
                              OpenVAS in Debian
                              +---------------+

How to use OpenVAS?
-------------------

As the root user:

  * Check that you have proper SSL certificates at /var/lib/openvas/CA,
    if the directory is empty set up the server certificate with
    `openvas-mkcert'. (Note: certificates are generated automatically
    when the openvas-server package is installed)

  * Set up a user with `openvas-adduser'.

    - If you wish to setup certificate-based authentication: set up the client
      certificate with `openvas-mkcert-client' and save the private key.

  * Run either '/etc/init.d/openvas-server start' or `openvasd -D' in order to
  * start the daemon.

As a normal user in either the system were OpenVAS (the server) is installed:

  *  If using certificates for authentication, copy over the private
     key generated before to your HOME directory.

  * In an X session start the OpenVAS-Client program (you need to have the
    `openvas-client' package installed the system you are workin on) 
    by executing `openvas-client' from a shell or from your Desktop's 
    menu (it should be available at Applications --> System tools)

  * Setup a connection to the machine where OpenVAS (the server) is 
    running. If you are running both in the same machine select 'localhost'. If
    you are running the server in a different system:

       - verify that there are no firewall rules blocking the client from
         connecting to the OpenVAS server (TCP port 4391)
       - verify that the TCP wrappers configuration (/etc/hosts.{allow,deny})
         allow the client to connect to the server (be careful if 
         'ALL: PARANOID' is defined in /etc/hosts.deny and the client has no
         reverse name resolution)

  * Depending on how you setup the user using `openvas-adduser' you have
    to either use a username/password or select the private key of the
    certificate generate using 'openvas-mkcert-client'

  * Setup a test security analysis run against a server.

OpenVAS has a test to detect if the program itself is running, because it is a
potential security problem, so it wouldn't seem wise to automatically start it
on boot-up.

Remember to `killall openvasd' (as root) after you finish with `openvasd'.

The package installs an init script for openvasd at /etc/init.d/openvas-server,
courtesy of Luca Andreucci <andrew@andrew.org> and others. By default, this
init script will not be run when the system starts up, it is only configured
to stop openvasd when the system stops (to prevent it from being killed and 
give it a chance to stop graciously)

If you want to use that init script to start up openvasd you just have to 
execute '/etc/init.d/openvas-server start' and you are done.

If you want to have the init-scripts run on system startup then either run:

# update-rc.d -f remove openvas-server
# update-rc.d openvas-server defaults

or run:

# for rc in 3 4 5 ; do  cd /etc/rc${rc}.d/ && ln -s ../init.d/openvas-server S20openvas-server;  done

to setup the symbolic links properly.


Debian defaults
---------------

Before you change Debian's openvasd.conf file (available at 
/etc/openvas/) consider this:

0.- signature checks (nasl_no_signature_check) only apply to "trusted"
plugins, and those are the plugins that do remote local security checks 
(through SSH connections that need to be preconfigured by the OpenVAS admin)

1.- you shouldn't give access to the OpenVAS daemon to users you don't trust,
or allow them to upload plugins. Giving access to users is equivalent to 
allowing them to launch remote attacks to any system your OpenVAS server is 
connected to. If you have local security checks it's equivalente to granting 
them SSH access to the remote hosts you have configured (if any)

2.- The openvas-plugins package does _not_ automatically run 
openvas-update-plugins, you have to do this manually. Review the plugins
retrieved by this before you run your OpenVAS server

3.- Be careful when setting up remote SSH access so that OpenVAS can run
local security checks since you are (effectively) given console access
to remote servers. Always use a non-root account for this.

4.- Also be aware that by default openvasd only listens on port 9390 on
127.0.0.1. If you wish to change this, then check out /etc/default/openvas-server.

-------------------------------
Sun, 12 Oct 2008 12:54:51 +0100

Tim Brown <timb@nth-dimension.org.uk>

