From Fedora Project Wiki

No edit summary
(update to openvas-7)
Line 1: Line 1:
{{Admon/warning | This test case could be outdated because newer versions of OpenVAS has new services around OpenVAS Scanner (OpenVAS Manager, OpenVAS Administrator, Greenbone Security Assistant) }}
{{Admon/warning | This test case is meant of OpenVAS-7. The version in Fedora 20 (OpenVAS-6) is known to not work well so please rebuild the openvas-7 packages from rawhide. The openvas-gsa package still missing in Fedora }}
{{QA/Test_Case
{{QA/Test_Case
|description=This test case tests the ability of OpenVAS to scan a host or network for vulnerabilities.
|description=This test case tests the ability of OpenVAS to scan a host or network for vulnerabilities.
Line 5: Line 5:
* A remote host with various network services (SSH, HTTP, DNS, SMTP ...) is required. For example: a Linux server with OpenSSH, Apache HTTPd, ISC BIND, Postfix or Sendmail.
* A remote host with various network services (SSH, HTTP, DNS, SMTP ...) is required. For example: a Linux server with OpenSSH, Apache HTTPd, ISC BIND, Postfix or Sendmail.
* Open ports of the scanned services in the remote host firewall.
* Open ports of the scanned services in the remote host firewall.
* Ensure that {{package|openvas-libraries}}, {{package|openvas-scanner}}, {{package|openvas-manager}}, {{package|openvas-client}} packages are installed.
* Ensure that {{package|openvas-libraries}}, {{package|openvas-scanner}}, {{package|openvas-manager}}, {{package|openvas-cli}} packages are installed.
|actions=
|actions=
# Start OpenVAS scanner: {{command |service openvas-scanner start}}
# Start OpenVAS scanner: {{command |service openvas-scanner start}}
# Check the logs on what is happening: {{command | tail -f /var/log/openvas/openvassd.log }}
# Create a new certificate: {{command |openvas-mkcert}}
# Create a new certificate: {{command |openvas-mkcert}}
# Add a OpenVAS user: {{command |openvas-adduser}}
# Add user certificate for the manager to be able to connect to scanner: {{command |openvas-mkcert-client -n -i }}
# Update the NVTs: {{command |openvas-nvt-sync}}
# Update the NVTs: {{command |openvas-nvt-sync}}
# Restart OpenVAS scanner (take a while for the first time): {{command |service openvas-scanner restart}}
# Restart OpenVAS scanner (take a while for the first time): {{command |service openvas-scanner restart}}

Revision as of 01:30, 16 September 2014

Warning.png
This test case is meant of OpenVAS-7. The version in Fedora 20 (OpenVAS-6) is known to not work well so please rebuild the openvas-7 packages from rawhide. The openvas-gsa package still missing in Fedora

Description

This test case tests the ability of OpenVAS to scan a host or network for vulnerabilities.

Setup

  • A remote host with various network services (SSH, HTTP, DNS, SMTP ...) is required. For example: a Linux server with OpenSSH, Apache HTTPd, ISC BIND, Postfix or Sendmail.
  • Open ports of the scanned services in the remote host firewall.
  • Ensure that Package-x-generic-16.pngopenvas-libraries, Package-x-generic-16.pngopenvas-scanner, Package-x-generic-16.pngopenvas-manager, Package-x-generic-16.pngopenvas-cli packages are installed.

How to test

  1. Start OpenVAS scanner: service openvas-scanner start
  2. Check the logs on what is happening: tail -f /var/log/openvas/openvassd.log
  3. Create a new certificate: openvas-mkcert
  4. Add user certificate for the manager to be able to connect to scanner: openvas-mkcert-client -n -i
  5. Update the NVTs: openvas-nvt-sync
  6. Restart OpenVAS scanner (take a while for the first time): service openvas-scanner restart
  7. Test that the OpenVAS scanner process openvassd is running: ps aux | grep [o]penvassd
  8. Test that the OpenVAS scanner listens on configured port: sudo lsof -i -nP | grep [o]penvassd
  9. Connect using the gnutls client to scanner port: gnutls-cli --insecure -p 9391 127.0.0.1 . Start the communication with < OTP/1.0 >. Try to login with the user created above.
  10. Start OpenVAS manager: service openvas-manager start
  11. Generate a new client certificate for manager to connect to scanner openvas-mkcert-client -n om -i
  12. Rebuild the NVT cache database openvasmd --rebuild
  13. Start OpenVAS manager: service openvas-manager start
  14. Test that the OpenVAS manager process openvasmd is running: ps aux | grep [o]penvasmd
  15. Test that the OpenVAS manager listens on configured port: sudo lsof -i -nP | grep [o]penvasmd
  16. Connect using the gnutls client to manager port: gnutls-cli --insecure -p 9390 127.0.0.1 . Start the communication with < OTP/1.0 >. Try to login with the user created above.
  17. Start OpenVAS client: openvas-client (or System Tools > OpenVAS Client)
  18. Connect to OpenVAS server with the user created above.
  19. Create a new scan using the client and wait until it finishes.
  20. Export the report to HTML or PDF.

Expected Results

  1. Start of openvas-scanner without previous configuration will most probably fail. Syslog should display hint about generating certificates.
  2. Certificate should be created in /etc/pki/openvas/CA/cacert.pem, /etc/pki/openvas/CA/servercert.pem with private keys in /etc/pki/openvas/private/CA/
  3. Adding of the user will create the account in /var/lib/openvas/users/
  4. openvas-nvt-sync will download plugins to /var/lib/openvas/plugins
  5. Restart of the service should result with OK. It takes longer for the first time. On Fedora 16 it is possible that the systemd will timeout thinking that the service failed to start, while actually it is still starting. Give it a while and try stop/start again.
  6. Process list should show openvassd process running as root "openvassd: waiting for incoming connections"
  7. lsof for openvassd should show it is listening on port 9391
  8. Passing wrong credentials will print error message about unsuccessfull authentication. After passing right credentials the server will wait expecting more commands to go.
  9. Starting openvas-manager without configuration of certificate and database will fail. Check syslog for the hint.
  10. Client certificate will for manager will be generated to /etc/pki/openvas/CA/clientcert.pem and key to /etc/pki/openvas/private/CA/clientkey.pem
  11. Database will be generated to /var/lib/openvas/mgr/tasks.db
  12. Start of the openvas-manager after configuring certificate and NVT cache database should result with OK.
  13. Process list should show openvasmd process running as root "openvasmd --port=9390 --slisten=127.0.0.1 --sport=9391 --otp"
  14. lsof for openvasmd should show it is listening on port 9390
  15. Passing wrong credentials will disconnect immediately. After passing right credentials the server will wait expecting more commands to go.
  16. The scan should finish correctly.
  17. In the report, you should see the network services being scanned and vulnerabilities reported.
Retrieved from "https://fedoraproject.org/w/index.php?title=QA:Testcase_OpenVAS&oldid=387096"