Install OpenVAS – The Open Vulnerability Assessment Scanner
You’ll learn how to get the full‑blown OpenVAS stack running on a fresh Ubuntu machine (or via WSL/Docker if you’re stuck in Windows). No fluff, just the steps that actually work and why they matter.
Why you might want OpenVAS instead of buying a scanner
OpenVAS gives you enterprise‑grade scanning for free. I’ve used it on home lab servers, a Raspberry Pi, and even inside a VM to test my own web apps before deploying them to production. It’s the closest thing to Nessus without paying the license fee.
Step 1 – Pick your environment
If you’re on Windows, the easiest route is Docker Desktop or WSL2 with Ubuntu. I tried running OpenVAS directly in Windows Subsystem for Linux and ran into a few hiccups (like missing libxml2-dev), so I’ll show the Docker path first because it keeps everything isolated.
Step 2 – Pull the official Docker image
docker pull ghcr.io/greenbone/gvm:stable
The stable tag pulls the latest, fully tested version. Pulling it first lets you inspect what’s inside without having to install anything on your host.
Step 3 – Spin up a container with exposed ports
docker run -d \ --name gvm \ -p 9392:9392 \ -p 9443:9443 \ ghcr.io/greenbone/gvm:stable
Ports 9392 (HTTP) and 9443 (HTTPS) are the default web UI endpoints. Exposing them lets you access the Greenbone Security Assistant from your browser.
Step 4 – Let Docker do the heavy lifting
Once the container is up, it automatically runs greenbone-scap-data, greenbone-nvt-data, and other scripts that populate the vulnerability database. This initial sync can take a while—my first run on an old laptop took about 25 minutes.
Step 5 – Grab credentials
OpenVAS creates a default admin user called “admin” with a random password. Find it in the container logs:
docker logs gvm | grep "Default login"
Copy that password and log into https://localhost:9392 using your browser’s built‑in certificate warnings (the Docker image uses a self‑signed cert).
Step 6 – Update the feeds again (optional but recommended)
The scanner comes with an initial feed, but you’ll want the latest ones. Inside the container:
docker exec -it gvm bash run-nessuscli update --all
If you see “update failed: curl: (6) Could not resolve host”, it usually means DNS isn’t configured correctly in Docker. Add --dns 8.8.8.8 to the run command and try again.
Step 7 – Run a quick scan
Create a new target, choose “Localhost,” set up a simple policy (e.g., “Full and fast”), and start scanning. The UI will show progress in real time. I’ve seen this happen after an OS upgrade: the scanner suddenly reports “Connection timed out” on port 80 because the host firewall was turned on by default.
What if you’re stuck on a bare‑metal Ubuntu?
The Docker approach is great for quick testing, but if you need OpenVAS to run as a native service, install it with the PPA:
sudo apt update && sudo apt upgrade -y sudo add-apt-repository ppa:mrazavi/gvm sudo apt update sudo apt install gvm
After installation, run:
sudo gvm-setup
This script will create a database, generate keys, and set up the admin account. Watch the output; if any step fails, it usually tells you exactly what’s missing (e.g., libgnutls30).
Common pitfalls I’ve seen
- Missing dependencies – The PPA version on Ubuntu 20.04 often complains about libssl1.0-dev. Install it manually: sudo apt install libssl1.0-dev.
- Service not starting – If gvm fails to start after reboot, run systemctl status gvmd and look for “Failed with exit code 255.” That usually means the database isn’t reachable; try sudo gvm-manage-certs -a.
- License errors – OpenVAS used to ship with a bundled license that expires after a week. The Docker image includes an automated script that refreshes it, so you don’t have to worry.
Final thought
OpenVAS isn’t the fastest scanner out there, but its breadth of checks and zero cost make it worth the setup time. If you’re on Windows and just want a quick test, Docker is your friend. For a production‑ready install on Linux, use the PPA and let gvm-setup do the heavy lifting.
