├── .gitignore ├── docker ├── Dockerfile ├── base │ ├── root │ │ ├── defaults │ │ │ ├── update-openvas.cron │ │ │ ├── openvas.conf │ │ │ └── ospd.conf │ │ └── etc │ │ │ ├── services.d │ │ │ ├── cron │ │ │ │ └── run │ │ │ └── logging │ │ │ │ └── run │ │ │ └── cont-init.d │ │ │ ├── 60-sync │ │ │ ├── 50-mailrelay │ │ │ └── 30-config │ ├── Dockerfile │ └── install-pkgs.sh ├── gvm │ ├── root │ │ ├── etc │ │ │ ├── services.d │ │ │ │ ├── postgres │ │ │ │ │ └── run │ │ │ │ ├── openvas │ │ │ │ │ └── run │ │ │ │ ├── gsa │ │ │ │ │ └── run │ │ │ │ └── gvmd │ │ │ │ │ └── run │ │ │ └── cont-init.d │ │ │ │ └── 50-postgres │ │ └── defaults │ │ │ └── update-openvas.sh │ ├── Dockerfile │ └── install-pkgs.sh ├── hooks │ ├── README.MD │ ├── push │ ├── build.local │ └── build ├── openvas │ ├── root │ │ ├── etc │ │ │ └── services.d │ │ │ │ ├── openvas │ │ │ │ └── run │ │ │ │ └── redis │ │ │ │ └── run │ │ └── defaults │ │ │ └── update-openvas.sh │ ├── Dockerfile │ └── install-pkgs.sh └── build │ ├── install-pkgs.sh │ └── Dockerfile ├── config ├── update-openvas.cron ├── openvas.conf ├── example.env └── ospd.conf ├── gvm.service ├── openvas.service ├── docker-compose.slave.yml ├── notes.txt ├── docker-compose.yml └── README.md /.gitignore: -------------------------------------------------------------------------------- 1 | data* 2 | local.env 3 | -------------------------------------------------------------------------------- /docker/Dockerfile: -------------------------------------------------------------------------------- 1 | # This is a dummy Dockerfile for DockerHub auto builds -------------------------------------------------------------------------------- /config/update-openvas.cron: -------------------------------------------------------------------------------- 1 | 1 1 * * * /bin/bash /defaults/update-openvas.sh > /dev/stdout 2 | -------------------------------------------------------------------------------- /docker/base/root/defaults/update-openvas.cron: -------------------------------------------------------------------------------- 1 | 0 0 * * * /bin/bash /defaults/update-openvas.sh 2 | -------------------------------------------------------------------------------- /docker/base/root/etc/services.d/cron/run: -------------------------------------------------------------------------------- 1 | #!/usr/bin/with-contenv bash 2 | 3 | /usr/sbin/cron -f -L 1 -------------------------------------------------------------------------------- /docker/base/root/etc/services.d/logging/run: -------------------------------------------------------------------------------- 1 | #!/usr/bin/with-contenv bash 2 | 3 | sleep 10 4 | 5 | exec s6-setuidgid abc tail -F /usr/local/var/log/gvm/* -------------------------------------------------------------------------------- /docker/base/root/etc/cont-init.d/60-sync: -------------------------------------------------------------------------------- 1 | #!/usr/bin/with-contenv bash 2 | 3 | if [ "$UPDATE_ON_START" ] ; then 4 | bash /defaults/update-openvas.sh 5 | fi -------------------------------------------------------------------------------- /docker/gvm/root/etc/services.d/postgres/run: -------------------------------------------------------------------------------- 1 | #!/usr/bin/with-contenv bash 2 | 3 | echo "Starting PostgreSQL..." 4 | s6-setuidgid postgres /usr/lib/postgresql/$PG_MAJOR/bin/postgres -------------------------------------------------------------------------------- /config/openvas.conf: -------------------------------------------------------------------------------- 1 | # Note - make any config changes to override defaults in here 2 | # see https://github.com/greenbone/openvas/blob/master/doc/openvas.8.in 3 | # example: max_checks = 20 -------------------------------------------------------------------------------- /docker/base/root/defaults/openvas.conf: -------------------------------------------------------------------------------- 1 | # Note - make any config changes to override defaults in here 2 | # see https://github.com/greenbone/openvas/blob/master/doc/openvas.8.in 3 | # example: max_checks = 20 -------------------------------------------------------------------------------- /docker/gvm/root/etc/services.d/openvas/run: -------------------------------------------------------------------------------- 1 | #!