3 Setting up OPENVAS SECURITY INTELLIGENCE¶

3.1 Installing OPENVAS SECURITY INTELLIGENCE¶

3.1.1 Installation as a Virtual Machine¶

OPENVAS SECURITY INTELLIGENCE is delivered by Greenbone as a virtual machine containing the OPENVAS Operating System (OPENVAS OS) and a certificate which authorizes the users to deploy OPENVAS SECURITY INTELLIGENCE.

To use OPENVAS SECURITY INTELLIGENCE, users must first set up OPENVAS OS.

OPENVAS SECURITY INTELLIGENCE is then installed as follows:

Access the shell of OPENVAS OS as the admin user.
Install OPENVAS SECURITY INTELLIGENCE by running the following command:
```
os-cli container-management install-product security-intelligence
```
Note

The address of the web interface must be specified explicitly.

Example: If the web interface should be reachable at https://osi.example.net, the address must be set to osi.example.net.

This setting must match the virtual machine’s network configuration. The command does not change the network configuration.

Set the address for the web interface by running the following command:

os-cli container-management configure-product security-intelligence --product-base-webaddress <WEB_INTERFACE_ADDRESS>

Note

If an appliance connected via outbound mode should be able to push scan data to OPENVAS SECURITY INTELLIGENCE (see Chapter 6), the TLS certificate used by OPENVAS SECURITY INTELLIGENCE must include the web interface address as a Subject Alternative Name (SAN).
- If a domain name is specified as the web interface address, the certificate must contain the corresponding DNS name, for example:
```
X509v3 Subject Alternative Name:
    DNS:example.local
```
- If an IP address is specified, the certificate must contain the corresponding IP address, for example:
```
X509v3 Subject Alternative Name:
    IP Address:192.168.1.50
```
If the certificate does not contain the configured web interface address, it must be replaced with a suitable certificate before scan data can be sent.

Information about replacing the TLS certificate in OPENVAS OS can be found here in the OPENVAS OS user manual.
To ensure consistent and correct handling of login sessions, the internal clocks of the OPENVAS SECURITY INTELLIGENCE instance and the system used to access it must be synchronized or at least nearly identical. To achieve this, it is recommended to activate the time synchronization on both systems.

For OPENVAS SECURITY INTELLIGENCE, the time synchronization can be activated via the respective host system or by executing os-cli service update systemd-timesyncd enabled:true in the OPENVAS OS CLI.

3.1.2 Installation on a Standard Linux Operating System¶

3.1.2.1 Preparing the Setup¶

3.1.2.1.1 Setup Requirements¶

The following tools are required:

Docker
Docker Compose, version 2.40.3 or higher
oras
openssl
tar
install
grep
sed
sort
tail
ls
curl
cp
less
tar
awk
tr
cat
pwd
zstd

Confirm that Docker is running and that the current user can access it:

docker ps

If this command fails because of missing permissions, either run the Docker commands with the required privileges, or add the user to the appropriate Docker group according to the host operating system policy.

3.1.2.1.2 Downloading the Installation Script¶

An installation script for OPENVAS SECURITY INTELLIGENCE is provided by Greenbone. It can be downloaded and made usable as follows:

Download the latest installation script provided on the release page.
Decompress the file:
```
unzstd openvas-deployment.zst
```
Make the script executable:
```
chmod +x openvas-deployment
```

3.1.2.1.3 Required Input Files¶

The following files are required for the setup:

OCI client certificate: Certificate used to authenticate against the Greenbone package registry.
OCI client private key: Private key belonging to the OCI client certificate.

Note

Alternatively, a license file (.toml format) containing the OCI client certificate and key can be used.

3.1.2.2 Overview of Actions and Deployment Options¶

Run the following command to view a list of available actions, deployment options and examples:

openvas-deployment --help

Note

More information can be found in the README of openvas-deployment.

3.1.2.3 Deploying OPENVAS SECURITY INTELLIGENCE¶

Note

The address of the web interface must be specified explicitly.

Example: If the web interface should be reachable at https://osi.example.net, the address must be set to osi.example.net.

This setting must match the virtual machine’s network configuration. The command does not change the network configuration.

