greenbone/openvas-scanner
Openvas Scanner
The openvas-scanner is a vulnerability scanner designed to identify security weaknesses and outdated software in target systems. It performs network vulnerability scanning by executing security tests and network attack scripts, as well as conducting local security auditing through static version checks of installed software.
The project utilizes community-managed feeds to synchronize and update local security definitions and vulnerability tests. These tests and scan configurations are loaded into the system via container images or manual transfers and stored in a persistent relational database for long-term tracking and reporting.
The system includes a management stack that can be deployed using container orchestration. Administrative control is provided through a web management dashboard, dedicated command-line tools, and various remote procedure interfaces, including XML-based APIs and Windows Management Instrumentation for remote process execution on Windows systems.
Security and access are managed through role-based access control, password policy enforcement, and TLS encryption for the web interface. The scanner also features asynchronous task scheduling to automate security audits and supports email notifications via SMTP for security alerts.
Features
- Local Software Auditing - Identifies weaknesses by performing static version checks on installed software against vulnerability databases.
- Security Scan Schedulers - Uses an internal runtime system to schedule recurring vulnerability scans on a predefined timetable.
- Relational Database Persistence - Consolidates scan results and vulnerability configurations into a central relational database for long-term tracking.
- Containerized Service Orchestration - Deploys the scanner and database as a stack of isolated images to ensure consistent environment configuration.
- Network Vulnerability Scanning - Executes security tests against target systems to identify weaknesses and outdated software across network infrastructure.
- Attack Script Execution - Runs network attack scripts to actively identify security weaknesses in target systems.
- Role-Based Access Control - Restricts administrative actions by managing user identities and permissions through groups and roles.
- Security Data Consolidations - Consolidates scan results and configurations into a central relational database for long-term tracking.
- Vulnerability Database Management - Maintains and synchronizes local copies of security metadata and vulnerability tests from external community feeds.
- Vulnerability Feed Synchronization - Updates local security definitions and vulnerability tests by downloading and importing data from community-managed feeds.
- Scan Coordination & Reporting - Coordinates authentication, scheduling, and the reporting of vulnerability information through a central database.
- Vulnerability Data Provisioning - Populates the system with security tests and compliance policies using dedicated data-loading services.
- Vulnerability Data Synchronization - Imports and updates vulnerability tests and compliance policies into persistent storage volumes.
- Vulnerable Product Detection - Identifies vulnerable software by performing static version checks on packages during scans.
- Web Dashboards - Provides a browser-based dashboard for managing security scans and visualizing vulnerability results.
- Remote Administration Interfaces - Provides web interfaces and command-line tools to manage scanners and tasks from remote locations.
- Full-Stack Orchestration - Packages the scanner, database, and management interface as a coordinated stack of container images.
- Containerized Deployment Images - Provides pre-configured container images for simplified deployment of the full vulnerability management stack.
- Remote Procedure Call Interfaces - Controls scanning processes and appliance settings from external locations using dedicated administrative communication protocols.
- Management Daemon APIs - Hosts a web server and API that connects web applications to the management daemon.
- XML-Based Remote Protocols - Exchanges scan commands and vulnerability test results between the manager and engine using a structured XML message format.
- XML Command Protocols - Supports XML-based APIs to initiate scans, retrieve test information, and receive results.
- Management Interfaces - Provides remote interfaces and command-line tools to control scanning processes and system settings.
- Scanner Management CLIs - Provides a dedicated command-line toolset to manage the vulnerability system and scanner.
- Engine Control Interfaces - Allows managing scanning engines and managers via standardized communication protocols through web interfaces or scripts.
- Asynchronous Schedulers - Manages the execution of vulnerability scans and system events based on a predefined internal timetable.
- CLI System Management - Allows querying data and controlling the manager and daemon via a command-line interface.
- Remote Administrative Control - Allows controlling the scanning stack from remote locations using dedicated administration protocols.