/usr/bin/with-contenv bash 2 | 3 | echo "Starting Open Scanner Protocol daemon for OpenVAS..." 4 | exec s6-setuidgid abc ospd-openvas --foreground --config /config/ospd.conf -------------------------------------------------------------------------------- /docker/hooks/README.MD: -------------------------------------------------------------------------------- 1 | https://github.com/brimstone/docker-kali 2 | 3 | https://medium.com/microscaling-systems/labelling-automated-builds-on-docker-hub-f3d073fb8e1 4 | 5 | https://docs.docker.com/docker-hub/builds/advanced/ -------------------------------------------------------------------------------- /docker/openvas/root/etc/services.d/openvas/run: -------------------------------------------------------------------------------- 1 | #!/usr/bin/with-contenv bash 2 | 3 | echo "Starting Open Scanner Protocol daemon for OpenVAS..." 4 | exec s6-setuidgid abc ospd-openvas -b $OPENVAS_HOST -p $OPENVAS_PORT --foreground --config /config/ospd.conf -------------------------------------------------------------------------------- /docker/hooks/push: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | set -ueo pipefail 3 | 4 | #docker push isaudits/gvm:build-20.8 5 | #docker push isaudits/gvm:base-20.8 6 | #docker push isaudits/gvm:openvas-20.8 7 | #docker push isaudits/gvm:gvmd-20.8 8 | #docker push isaudits/gvm:gvm-20.8 9 | 10 | docker push isaudits/gvm -------------------------------------------------------------------------------- /docker/gvm/root/etc/services.d/gsa/run: -------------------------------------------------------------------------------- 1 | #!/usr/bin/with-contenv bash 2 | 3 | while [ ! -S /usr/local/var/run/gvmd.sock ]; do 4 | echo "Greenbone Security Assistant - waiting for GVMD..." 5 | sleep 10 6 | done 7 | 8 | echo "Starting Greenbone Security Assistant..." 9 | exec s6-setuidgid abc gsad --foreground --verbose --listen=$GSA_HOST --port=$GSA_PORT --timeout=$GSA_TIMEOUT -------------------------------------------------------------------------------- /docker/openvas/root/defaults/update-openvas.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/with-contenv bash 2 | 3 | echo "Updating NVTs..." 4 | #s6-setuidgid abc greenbone-nvt-sync 5 | s6-setuidgid abc rsync --compress-level=9 --links --times --omit-dir-times --recursive --partial --quiet rsync://feed.community.greenbone.net:/nvt-feed /usr/local/var/lib/openvas/plugins 6 | sleep 5 7 | 8 | rm /usr/local/var/run/feed-update.lock || true -------------------------------------------------------------------------------- /config/example.env: -------------------------------------------------------------------------------- 1 | # COPY OR RENAME TO "local.env" AND CUSTOMIZE 2 | 3 | # Custom environment variables 4 | UPDATE_ON_START=true 5 | SCHEDULED_UPDATES=true 6 | PUID=1000 7 | PGID=100 8 | TZ=America/New_York 9 | 10 | # docker-gvm environment variables 11 | GVM_USER=admin 12 | GVM_PASSWORD=admin 13 | GVMD_MAX_IPS_PER_TARGET=4096 14 | GSA_TIMEOUT=600 15 | SMTP_HOST=smtp.example.com 16 | SMTP_PORT=25 17 | SMTP_MASQ=example.com -------------------------------------------------------------------------------- /config/ospd.conf: -------------------------------------------------------------------------------- 1 | [OSPD - openvas] 2 | log_level = INFO 3 | socket_mode = 0o770 4 | unix_socket = /var/run/ospd/ospd.sock 5 | lock_file_dir = /usr/local/var/run 6 | pid_file = /usr/local/var/run/openvas.pid 7 | log_file = /usr/local/var/log/gvm/openvas.log 8 | key_file = /usr/local/var/lib/gvm/private/CA/clientkey.pem 9 | cert_file = /usr/local/var/lib/gvm/CA/clientcert.pem 10 | ca_file = /usr/local/var/lib/gvm/CA/cacert.pem -------------------------------------------------------------------------------- /docker/base/root/defaults/ospd.conf: -------------------------------------------------------------------------------- 1 | [OSPD - openvas] 2 | log_level = INFO 3 | socket_mode = 0o770 4 | unix_socket = /var/run/ospd/ospd.sock 5 | lock_file_dir = /usr/local/var/run 6 | pid_file = /usr/local/var/run/openvas.pid 7 | log_file = /usr/local/var/log/gvm/openvas.log 8 | key_file = /usr/local/var/lib/gvm/private/CA/clientkey.pem 9 | cert_file = /usr/local/var/lib/gvm/CA/clientcert.pem 10 | ca_file = /usr/local/var/lib/gvm/CA/cacert.pem -------------------------------------------------------------------------------- /docker/openvas/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM isaudits/gvm:base-21.4 2 | 3 | COPY install-pkgs.sh /install-pkgs.sh 4 | 5 | RUN bash /install-pkgs.sh 6 | 7 | COPY --from=isaudits/gvm:build-21.4 /install/openvas_smb/ /install/openvas_scanner/ /usr/local/ 8 | 9 | RUN echo "/usr/local/lib" > /etc/ld.so.conf.d/openvas.conf && ldconfig 10 | 11 | RUN echo "abc ALL=(ALL) NOPASSWD: /usr/local/sbin/openvas" >> /etc/sudoers 12 | 13 | COPY root/ / 14 | 15 | 16 | -------------------------------------------------------------------------------- /docker/openvas/root/etc/services.d/redis/run: -------------------------------------------------------------------------------- 1 | #!/usr/bin/with-contenv bash 2 | 3 | if [ ! -d "/run/redis" ]; then 4 | mkdir /run/redis/ 5 | fi 6 | 7 | chown abc:abc /run/redis/ 8 | 9 | if [ -S /run/redis/redis.sock ]; then 10 | rm /run/redis/redis.sock 11 | fi 12 | 13 | exec s6-setuidgid abc redis-server --unixsocket /run/redis/redis.sock --unixsocketperm 766 --timeout 0 --databases 128 --maxclients 512 --port 6379 --bind 127.0.0.1 14 | 15 | -------------------------------------------------------------------------------- /docker/gvm/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM isaudits/gvm:openvas-21.4 2 | 3 | COPY install-pkgs.sh /install-pkgs.sh 4 | 5 | RUN bash /install-pkgs.sh 6 | 7 | RUN mkdir -p /var/run/postgresql && chown -R postgres /var/run/postgresql 8 | 9 | COPY --from=isaudits/gvm:build-21.4 /install/gvmd/ /install/gsa/ /usr/local/ 10 | 11 | #Grab report_formats from previous version so they can be migrated in case of an upgrade 12 | #COPY --from=isaudits/gvm:gvm-11 /usr/local/share/gvm/gvmd/report_formats/ /usr/local/share/gvm/gvmd/report_formats/ 13 | 14 | RUN echo "abc ALL=(ALL) NOPASSWD: /usr/local/sbin/gsad" >> /etc/sudoers 15 | 16 | COPY root/ / 17 | 18 | 19 | -------------------------------------------------------------------------------- /gvm.service: -------------------------------------------------------------------------------- 1 | # /etc/systemd/system/gvm.service 2 | 3 | # https://stackoverflow.com/questions/43671482/how-to-run-docker-compose-up-d-at-system-start-up 4 | 5 | [Unit] 6 | Description=Greenboone Vulnerability Manager Docker Compose Application Service 7 | Requires=docker.service 8 | After=docker.service 9 | 10 | [Service] 11 | Environment=COMPOSE_HTTP_TIMEOUT=200 12 | User=docker 13 | Group=docker 14 | WorkingDirectory=/data/ 15 | ExecStart=/usr/local/bin/docker-compose up 16 | ExecStop=/usr/local/bin/docker-compose down 17 | TimeoutStartSec=0 18 | Restart=on-failure 19 | StartLimitIntervalSec=60 20 | StartLimitBurst=3 21 | 22 | [Install] 23 | WantedBy=multi-user.target -------------------------------------------------------------------------------- /docker/openvas/install-pkgs.