Installing OpenVAS on BackTrack 5

In preparation for a talk I'll be giving at BSidesKC in October, I've been playing with BackTrack 5 and OpenVAS. OpenVAS was a little bit of a pain to get compiled on Ubuntu, but now that the OpenSUSE guys have built .DEB packages of a fairly recent version of OpenVAS (4.x), it's pretty easy to install on most modern Debian-derived systems. In fact, this works on Ubuntu Server as well, and I have tested it on 10.04 LTS. You just have to do it as root, like you'd do on BackTrack, because I was too lazy to write these instructions with "sudo" in front of each line (and using "| sudo tee -a" instead of the append-redirect for adding a quick line to the sources.list file).

This will be a rough post just to get my install notes down. The instructions on OpenVAS' website do not currently work as designed (however, I'm basing this post on them) and at the time of writing, the OpenSUSE build packages are broken in a number of ways that are easily fixed. For example, the openvas-scanner package provides a startup script in /etc/init.d, but the greenbone-security-assistant, openvas-manager and openvas-administrator packages do not. Some of the binaries are built to read files from /var/lib/openvas while others go for /usr/local/var/lib/openvas. Whatever. We'll deal with it. Also, a lot of these command lines are insanely long and probably will get cut off or line-wrapped by HiR's template. Copy. Paste. View Source. I trust our readers to be smart enough to figure that out.

Before starting, I recommend making sure you're up to date:

apt-get update && apt-get upgrade

Add the OpenVAS branch of the OpenSUSE Build Service to your apt sources, get the apt key and update your repository cache:

echo "deb http://download.opensuse.org/repositories/security:/OpenVAS:/STABLE:/v4/Debian_5.0/ ./" >> /etc/apt/sources.list

apt-key adv --keyserver hkp://keys.gnupg.net --recv-keys BED1E87979EAFD54

apt-get update

Next, install all the fun packages and dependencies needed in one run of things. Consider adding "gsd" to this package list if you think you'll want to use the Greenbone Security Desktop GUI interface. I plan on doing no such thing.

apt-get -y install greenbone-security-assistant openvas-cli openvas-manager openvas-scanner openvas-administrator sqlite3 xsltproc texlive-latex-base texlive-latex-extra texlive-latex-recommended htmldoc alien rpm nsis fakeroot

Make some directories and some symlinks to compensate for the clustercoitus of path discrepancies in the OBS packages.

mkdir -p /var/lib/openvas/private /var/lib/openvas/CA

mkdir -p /usr/local/var/lib/openvas /usr/local/var/lib/openvas/users

ln -s /var/lib/openvas/users /usr/local/var/lib/openvas/users

ln -s /var/lib/openvas/CA /usr/local/var/lib/openvas/CA

ln -s /var/lib/openvas/private /usr/local/var/lib/openvas/private

Make the openvas server cert, fetch the latest NVT plugins, and make the client cert used by openvas-manager:

openvas-mkcert -q

openvas-nvt-sync

openvas-mkcert-client -n om -i

Start the OpenVAS Services manually, rebuilding the OpenVAS Manager database once your get openvassd started (it'll take a good couple of minutes to load all the plugins), and all that jazz. Hey, Greenbone Security Assistant (the Web UI) works over https when you install it this way! It would only do HTTP when I installed it from source.

openvassd

openvasmd --rebuild

openvasmd

openvasad

gsad

Add an admin-level account for yourself. I suggest a different username for the -u argument. -r specifies the role, and you want to leave that value set to "Admin" if you want to be able to do much with OpenVAS.

openvasad -c add_user -n axon -r Admin

At this point, you should be good to go. Hit https: on your machine and have a blast.

Look for another article related to BackTrack 5 and OpenVAS right after BSidesKC. I've got something fun up my sleeve. If you're anywhere in the region, you should probably just show up. It'll be a good time.

Linux: Ready only for the geek desktop

I do almost everything within either OpenBSD, Solaris or Mac OS X. All of them required me to install quite a few extra pieces of software to work just the way I like, but at the end of the day, they're great for the things I do, with some exceptions noted in Solaris. I spend the majority of my time doing web stuff (surfing, forums, blogging), listening to music, writing e-mail, word processing, performing systems administration, and tinkering with encryption and information security. Occasionally, I may goof around with my own music or graphical art. Solaris lacks easily-installed free or bundled graphics, MIDI, and audio editing software.

Enter Linux. Linux is a pretty broad brush to be painting with these days. Linux is a kernel. It's also a highly generalized term for any operating environment with Linux at its core. The end result is quite confusing. As part of my job, I take care of a bunch of Red Hat Enterprise Linux servers. I've been familiar with Red Hat for quite some time. While I don't particularly like how Red Hat approaches certain things, I am quite good at installing, patching, managing, and tweaking Red Hat Linux servers simply because I've been doing it for so long. When I went to play with a totally different flavor of Linux on a spare server at home, however, my first instinct to use the command-line for everything was met with a few problems. Primarily, many of the tools and programs that Red Hat provides me with are nowhere to be found. Only because of my familiarity with Linux and UNIX flavors in general (okay, and my ability to read documentation) was I able to figure out how certain things were set up. For those who care, it was ArchLinux, but I had similar issues with SME Server as well, despite being loosely derived Red Hat Enterprise Linux.

