gvmd(8)

📦
version 26.28.0 · 5 versions
, in alpine 3.24, ubuntu stonking

💖 gvmd — bestie edition 💖

okay so this is the manual page for gvmd, straight out of the System Manager's Manual. yes you're in section 8 (that's the "system manager" bit), and yes, it's about to be your whole personality for the next ten minutes. let's go 😌✨

✨ NAME ✨

gvmd — the Greenbone Vulnerability Manager daemon 👑

🌸 SYNOPSIS 🌸

gvmd OPTIONS

that's it. that's the whole synopsis. gvmd plus whatever options you're feeling 💅

🦋 DESCRIPTION 🦋

The Greenbone Vulnerability Manager is, and I cannot stress this enough, the central management service — it sits right in the middle between your security scanners and your user clients. main character energy from day one fr fr.

It manages (and stores) any vulnerability management configurations and also the scan results. Like, all of it. The storage? Handled. Then access to data, control commands and workflows gets offered via the XML-based Greenbone Management Protocol (GMP).

Now for the scanner gossip: the primary scanner, OpenVAS Scanner, is controlled directly via protocol OTP. Meanwhile any other remote scanner gets coupled up with the Open Scanner Protocol (OSP). different protocol for different vibes, it's giving polyamorous networking 🫶

💅 OPTIONS 💅

  • -h, --help — show help options. iconic of her.
  • --affected-products-query-size=NUMBER — sets how many CVEs get processed per query when updating the affected products. defaults to 20000.
  • --auth-timeout=TIMEOUT — sets the authentication timeout time for the cached authentication. defaults to 15 minutes.
  • --broker-address=ADDRESS — sets the address for the publish-subscribe message (MQTT) broker. defaults to localhost:9138. set it to empty to disable.
  • --check-alerts — check SecInfo alerts.
  • --client-watch-interval=NUMBER — check whether the client connection was closed every NUMBER seconds. 0 disables it. defaults to 1 second.
  • --create-encryption-key — create a new credential encryption key, set it as the new default, and exit. if you give no other options, a 4096 bit RSA key gets created.
  • --create-scanner=SCANNER — create global scanner SCANNER and exit.
  • --create-user=USERNAME — create admin user USERNAME and exit.
  • -d, --database=NAME — use NAME as database for PostgreSQL.
  • --db-host=HOST — use HOST as database host or socket directory for PostgreSQL.
  • --db-port=PORT — use PORT as database port or socket extension for PostgreSQL.
  • --delete-scanner=SCANNER-UUID — delete scanner SCANNER-UUID and exit.
  • --delete-user=USERNAME — delete user USERNAME and exit.
  • --dh-params=FILE — Diffie-Hellman parameters file.
  • --disable-cmds=COMMANDS — disable comma-separated COMMANDS.
  • --disable-encrypted-credentials — do not encrypt or decrypt credentials.
  • --disable-password-policy — do not restrict passwords to the policy.
  • --disable-scheduling — disable task scheduling.
  • --encryption-key-length=LENGTH — set key length to LENGTH bits when creating a new RSA credential encryption key. defaults to 4096.
  • --encryption-key-type=TYPE — use the key type TYPE when creating a new credential encryption key. rn only RSA is supported.
  • --encrypt-all-credentials — (re-)encrypt all credentials. glow up for every single one of them ✨
  • --feed-lock-path=PATH — sets the path to the feed lock file.
  • --feed-lock-timeout=TIMEOUT — sets the number of seconds to retry for if the feed is locked in contexts (like migration or rebuilds) that do not retry on their own (like automatic syncs). defaults to 0 (no retry).
  • -f, --foreground — run in foreground.
  • --get-scanners — list scanners and exit.
  • --get-users — list users and exit.
  • --gnutls-priorities=PRIORITIES-STRING — sets the GnuTLS priorities for the Manager socket.
  • --gvmd-config=PATH — use the given path for the gvmd system configuration file.
  • --inheritor=USERNAME — have USERNAME inherit from deleted user.
  • -a, --listen=ADDRESS — listen on ADDRESS.
  • --ldap-debug — enable debugging of LDAP authentication.
  • --listen2=ADDRESS — listen also on ADDRESS.
  • --listen-group=STRING — group of the unix socket.
  • --listen-mode=STRING — file mode of the unix socket.
  • --listen-owner=STRING — owner of the unix socket.
  • --max-concurrent-scan-updates=NUMBER — maximum number of scan updates that can run at the same time. default: 0 (unlimited).
