5. Setting up the Greenbone Security Manager

This chapter provides specific setup guides for all current GSM appliances:

  • GSM 5400/6500 → Chapter 5.1
  • GSM 400/450/600/650 → Chapter 5.2
  • GSM 150 → Chapter 5.3
  • GSM 35 → Chapter 5.4
  • GSM 150V/CENO/DECA/TERA/PETA/EXA → Chapter 5.5
  • GSM 25V → Chapter 5.6
  • GSM ONE/MAVEN → Chapter 5.7

5.1. GSM 5400/6500

This setup guide shows the steps required to put a GSM 5400 or 6500 appliance into operation.

The following checklist can be used to monitor the progress:

Step Done
Power supply established (2 connectors)  
Networking cables connected  
Console access established  
Keyboard layout selected  
IP address configured  
DNS server configured  
SSH service enabled (optional)  
SSL certificate created  
Web user account created  
GOS selfcheck run  

5.1.1. Installing the Appliance

The GSM 5400 and GSM 6500 are 19-inch mountable and require two rack units (RU). Rack holders for the installation in a 19-inch rack are supplied.

For cabling GSM 5400 and GSM 6500 appliances have corresponding connectors at the front and back:

  • Front
    • 1 RS-232 serial port, Cisco compatible, suitable cable is enclosed
    • 2 USB 2.0 ports
    • 2 RJ45 Ethernet ports, labeled “MGMT”, for management
    • Up to 4 optional modules with additional Ethernet ports (RJ45, SFP, SFP+ or XFP)
  • Back
    • 1 VGA port
    • 2 USB 3.0 ports
    • 2 USB 2.0 ports
    • 2 power supplies

The installation requires either a monitor and a keyboard or a serial console connection and a terminal application.

5.1.2. Utilizing the Serial Port

The enclosed console cable is used for utilizing the serial port. Alternatively, a blue Cisco console cable (rollover cable) can be used.

To access the serial port a terminal application is required. The application needs to be configured to a speed of 9600 bits/s (Baud).

In Linux the command screen can be used in the command line to access the serial port by passing the device providing the serial port as parameter:

screen /dev/ttyS0  #(for serial port)
screen /dev/ttyUSB0 #(for USB adapter)

Tip

After starting screen, it may be necessary to press Enter several times to see a command prompt.

To close the serial connection, press Ctrl + a and immediately afterwards \.

In Microsoft Windows the PuTTY application can be used. After starting it, the options as shown in Fig. 5.1 and the appropriate serial port have to be selected.

_images/putty_serial.png

Fig. 5.1 Setting up the serial port in PuTTY

5.1.3. Starting the Appliance

Once the appliance is fully wired, a connection to the appliance using the console cable is achieved and the terminal application (PuTTY, screen or similar) is set up, the appliance can be started.

The appliance will boot and after short time – depending on the exact model – the first messages will be displayed in the terminal application.

5.1.4. Performing a General System Setup

All GSM appliances share the same way of basic configuration and readiness check.

When the GSM is delivered by Greenbone Networks or after a factory reset, the GOS administration menu shows the first setup wizard after logging in to assist with the basic GOS configuration (see Fig. 5.2).

_images/first_setup_wizard_1.png

Fig. 5.2 Using the first setup wizard

By selecting Yes and pressing Enter the first setup wizard is opened and can be used as follows:

Note

By selecting No and pressing Enter the wizard can be closed. Steps which have not been completed yet are displayed when logging in again.

By selecting Cancel and pressing Enter the wizard can be closed as well. However, in this case, incomplete steps are not shown again.

The first setup wizard is dynamic and shows only those steps necessary to operate the used GSM type. In the following, all possible steps are mentioned but they may not appear in every case.

In case of a factory reset, all steps have to be carried out (see 20.4).

Every step can be skipped by selecting Skip or No and pressing Enter. Skipped steps are displayed when logging in again.

1. Importing or Generating an HTTPS Certificate

An HTTPS certificate has to be present on the GSM to use the web interface securely. The certificate can be imported or generated as follows:

  1. Select Import and press Enter (see Fig. 5.3).

    → A message informs that a PKCS#12 file can be imported.

    _images/first_setup_wizard_2.png

    Fig. 5.3 Importing or generating an HTTPS certificate

  2. Select Continue and press Enter.

  3. Open the web browser and enter the displayed URL.

  4. Click Browse..., select the PKCS#12 file and click Upload.

    → When the certificate is retrieved by the GSM, the GOS administration menu displays the fingerprint of the certificate for verification.

  5. Check the fingerprint and confirm the certificate by pressing Enter.

    or

  1. Select Generate and press Enter.

    → A message informs that parameters have to be entered to generate the certificate.

  2. Select Continue and press Enter.

  3. Provide the settings for the certificate (see Fig. 5.4).

    _images/first_setup_wizard_3.png

    Fig. 5.4 Entering information for the certificate

  4. Select OK and press Enter.

    → A message informs that the certificate is created and can be downloaded (see Fig. 5.5).

    Note

    The download is not done in the first setup wizard, but in the later GOS administration menu as described in Chapter 7.2.3.1.3.1, steps 1 – 4 and 9 – 13.

    _images/first_setup_wizard_8.png

    Fig. 5.5 Entering information for the certificate

    or

  1. Select CSR and press Enter.

    → A message informs that a key pair and a certificate request are created.

  2. Select Continue and press Enter.

  3. Provide the settings for the certificate.

  4. Select OK and press Enter.

  5. Open the web browser and enter the displayed URL.

  6. Download the PEM file.

    → The GOS administration menu displays a message to verify that the CSR has not been tampered with.

  7. Verify the information by pressing Enter.

    Note

    When the certificate is signed it has to be uploaded to the GSM. The upload is not done in the first setup wizard, but in the later GOS administration menu as described in Chapter 7.2.3.1.3.2, steps 1 – 4 and 11 – 14.

2. Creating a Web Administrator

If there is no web administrator, it is asked whether such an account should be created (see Fig. 5.6).

Note

A web administrator is required to use the web interface of the GSM.

_images/first_setup_wizard_7.png

Fig. 5.6 Creating a web administrator

  1. Select Yes and press Enter.

  2. Enter the user name for the web administrator.

  3. Enter the password for the web administrator twice.

  4. Select OK and press Enter.

    → A message informs that the web administrator has been created.

  5. Press Enter to close the message.

3. Entering or Uploading a Greenbone Security Feed (GSF) Subscription Key

If no valid GSF subscription key is stored on the appliance, the appliance only uses the public Greenbone Community Feed (GCF) and not the GSF. A GSF subscription key can be entered or uploaded as follows:

  1. Select Editor and press Enter (see Fig. 5.7).

    → The editor is opened.

    _images/first_setup_wizard_9.png

    Fig. 5.7 Entering or uploading a GSF subscription key

  2. Enter the subscription key.

  3. Press Ctrl + X.

  4. Press Y to save the changes.

  5. Press Enter.

    or

  1. Select HTTP Upload and press Enter.
  2. Open the web browser and enter the displayed URL.
  3. Click Browse..., select the subscription key and click Upload.

4. Downloading the Feed

If no feed is present on the GSM, the feed can be downloaded as follows:

  1. Select Yes and press Enter (see Fig. 5.8).

    _images/first_setup_wizard_4.png

    Fig. 5.8 Downloading the feed

    → A message informs that the feed update was started in the background (see Fig. 5.9).