Initiate the deployment with OCI client certificate and key:

openvas-deployment --init --product security-intelligence --oci-client-cert <PATH_TO_OCI_CLIENT_CERT> --oci-client-key <PATH_TO_OCI_CLIENT_KEY> --domain-name <WEB_INTERFACE_ADDRESS>

Initiate the deployment with a license file:

openvas-deployment --init --product security-intelligence --license-file <PATH_TO_LICENSE_FILE> --domain-name <WEB_INTERFACE_ADDRESS>

Press y if the OCI certificate and key should be installed with sudo.
Enter the sudo password.

or

Press n if the OCI certificate and key should not be installed with sudo.

Install the OCI client certificate and key as root:

mkdir -p /etc/docker/certs.d/packages.greenbone.net

install -m 0600 product.crt /etc/docker/certs.d/packages.greenbone.net/client.cert

install -m 0600 product.key /etc/docker/certs.d/packages.greenbone.net/client.key

→ The initialization is done.

Download the latest product artifact:
```
openvas-deployment --update
```
Run the deployment:
```
openvas-deployment --run
```
Check the running services:
```
openvas-deployment --ps
```
Review the logs if required:
```
openvas-deployment --logs
```
Review the logs of a specific service:
```
openvas-deployment --logs --service-name '<SERVICE_NAME>'
```
Note

The service name can be found in the SERVICE column of the output of the command openvas-deployment --ps.

Note

It must be ensured that at least 15 million inodes are available on the partition used by the container orchestrator. This keeps the system running reliably over the long term.

For non-inode-based file systems, metadata storage must be available for approximately 4 million files.
If an appliance connected via outbound mode should be able to push scan data to OPENVAS SECURITY INTELLIGENCE (see Chapter 6), the TLS certificate used by OPENVAS SECURITY INTELLIGENCE must include the web interface address as a Subject Alternative Name (SAN).
- If a domain name is specified as the web interface address, the certificate must contain the corresponding DNS name, for example:
```
X509v3 Subject Alternative Name:
    DNS:example.local
```
- If an IP address is specified, the certificate must contain the corresponding IP address, for example:
```
X509v3 Subject Alternative Name:
    IP Address:192.168.1.50
```
If the certificate does not contain the configured web interface address, it must be replaced with a suitable certificate before scan data can be sent.

Information about replacing the TLS certificate in OPENVAS OS can be found here in the OPENVAS OS user manual.
To ensure consistent and correct handling of login sessions, the internal clocks of the OPENVAS SECURITY INTELLIGENCE instance and the system used to access it must be synchronized or at least nearly identical. To achieve this, it is recommended to activate the time synchronization on both systems.

For OPENVAS SECURITY INTELLIGENCE, the time synchronization can be activated via the respective host system or by executing os-cli service update systemd-timesyncd enabled:true in the OPENVAS OS CLI.

3.2 Initially Signing in as a Super Admin¶

OPENVAS SECURITY INTELLIGENCE can initially be accessed as a super admin as follows:

Open the web browser.
Enter the configured web interface address of OPENVAS SECURITY INTELLIGENCE.
Sign in using the user name openvas and the initial password openvas#user.
When signing in for the first time, a new password must be set.
Note

The password must fulfill the following criteria:
- At least 10 characters long
- Different from the user name
- Different from the e-mail address
- Different from the last three passwords
- Not a common word that could be found in an English or German dictionary
The user name cannot be changed.

Enter and repeat a new password.
Click Submit.

Fig. 3.1 Signing in to OPENVAS SECURITY INTELLIGENCE as a super admin for the first time¶

→ The super admin can now create additional users for OPENVAS SECURITY INTELLIGENCE.

Note

After signing in initially, the meta feed must be updated manually once, so that the relevant data is loaded into OPENVAS SECURITY INTELLIGENCE.
Select Data Management > Feed in the menu.
Click Update Feed.

→ The feed update is running. It may take up to three to four hours to complete.

Note

To verify users’ e-mail addresses, reset passwords, or send notifications about server events to administrators, the system must be able to send e-mails. To do this, a mail server must be connected. The mail server must support the Simple Mail Transfer Protocol (SMTP).
Select Settings > User Management in the menu.

→ The user management is opened in a new browser tab.
Select Realm settings in the menu.
Select the Email tab.
Fill in the input boxes.

The following settings are required:

From
E-mail address that is used as the sender for e-mails.

Host
Mail server host name used for sending e-mails.

Note

More information can be found in the Keycloak documentation.
Click Test connection.

→ The result of the test is displayed in the upper right corner.
Click Save.