Right now, the big push in the Linux world is getting Linux onto the desktop. Linux for everyone. Break free from your commercial operating system hell! Linux is here to save the day! Ubuntu is the big name that gets thrown around most often. Self-described as "Linux for human beings", Ubuntu aims to be the final answer to the Linux desktop quandary. After trying Ubuntu Desktop, Ubuntu Server, and Kubuntu Desktop, I can say that "Linux" has come quite a way in its quest for desktop domination.

Ubuntu Desktop is based on the Gnome desktop environment. Asmodian X pointed out to me that Gnome feels an awful lot like Mac OS 9, and I wouldn't have quoted him on that unless I agreed. Part of the clunky feel is the fact that Linux is still bound by the X Window System. Essentially, all graphics go through a network or local socket. Windows and MacOS X don't suffer the same fate, and their interfaces simply feel more responsive. I can deal with a sluggish display, though. There are bigger fish to fry. All flavors of Ubuntu install quickly and ask a very minimal set of questions during installation. As long as the hardware is supported, pretty much anyone can get any of the Ubuntu flavors installed in minutes.

Ubuntu server is everything you'd expect in an open source LAMP server distribution that's released by a company that believes in ease-of-installation. Much like Ubuntu Desktop, only a small set of options are available during installation. The end result is a server distro that is neither lean and mean, nor bloated. It's pretty damned generic, and up to the user to install and configure what needs to be installed if anything more than a basic web application and database server is desired.

Kubuntu Desktop replaces Gnome with the K Desktop Environment (KDE) and a different set of bundled applications -- for the most part, the KDE-based apps are chosen over the competing software packages where available. Konqueror is the default web browser as opposed to Firefox. Kontact and Kopete handle mail/scheduling and Instant messaging respectively. The list goes on and on. If I had to compare Gnome to MacOS Classic, I'd have to say that on a user interface level, KDE feels a bit like Windows Vista with most of the snazzy features turned off, except a little more "Fisher Price." It kind of feels like a toy, but it gets the job done nicely.

Keep in mind that my impression of the two desktop environments is based only on Ubuntu. I haven't used KDE or Gnome prior to this in several years. Right now, I'd say I favor KDE over Gnome, at least in the configurations provided by Canonical (the company behind Ubuntu). There are other variants of Ubuntu which I have not yet tried, so they aren't being reviewed here.

After you get one of the desktop flavors of Ubuntu up and running, keeping the system secure and up-to-date is a breeze. The system checks for upgraded packages that are available for download, and alerts you to their presence. It's easier to keep Ubuntu up-to-date than it is to do the same on Windows. It really is that easy. Installing other software packages can be a breeze as well. Ubuntu provides a graphical application installer that lets you simply choose programs from a list or search through the list for what you want. You simply select the programs you want to install, then install them. The system handles all the downloading and installation procedures on its own, including any other packages that are required by the software you selected.

BSD has been doing package management like this for years without the graphical installation wizard. You still need to know what you want, and have to look through the list manually. Ubuntu is based on the Debian package system, and Debian has also had similar functionality for many years. This stuff isn't new, but combined with the other aspects of Ubuntu, it makes for a system that's pretty user-friendly.

• Installation is a breeze.
• Applications that you need to get going are already installed by default
• Patching and upgrading software is automated.
• Installing new software is as easy as picking it from a list.

Almost anyone can install and use Ubuntu without much of a fuss. What more could you ask for? Quite a bit, actually. Compared to Windows or Mac OS X (still the two heaviest hitters in the desktop operating system market), all Linux flavors are left wanting. Configuration of anything but the most rudimentary options requires the use of the command-line, which is not an environment that many people are comfortable in. For me? I live and die by the CLI and don't mind it one bit. If there's a software package that you read about for Linux and it's not on the list of stuff that Ubuntu provides, then there's no easy way to install it. Someone like me could download and unpack it, and compile it if needed. Most people are used to double-clicking on the installer or dragging the application (seemingly one file) to their hard drive. Don't get me started on the difficulty of installing certain drivers under Ubuntu.

The other advent that the Linux desktop has brought to the table is "Live" distributions. A Live distribution is an operating environment that boots from removable media such as a CD-ROM or Flash drive, providing an instantly functional system that doesn't rely on a hard drive to operate. Ubuntu and Kubuntu Desktop installation CDs initially launch in this mode. You truly get to try it before you install it. Things tend to load very slowly from CD, so the whole operating system seems very sluggish when run this way.

There are dozens of popular Live distributions that you could check out. Back|Track is my favorite so far: for hackers, geeks, auditors, and security professionals alike. Back|Track, is the end result of Whax and Auditor joining forces. Upon booting, you get a clean, functional desktop platform from which to launch any number of tests and exploits.

Truly, Ubuntu is only good for end users who are happy using it pretty much just as it comes from a default installation. The Live version is sluggish and not recommended as a replacement for Windows - a preview if you will. Other Live distos are great for tinkerers and nerds. For geeks and hackers, a full install of Debian or ArchLinux would be considerably more flexible than Ubuntu if you wish to stick with the Linux kernel.

In closing, I'll say that the biggest hurdle remaining for Linux to conquer on the way to end-user desktops is the fact that the command-line is still not optional despite the best efforts of the Linux community. A command-line should only be required as a last-ditch interface to the operating system in order to recover from some earth-shattering catastrophic failure. Windows has been to this point for years. OS X has as well. For some reason, Linux is lollygagging. It would also help if everyone could just agree on one package distribution model and stick with it. So far, I think Debian's system holds the most promise for the Desktop and enterprise workstations.