The Greenbone Security Manager allows for the building of a distributed scan system. Hereby it is possible that one GSM remotely controls another GSM for this purpose.
Thereby the controlling GSM is called a master device and the controlled GSM a remote scanner. As soon as two GSMs are configured as master and remote scanner a user can individually configure a scan for the remote scanner via the web interface of the scan master depending on requirements and permissions. Every GSM starting from the midrange models upwards can be used as scan master and control one or more scanners. Every GSM can function as a remote scanner.
The remote scanners are independent GSMs. This is why the administrator must configure the feed updates and release updates locally on the remote scanners as well and ensure their execution. A remote scanner also provides their own graphical interface and own management. This allows for it being able to be used completely independently, however some scans being executed from the master.
Additionally the remote scanner can be configured as sensor. A scan sensor is a GSM that exclusively is being used for the function of scan slave and also completely being managed by the assigned master. This management includes automatic updates of the feeds as well as the automatic updates of release updates. A sensor does not require any network connectivity other than to a sensor master and after initial setup no further administrative tasks.
Remote scanners and slaves can be integrated into a scan master, in order to test those network segments for vulnerabilities that are not accessible in any other way.
Basically the master establishes the connection to the delegated remote scanners. The connection is established by using the Greenbone management protocol (GMP) which uses TCP port 22 (ssh). The feed and release updates send to sensors use the port 22/tcp (ssh) as well. Thus only this one port is required for remote scanners and sensor setup.
But it is very important to distinguish these two features:
Like with any other GSM the basic setup of a remote scanner is being performed via the serial port. In addition to the network configuration and the administrative access two other basic parameters for the use as slave are required:
Afterwards the remote scanners can be set up on the master and a task may be delegated to the remote scanner.
GMP-Scanner
in the Overlay and enter the IP address and the credentials of the scan user generated on the remote scanner.For security reasons often it is not possible to scan network segments directly. Most of the time direct access of this segment to the Internet is not desired. In order for a sensor to have the latest NVTs available, the Greenbone Security Feed from the master may be pushed to the sensor and as such allow for a feed synchronization with the sensor. After the initial setup this occurs automatically. As soon as the master synchronized itself with the feed server it will transfer the information to the sensor as well.
To achieve this the master uses the SSH protocol. The following steps are required to setup the communication between the master and the sensor.
The remote scanners and sensors communicate using SSH. This protocol must be allowed through possible existing firewall systems. Hereby the master always establishes the connection to the sensor. For backward compatibility the master also tries to connect to the sensor using the port 9390/tcp. The availability of the port may be switch on the sensor.
The feed update of the delegated scan sensors is being performed selectively either directly from the Greenbone Update Servers or through the master. For updates from the master to the scan sensor SSH (TCP per 22) is being used. If this option is not being used it has to be remembered that a possible firewall situated between the master and the scan sensor blocks this connection without notification (Drop or Deny setting). Instead the establishing of the connection should be allowed (Accept or Permit) or rejected (Reject) with notification as the master will always try to transfer the feed updates to the scan sensor.