    _images/first_setup_wizard_5.png

    Fig. 5.9 Downloading the feed

  2. Press Enter to close the message.

5. Finishing the First Setup Wizard

Note

After the last step, a status check is performed. A message shows the result (see Fig. 5.10).

After closing the message by pressing Enter the GOS administration menu can be used as described in Chapter 7.

If there are any unfinished or skipped steps, the first setup wizard is shown when logging in again.

_images/first_setup_wizard_6.png

Fig. 5.10 Result of the status check

5.1.5. Logging into the Web Interface

The main interface of the GSM is the web interface, also called Greenbone Security Assistant (GSA). The web interface can be accessed as described in Chapter 8.1.

5.2. GSM 400/450/600/650

This setup guide shows the steps required to put a GSM 400, GSM 450, GSM 600 or GSM 650 appliance into operation.

The following checklist can be used to monitor the progress:

Step Done
Power supply established (1 connector)  
Networking cables connected  
Console access established  
Keyboard layout selected  
IP address configured  
DNS server configured  
SSH service enabled (optional)  
SSL certificate created  
Web user account created  
GOS selfcheck run  

5.2.1. Installing the Appliance

The GSM 400, GSM 450, GSM 600 and GSM 650 are 19-inch mountable and require one rack unit (RU). Rack holders for the installation in a 19-inch rack are supplied.

For cabling GSM 400, GSM 450, GSM 600 and GSM 650 appliances have corresponding connectors at the front and back:

  • Front
    • 1 RS-232 serial port, Cisco compatible, suitable cable is enclosed
    • 2 USB 3.0 ports
    • 6 RJ45 Ethernet ports
    • 2 SFP Ethernet ports
  • Back
    • 1 VGA port
    • 1 power supply

The installation requires either a monitor and a keyboard or a serial console connection and a terminal application.

5.2.2. Utilizing the Serial Port

The enclosed console cable is used for utilizing the serial port. Alternatively, a blue Cisco console cable (rollover cable) can be used.

To access the serial port a terminal application is required. The application needs to be configured to a speed of 9600 bits/s (Baud).

In Linux the command screen can be used in the command line to access the serial port by passing the device providing the serial port as parameter:

screen /dev/ttyS0  #(for serial port)
screen /dev/ttyUSB0 #(for USB adapter)

Tip

After starting screen, it may be necessary to press Enter several times to see a command prompt.

To close the serial connection, press Ctrl + a and immediately afterwards \.

In Microsoft Windows the PuTTY application can be used. After starting it, the options as shown in Fig. 5.11 and the appropriate serial port have to be selected.

_images/putty_serial.png

Fig. 5.11 Setting up the serial port in PuTTY

5.2.3. Starting the Appliance

Once the appliance is fully wired, a connection to the appliance using the console cable is achieved and the terminal application (PuTTY, screen or similar) is set up, the appliance can be started.

The appliance will boot and after short time – depending on the exact model – the first messages will be displayed in the terminal application.

5.2.4. Performing a General System Setup

All GSM appliances share the same way of basic configuration and readiness check.

When the GSM is delivered by Greenbone Networks or after a factory reset, the GOS administration menu shows the first setup wizard after logging in to assist with the basic GOS configuration (see Fig. 5.12).

_images/first_setup_wizard_1.png

Fig. 5.12 Using the first setup wizard

By selecting Yes and pressing Enter the first setup wizard is opened and can be used as follows:

Note

By selecting No and pressing Enter the wizard can be closed. Steps which have not been completed yet are displayed when logging in again.

By selecting Cancel and pressing Enter the wizard can be closed as well. However, in this case, incomplete steps are not shown again.

The first setup wizard is dynamic and shows only those steps necessary to operate the used GSM type. In the following, all possible steps are mentioned but they may not appear in every case.

In case of a factory reset, all steps have to be carried out (see 20.4).

Every step can be skipped by selecting Skip or No and pressing Enter. Skipped steps are displayed when logging in again.

1. Importing or Generating an HTTPS Certificate

An HTTPS certificate has to be present on the GSM to use the web interface securely. The certificate can be imported or generated as follows:

  1. Select Import and press Enter (see Fig. 5.13).

    → A message informs that a PKCS#12 file can be imported.

    _images/first_setup_wizard_2.png

    Fig. 5.13 Importing or generating an HTTPS certificate

  2. Select Continue and press Enter.

  3. Open the web browser and enter the displayed URL.

  4. Click Browse..., select the PKCS#12 file and click Upload.

    → When the certificate is retrieved by the GSM, the GOS administration menu displays the fingerprint of the certificate for verification.

  5. Check the fingerprint and confirm the certificate by pressing Enter.

    or

  1. Select Generate and press Enter.

    → A message informs that parameters have to be entered to generate the certificate.

  2. Select Continue and press Enter.

  3. Provide the settings for the certificate (see Fig. 5.14).

    _images/first_setup_wizard_3.png

    Fig. 5.14 Entering information for the certificate

  4. Select OK and press Enter.

    → A message informs that the certificate is created and can be downloaded (see Fig. 5.15).

    Note

    The download is not done in the first setup wizard, but in the later GOS administration menu as described in Chapter 7.2.3.1.3.1, steps 1 – 4 and 9 – 13.

    _images/first_setup_wizard_8.png

    Fig. 5.15 Entering information for the certificate

    or

  1. Select CSR and press Enter.

    → A message informs that a key pair and a certificate request are created.

  2. Select Continue and press Enter.

  3. Provide the settings for the certificate.

  4. Select OK and press Enter.

  5. Open the web browser and enter the displayed URL.

  6. Download the PEM file.

    → The GOS administration menu displays a message to verify that the CSR has not been tampered with.

  7. Verify the information by pressing Enter.

    Note

    When the certificate is signed it has to be uploaded to the GSM. The upload is not done in the first setup wizard, but in the later GOS administration menu as described in Chapter 7.2.3.1.3.2, steps 1 – 4 and 11 – 14.

2. Creating a Web Administrator

If there is no web administrator, it is asked whether such an account should be created (see Fig. 5.16).

Note

A web administrator is required to use the web interface of the GSM.

_images/first_setup_wizard_7.png

Fig. 5.16 Creating a web administrator

  1. Select Yes and press Enter.

  2. Enter the user name for the web administrator.

  3. Enter the password for the web administrator twice.

  4. Select OK and press Enter.

    → A message informs that the web administrator has been created.

  5. Press Enter to close the message.

3. Entering or Uploading a Greenbone Security Feed (GSF) Subscription Key

If no valid GSF subscription key is stored on the appliance, the appliance only uses the public Greenbone Community Feed (GCF) and not the GSF. A GSF subscription key can be entered or uploaded as follows:

  1. Select Editor and press Enter (see Fig. 5.17).

    → The editor is opened.

    _images/first_setup_wizard_9.png

    Fig. 5.17 Entering or uploading a GSF subscription key

  2. Enter the subscription key.

  3. Press Ctrl + X.

  4. Press Y to save the changes.

  5. Press Enter.

    or

  1. Select HTTP Upload and press Enter.
  2. Open the web browser and enter the displayed URL.
  3. Click Browse..., select the subscription key and click Upload.

4. Downloading the Feed

If no feed is present on the GSM, the feed can be downloaded as follows:

  1. Select Yes and press Enter (see Fig. 5.18).

    _images/first_setup_wizard_4.png

    Fig. 5.18 Downloading the feed

    → A message informs that the feed update was started in the background (see Fig. 5.19).

