差異處

這裏顯示兩個版本的差異處。

連向這個比對檢視

兩邊的前次修訂版 前次修改
下次修改		 前次修改
tech:openvas [2024/07/19 19:43] – 加上[問題與解法] jonathantech:openvas [2025/04/10 15:20] (目前版本) – 4. 當 pg-gvm log 出現 LOG: checkpoints are occurring too frequently jonathan
行 7: 行 7:
 ===== 安裝程序 ===== ===== 安裝程序 =====
   * <cli>   * <cli>
-curl -f -L https://greenbone.github.io/docs/latest/_static/docker-compose-22.4.yml -o docker-compose.yml+curl -f -O -L https://raw.githubusercontent.com/tryweb/docker-compose/refs/heads/main/openvas/docker-compose.yml -o docker-compose.yml 
 +curl -f -O -L https://raw.githubusercontent.com/tryweb/docker-compose/refs/heads/main/openvas/.env.example -o .env
 </cli> </cli>
 +  * {{repo>https://raw.githubusercontent.com/tryweb/docker-compose/refs/heads/main/openvas/docker-compose.yml | docker-compose.yml}}
   * 修改符合需要設定   * 修改符合需要設定
-    - gvmd 設定 SMTP 環境變數 
     - gsa 將 Listen IP Port 由 127.0.0.1:9392:80(只接受本機) 改為 0.0.0.0:9392:80 (接受所有來源)     - gsa 將 Listen IP Port 由 127.0.0.1:9392:80(只接受本機) 改為 0.0.0.0:9392:80 (接受所有來源)
     - openvasd 開啟 API 服務 Listen IP Port: 0.0.0.0:3000:80     - openvasd 開啟 API 服務 Listen IP Port: 0.0.0.0:3000:80
-  * docker-compose.yml<file> +  * {{repo>https://raw.githubusercontent.com/tryweb/docker-compose/refs/heads/main/openvas/.env.example | .env}} 
-services: +  * 修改 .env 內的 SMTP 設定
-  vulnerability-tests: +
-    image: greenbone/vulnerability-tests +
-    environment:/iii +
-      STORAGE_PATH: /var/lib/openvas/22.04/vt-data/nasl +
-    volumes: +
-      - vt_data_vol:/mnt +
- +
-  notus-data: +
-    image: greenbone/notus-data +
-    volumes: +
-      - notus_data_vol:/mnt +
- +
-  scap-data: +
-    image: greenbone/scap-data +
-    volumes: +
-      - scap_data_vol:/mnt +
- +
-  cert-bund-data: +
-    image: greenbone/cert-bund-data +
-    volumes: +
-      - cert_data_vol:/mnt +
- +
-  dfn-cert-data: +
-    image: greenbone/dfn-cert-data +
-    volumes: +
-      - cert_data_vol:/mnt +
-    depends_on: +
-      - cert-bund-data +
- +
-  data-objects: +
-    image: greenbone/data-objects +
-    volumes: +
-      - data_objects_vol:/mnt +
- +
-  report-formats: +
-    image: greenbone/report-formats +
-    volumes: +
-      - data_objects_vol:/mnt +
-    depends_on: +
-      - data-objects +
- +
-  gpg-data: +
-    image: greenbone/gpg-data +
-    volumes: +
-      - gpg_data_vol:/mnt +
- +
-  redis-server: +
-    image: greenbone/redis-server +
-    restart: on-failure +
-    volumes: +
-      - redis_socket_vol:/run/redis/ +
- +
-  pg-gvm: +
-    image: greenbone/pg-gvm:stable +
-    restart: on-failure +
-    volumes: +
-      - psql_data_vol:/var/lib/postgresql +
-      - psql_socket_vol:/var/run/postgresql +
- +
-  gvmd: +
-    image: greenbone/gvmd:stable +
-    restart: on-failure +
-    environment: +
-      MTA_HOST: "smtp.gmail.com" +
-      MTA_PORT: "587" +
-      MTA_TLS: "on" +
