Greenbone Vulnerability Manager
The Greenbone Vulnerability Manager is the central management service between
security scanners and the user clients.
It manages the storage of any vulnerability management configurations and of the
scan results. Access to data, control commands and workflows is offered via the
XML-based Greenbone Management Protocol (GMP). Controlling scanners like
the OPENVAS Scanner* is done via
the Open Scanner Protocol (OSP).
Releases
All release files are signed with
the Greenbone Community Feed integrity key.
This gpg key can be downloaded at https://www.greenbone.net/GBCommunitySigningKey.asc
and the fingerprint is 8AE4 BE42 9B60 A59B 311C 2E73 9823 FAA6 0ED1 E580.
Installation and Usage
This module can be configured, built and installed with following commands:
cmake .
make install
For detailed installation requirements and instructions, please see the file
INSTALL.md. The file also contains instructions for setting up
gvmd and for connecting gvmd to vulnerability scanners and to the
GSA web interface.
In case everything was installed using the defaults, then starting the manager
daemon can be done with this simple command:
gvmd
To see all available command line options of gvmd enter this command:
gvmd --help
If you are not familiar or comfortable building from source code, we recommend
that you use the Greenbone Enterprise TRIAL, a prepared virtual
machine with a readily available setup. Information regarding the virtual machine
is available at https://www.greenbone.net/en/testnow.
Configuration
The configuration of gvmd is handled via the following methods:
- Settings that can be changed globally via the
--modify-setting command line
option.
- Command line options given to the main gvmd process when starting it.
- A configuration file (
gvmd.conf) that is located in ${GVM_SYSCONF_DIR}
(etc/gvm in the given installation prefix for the default build setup).
Authentication options
Options for the GMP authentication can be found in [authentication] section
of the config file. These are:
| Config file key |
Environment variable |
Type |
Default value |
Description |
| jwt_access_duration |
GVMD_JWT_ACCESS_DURATION |
integer |
60 |
Lifetime of access tokens issued by gvmd in seconds |
| jwt_decode_secret |
GVMD_JWT_DECODE_SECRET |
string |
|
Secret to decode / verify JWTs |
| jwt_decode_secret_path |
GVMD_JWT_DECODE_SECRET_PATH |
file path |
|
Path to the secret to decode / verify JWTs |
| jwt_encode_secret |
GVMD_JWT_ENCODE_SECRET |
string |
|
Secret to encode / generate JWTs |
| jwt_encode_secret_path |
GVMD_JWT_ENCODE_SECRET_PATH |
file path |
|
Path to the secret to encode / generate JWTs |
| jwt_secret_type |
GVMD_JWT_SECRET_TYPE |
string |
|
Type of secret to use for JWT signatures |
For gvmd to be able to verify JSON web tokens in the <authenticate> GMP
command, both the JWT secret type and a decode secret must be given. For it
to be able to generate JWTs, the secret type and an encode secret must be
given. The supported secret types are ECDSA, RSA and shared.
Agent inventory authentication options
Options for signing agent inventory tokens are configured in the
[agent_inventory_authentication] section. They apply to agent support
independently of JWT login authentication.
| Config file key |
Environment variable |
Type |
Default value |
Description |
| agent_jwt_access_duration |
GVMD_AGENT_JWT_ACCESS_DURATION |
integer |
600 |
Lifetime of agent inventory tokens in seconds |
| agent_jwt_encode_secret |
AGENT_CONTROL_USER_TOKEN_SECRET |
string |
|
Shared secret used to sign agent inventory tokens |
| agent_jwt_encode_secret_path |
GVMD_AGENT_JWT_ENCODE_SECRET_PATH |
file path |
|
Path to a file containing the shared secret |
For example, the configuration template contains:
[agent_inventory_authentication]
agent_jwt_access_duration = 600
agent_jwt_encode_secret_path = @GVMD_STATE_DIR@/jwt/agent-inventory-secret
# agent_jwt_encode_secret = <shared-secret>
The build replaces @GVMD_STATE_DIR@ with the configured gvmd state directory.
Environment variables take precedence over their corresponding configuration
keys. The secret is selected in this order:
AGENT_CONTROL_USER_TOKEN_SECRET.agent_jwt_encode_secret in the configuration file.- File contents from
GVMD_AGENT_JWT_ENCODE_SECRET_PATH, or from
agent_jwt_encode_secret_path if that environment variable is unset.
Feature flags
The [features] section of the configuration file and the corresponding
environment variables are used to enable optional features as long as they
also have been enabled at build time.
For a list of the feature flags and more information see the separate
feature flags documentation.
Security Intelligence export
Options for the security intelligence export can be found in [security_intelligence_export] section
of the config file. These are:
| Config file key |
Environment variable |
Type |
Default value |
Description |
| max_retries |
GVMD_REPORT_EXPORT_MAX_RETRIES |
integer |
10 |
The maximum retry attemps for exporting reports to security intelligence |
| retry_base_delay |
GVMD_REPORT_EXPORT_RETRY_BASE_DELAY |
integer |
10 |
The base delay used to compute timestamp for next export retry attempt (min(base_delay * (multiplier ^ retry_count), max_delay) |
| retry_multiplier |
GVMD_REPORT_EXPORT_RETRY_MULTIPLIER |
integer |
2 |
The multiplier used to compute timestamp for next export retry attempt (see above) |
| retry_max_delay |
GVMD_REPORT_EXPORT_RETRY_MAX_DELAY |
integer |
600 |
The max delay used to compute timestamp for next export retry attempt (see above) |
| stale_threshold |
GVMD_REPORT_EXPORT_STALE_THRESHOLD |
integer |
720 |
The time, in minutes, after which a started export is considered stale and set to failed (Will then be picked up by scheduler again) |
CVE scan
Options for CVE scan matching can be found in the [cve_scan] section of the
configuration file.
| Config file key |
Environment variable |
Type |
Default value |
Description |
| cve_scan_matching_version |
GVMD_CVE_SCAN_MATCHING_VERSION |
integer |
0 |
Selects the CPE-to-CVE matching implementation. Version 0 matches detected CPEs against CVE affected-product lists. Version 1 evaluates CVE match criteria from the SCAP data. If version 1 is configured but the required SCAP data is unavailable, version 0 is used. |
Support
For any question on the usage of gvmd please use the Greenbone Community
Forum. If you found a problem with the
software, please create an issue on
GitHub. If you are a Greenbone customer you may alternatively or additionally
forward your issue to the Greenbone Support Portal.
Maintainer
This project is maintained by Greenbone AG.
Contributing
Your contributions are highly appreciated. Please create a pull
request on GitHub. Bigger changes need
to be discussed with the development team via the issues section at
GitHub first.
Before creating a pull request, it is recommended to run the following command:
make format
This reformats the new code to ensure that it follows the code style and
formatting guidelines.
All CMake files are formatted using gersemi.
To install gersemi on a Debian based system the following commands can be used:
sudo apt install pipx
pipx install gersemi
To format all CMake files run the command:
gersemi -i cmake .
License
Copyright © 2009-2026 Greenbone AG
Licensed under the GNU Affero General Public License v3.0 or later.
评论