    _images/first_setup_wizard_5.png

    Fig. 5.19 Downloading the feed

  2. Press Enter to close the message.

5. Finishing the First Setup Wizard

Note

After the last step, a status check is performed. A message shows the result (see Fig. 5.20).

After closing the message by pressing Enter the GOS administration menu can be used as described in Chapter 7.

If there are any unfinished or skipped steps, the first setup wizard is shown when logging in again.

_images/first_setup_wizard_6.png

Fig. 5.20 Result of the status check

5.2.5. Logging into the Web Interface

The main interface of the GSM is the web interface, also called Greenbone Security Assistant (GSA). The web interface can be accessed as described in Chapter 8.1.

5.3. GSM 150

This setup guide shows the steps required to put a GSM 150 appliance into operation.

The following checklist can be used to monitor the progress:

Step Done
Power supply established (1 connector)  
Networking cables connected  
Console access established  
Keyboard layout selected  
IP address configured  
DNS server configured  
SSH service enabled (optional)  
SSL certificate created  
Web user account created  
GOS selfcheck run  

5.3.1. Installing the Appliance

The GSM 150 is 19-inch mountable and requires one rack unit (RU). The optional RACKMOUNT150 kit provides the rack holders for installing the appliance in a 19-inch rack.

For stand-alone appliances four self-sticking rubber pads have to be mounted on the corresponding bottom side embossments.

For cabling the GSM 150 appliance has corresponding connectors at the front and back:

  • Front
    • 1 RS-232 serial port, Cisco compatible, suitable cable is enclosed
    • 2 USB 3.0 ports
    • 1 HDMI port
    • 4 RJ45 Ethernet ports
  • Back
    • 1 power supply

The installation requires either a monitor and a keyboard or a serial console connection and a terminal application.

5.3.2. Utilizing the Serial Port

The enclosed console cable is used for utilizing the serial port. Alternatively, a blue Cisco console cable (rollover cable) can be used.

To access the serial port a terminal application is required. The application needs to be configured to a speed of 9600 bits/s (Baud).

In Linux the command screen can be used in the command line to access the serial port by passing the device providing the serial port as parameter:

screen /dev/ttyS0  #(for serial port)
screen /dev/ttyUSB0 #(for USB adapter)

Tip

After starting screen, it may be necessary to press Enter several times to see a command prompt.

To close the serial connection, press Ctrl + a and immediately afterwards \.

In Microsoft Windows the PuTTY application can be used. After starting it, the options as shown in Fig. 5.21 and the appropriate serial port have to be selected.

_images/putty_serial.png

Fig. 5.21 Setting up the serial port in PuTTY

5.3.3. Starting the Appliance

Once the appliance is fully wired, a connection to the appliance using the console cable is achieved and the terminal application (PuTTY, screen or similar) is set up, the appliance can be started.

The appliance will boot and after short time – depending on the exact model – the first messages will be displayed in the terminal application.

5.3.4. Performing a General System Setup

All GSM appliances share the same way of basic configuration and readiness check.

When the GSM is delivered by Greenbone Networks or after a factory reset, the GOS administration menu shows the first setup wizard after logging in to assist with the basic GOS configuration (see Fig. 5.22).

_images/first_setup_wizard_1.png

Fig. 5.22 Using the first setup wizard

By selecting Yes and pressing Enter the first setup wizard is opened and can be used as follows:

Note

By selecting No and pressing Enter the wizard can be closed. Steps which have not been completed yet are displayed when logging in again.

By selecting Cancel and pressing Enter the wizard can be closed as well. However, in this case, incomplete steps are not shown again.

The first setup wizard is dynamic and shows only those steps necessary to operate the used GSM type. In the following, all possible steps are mentioned but they may not appear in every case.

In case of a factory reset, all steps have to be carried out (see 20.4).

Every step can be skipped by selecting Skip or No and pressing Enter. Skipped steps are displayed when logging in again.

1. Importing or Generating an HTTPS Certificate

An HTTPS certificate has to be present on the GSM to use the web interface securely. The certificate can be imported or generated as follows:

  1. Select Import and press Enter (see Fig. 5.23).

    → A message informs that a PKCS#12 file can be imported.

    _images/first_setup_wizard_2.png

    Fig. 5.23 Importing or generating an HTTPS certificate

  2. Select Continue and press Enter.

  3. Open the web browser and enter the displayed URL.

  4. Click Browse..., select the PKCS#12 file and click Upload.

    → When the certificate is retrieved by the GSM, the GOS administration menu displays the fingerprint of the certificate for verification.

  5. Check the fingerprint and confirm the certificate by pressing Enter.

    or

  1. Select Generate and press Enter.

    → A message informs that parameters have to be entered to generate the certificate.

  2. Select Continue and press Enter.

  3. Provide the settings for the certificate (see Fig. 5.24).

    _images/first_setup_wizard_3.png

    Fig. 5.24 Entering information for the certificate

  4. Select OK and press Enter.

    → A message informs that the certificate is created and can be downloaded (see Fig. 5.25).

    Note

    The download is not done in the first setup wizard, but in the later GOS administration menu as described in Chapter 7.2.3.1.3.1, steps 1 – 4 and 9 – 13.

    _images/first_setup_wizard_8.png

    Fig. 5.25 Entering information for the certificate

    or

  1. Select CSR and press Enter.

    → A message informs that a key pair and a certificate request are created.

  2. Select Continue and press Enter.

  3. Provide the settings for the certificate.

  4. Select OK and press Enter.

  5. Open the web browser and enter the displayed URL.

  6. Download the PEM file.

    → The GOS administration menu displays a message to verify that the CSR has not been tampered with.

  7. Verify the information by pressing Enter.

    Note

    When the certificate is signed it has to be uploaded to the GSM. The upload is not done in the first setup wizard, but in the later GOS administration menu as described in Chapter 7.2.3.1.3.2, steps 1 – 4 and 11 – 14.

2. Creating a Web Administrator

If there is no web administrator, it is asked whether such an account should be created (see Fig. 5.26).

Note

A web administrator is required to use the web interface of the GSM.

_images/first_setup_wizard_7.png

Fig. 5.26 Creating a web administrator

  1. Select Yes and press Enter.

  2. Enter the user name for the web administrator.

  3. Enter the password for the web administrator twice.

  4. Select OK and press Enter.

    → A message informs that the web administrator has been created.

  5. Press Enter to close the message.

3. Entering or Uploading a Greenbone Security Feed (GSF) Subscription Key

If no valid GSF subscription key is stored on the appliance, the appliance only uses the public Greenbone Community Feed (GCF) and not the GSF. A GSF subscription key can be entered or uploaded as follows:

  1. Select Editor and press Enter (see Fig. 5.27).

    → The editor is opened.

    _images/first_setup_wizard_9.png

    Fig. 5.27 Entering or uploading a GSF subscription key

  2. Enter the subscription key.

  3. Press Ctrl + X.

  4. Press Y to save the changes.

  5. Press Enter.

    or

  1. Select HTTP Upload and press Enter.
  2. Open the web browser and enter the displayed URL.
  3. Click Browse..., select the subscription key and click Upload.

4. Downloading the Feed

If no feed is present on the GSM, the feed can be downloaded as follows:

  1. Select Yes and press Enter (see Fig. 5.28).

    _images/first_setup_wizard_4.png

    Fig. 5.28 Downloading the feed

    → A message informs that the feed update was started in the background (see Fig. 5.29).