-      MTA_STARTTLS: "on" +
-      MTA_AUTH: "on" +
-      MTA_USER: "<your_google_account>" +
-      MTA_FROM: "[email protected]" +
-      MTA_PASSWORD: "<your_google_password>" +
-    volumes: +
-      - gvmd_data_vol:/var/lib/gvm +
-      - scap_data_vol:/var/lib/gvm/scap-data/ +
-      - cert_data_vol:/var/lib/gvm/cert-data +
-      - data_objects_vol:/var/lib/gvm/data-objects/gvmd +
-      - vt_data_vol:/var/lib/openvas/plugins +
-      - psql_data_vol:/var/lib/postgresql +
-      - gvmd_socket_vol:/run/gvmd +
-      - ospd_openvas_socket_vol:/run/ospd +
-      - psql_socket_vol:/var/run/postgresql +
-    depends_on: +
-      pg-gvm: +
-        condition: service_started +
-      scap-data: +
-        condition: service_completed_successfully +
-      cert-bund-data: +
-        condition: service_completed_successfully +
-      dfn-cert-data: +
-        condition: service_completed_successfully +
-      data-objects: +
-        condition: service_completed_successfully +
-      report-formats: +
-        condition: service_completed_successfully +
- +
-  gsa: +
-    image: greenbone/gsa:stable +
-    restart: on-failure +
-    ports: +
-      - 0.0.0.0:9392:80 +
-    volumes: +
-      - gvmd_socket_vol:/run/gvmd +
-    depends_on: +
-      - gvmd +
-  # Sets log level of openvas to the set LOG_LEVEL within the env +
-  # and changes log output to /var/log/openvas instead /var/log/gvm +
-  # to reduce likelyhood of unwanted log interferences +
-  configure-openvas: +
-    image: greenbone/openvas-scanner:stable +
-    volumes: +
-      - openvas_data_vol:/mnt +
-      - openvas_log_data_vol:/var/log/openvas +
-    command: +
-      - /bin/sh +
-      - -c +
-      - | +
-        printf "table_driven_lsc = yes\nopenvasd_server = http://openvasd:80\n" > /mnt/openvas.conf +
-        sed "s/127/128/" /etc/openvas/openvas_log.conf | sed 's/gvm/openvas/' > /mnt/openvas_log.conf +
-        chmod 644 /mnt/openvas.conf +
-        chmod 644 /mnt/openvas_log.conf +
-        touch /var/log/openvas/openvas.log +
-        chmod 666 /var/log/openvas/openvas.log +
- +
-  # shows logs of openvas +
-  openvas: +
-    image: greenbone/openvas-scanner:stable +
-    restart: on-failure +
-    volumes: +
-      - openvas_data_vol:/etc/openvas +
-      - openvas_log_data_vol:/var/log/openvas +
-    command: +
-      - /bin/sh +
-      - -c +
-      - | +
-        cat /etc/openvas/openvas.conf +
-        tail -f /var/log/openvas/openvas.log +
-    depends_on: +
-      configure-openvas: +
-        condition: service_completed_successfully +
- +
-  openvasd: +
-    image: greenbone/openvas-scanner:stable +
-    restart: on-failure +
-    environment: +
-      # `service_notus` is set to disable everything but notus, +
-      # if you want to utilize openvasd directly removed `OPENVASD_MODE` +
-      OPENVASD_MODE: service_notus +
