.d/openvas-scanner restart
Update OpenVAS Plugins (NVT, Cert Data & SCAP Data) Automatically
Once you have install OpenVAS it is a good idea to ensure it is kept up to date and running the latest security scripts to find the latest vulnerabilities as well as sync to the most updated nvt, scap and cert data. The best way to do this is to create a script that sync’s the necessary data for you automatically each day.
Create a script under /usr/local/bin called update-openvas
- vi /usr/local/bin/update-openvas
add the following contents to the file
- /usr/sbin/greenbone-nvt-sync
- /usr/sbin/greenbone-certdata-sync
- /usr/sbin/greenbone-scapdata-sync
- /usr/sbin/openvasmd –update –verbose –progress
- /etc/init.d/openvas-manager restart
- /etc/init.d/openvas-scanner restart
save the file and make it executeable
- chmod a+x /usr/local/bin/update-openvas
run the script to make sure it works and that there are no errors
- /usr/local/bin/update-openvas
add the script to cron to run daily
- crontab -e
add the following contents
- 1 1 * * * /usr/local/bin/update-openvas 1>/dev/null 2>/dev/null
the above cronjob will be run at 1 minute past 1 every day
10 Year Old Talks about Cyber Bullying
How to Reset or Create a Password for OpenVas
The password to access OpenVas vulnerability scanner with username ‘admin’ is created during the initial setup. At times you forget the password or want to reset it. This can be accomplished by resetting the password using the following command:
To change admin password:
sudo openvasmd — –user=admin — –new-password=letmein
Then logon using admin for the username and letmein as the password
If you would like to create additional user accounts for user accountability, you can create additional usernames by using the following commands:
sudo openvasmd — –create-user [my-new-user]
and it would create the user with a generated password.
Did Cambridge Analytica access your Facebook information? How to check and protect yourself
Starting this past Monday, Facebook started to inform users if their data may have been shared with Cambridge Analytica.
The social media company is informing affected users at the top of “News Feeds.” The alert, titled “Protecting Your Information,” will be visible to users whose information was accessed by a third-party website and potentially shared with Cambridge Analytica. Facebook will direct those users to a “See How You’re Affected” tool.
Facebook will provide other users with a different link that identifies which apps are connected to their accounts. Users have the option of prohibiting apps from accessing their data.
Important Message Regarding MyFitnessPal Account Security
| NOTICE OF DATA BREACH |
|
To the MyFitnessPal Community:
We are writing to notify you about an issue that may involve your MyFitnessPal account information. We understand that you value your privacy and we take the protection of your information seriously. What Happened? On March 25, 2018, we became aware that during February of this year an unauthorized party acquired data associated with MyFitnessPal user accounts. What Information Was Involved? The affected information included usernames, email addresses, and hashed passwords – the majority with the hashing function called bcrypt used to secure passwords. What We Are Doing Once we became aware, we quickly took steps to determine the nature and scope of the issue. We are working with leading data security firms to assist in our investigation. We have also notified and are coordinating with law enforcement authorities. We are taking steps to protect our community, including the following:
What You Can Do We take our obligation to safeguard your personal data very seriously and are alerting you about this issue so you can take steps to help protect your information. We recommend you:
For More Information For more information, please go to https://content.myfitnesspal. Sincerely, Paul Fipps |