    _images/first_setup_wizard_5.png

    Fig. 5.29 Downloading the feed

  2. Press Enter to close the message.

5. Finishing the First Setup Wizard

Note

After the last step, a status check is performed. A message shows the result (see Fig. 5.30).

After closing the message by pressing Enter the GOS administration menu can be used as described in Chapter 7.

If there are any unfinished or skipped steps, the first setup wizard is shown when logging in again.

_images/first_setup_wizard_6.png

Fig. 5.30 Result of the status check

5.3.5. Logging into the Web Interface

The main interface of the GSM is the web interface, also called Greenbone Security Assistant (GSA). The web interface can be accessed as described in Chapter 8.1.

5.4. GSM 35

This setup guide shows the steps required to put a GSM 35 sensor appliance into operation.

The following checklist can be used to monitor the progress:

Step Done
Power supply established (1 connector)  
Networking cables connected  
Console access established  
Keyboard layout selected  
IP address configured  
DNS server configured  
SSH service enabled (optional)  
SSL certificate created  
Scan user account created  
GOS selfcheck run  

5.4.1. Installing the Appliance

The GSM 35 is 19-inch mountable and requires one rack unit (RU). The optional RACKMOUNT35 kit provides the rack holders for installing the appliance in a 19-inch rack.

For stand-alone appliances four self-sticking rubber pads have to be mounted on the corresponding bottom side embossments.

For cabling the GSM 35 appliance has corresponding connectors at the front and back:

  • Front
    • 1 RS-232 serial port, Cisco compatible, suitable cable is enclosed
    • 2 USB 3.0 ports
    • 1 HDMI port
    • 4 RJ45 Ethernet ports
  • Back
    • 1 power supply

The installation requires either a monitor and a keyboard or a serial console connection and a terminal application.

5.4.2. Utilizing the Serial Port

The enclosed console cable is used for utilizing the serial port. Alternatively, a blue Cisco console cable (rollover cable) can be used.

To access the serial port a terminal application is required. The application needs to be configured to a speed of 9600 bits/s (Baud).

In Linux the command screen can be used in the command line to access the serial port by passing the device providing the serial port as parameter:

screen /dev/ttyS0  #(for serial port)
screen /dev/ttyUSB0 #(for USB adapter)

Tip

After starting screen, it may be necessary to press Enter several times to see a command prompt.

To close the serial connection, press Ctrl + a and immediately afterwards \.

In Microsoft Windows the PuTTY application can be used. After starting it, the options as shown in Fig. 5.31 and the appropriate serial port have to be selected.

_images/putty_serial.png

Fig. 5.31 Setting up the serial port in PuTTY

5.4.3. Starting the Appliance

Once the appliance is fully wired, a connection to the appliance using the console cable is achieved and the terminal application (PuTTY, screen or similar) is set up, the appliance can be started.

The appliance will boot and after short time – depending on the exact model – the first messages will be displayed in the terminal application.

5.4.4. Performing a General System Setup

All GSM appliances share the same way of basic configuration and readiness check.

However, since the GSM 35 is a dedicated sensor, some setup steps differ from those of other appliances:

  • A scan user account has to be created instead of a web administrator account.
  • The master key has to be exchanged with the sensor.

When the GSM is delivered by Greenbone Networks or after a factory reset, the GOS administration menu shows the first setup wizard after logging in to assist with the basic GOS configuration (see Fig. 5.32).

_images/first_setup_wizard_1.png

Fig. 5.32 Using the first setup wizard

By selecting Yes and pressing Enter the first setup wizard is opened and can be used as follows:

Note

By selecting No and pressing Enter the wizard can be closed. Steps which have not been completed yet are displayed when logging in again.

By selecting Cancel and pressing Enter the wizard can be closed as well. However, in this case, incomplete steps are not shown again.

The first setup wizard is dynamic and shows only those steps necessary to operate the used GSM type. In the following, all possible steps are mentioned but they may not appear in every case.

In case of a factory reset, all steps have to be carried out (see 20.4).

Every step can be skipped by selecting Skip or No and pressing Enter. Skipped steps are displayed when logging in again.

1. Importing or Generating an HTTPS Certificate

An HTTPS certificate has to be present on the GSM to use the web interface securely. The certificate can be imported or generated as follows:

  1. Select Import and press Enter (see Fig. 5.33).

    → A message informs that a PKCS#12 file can be imported.

    _images/first_setup_wizard_2.png

    Fig. 5.33 Importing or generating an HTTPS certificate

  2. Select Continue and press Enter.

  3. Open the web browser and enter the displayed URL.

  4. Click Browse..., select the PKCS#12 file and click Upload.

    → When the certificate is retrieved by the GSM, the GOS administration menu displays the fingerprint of the certificate for verification.

  5. Check the fingerprint and confirm the certificate by pressing Enter.

    or

  1. Select Generate and press Enter.

    → A message informs that parameters have to be entered to generate the certificate.

  2. Select Continue and press Enter.

  3. Provide the settings for the certificate (see Fig. 5.34).

    _images/first_setup_wizard_3.png

    Fig. 5.34 Entering information for the certificate

  4. Select OK and press Enter.

    → A message informs that the certificate is created and can be downloaded (see Fig. 5.35).

    Note

    The download is not done in the first setup wizard, but in the later GOS administration menu as described in Chapter 7.2.3.1.3.1, steps 1 – 4 and 9 – 13.

    _images/first_setup_wizard_8.png

    Fig. 5.35 Entering information for the certificate

    or

  1. Select CSR and press Enter.

    → A message informs that a key pair and a certificate request are created.

  2. Select Continue and press Enter.

  3. Provide the settings for the certificate.

  4. Select OK and press Enter.

  5. Open the web browser and enter the displayed URL.

  6. Download the PEM file.

    → The GOS administration menu displays a message to verify that the CSR has not been tampered with.

  7. Verify the information by pressing Enter.

    Note

    When the certificate is signed it has to be uploaded to the GSM. The upload is not done in the first setup wizard, but in the later GOS administration menu as described in Chapter 7.2.3.1.3.2, steps 1 – 4 and 11 – 14.

2. Creating a Scan User

If there is no scan user, it is asked whether such an account should be created.

  1. Select Yes and press Enter.

  2. Enter the user name for the scan user.

  3. Enter the password for the scan user twice.

  4. Select OK and press Enter.

    → A message informs that the scan user has been created.

  5. Press Enter to close the message.

3. Entering or Uploading a Greenbone Security Feed (GSF) Subscription Key

If no valid GSF subscription key is stored on the appliance, the appliance only uses the public Greenbone Community Feed (GCF) and not the GSF. A GSF subscription key can be entered or uploaded as follows:

  1. Select Editor and press Enter (see Fig. 5.36).

    → The editor is opened.

    _images/first_setup_wizard_9.png

    Fig. 5.36 Entering or uploading a GSF subscription key

  2. Enter the subscription key.

  3. Press Ctrl + X.

  4. Press Y to save the changes.

  5. Press Enter.

    or

  1. Select HTTP Upload and press Enter.
  2. Open the web browser and enter the displayed URL.
  3. Click Browse..., select the subscription key and click Upload.