-      GNUPGHOME: /etc/openvas/gnupg +
-      LISTENING: 0.0.0.0:80 +
-    volumes: +
-      - openvas_data_vol:/etc/openvas +
-      - openvas_log_data_vol:/var/log/openvas +
-      - gpg_data_vol:/etc/openvas/gnupg +
-      - notus_data_vol:/var/lib/notus +
-    # enable port forwarding when you want to use the http api from your host machine +
-    ports: +
-      - 0.0.0.0:3000:80 +
-    depends_on: +
-      vulnerability-tests: +
-        condition: service_completed_successfully +
-      configure-openvas: +
-        condition: service_completed_successfully +
-      gpg-data: +
-        condition: service_completed_successfully +
-    networks: +
-      default: +
-        aliases: +
-          - openvasd +
- +
-  ospd-openvas: +
-    image: greenbone/ospd-openvas:stable +
-    restart: on-failure +
-    hostname: ospd-openvas.local +
-    cap_add: +
-      - NET_ADMIN # for capturing packages in promiscuous mode +
-      - NET_RAW # for raw sockets e.g. used for the boreas alive detection +
-    security_opt: +
-      - seccomp=unconfined +
-      - apparmor=unconfined +
-    command: +
-      [ +
-        "ospd-openvas", +
-        "-f", +
-        "--config", +
-        "/etc/gvm/ospd-openvas.conf", +
-        "--notus-feed-dir", +
-        "/var/lib/notus/advisories", +
-        "-m", +
-        "666" +
-      ] +
-    volumes: +
-      - gpg_data_vol:/etc/openvas/gnupg +
-      - vt_data_vol:/var/lib/openvas/plugins +
-      - notus_data_vol:/var/lib/notus +
-      - ospd_openvas_socket_vol:/run/ospd +
-      - redis_socket_vol:/run/redis/ +
-      - openvas_data_vol:/etc/openvas/ +
-      - openvas_log_data_vol:/var/log/openvas +
-    depends_on: +
-      redis-server: +
-        condition: service_started +
-      gpg-data: +
-        condition: service_completed_successfully +
-      vulnerability-tests: +
-        condition: service_completed_successfully +
-      configure-openvas: +
-        condition: service_completed_successfully +
- +
-  gvm-tools: +
-    image: greenbone/gvm-tools +
-    volumes: +
-      - gvmd_socket_vol:/run/gvmd +
-      - ospd_openvas_socket_vol:/run/ospd +
-    depends_on: +
-      - gvmd +
-      - ospd-openvas +
- +
-volumes: +
-  gpg_data_vol: +
-  scap_data_vol: +
-  cert_data_vol: +
-  data_objects_vol: +
-  gvmd_data_vol: +
-  psql_data_vol: +
-  vt_data_vol: +
-  notus_data_vol: +
-  psql_socket_vol: +
-  gvmd_socket_vol: +
-  ospd_openvas_socket_vol: +
-  redis_socket_vol: +
-  openvas_data_vol: +
-  openvas_log_data_vol: +
-</file>+
   * 啟動服務 <cli>   * 啟動服務 <cli>
-docker compose -p greenbone-community-edition up -d +docker compose up -d 
-docker compose -p greenbone-community-edition logs -f+docker compose logs -f
 </cli> </cli>
   * 設定管理者帳號密碼 <cli>   * 設定管理者帳號密碼 <cli>