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | apt-get update && apt-get upgrade -y 4 | 5 | # OpenVAS scanner requirements 6 | { cat < /dev/nul || true 6 | s6-setuidgid abc gvmd --migrate || true 7 | s6-setuidgid abc gvmd --create-user=${GVM_USER} --password=${GVM_PASSWORD} || true 8 | 9 | echo "Attempting to set max report rows to $GVMD_MAXROWS" 10 | s6-setuidgid abc gvmd --modify-setting 76374a7a-0569-11e6-b6da-28d24461215b --value $GVMD_MAXROWS || true 11 | 12 | UUID=$(s6-setuidgid abc gvmd --get-users --verbose | grep $GVM_USER | awk '{print $2}') 13 | echo "Granting feed import owner rights to default user ($GVM_USER) with UUID $UUID" 14 | s6-setuidgid abc gvmd --modify-setting 78eceaec-3385-11ea-b237-28d24461215b --value $UUID || true 15 | 16 | while [ ! -S /var/run/ospd/ospd.sock ]; do 17 | echo "Greenbone Vulnerability Manager - waiting for OSPD..." 18 | sleep 10 19 | done 20 | 21 | echo "Starting Greenbone Vulnerability Manager..." 22 | 23 | exec s6-setuidgid abc gvmd --max-ips-per-target=$GVMD_MAX_IPS_PER_TARGET --foreground -------------------------------------------------------------------------------- /docker/base/install-pkgs.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | apt-get update && apt-get upgrade -y 4 | 5 | # Base OS stuff 6 | { cat < $CONF <> $CONF 25 | fi 26 | 27 | if [[ ! -z $SMTP_PASS ]]; then 28 | echo "AuthUser=$SMTP_PASS" >> $CONF 29 | fi 30 | 31 | shopt -s nocasematch 32 | if [[ ! -z $SMTP_USER ]] || [[ $SMTP_SECURE == "true" ]] 33 | then 34 | : ${SMTP_SECURE:='TRUE'} 35 | if [[ $SMTP_SECURE == "TRUE" ]] 36 | then 37 | echo "UseTLS=Yes" >> $CONF 38 | else 39 | echo "UseTLS=No" >> $CONF 40 | fi 41 | 42 | if [[ $SMTP_SECURE == "true" && $SMTP_TLS = "true" ]] 43 | then 44 | echo "UseSTARTTLS=Yes" >> $CONF 45 | else 46 | echo "UseSTARTTLS=No" >> $CONF 47 | fi 48 | else 49 | echo "UseTLS=No" >> $CONF 50 | echo "UseSTARTTLS=No" >> $CONF 51 | fi -------------------------------------------------------------------------------- /docker/hooks/build: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | set -ueo pipefail 3 | 4 | # stolen from https://medium.com/microscaling-systems/labelling-automated-builds-on-docker-hub-f3d073fb8e1 5 | 6 | # NOTE - MAKE SURE WE GO BACK AND REMOVE OPENVAS AND LATEST TAGS FROM PREVIOUS VERSION WHEN WE PUSH THESE 7 | # TAGS TO THIS VERSION; DELETE, DO NOT COMMENT TAG LINE OUT OR BUILD WILL FAIL 8 | 9 | docker build --build-arg VCS_REF="$(git rev-parse --short HEAD)" \ 10 | --build-arg BUILD_DATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \ 11 | -t isaudits/gvm:build-21.4 build/. 12 | 13 | docker build --build-arg VCS_REF="$(git rev-parse --short HEAD)" \ 14 | --build-arg BUILD_DATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \ 15 | -t isaudits/gvm:base-21.4 base/. 16 | 17 | docker build --build-arg VCS_REF="$(git rev-parse --short HEAD)" \ 18 | --build-arg BUILD_DATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \ 19 | -t isaudits/gvm:openvas-21.4 -t isaudits/gvm:openvas openvas/. 20 | #-t isaudits/gvm:openvas-21.4 openvas/. 21 | 22 | docker build --build-arg VCS_REF="$(git rev-parse --short HEAD)" \ 23 | --build-arg BUILD_DATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \ 24 | -t isaudits/gvm:gvm-21.4 -t isaudits/gvm:latest gvm/. 25 | #-t isaudits/gvm:gvm-21.4 gvm/. -------------------------------------------------------------------------------- /docker/build/install-pkgs.