4. Downloading the Feed

If no feed is present on the GSM, the feed can be downloaded as follows:

  1. Select Yes and press Enter (see Fig. 5.37).

    _images/first_setup_wizard_4.png

    Fig. 5.37 Downloading the feed

    → A message informs that the feed update was started in the background (see Fig. 5.38).

    _images/first_setup_wizard_5.png

    Fig. 5.38 Downloading the feed

  2. Press Enter to close the message.

5. Finishing the First Setup Wizard

Note

After the last step, a status check is performed. A message shows the result (see Fig. 5.39).

After closing the message by pressing Enter the GOS administration menu can be used as described in Chapter 7.

If there are any unfinished or skipped steps, the first setup wizard is shown when logging in again.

_images/first_setup_wizard_6.png

Fig. 5.39 Result of the status check

6. Exchanging the Master Key with the Sensor

Continue with Chapter 16 to exchange the keys with the master.

Note

The GSM 35 does not offer any web interface. The sensor is solely managed by the master. Logging into the sensor is possible by using the console and SSH from the master.

If the communication between master and sensor fails, the rule set of any internal firewall governing the network connection may be adjusted.

5.5. GSM 150V/CENO/DECA/TERA/PETA/EXA

This setup guide shows the steps required to put a GSM 150V/CENO, GSM DECA, GSM TERA, GSM PETA or GSM EXA appliance into operation.

The following checklist can be used to monitor the progress:

Step Done
VMware ESXi installed  
Integrity verified (optional)  
OVA file imported  
Virtual machine settings checked  
Keyboard layout selected  
IP address configured  
DNS server configured  
SSH service enabled (optional)  
SSL certificate created  
Web user account created  
GOS selfcheck run  

5.5.1. Setup Requirements

This section lists the requirements for successfully deploying a GSM 150V/CENO, GSM DECA, GSM TERA, GSM PETA or GSM EXA appliance. All requirements have to be met.

5.5.1.1. Resources

The virtual appliances require at least the following resources:

GSM 150V/CENO

  • 2 virtual CPUs
  • 8 GB RAM
  • 32 GB hard disk

GSM DECA

  • 4 virtual CPUs
  • 8 GB RAM
  • 140 GB hard disk

GSM TERA

  • 6 virtual CPUs
  • 8 GB RAM
  • 140 GB hard disk

GSM PETA

  • 8 virtual CPUs
  • 16 GB RAM
  • 140 GB hard disk

GSM EXA

  • 12 virtual CPUs
  • 24 GB RAM
  • 140 GB hard disk

5.5.1.2. Supported Hypervisor

While a GSM 150V/CENO/DECA/TERA/PETA/EXA can be run on various hypervisors, currently only VMware hypervisors are officially supported.

Each GSM 150V/CENO/DECA/TERA/PETA/EXA is delivered in hardware version 9 format. For VMware ESXi/ESX version 5.1 or higher is required.

5.5.1.3. Verification of Integrity

Note

The integrity of the virtual appliance can be verified. On request the Greenbone Networks Support provides an integrity checksum.

To request the checksum contact the Greenbone Networks Support via e-mail (support@greenbone.net) including the subscription number.

The integrity checksum can be provided via phone or via support portal at https://support.greenbone.net. Specify the preferred channel in the e-mail.

The local verification of the checksum depends on the host operating system.

On Linux systems the following command for calculating the checksum for the GSM 150V/CENO/DECA/TERA/PETA/EXA can be used:

sha256sum GSM-150V-5.0.4-gsf201906301.ova

Note

The commands for the other GSM types differ according to the GSM type and the GSF subscription key.

On Microsoft Windows systems an appropriate program has to be installed first.

Tip

Rehash may be used which can be found at http://rehash.sourceforge.net.

To calculate the checksum, use:

rehash.exe -none -sha256 C:\<path>\GSM-150V-5.0.4-gsf201906301.ova

Note

The commands for the other GSM types differ according to the GSM type and the GSF subscription key.

If the checksum does not match the checksum provided by the Greenbone Networks Support, the virtual appliance has been modified and should not be used.

5.5.2. Deploying the Appliance

The virtual appliance is provided by Greenbone Networks in the Open Virtualization Appliance (OVA) format.

Each GSM 150V/CENO/DECA/TERA/PETA/EXA is activated using a unique subscription key.

Note

Cloning the GSM 150V/CENO/DECA/TERA/PETA/EXA and using several instances in parallel is not permitted and can result in inconsistencies and unwanted side effects.

To deploy a GSM 150V/CENO/DECA/TERA/PETA/EXA, it has to be imported into the hypervisor of choice as follows:

Note

The example features VMware ESXi, but is also applicable for VMware vSphere.

The figures show the installation of a GSM 150V. The installation of a GSM CENO/DECA/TERA/PETA/EXA is carried out equivalently. File names used in the example differ based on the GSM type and the GSF subscription key.

  1. Install VMware ESXi for the current operating system.

  2. Open the web interface of the VMware ESXi instance and log in.

  3. Click Virtual Machines in the Navigator column on the left.

  4. Click create_register_vm Create / Register VM.

  5. Select Deploy a virtual machine from an OVF or OVA file and click Next (see Fig. 5.40).

    _images/vmware_2.png

    Fig. 5.40 Selecting the creation type

  6. Enter a name for the virtual machine in the input box.

  7. Click Click to select files or drag/drop, select the OVA file of the appliance and click Next.

  8. Select the storage location in which to store the virtual machine files and click Next.

  9. Adjust the deployment options as required and click Next.

    Note

    The default deployment settings may be used.

  10. Check the configuration of the virtual machine (see Fig. 5.41).

    Tip

    Settings can be changed by clicking Back and adjusting them in the respective dialog.

    _images/25v-150v_setup_vmware_readycomplete.png

    Fig. 5.41 Checking the configuration of the virtual machine

  11. Click Finish.

    → The appliance is being imported. This can take up to 10 minutes.

    Important

    Do not refresh the browser while the virtual machine is being deployed.

  12. When the appliance is imported, click Virtual Machines in the Navigator column on the left.

  13. Select the appliance in the list and click vm_poweron Power on (see Fig. 5.42).

    _images/vmware_3.png

    Fig. 5.42 Imported virtual machine

5.5.3. Performing a General System Setup

All GSM appliances share the same way of basic configuration and readiness check.

When the GSM is delivered by Greenbone Networks or after a factory reset, the GOS administration menu shows the first setup wizard after logging in to assist with the basic GOS configuration (see Fig. 5.43).

_images/first_setup_wizard_1.png

Fig. 5.43 Using the first setup wizard

By selecting Yes and pressing Enter the first setup wizard is opened and can be used as follows:

Note

By selecting No and pressing Enter the wizard can be closed. Steps which have not been completed yet are displayed when logging in again.

By selecting Cancel and pressing Enter the wizard can be closed as well. However, in this case, incomplete steps are not shown again.

The first setup wizard is dynamic and shows only those steps necessary to operate the used GSM type. In the following, all possible steps are mentioned but they may not appear in every case.

In case of a factory reset, all steps have to be carried out (see 20.4).

Every step can be skipped by selecting Skip or No and pressing Enter. Skipped steps are displayed when logging in again.

1. Importing or Generating an HTTPS Certificate

An HTTPS certificate has to be present on the GSM to use the web interface securely. The certificate can be imported or generated as follows:

  1. Select Import and press Enter (see Fig. 5.44).

    → A message informs that a PKCS#12 file can be imported.

