OpenVAS Tutorial: Open-Source Vulnerability Scanning Guide

Proactive assessment is an essential requirement for securing modern IT infrastructure. The Open Vulnerability Assessment System (OpenVAS) provides security teams with an open-source engine capable of discovering security flaws across network hosts, operating systems, and application services. As the primary scanning component of the Greenbone Vulnerability Management (GVM) framework, OpenVAS combines community-driven vulnerability feeds with automated assessment controls. Teams often pair network reconnaissance from our Nmap cheat sheet with OpenVAS to turn raw discovery data into structured remediation workflows.

What Is OpenVAS?

OpenVAS is a network vulnerability scanner maintained under the Greenbone Vulnerability Management GitHub repository. It checks networked devices against a continuously updated feed of Network Vulnerability Tests (NVTs). Each test probes target services for known misconfigurations, outdated patch levels, missing security controls, and exploitable flaws cataloged under Common Vulnerabilities and Exposures (CVE) definitions.

Unlike single-purpose tools like the template-driven Nuclei vulnerability scanner, OpenVAS provides broad multi-protocol assessments across infrastructure layers. It evaluates systems across protocols including SSH, SMB, HTTP/S, and FTP, allowing security teams to pinpoint exposure before adversaries exploit it.

OpenVAS and GVM Architecture

Modern OpenVAS operates as a service within the modular GVM client-server architecture. The environment distributes tasks across four major components:

• OpenVAS Scanner: The scanning daemon responsible for executing individual NVTs against designated targets.
• Greenbone Vulnerability Manager (gvmd): The central management service that controls scan configs, schedules jobs, manages feeds, and stores results in a PostgreSQL database.
• Greenbone Security Assistant (GSA): The web-based graphical user interface where administrators configure scans, review vulnerability dashboards, and generate reports.
• Greenbone Community Feed: The public vulnerability feed delivering regularly updated signatures and scripts to the scanner.

How the Vulnerability Scanning Workflow Operates

OpenVAS follows a structured routine to scan targets and present actionable findings without destabilizing production systems:

1. Target Definition: Operators specify individual IP addresses, hostnames, or CIDR network blocks to establish precise scanning boundaries.
2. Configuration Selection: The user selects a scan policy, such as a fast port discovery profile or an exhaustive deep-system audit.
3. NVT Execution: The scanner sends non-destructive probes and service queries to the designated endpoints using specialized routines written in NASL (Nessus Attack Scripting Language).
4. Severity Scoring: Discovered weaknesses are evaluated and assigned standard Common Vulnerability Scoring System (CVSS) ratings (Low, Medium, High, and Critical).
5. Report Generation: The manager compiles findings into structured formats (PDF, XML, or CSV) featuring detailed vulnerability summaries and remediation instructions.

Technical Specifications

Specification	Details
Supported Operating Systems	Debian, Ubuntu, CentOS, Kali Linux
Database Storage	PostgreSQL backend managed by gvmd
Scripting Language	NASL (Nessus Attack Scripting Language) for custom test creation
Network Protocols	TCP/IP, UDP, HTTP, HTTPS, SSH, SMB, FTP, SNMP
Enterprise Integrations	SIEM forwarders, Syslog, vulnerability tracking APIs

Installing and Configuring OpenVAS on Debian and Ubuntu

Enterprise deployments should run on dedicated server hardware or isolated virtual machines with sufficient memory and storage to compile the NVT feed. Debian-based distributions provide streamlined package management for OpenVAS and GVM.

Update the package index and install the vulnerability management software:

sudo apt-get update
sudo apt-get install openvas

Once installation finishes, execute the automated setup script. This process downloads the vulnerability tests, synchronizes the database, and configures backend credentials:

sudo gvm-setup

After setup concludes, verify that the daemon components are active and properly linked:

sudo gvm-check-setup

Start the Greenbone services to launch the web console:

sudo gvm-start

Open a web browser and navigate to https://<server-ip>:9392 to access the Greenbone Security Assistant dashboard. Log in using the administrative credentials displayed at the end of the gvm-setup run.

Best Practices for Scanning Corporate Networks

Running enterprise-scale scans requires disciplined operational practices to minimize noise and avoid unexpected service disruptions:

• Automate Feed Synchronization: Update the NVT feed frequently using sudo greenbone-feed-sync to ensure protection against newly discovered zero-day vulnerabilities and exploits.
• Schedule Scans During Maintenance Windows: Schedule high-throughput scans during off-peak hours to avoid saturating internal network switches or impacting production services.
• Deploy Authenticated Scans: Provide target credentials (SSH or SMB) within GSA configurations. Authenticated audits let the scanner inspect local package databases and missing operating system patches with higher accuracy than unauthenticated network probes.
• Establish Formal Remediation Cycles: Feed scan results into central ticketing systems so engineering teams can remediate high-severity CVEs within defined service level agreements (SLAs).