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | # Borrowed from https://github.com/Secure-Compliance-Solutions-LLC/GVM-Docker/blob/master/install-pkgs.sh 4 | 5 | apt-get update && apt-get upgrade -y 6 | 7 | # removed packages: 8 | #ike-scan 9 | #net-tools 10 | #nmap 11 | #nsis 12 | #wapiti 13 | #python3-defusedxml 14 | #python3-dialog 15 | #python3-lxml 16 | #python3-paramiko 17 | #python3-pip 18 | #python3-polib 19 | #python3-psutil 20 | #python3-setuptools 21 | 22 | { cat <> "$PGDATA/pg_hba.conf" 23 | 24 | # internal start of server in order to allow set-up using psql-client 25 | # does not listen on TCP/IP and waits until start finishes 26 | su postgres -c "/usr/lib/postgresql/"$PG_MAJOR"/bin/pg_ctl -D \"$PGDATA\" \ 27 | -o \"-c listen_addresses=''\" \ 28 | -w start" 29 | 30 | : ${POSTGRES_USER:=postgres} 31 | : ${POSTGRES_DB:=$POSTGRES_USER} 32 | export POSTGRES_USER POSTGRES_DB 33 | 34 | if [ "$POSTGRES_DB" != 'postgres' ]; then 35 | #/usr/lib/postgresql/"$PG_MAJOR"/bin/psql --username postgres "CREATE DATABASE \"$POSTGRES_DB\" ;" 36 | su -c "createdb $POSTGRES_DB" postgres 37 | fi 38 | 39 | /usr/lib/postgresql/"$PG_MAJOR"/bin/psql --username postgres -d "$POSTGRES_DB" -c "CREATE EXTENSION adminpack;" 40 | 41 | if [ "$POSTGRES_USER" = 'postgres' ]; then 42 | op='ALTER' 43 | else 44 | op='CREATE' 45 | fi 46 | 47 | /usr/lib/postgresql/"$PG_MAJOR"/bin/psql -U postgres -d postgres -c "$op USER \"$POSTGRES_USER\" WITH SUPERUSER $pass ;" 48 | 49 | # GVM specific database initialization tasks 50 | su -c "createuser -DRS abc" postgres 51 | su -c "psql --command='ALTER DATABASE $POSTGRES_DB OWNER TO abc;'" postgres 52 | su -c "psql --dbname=$POSTGRES_DB --command='create role dba with superuser noinherit;'" postgres 53 | su -c "psql --dbname=$POSTGRES_DB --command='grant dba to abc;'" postgres 54 | su -c "psql --dbname=$POSTGRES_DB --command='create extension \"uuid-ossp\";'" postgres 55 | su -c "psql --dbname=$POSTGRES_DB --command='create extension \"pgcrypto\";'" postgres 56 | 57 | su postgres -c "/usr/lib/postgresql/"$PG_MAJOR"/bin/pg_ctl -D \"$PGDATA\" -m fast -w stop" 58 | #set_listen_addresses '*' 59 | 60 | echo 61 | echo 'PostgreSQL init process complete; ready for start up.' 62 | echo 63 | 64 | fi -------------------------------------------------------------------------------- /docker/base/root/etc/cont-init.d/30-config: -------------------------------------------------------------------------------- 1 | #!/usr/bin/with-contenv bash 2 | 3 | # NOTE - based on https://github.com/linuxserver/docker-webgrabplus/blob/master/root/etc/cont-init.d/30-config 4 | # The default cron schedule can be edited by mounting /config as a volume and tweaking the default file 5 | 6 | # comment out PAM 7 | sed -i -e '/pam_loginuid.so/s/^/#/' /etc/pam.d/crond 8 | 9 | # add cron file for running feed updates 10 | [[ ! -e /config/update-openvas.cron ]] && \ 11 | cp /defaults/update-openvas.cron /config/update-openvas.cron 12 | 13 | # Check environment variable for cron job changes and update config file 14 | if [ "$UPDATE_CRON" ] ; then 15 | echo "${UPDATE_CRON} /bin/bash /defaults/update-openvas.sh > /dev/stdout" > /config/update-openvas.cron 16 | fi 17 | 18 | if [ "$SCHEDULED_UPDATES" ] ; then 19 | crontab /config/update-openvas.cron 20 | fi 21 | 22 | # ospd.conf (note - have to manually specify an ospd.conf file on launch since not running as root to keep from erroring out) 23 | [[ ! -e /config/ospd.conf ]] && \ 24 | cp /defaults/ospd.conf /config/ospd.conf 25 | 26 | sed -r -i 's|^(socket_mode[[:blank:]]*=[[:blank:]]*).*|\10o770|' /config/ospd.conf 27 | sed -r -i 's|^(unix_socket[[:blank:]]*=[[:blank:]]*).*|\1/var/run/ospd/ospd.sock|' /config/ospd.conf 28 | sed -r -i 's|^(lock_file_dir[[:blank:]]*=[[:blank:]]*).*|\1/usr/local/var/run|' /config/ospd.conf 29 | sed -r -i 's|^(pid_file[[:blank:]]*=[[:blank:]]*).*|\1/usr/local/var/run/openvas.pid|' /config/ospd.conf 30 | sed -r -i 's|^(log_file[[:blank:]]*=[[:blank:]]*).