    _images/first_setup_wizard_2.png

    Fig. 5.44 Importing or generating an HTTPS certificate

  2. Select Continue and press Enter.

  3. Open the web browser and enter the displayed URL.

  4. Click Browse..., select the PKCS#12 file and click Upload.

    → When the certificate is retrieved by the GSM, the GOS administration menu displays the fingerprint of the certificate for verification.

  5. Check the fingerprint and confirm the certificate by pressing Enter.

    or

  1. Select Generate and press Enter.

    → A message informs that parameters have to be entered to generate the certificate.

  2. Select Continue and press Enter.

  3. Provide the settings for the certificate (see Fig. 5.45).

    _images/first_setup_wizard_3.png

    Fig. 5.45 Entering information for the certificate

  4. Select OK and press Enter.

    → A message informs that the certificate is created and can be downloaded (see Fig. 5.46).

    Note

    The download is not done in the first setup wizard, but in the later GOS administration menu as described in Chapter 7.2.3.1.3.1, steps 1 – 4 and 9 – 13.

    _images/first_setup_wizard_8.png

    Fig. 5.46 Entering information for the certificate

    or

  1. Select CSR and press Enter.

    → A message informs that a key pair and a certificate request are created.

  2. Select Continue and press Enter.

  3. Provide the settings for the certificate.

  4. Select OK and press Enter.

  5. Open the web browser and enter the displayed URL.

  6. Download the PEM file.

    → The GOS administration menu displays a message to verify that the CSR has not been tampered with.

  7. Verify the information by pressing Enter.

    Note

    When the certificate is signed it has to be uploaded to the GSM. The upload is not done in the first setup wizard, but in the later GOS administration menu as described in Chapter 7.2.3.1.3.2, steps 1 – 4 and 11 – 14.

2. Creating a Web Administrator

If there is no web administrator, it is asked whether such an account should be created (see Fig. 5.47).

Note

A web administrator is required to use the web interface of the GSM.

_images/first_setup_wizard_7.png

Fig. 5.47 Creating a web administrator

  1. Select Yes and press Enter.

  2. Enter the user name for the web administrator.

  3. Enter the password for the web administrator twice.

  4. Select OK and press Enter.

    → A message informs that the web administrator has been created.

  5. Press Enter to close the message.

3. Entering or Uploading a Greenbone Security Feed (GSF) Subscription Key

If no valid GSF subscription key is stored on the appliance, the appliance only uses the public Greenbone Community Feed (GCF) and not the GSF. A GSF subscription key can be entered or uploaded as follows:

  1. Select Editor and press Enter (see Fig. 5.48).

    → The editor is opened.

    _images/first_setup_wizard_9.png

    Fig. 5.48 Entering or uploading a GSF subscription key

  2. Enter the subscription key.

  3. Press Ctrl + X.

  4. Press Y to save the changes.

  5. Press Enter.

    or

  1. Select HTTP Upload and press Enter.
  2. Open the web browser and enter the displayed URL.
  3. Click Browse..., select the subscription key and click Upload.

4. Downloading the Feed

If no feed is present on the GSM, the feed can be downloaded as follows:

  1. Select Yes and press Enter (see Fig. 5.49).

    _images/first_setup_wizard_4.png

    Fig. 5.49 Downloading the feed

    → A message informs that the feed update was started in the background (see Fig. 5.50).

    _images/first_setup_wizard_5.png

    Fig. 5.50 Downloading the feed

  2. Press Enter to close the message.

5. Finishing the First Setup Wizard

Note

After the last step, a status check is performed. A message shows the result (see Fig. 5.51).

After closing the message by pressing Enter the GOS administration menu can be used as described in Chapter 7.

If there are any unfinished or skipped steps, the first setup wizard is shown when logging in again.

_images/first_setup_wizard_6.png

Fig. 5.51 Result of the status check

5.5.4. Logging into the Web Interface

The main interface of the GSM is the web interface, also called Greenbone Security Assistant (GSA). The web interface can be accessed as described in Chapter 8.1.

5.6. GSM 25V

This setup guide shows the steps required to put a GSM 25V sensor appliance into operation.

The following checklist can be used to monitor the progress:

Step Done
VMware ESXi installed  
Integrity verified (optional)  
OVA file imported  
Virtual machine settings checked  
Keyboard layout selected  
IP address configured  
DNS server configured  
SSH service enabled (optional)  
SSL certificate created  
Scan user account created  
GOS selfcheck run  

5.6.1. Setup Requirements

This section lists the requirements for successfully deploying the GSM 25V appliance. All requirements have to be met.

5.6.1.1. Resources

The virtual appliance requires at least the following resources:

  • 2 virtual CPUs
  • 4 GB RAM
  • 16 GB hard disk

5.6.1.2. Supported Hypervisor

While the GSM 25V can be run on various hypervisors, currently only VMware hypervisors are officially supported.

Each GSM 25V is delivered in hardware version 9 format. For VMware ESXi/ESX version 5.1 or higher is required.

5.6.1.3. Verification of Integrity

Note

The integrity of the virtual appliance can be verified. On request the Greenbone Networks Support provides an integrity checksum.

To request the checksum contact the Greenbone Networks Support via e-mail (support@greenbone.net) including the subscription number.

The integrity checksum can be provided via phone or via support portal at https://support.greenbone.net. Specify the preferred channel in the e-mail.

The local verification of the checksum depends on the host operating system.

On Linux systems the following command for calculating the checksum for the GSM 25V can be used:

sha256sum GSM-25V-5.0.4-gsf201906301.ova

On Microsoft Windows systems an appropriate program has to be installed first.

Tip

Rehash may be used which can be found at http://rehash.sourceforge.net.

To calculate the checksum, use:

rehash.exe -none -sha256 C:\<path>\GSM-25V-5.0.4-gsf201906301.ova

If the checksum does not match the checksum provided by the Greenbone Networks Support, the virtual appliance has been modified and should not be used.

5.6.2. Deploying the Appliance

The GSM 25V is provided by Greenbone Networks in the Open Virtualization Appliance (OVA) format.

Each GSM 25V is activated using a unique subscription key.

Note

Cloning the GSM 25V and using several instances in parallel is not permitted because and can result in inconsistencies and unwanted side effects.

To deploy the GSM 25V, it has to be imported into the hypervisor of choice as follows:

Note

The example features VMware ESXi, but is also applicable for VMware vSphere.

The figures show the installation of a GSM 150V. The installation of a GSM 25V is carried out equivalently. File names used in the example differ based on the GSM type and the GSF subscription key.

  1. Install VMware ESXi for the current operating system.

  2. Open the web interface of the VMware ESXi instance and log in.

  3. Click Virtual Machines in the Navigator column on the left.

  4. Click create_register_vm Create / Register VM.

  5. Select Deploy a virtual machine from an OVF or OVA file and click Next (see Fig. 5.52).

    _images/vmware_2.png

    Fig. 5.52 Selecting the creation type

  6. Enter a name for the virtual machine in the input box.

  7. Click Click to select files or drag/drop, select the OVA file of the appliance and click Next.

  8. Select the storage location in which to store the virtual machine files and click Next.

  9. Adjust the deployment options as required and click Next.

    Note

    The default deployment settings may be used.

  10. Check the configuration of the virtual machine (see Fig. 5.53).

    Tip

    Settings can be changed by clicking Back and adjusting them in the respective dialog.