-docker compose -p greenbone-community-edition exec -u gvmd gvmd gvmd --user=admin --new-password='<password>'+docker compose exec -u gvmd gvmd gvmd --user=admin --new-password='<password>'
 </cli> </cli>
   * 開啟網頁進入管理介面 - http://server-ip:9392 (使用 admin 與設定的密碼登入) \\ {{:tech:螢幕擷取畫面_2024-07-16_152348.png|}} \\ {{:tech:螢幕擷取畫面_2024-07-16_152453.png|}}   * 開啟網頁進入管理介面 - http://server-ip:9392 (使用 admin 與設定的密碼登入) \\ {{:tech:螢幕擷取畫面_2024-07-16_152348.png|}} \\ {{:tech:螢幕擷取畫面_2024-07-16_152453.png|}}
   * 確認弱點資料庫更新狀況 \\ {{:tech:螢幕擷取畫面_2024-07-16_153723.png|}}   * 確認弱點資料庫更新狀況 \\ {{:tech:螢幕擷取畫面_2024-07-16_153723.png|}}
 +  * 設定更新 script <cli>wget https://raw.githubusercontent.com/tryweb/docker-compose/refs/heads/main/openvas/update.sh</cli>
 +  * {{repo>https://raw.githubusercontent.com/tryweb/docker-compose/refs/heads/main/openvas/update.sh | update.sh}}
 +  * 設定可執行權限<cli>chmod a+x update.sh</cli>
  
 ===== 問題與解法 ===== ===== 問題與解法 =====
 ==== 1. 手動更新弱點資料庫 ==== ==== 1. 手動更新弱點資料庫 ====
-  * 參考 - https://forum.greenbone.net/t/update-feeds-in-docker/13456/9+  * 單純更新 notus-data vulnerability-tests scap-data dfn-cert-data cert-bund-data report-formats data-objects 似乎於更新後系統無法正常運作, 但關閉重啟就可以更新後系統正常運作
   * <cli>   * <cli>
-docker compose -p greenbone-community-edition pull notus-data vulnerability-tests scap-data dfn-cert-data cert-bund-data report-formats data-objects +docker compose stop 
-docker compose -p greenbone-community-edition up -d notus-data vulnerability-tests scap-data dfn-cert-data cert-bund-data report-formats data-objects+docker compose pull 
 +docker compose up -d
 </cli> </cli>
   * 可以透過 gvmd 查看狀況 <cli>   * 可以透過 gvmd 查看狀況 <cli>
-docker compose -p greenbone-community-edition logs -f gvmd+docker compose logs -f gvmd 
 +</cli>當出現類似以下訊息就表示已經正確更新與啟動<cli> 
 +: 
 +gvmd-1  | md manage:   INFO:2024-07-25 15h12.53 utc:73: Updating CVSS scores and CVE counts for CPEs 
 +gvmd-1  | md manage:   INFO:2024-07-25 15h14.21 utc:73: Updating placeholder CPEs 
 +gvmd-1  | md manage:   INFO:2024-07-25 15h14.34 utc:73: Updating Max CVSS for DFN-CERT 
 +gvmd-1  | md manage:   INFO:2024-07-25 15h14.36 utc:73: Updating DFN-CERT CVSS max succeeded. 
 +gvmd-1  | md manage:   INFO:2024-07-25 15h14.36 utc:73: Updating Max CVSS for CERT-Bund 
 +gvmd-1  | md manage:   INFO:2024-07-25 15h14.37 utc:73: Updating CERT-Bund CVSS max succeeded. 
 +gvmd-1  | md manage:   INFO:2024-07-25 15h14.38 utc:73: update_scap_end: Updating SCAP info succeeded 
 +gvmd-1  | md manage:   INFO:2024-07-25 15h14.39 utc:70: Assigning EPSS scores to VTs 
 +gvmd-1  | md manage:   INFO:2024-07-25 15h14.56 utc:209: OSP service has different VT status (version 202407250605) from database (version 202407240611, 141853 VTs). Starting update ... 
 +gvmd-1  | md manage:   INFO:2024-07-25 15h15.34 utc:209: Updating VTs in database ... 3 new VTs, 204 changed VTs 
 +gvmd-1  | md manage:   INFO:2024-07-25 15h15.35 utc:209: Updating VTs in database ... done (141873 VTs). 
