OpenVAS Vulnerability Scanning in Practice: GVM Deployment and Scheduled Scan Configuration

End-to-end OpenVAS (now GVM) vulnerability-scan deployment: install and init, scan targets and tasks, report analysis, and scheduled-scan scripts, plus verification and common troubleshooting.

OpenVAS vulnerability scanning is a common open-source vuln detection stack in security ops. This article centers on GVM (Greenbone Vulnerability Management) and walks through install, deploy, and scheduled scans so you can stand up a working vuln-management process.

Use cases

OpenVAS fits: periodic compliance scans of internal hosts, pre-prod security acceptance, Web and database attack-surface checks, and vuln discovery in MLPS assessments. Paired with baseline checks, it covers most SMB vuln-management needs.

Prerequisites

• One Ubuntu 22.04 / Debian 12 server (recommend ≥ 4 CPU cores, 8 GB RAM, 50 GB disk)
• root or sudo
• Targets reachable on the network, with authorized scanning

How it works

GVM has three components: gvmd (management daemon; task scheduling and report storage), openvas-scanner (runs scans, loads NVT plugins), gsad (Web UI). The scanner talks to gvmd over Greenbone Vulnerability Protocol (GVP). Plugin feeds (NVTs) update via greenbone-feed-sync so detections stay current.

Steps

1. Install GVM

`sudo apt update
sudo apt install -y gvm
sudo greenbone-feed-sync   # Sync the vulnerability feed; this takes a while`

2. Initialize and start services

`sudo gvm-setup          # First-time init; generates the default admin password
sudo gvm-start          # Start all services`

After init, browse to https://SERVER_IP:9392, log in as admin with the password printed during setup. Change the default password on first login.

3. Create scan targets

Go to Configuration → Targets → New. Set target name and host list (e.g. 192.168.1.0/24). Port list: All IANA assigned TCP. Leave credentials empty for unauthenticated scans.

4. Create a scan task

`# Scans → Tasks → New
# Name: Internal quarterly vuln scan
# Scan config: Full and fast
# Target: the target created in the previous step`

Save, then click the play button at the start of the task row. Status goes Requested → Running → Done.

5. Analyze reports

`# Scans → Reports → open the latest report
# Filter by severity on the left: High / Critical
# Click a vulnerability ID for details and remediation (Solution)`

6. Schedule recurring scans

`# Method 1: Configure a period in the Web UI Schedule module, then attach it to the task
# Method 2: invoke the CLI from cron
sudo apt install -y gvm-tools
gvm-cli --gmp-username admin --gmp-password PASSWORD   --socketpath /run/gvmd/gvmd.sock   --xml "<create_task><name>Daily vuln scan</name><config id='daba56c8-73ec-11df-a475-002264764cea'/><target id='TARGET_ID'/></create_task>"`

`# Add to crontab
0 2 * * * /usr/bin/gvm-cli --gmp-username admin --gmp-password PASSWORD --socketpath /run/gvmd/gvmd.sock --xml "<start_task task_id='TASK_ID'/>"`

Verify the setup

`sudo gvm-check-setup     # OK in the output means the install is complete
sudo gvmd --version      # Show gvmd version
curl -k https://127.0.0.1:9392 -o /dev/null -w "%{http_code}\n"  # expect 200`

Cross-check with Nmap on the same target; OpenVAS-discovered services and ports should largely match. If the report is empty, check target reachability and credentials first.

FAQ

Q1: gvm-setup errors with “Failed to rebuild the feed”?

Usually an interrupted sync. Retry sudo greenbone-feed-sync --type GVMD_DATA, then sudo gvm-setup. If it still fails, clear the feed cache under /var/lib/gvm/ and retry.

Q2: Scan finished but report is empty?

Check the target CIDR, that host firewalls allow scan traffic, and that you used Full and fast rather than a host-discovery-only config. Unauthenticated scans have limited Windows coverage; add SSH/Windows credentials and rescan.

Q3: Scan hangs due to low memory?

GVM defaults to high concurrency. Lower it: edit /etc/gvm/ospd-openvas.conf, set max_parallel_scans to 2~4, and cap targets per task. Do not scan an entire /8 in one job.

Summary

OpenVAS vuln scanning is deploy → configure targets → scheduled scans → fix and verify. This GVM walkthrough gets you from zero to recurring scans. Feed results into a ticketing system; set SLAs and rescan verification for High/Critical findings.