    _images/25v-150v_setup_vmware_readycomplete.png

    Fig. 5.53 Checking the configuration of the virtual machine

  11. Click Finish.

    → The appliance is being imported. This can take up to 10 minutes.

    Important

    Do not refresh the browser while the virtual machine is being deployed.

  12. When the appliance is imported, click Virtual Machines in the Navigator column on the left.

  13. Select the appliance in the list and click vm_poweron Power on (see Fig. 5.54).

    _images/vmware_3.png

    Fig. 5.54 Imported virtual machine

5.6.3. Performing a General System Setup

All GSM appliances share the same way of basic configuration and readiness check.

However, since the GSM 25V is a dedicated sensor, some setup steps differ from those of other appliances:

  • A scan user account has to be created instead of a web administrator account.
  • The master key has to be exchanged with the sensor.

When the GSM is delivered by Greenbone Networks or after a factory reset, the GOS administration menu shows the first setup wizard after logging in to assist with the basic GOS configuration (see Fig. 5.55).

_images/first_setup_wizard_1.png

Fig. 5.55 Using the first setup wizard

By selecting Yes and pressing Enter the first setup wizard is opened and can be used as follows:

Note

By selecting No and pressing Enter the wizard can be closed. Steps which have not been completed yet are displayed when logging in again.

By selecting Cancel and pressing Enter the wizard can be closed as well. However, in this case, incomplete steps are not shown again.

The first setup wizard is dynamic and shows only those steps necessary to operate the used GSM type. In the following, all possible steps are mentioned but they may not appear in every case.

In case of a factory reset, all steps have to be carried out (see 20.4).

Every step can be skipped by selecting Skip or No and pressing Enter. Skipped steps are displayed when logging in again.

1. Importing or Generating an HTTPS Certificate

An HTTPS certificate has to be present on the GSM to use the web interface securely. The certificate can be imported or generated as follows:

  1. Select Import and press Enter (see Fig. 5.56).

    → A message informs that a PKCS#12 file can be imported.

    _images/first_setup_wizard_2.png

    Fig. 5.56 Importing or generating an HTTPS certificate

  2. Select Continue and press Enter.

  3. Open the web browser and enter the displayed URL.

  4. Click Browse..., select the PKCS#12 file and click Upload.

    → When the certificate is retrieved by the GSM, the GOS administration menu displays the fingerprint of the certificate for verification.

  5. Check the fingerprint and confirm the certificate by pressing Enter.

    or

  1. Select Generate and press Enter.

    → A message informs that parameters have to be entered to generate the certificate.

  2. Select Continue and press Enter.

  3. Provide the settings for the certificate (see Fig. 5.57).

    _images/first_setup_wizard_3.png

    Fig. 5.57 Entering information for the certificate

  4. Select OK and press Enter.

    → A message informs that the certificate is created and can be downloaded (see Fig. 5.58).

    Note

    The download is not done in the first setup wizard, but in the later GOS administration menu as described in Chapter 7.2.3.1.3.1, steps 1 – 4 and 9 – 13.

    _images/first_setup_wizard_8.png

    Fig. 5.58 Entering information for the certificate

    or

  1. Select CSR and press Enter.

    → A message informs that a key pair and a certificate request are created.

  2. Select Continue and press Enter.

  3. Provide the settings for the certificate.

  4. Select OK and press Enter.

  5. Open the web browser and enter the displayed URL.

  6. Download the PEM file.

    → The GOS administration menu displays a message to verify that the CSR has not been tampered with.

  7. Verify the information by pressing Enter.

    Note

    When the certificate is signed it has to be uploaded to the GSM. The upload is not done in the first setup wizard, but in the later GOS administration menu as described in Chapter 7.2.3.1.3.2, steps 1 – 4 and 11 – 14.

2. Creating a Scan User

If there is no scan user, it is asked whether such an account should be created.

  1. Select Yes and press Enter.

  2. Enter the user name for the scan user.

  3. Enter the password for the scan user twice.

  4. Select OK and press Enter.

    → A message informs that the scan user has been created.

  5. Press Enter to close the message.

3. Entering or Uploading a Greenbone Security Feed (GSF) Subscription Key

If no valid GSF subscription key is stored on the appliance, the appliance only uses the public Greenbone Community Feed (GCF) and not the GSF. A GSF subscription key can be entered or uploaded as follows:

  1. Select Editor and press Enter (see Fig. 5.59).

    → The editor is opened.

    _images/first_setup_wizard_9.png

    Fig. 5.59 Entering or uploading a GSF subscription key

  2. Enter the subscription key.

  3. Press Ctrl + X.

  4. Press Y to save the changes.

  5. Press Enter.

    or

  1. Select HTTP Upload and press Enter.
  2. Open the web browser and enter the displayed URL.
  3. Click Browse..., select the subscription key and click Upload.

4. Downloading the Feed

If no feed is present on the GSM, the feed can be downloaded as follows:

  1. Select Yes and press Enter (see Fig. 5.60).

    _images/first_setup_wizard_4.png

    Fig. 5.60 Downloading the feed

    → A message informs that the feed update was started in the background (see Fig. 5.61).

    _images/first_setup_wizard_5.png

    Fig. 5.61 Downloading the feed

  2. Press Enter to close the message.

5. Finishing the First Setup Wizard

Note

After the last step, a status check is performed. A message shows the result (see Fig. 5.62).

After closing the message by pressing Enter the GOS administration menu can be used as described in Chapter 7.

If there are any unfinished or skipped steps, the first setup wizard is shown when logging in again.

_images/first_setup_wizard_6.png

Fig. 5.62 Result of the status check

6. Exchanging the Master Key with the Sensor

Continue with Chapter 16 to exchange the keys with the master.

Note

The GSM 25V does not offer any web interface. The sensor is solely managed by the master. Logging into the sensor is possible by using the console and SSH from the master.

If the communication between master and sensor fails, the rule set of any internal firewall governing the network connection may be adjusted.

5.7. GSM ONE/MAVEN

This setup guide shows the steps required to put a GSM ONE or GSM MAVEN appliance into operation.

The following checklist can be used to monitor the progress:

Step Done
VirtualBox installed  
Integrity verified (optional)  
OVA file imported  
Virtual machine settings checked  
Keyboard layout selected  
IP address configured  
DNS server configured  
SSH service enabled (optional)  
SSL certificate created  
Web user account created  
GOS selfcheck run  

5.7.1. Setup Requirements

This section lists the requirements for successfully deploying a GSM ONE or GSM MAVEN appliance. All requirements have to be met.

5.7.1.1. Resources

The virtual appliance requires at least the following resources:

  • 2 virtual CPUs
  • 4 GB RAM
  • 16 GB hard disk

5.7.1.2. Supported Hypervisor

While a GSM ONE/MAVEN can be run on various hypervisors, currently only Oracle VirtualBox version 5.2 or higher is officially supported.

5.7.1.3. Verification of Integrity

Note

The integrity of the virtual appliance can be verified. On request the Greenbone Networks Support provides an integrity checksum.

To request the checksum contact the Greenbone Networks Support via e-mail (support@greenbone.net) including the subscription number.

The integrity checksum can be provided via phone or via support portal at https://support.greenbone.net. Specify the preferred channel in the e-mail.

The local verification of the checksum depends on the host operating system.

On Linux systems the following command for calculating the checksum for a GSM ONE/MAVEN can be used:

sha256sum GSM-ONE-5.0.4-gsf201906301.ova

Note

The command for the GSM MAVEN differs according to the GSM type and the GSF subscription key.