 +gvmd-1  | md manage:   INFO:2024-07-25 15h15.35 utc:207: Assigning EPSS scores to VTs
 </cli> </cli>
  
行 272: 行 58:
   * 參考 - https://greenbone.github.io/docs/latest/22.4/container/workflows.html#setting-up-a-mail-transport-agent-inside-docker-container   * 參考 - https://greenbone.github.io/docs/latest/22.4/container/workflows.html#setting-up-a-mail-transport-agent-inside-docker-container
   * 如果透過 Test Alert 發現異常, 可以進去 gvmd 容器內 debug <cli>   * 如果透過 Test Alert 發現異常, 可以進去 gvmd 容器內 debug <cli>
-docker exec -it greenbone-community-edition-gvmd-1 bash+docker exec -it root-gvmd-1 bash
 </cli> </cli>
     - 確認環境變數是否正確 Exp.<cli>     - 確認環境變數是否正確 Exp.<cli>
行 325: 行 111:
 apt install ca-certificates -y apt install ca-certificates -y
 </cli>如果已經離開容器, 可以改用<cli> </cli>如果已經離開容器, 可以改用<cli>
-docker exec greenbone-community-edition-gvmd-1 apt update +docker exec root-gvmd-1 apt update 
-docker exec greenbone-community-edition-gvmd-1 apt install ca-certificates -y+docker exec root-gvmd-1 apt install ca-certificates -y
 </cli> </cli>
  
 +==== 3. 檔案空間被 openvas.log 大量使用議題 ====
 +  * 主要會將 log 寫入 /var/lib/docker/volumes/root_openvas_log_data_vol/_data/openvas.log 
 +  * 這紀錄檔案不特別處理, 一段時間有可能超過 100G
 +  * 解決方式:
 +    - 配合定期更新週期一起刪除, docker compose 啟動會自動建立 <cli>
 +docker compose down
 +rm /var/lib/docker/volumes/root_openvas_log_data_vol/_data/openvas.log
 +docker compose pull
 +docker compose up -d
 +</cli>
 +    - 設定環境變數 LOG_LEVEL: 1 (只紀錄 ERROR 與 WARNING)<cli>
 +vi docker-compose.yml</cli><file>
 +:
 +  # Sets log level of openvas to the set LOG_LEVEL within the env
 +  # and changes log output to /var/log/openvas instead /var/log/gvm
 +  # to reduce likelyhood of unwanted log interferences
 +  configure-openvas:
 +    image: greenbone/openvas-scanner:stable
 +    environment:
 +      LOG_LEVEL: 1
 +    volumes:
 +      - openvas_data_vol:/mnt
 +      - openvas_log_data_vol:/var/log/openvas
 +    command:
 +      - /bin/sh
 +      - -c
 +      - |
 +:
 +</file>重起 docker compose<cli>
 +docker compose down
 +docker compose up -d
 +</cli>
 +
 +==== 4. 當 pg-gvm log 出現 LOG:  checkpoints are occurring too frequently ====
 +  * 可能是執行環境的 DiskIO 比較慢出現的訊息, 可以加大 PostgreSQL 的 max_wal_size (預設是1GB)
 +  * Exp. 設定加大為 2GB 
 +    - 建立 max_wal.conf<file>
 +max_wal_size = 2GB
 +</file>
 +    - 修改 docker-compose.yml <file>
 +:
 +  pg-gvm:
 +    image: registry.community.greenbone.net/community/pg-gvm:stable
 +    restart: on-failure
 +    volumes:
 +      - psql_data_vol:/var/lib/postgresql
 +      - psql_socket_vol:/var/run/postgresql
 +      - ./max_wal.conf:/etc/postgresql/13/main/conf.d/max_wal.conf
 +:
 +</file>
 +    - 重起 docker compose <cli>
 +docker compose down
 +docker compose up -d
 +</cli>
 +    - 檢視設定是否成功 <cli>
 +$ docker compose exec pg-gvm psql -U gvmd -c "SHOW max_wal_size;"
 + max_wal_size
 +--------------
 + 2GB
 +(1 row)
 +</cli>
 +    - 檢視 pg-gvm log 是否不再出現 LOG:  checkpoints are occurring too frequently <cli>
 +docker compose logs -f pg-gvm
 +</cli>如果還是出現, 可以考慮加大 max_wal_size Exp. 4GB
 ===== 參考網址 ===== ===== 參考網址 =====
   * https://greenbone.github.io/docs/latest/22.4/container/index.html   * https://greenbone.github.io/docs/latest/22.4/container/index.html
  
-{{tag>draft openvas 主機弱掃}}+{{tag>openvas 主機弱掃}}
  
  • tech/openvas.1721389428.txt.gz
  • 上一次變更: 2024/07/19 19:43
  • 由 jonathan