*|\1/usr/local/var/log/gvm/openvas.log|' /config/ospd.conf 31 | 32 | # openvas.conf 33 | [[ ! -e /config/openvas.conf ]] && \ 34 | cp /defaults/openvas.conf /config/openvas.conf 35 | ln -s /config/openvas.conf /usr/local/etc/openvas/openvas.conf 36 | 37 | # generate certificates 38 | gvm-manage-certs -a 39 | 40 | # disable THP for Redis 41 | echo 'never' > /sys/kernel/mm/transparent_hugepage/enabled && echo 'never' > /sys/kernel/mm/transparent_hugepage 42 | 43 | # create directories if necessary 44 | mkdir -p /var/run/ospd 45 | mkdir -p /usr/local/var/lib/openvas/plugins 46 | mkdir -p /usr/local/var/lib/gvm/cert-data 47 | mkdir -p /usr/local/var/lib/gvm/scap-data 48 | mkdir -p /usr/local/var/lib/gvm/data-objects 49 | 50 | chown -R abc:abc \ 51 | /config \ 52 | /defaults \ 53 | /var/run/ospd \ 54 | /usr/local/var/run \ 55 | /usr/local/var/log \ 56 | /usr/local/var/lib/gvm/gvmd \ 57 | /usr/local/var/lib/gvm/private \ 58 | /usr/local/var/lib/gvm/CA \ 59 | /usr/local/share/gvm/gvmd/report_formats 60 | 61 | chown abc:abc \ 62 | /usr/local/var/lib/openvas/plugins \ 63 | /usr/local/var/lib/gvm/cert-data \ 64 | /usr/local/var/lib/gvm/scap-data \ 65 | /usr/local/var/lib/gvm/data-objects 66 | -------------------------------------------------------------------------------- /docker/build/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM lsiobase/ubuntu:focal as build 2 | 3 | ENV DEBIAN_FRONTEND=noninteractive 4 | ENV LANG=C.UTF-8 5 | 6 | COPY install-pkgs.sh /install-pkgs.sh 7 | 8 | RUN bash /install-pkgs.sh 9 | 10 | ENV gvm_libs_version="v21.4.1" \ 11 | openvas_scanner_version="v21.4.1" \ 12 | gvmd_version="v21.4.2" \ 13 | gsa_version="v21.4.1" \ 14 | openvas_smb="v21.4.0" 15 | 16 | RUN echo "Starting Build..." && mkdir /build && mkdir /install 17 | 18 | FROM build as build-gvm_libs 19 | 20 | RUN cd /build && \ 21 | wget --no-verbose https://github.com/greenbone/gvm-libs/archive/$gvm_libs_version.tar.gz && \ 22 | tar -zxf $gvm_libs_version.tar.gz && \ 23 | cd /build/*/ && \ 24 | mkdir build && \ 25 | cd build && \ 26 | cmake -DCMAKE_BUILD_TYPE=Release .. && \ 27 | make && \ 28 | make install && \ 29 | cd /build && \ 30 | rm -rf * 31 | 32 | RUN cd /install && \ 33 | tar cvzf gvm_libs.tar.gz /usr/local/ 34 | 35 | FROM build as build-openvas_smb 36 | 37 | RUN cd /build && \ 38 | wget --no-verbose https://github.com/greenbone/openvas-smb/archive/$openvas_smb.tar.gz && \ 39 | tar -zxf $openvas_smb.tar.gz && \ 40 | cd /build/*/ && \ 41 | mkdir build && \ 42 | cd build && \ 43 | cmake -DCMAKE_BUILD_TYPE=Release .. && \ 44 | make && \ 45 | make install && \ 46 | cd /build && \ 47 | rm -rf * 48 | 49 | RUN cd /install && \ 50 | tar cvzf openvas_smb.tar.gz /usr/local/ 51 | 52 | #NOTE - requires gvm_libs as dependency 53 | FROM build-gvm_libs as build-gvmd 54 | 55 | RUN cd /build && \ 56 | wget --no-verbose https://github.com/greenbone/gvmd/archive/$gvmd_version.tar.gz && \ 57 | tar -zxf $gvmd_version.tar.gz && \ 58 | cd /build/*/ && \ 59 | mkdir build && \ 60 | cd build && \ 61 | cmake -DCMAKE_BUILD_TYPE=Release .. && \ 62 | make && \ 63 | make install && \ 64 | cd /build && \ 65 | rm -rf * 66 | 67 | RUN cd /install && \ 68 | tar cvzf gvmd.tar.gz /usr/local/ 69 | 70 | #NOTE - requires gvm_libs as dependency 71 | FROM build-gvm_libs as build-openvas_scanner 72 | 73 | RUN cd /build && \ 74 | wget --no-verbose https://github.com/greenbone/openvas-scanner/archive/$openvas_scanner_version.tar.gz && \ 75 | tar -zxf $openvas_scanner_version.tar.gz && \ 76 | cd /build/*/ && \ 77 | mkdir build && \ 78 | cd build && \ 79 | cmake -DCMAKE_BUILD_TYPE=Release .. && \ 80 | make && \ 81 | make install && \ 82 | cd /build && \ 83 | rm -rf * 84 | 85 | RUN cd /install && \ 86 | tar cvzf openvas_scanner.tar.gz /usr/local/ 87 | 88 | #NOTE - requires gvm_libs as dependency 89 | FROM build-gvm_libs as build-gsa 90 | 91 | RUN cd /build && \ 92 | wget --no-verbose https://github.com/greenbone/gsa/archive/$gsa_version.tar.gz && \ 93 | tar -zxf $gsa_version.tar.gz && \ 94 | cd /build/*/ && \ 95 | mkdir build && \ 96 | cd build && \ 97 | cmake -DCMAKE_BUILD_TYPE=Release .. && \ 98 | make && \ 99 | make install && \ 100 | cd /build && \ 101 | rm -rf * 102 | 103 | RUN cd /install && \ 104 | tar cvzf gsa.tar.gz /usr/local/ 105 | 106 | 107 | FROM lsiobase/ubuntu:focal 108 | 109 | #RUN mkdir /install 110 | 111 | #COPY --from=build-gvm_libs /install/ /install/ 112 | #COPY --from=build-openvas_smb /install/ /install/ 113 | #COPY --from=build-gvmd /install/ /install/ 114 | #COPY --from=build-openvas_scanner /install/ /install/ 115 | #COPY --from=build-gsa /install/ /install/ 116 | 117 | RUN mkdir /install && \ 118 | mkdir /install/gvm_libs && \ 119 | mkdir /install/openvas_smb && \ 120 | mkdir /install/gvmd && \ 121 | mkdir /install/openvas_scanner && \ 122 | mkdir /install/gsa 123 | 124 | COPY --from=build-gvm_libs /usr/local/ /install/gvm_libs 125 | COPY --from=build-openvas_smb /usr/local/ /install/openvas_smb 126 | COPY --from=build-gvmd /usr/local/ /install/gvmd 127 | COPY --from=build-openvas_scanner /usr/local/ /install/openvas_scanner 128 | COPY --from=build-gsa /usr/local/ /install/gsa 129 | 130 | 131 | 132 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # docker-gvm 2 | Docker implementation of Greenbone Vulnerability Management (GVM) / OpenVAS 3 | 4 | ## THIS PROJECT IS NO LONGER ACTIVELY MAINTAINED 5 | Greenbone now maintains their own docker images of all GVM / Openvas components - 6 | 7 | 8 | ## Source repo 9 | 10 | 11 | ## Run notes 12 | The easiest way to run is using docker-compose. An example compose file can be 13 | found in the github repo at . 14 | 15 | The sample compose file references an .env file for defining environment variables 16 | at config/local.env; a sample .env file can also be found in the github repo. 17 | 18 | ## Environment variables 19 | The following environment variables can be defined in your docker-compose file or 20 | the referenced .env file, or can be passed into docker command line: 21 | 22 | - UPDATE_ON_START - run feed update script on launch 23 | - PUID - PID of non-root user (1000) 24 | - PGID - GID of non-root user (100) 25 | - TZ - Time Zone (America/New_York) 26 | - GVM_USER - username of default GVM user (admin) 27 | - GVM_PASSWORD - password for default GVM user (admin - can be changed in GSA later) 28 | - GVMD_MAX_IPS_PER_TARGET - Max hosts per scan target (4096) 29 | - GSA_TIMEOUT - HTTP timeout for GSA (600) 30 | - SMTP_HOST - SMTP relay for emailing reports 31 | - SMTP_PORT - SMTP relay port 32 | - SMTP_MASQ - SMTP masquerade domain 33 | 34 | 35 | ## Version / upgrade notes 36 | 37 | ### General 38 | When launching a new build that requires a DB schema migration, the migration will fail while there are any plugin 39 | updates being processed. This will likely occur if your instance is configured to download plugin updates on startup. 40 | 41 | If you see error messages in the console such as "SCAP sync already running" followed by 42 | "gvmd: cannot migrate SCAP database" then an ongoing sync is preventing the initial migration from taking place. 43 | GVMD will fail to launch until this process is completed, so just allow the process to complete and GVMD should 44 | eventually start. 45 | 46 | Major updates to schema could require some database tables to be reinitialized. GVMD will do this upon start, however 47 | GSA will not load until this process completes and the GVMD daemon is started. 48 | 49 | TLDR; upon first launch, just walk away for a bit and have a coffee! 50 | ### 21.4 51 | No known upgrade issues from 20.8.1 build or higher. Previous build notes apply to upgrades from previous builds. 52 | Going forward, release build tags will only be updated to a new tag if minor release causes upgrade or dependency 53 | issues as was the case from 20.8 to 20.8.1. Major releases (e.g. 21.4 vs 20.8 will continue to receive new build tags). 54 | ### 20.8.1 / 20.8.2 55 | Upgraded base image from 20.8 release to Ubuntu 20.04 (Focal) due to required dependency versions not being upgraded in 56 | 18.04 (Bionic). This also results in an upgrade of Postgres from 10 to 12, which will require the GVM 57 | database to either be manually updated or recreated. 