On Microsoft Windows systems an appropriate program has to be installed first.

Tip

Rehash may be used which can be found at http://rehash.sourceforge.net.

To calculate the checksum, use:

rehash.exe -none -sha256 C:\<path>\GSM-ONE-5.0.4-gsf201906301.ova

Note

The command for the GSM MAVEN differs according to the GSM type and the GSF subscription key.

If the checksum does not match the checksum provided by the Greenbone Networks Support, the virtual appliance has been modified and should not be used.

5.7.2. Deploying the Appliance

The virtual appliance is provided by Greenbone Networks in the Open Virtualization Appliance (OVA) format.

Each GSM ONE/MAVEN is activated using a unique subscription key.

Note

Cloning the GSM ONE/MAVEN and using several instances in parallel is not permitted and can result in inconsistencies and unwanted side effects.

To deploy a GSM ONE/MAVEN, it has to be imported into the hypervisor of choice as follows:

Note

The figure shows the installation of a GSM ONE. The installation of a GSM MAVEN is carried out equivalently. File names used in the example differ based on the GSM type and the GSF subscription key.

  1. Install Oracle VirtualBox for the current operating system.

    Note

    VirtualBox is often included with Linux distributions.

    Should this not be the case and or a version of Microsoft Windows is used, VirtualBox is available at https://www.virtualbox.org/wiki/Downloads.

  2. Start VirtualBox.

  3. Select File > Import Appliance... in the menu bar.

  4. Click import_vbox and select the OVA file of the appliance (see Fig. 5.63).

    _images/vbox_import.png

    Fig. 5.63 Importing the OVA file of the appliance

  5. Check the configuration of the virtual machine in the window Appliance settings (see Fig. 5.63).

    Values can be changed by double clicking into the input box of the respective value.

    Note

    If possible, select 4096 MB RAM (memory) for optimal configuration of the virtual appliance.

  6. Click Import.

    → The appliance is being imported. This can take up to 10 minutes.

    When the appliance is imported, it is displayed in the left column in VirtualBox.

  7. Select the appliance in the list and click Start.

5.7.3. Performing a General System Setup

All GSM appliances share the same way of basic configuration and readiness check.

When the GSM is delivered by Greenbone Networks or after a factory reset, the GOS administration menu shows the first setup wizard after logging in to assist with the basic GOS configuration (see Fig. 5.64).

_images/first_setup_wizard_1.png

Fig. 5.64 Using the first setup wizard

By selecting Yes and pressing Enter the first setup wizard is opened and can be used as follows:

Note

By selecting No and pressing Enter the wizard can be closed. Steps which have not been completed yet are displayed when logging in again.

By selecting Cancel and pressing Enter the wizard can be closed as well. However, in this case, incomplete steps are not shown again.

The first setup wizard is dynamic and shows only those steps necessary to operate the used GSM type. In the following, all possible steps are mentioned but they may not appear in every case.

In case of a factory reset, all steps have to be carried out (see 20.4).

Every step can be skipped by selecting Skip or No and pressing Enter. Skipped steps are displayed when logging in again.

1. Importing or Generating an HTTPS Certificate

An HTTPS certificate has to be present on the GSM to use the web interface securely. The certificate can be imported or generated as follows:

  1. Select Import and press Enter (see Fig. 5.65).

    → A message informs that a PKCS#12 file can be imported.

    _images/first_setup_wizard_2.png

    Fig. 5.65 Importing or generating an HTTPS certificate

  2. Select Continue and press Enter.

  3. Open the web browser and enter the displayed URL.

  4. Click Browse..., select the PKCS#12 file and click Upload.

    → When the certificate is retrieved by the GSM, the GOS administration menu displays the fingerprint of the certificate for verification.

  5. Check the fingerprint and confirm the certificate by pressing Enter.

    or

  1. Select Generate and press Enter.

    → A message informs that parameters have to be entered to generate the certificate.

  2. Select Continue and press Enter.

  3. Provide the settings for the certificate (see Fig. 5.66).

    _images/first_setup_wizard_3.png

    Fig. 5.66 Entering information for the certificate

  4. Select OK and press Enter.

    → A message informs that the certificate is created and can be downloaded (see Fig. 5.67).

    Note

    The download is not done in the first setup wizard, but in the later GOS administration menu as described in Chapter 7.2.3.1.3.1, steps 1 – 4 and 9 – 13.

    _images/first_setup_wizard_8.png

    Fig. 5.67 Entering information for the certificate

    or

  1. Select CSR and press Enter.

    → A message informs that a key pair and a certificate request are created.

  2. Select Continue and press Enter.

  3. Provide the settings for the certificate.

  4. Select OK and press Enter.

  5. Open the web browser and enter the displayed URL.

  6. Download the PEM file.

    → The GOS administration menu displays a message to verify that the CSR has not been tampered with.

  7. Verify the information by pressing Enter.

    Note

    When the certificate is signed it has to be uploaded to the GSM. The upload is not done in the first setup wizard, but in the later GOS administration menu as described in Chapter 7.2.3.1.3.2, steps 1 – 4 and 11 – 14.

2. Creating a Web Administrator

If there is no web administrator, it is asked whether such an account should be created (see Fig. 5.68).

Note

A web administrator is required to use the web interface of the GSM.

_images/first_setup_wizard_7.png

Fig. 5.68 Creating a web administrator

  1. Select Yes and press Enter.

  2. Enter the user name for the web administrator.

  3. Enter the password for the web administrator twice.

  4. Select OK and press Enter.

    → A message informs that the web administrator has been created.

  5. Press Enter to close the message.

3. Entering or Uploading a Greenbone Security Feed (GSF) Subscription Key

If no valid GSF subscription key is stored on the appliance, the appliance only uses the public Greenbone Community Feed (GCF) and not the GSF. A GSF subscription key can be entered or uploaded as follows:

  1. Select Editor and press Enter (see Fig. 5.69).

    → The editor is opened.

    _images/first_setup_wizard_9.png

    Fig. 5.69 Entering or uploading a GSF subscription key

  2. Enter the subscription key.

  3. Press Ctrl + X.

  4. Press Y to save the changes.

  5. Press Enter.

    or

  1. Select HTTP Upload and press Enter.
  2. Open the web browser and enter the displayed URL.
  3. Click Browse..., select the subscription key and click Upload.

4. Downloading the Feed

If no feed is present on the GSM, the feed can be downloaded as follows:

  1. Select Yes and press Enter (see Fig. 5.70).

    _images/first_setup_wizard_4.png

    Fig. 5.70 Downloading the feed

    → A message informs that the feed update was started in the background (see Fig. 5.71).

    _images/first_setup_wizard_5.png

    Fig. 5.71 Downloading the feed

  2. Press Enter to close the message.

5. Finishing the First Setup Wizard

Note

After the last step, a status check is performed. A message shows the result (see Fig. 5.72).

After closing the message by pressing Enter the GOS administration menu can be used as described in Chapter 7.

If there are any unfinished or skipped steps, the first setup wizard is shown when logging in again.

_images/first_setup_wizard_6.png

Fig. 5.72 Result of the status check

5.7.4. Logging into the Web Interface

The main interface of the GSM is the web interface, also called Greenbone Security Assistant (GSA). The web interface can be accessed as described in Chapter 8.1.