58 | 59 | At this point, we have not found a simple way to perform an in-place upgrade of the database. 60 | You can TRY the following steps at your own risk (this is unsupported and we will not accept any 61 | blame if you brick a production database nor will we respond to any support requests for assistance 62 | with upgrading a database). 63 | 64 | # backup existing volume 65 | docker volume rm gvm_db_bak 66 | docker volume create gvm_db_bak 67 | docker run --rm -it -v gvm_db:/from -v gvm_db_bak:/to alpine ash -c "cd /from ; cp -av . /to" 68 | 69 | # export data to temp volume 70 | docker volume rm gvm_db_temp 71 | docker volume create gvm_db_temp 72 | 73 | # use 20.8 image to export database 74 | docker run --rm -it -v gvm_db:/var/lib/postgresql/data -v gvm_db_temp:/backup --entrypoint /bin/bash isaudits/gvm:gvm-20.8 75 | 76 | # dump gvm database 77 | s6-setuidgid postgres /usr/lib/postgresql/10/bin/postgres & 78 | sudo -u abc pg_dump -O gvmd >/backup/gvmd_dump.sql 79 | exit 80 | 81 | # use 20.8.1 image to restore database 82 | docker volume rm gvm_db 83 | docker volume create gvm_db 84 | docker run --rm -it -v gvm_db:/var/lib/postgresql/data -v gvm_db_temp:/backup --entrypoint /bin/bash isaudits/gvm:gvm-20.8.1 85 | 86 | # initialize GVMD database and restore backup 87 | cat /etc/cont-init.d/50-postgres | /bin/bash 88 | s6-setuidgid postgres /usr/lib/postgresql/12/bin/postgres & 89 | sudo -u abc psql -f /backup/gvmd_dump.sql gvmd 90 | exit 91 | 92 | # undo if something screws up 93 | docker volume rm gvm_db 94 | docker volume create gvm_db 95 | docker run --rm -it -v gvm_db_bak:/from -v gvm_db:/to alpine ash -c "cd /from ; cp -av . /to" 96 | 97 | # if all looks ok, delete temp volumes 98 | docker volume rm gvm_db_temp 99 | docker volume rm gvm_db_bak 100 | 101 | ### 20.8 102 | When upgrading from GVM 11, the system has to migrate default reports from those included 103 | with source of GVM 11 (/usr/local/share/gvm/gvmd/report_formats/) to the new feed based 104 | reports. This process fails if the directory is empty (which is the case when this directory 105 | lives inside a docker image for version 11). Solution was to populate this directory inside 106 | the image from our GVM11 base image 107 | 108 | Default path for ospd socket has changed from /tmp/ospd.sock to /var/run/ospd/ospd.sock; 109 | This path has to be changed in the ospd.conf file. Solution was to implement commands 110 | on startup to set default values in ospd.conf 111 | 112 | Have to manually change scanner pid path on existing scanner if upgraded from GVM 11; 113 | on portainer, use command shell as user abc: 114 | ``` 115 | gvmd --get-scanners 116 | gvmd --modify-scanner= --scanner-host=/var/run/ospd/ospd.sock 117 | ``` 118 | 119 | -------------------------------------------------------------------------------- 120 | 121 | Copyright 2020 122 | 123 | Matthew C. Jones, CPA, CISA, OSCP, CCFE 124 | 125 | IS Audits & Consulting, LLC - 126 | 127 | TJS Deemer Dana LLP - 128 | 129 | -------------------------------------------------------------------------------- 130 | 131 | Except as otherwise specified: 132 | 133 | This program is free software: you can redistribute it and/or modify it under 134 | the terms of the GNU General Public License as published by the Free Software 135 | Foundation, either version 3 of the License, or (at your option) any later 136 | version. 137 | 138 | This program is distributed in the hope that it will be useful, but WITHOUT ANY 139 | WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A 140 | PARTICULAR PURPOSE. See the GNU General Public License for more details. 141 | 142 | You should have received a copy of the GNU General Public License along with 143 | this program. If not, see . --------------------------------------------------------------------------------