  • --max-email-attachment-size=NUMBER — maximum size of alert email attachments, in bytes.
  • --max-email-include-size=NUMBER — maximum size of inlined content in alert emails, in bytes.
  • --max-email-message-size=NUMBER — maximum size of user-defined message text in alert emails, in bytes.
  • --max-ips-per-target=NUMBER — maximum number of IPs per target.
  • --mem-wait-retries=NUMBER — how often to try waiting for available memory. default: 30. each retry will wait for 10 seconds.
  • -m, --migrate — migrate the database and exit.
  • --min-mem-feed-update=NUMBER — minimum memory in MiB for feed updates. default: 0. feed updates are skipped if less physical memory is available.
  • --modify-scanner=SCANNER-UUID — modify scanner SCANNER-UUID and exit.
  • --modify-setting=UUID — modify setting UUID and exit.
  • --new-password=PASSWORD — modify user's password and exit.
  • --new-password=PASSWORD — modify user's password and exit. (yes bestie it's listed twice in the original, we don't question the source, we simply respect it 😭)
  • --optimize=NAME — run an optimization: vacuum, add-feed-permissions, analyze, cleanup-config-prefs, cleanup-feed-permissions, cleanup-port-names, cleanup-report-formats, cleanup-result-nvts, cleanup-result-severities, cleanup-schedule-times, cleanup-sequences, cleanup-tls-certificate-encoding, rebuild-report-cache or update-report-cache.
  • --osp-vt-update=SCANNER-SOCKET — unix socket for OSP NVT update. defaults to the path of the 'OpenVAS Default' scanner if it is an absolute path.
  • --password=PASSWORD — password, for --create-user.
  • -p, --port=NUMBER — use port number NUMBER.
  • --port2=NUMBER — use port number NUMBER for address 2.
  • --rebuild-gvmd-data=TYPES — reload all gvmd data objects of a given types from feed. the types must be "all" or a comma-separated of the following: "configs", "port_lists" and "report_formats".
  • --rebuild-scap — rebuild all SCAP data.
  • --relay-mapper=FILE — executable for automatically mapping scanner hosts to relays. if the option is empty or not given, automatic mapping is disabled.
⚠️ this option is deprecated and relays should be set explictly in the relay_... fields of scanners. (also yes, "explictly" is spelled like that in the source, we're keeping it, no cap.)
  • --relays-path=FILE — path to an externally managed JSON file used to automatically update the relays of scanners. these will overwrite any relays set manually and remove the relays for scanners not listed in the file. she's assertive like that.
  • --role=ROLE — role for --create-user and --get-users.
  • --scanner-ca-pub=SCANNER-CA-PUB — scanner CA Certificate path for --[create|modify]-scanner.
  • --scanner-credential=SCANNER-CREDENTIAL — scanner credential for --create-scanner and --modify-scanner. can be blank to unset or a credential UUID. if omitted, a new credential can be created instead.
  • --scanner-host=SCANNER-HOST — scanner host or socket for --create-scanner and --modify-scanner.
  • --scanner-key-priv=SCANNER-KEY-PRIVATE — scanner private key path for --[create|modify]-scanner if --scanner-credential is not given.
  • --scanner-key-pub=SCANNER-KEY-PUBLIC — scanner Certificate path for --[create|modify]-scanner if --scanner-credential is not given.
  • --scanner-name=NAME — name for --modify-scanner.
  • --scanner-port=SCANNER-PORT — scanner port for --create-scanner and --modify-scanner.
  • --scanner-relay-host=SCANNER-HOST — scanner relay host or socket for --create-scanner and --modify-scanner.
  • --scanner-relay-port=SCANNER-PORT — scanner relay port for --create-scanner and --modify-scanner.
  • --scanner-type=SCANNER-TYPE — scanner type for --create-scanner and --modify-scanner. either 'OpenVAS', 'GMP', 'OSP-Sensor' or a number as used in GMP.
  • --scanner-connection-retry=NUMBER — number of auto retries if scanner connection is lost in a running task.
  • --schedule-timeout=TIME — time out tasks that are more than TIME minutes overdue. -1 to disable, 0 for minimum time.
  • --secinfo-commit-size=NUMBER — during CERT and SCAP sync, commit updates to the database every NUMBER items, 0 for unlimited.
  • --secinfo-fast-init=NUMBER — whether to prefer faster SQL with less checks for non-incremental SecInfo updates. 0 to use statements with more checks, 1 to use faster statements, default: 1.
  • --secinfo-update-strategy=NUMBER — the strategy how to handle SecInfo updates: 0 (default) = keep old schemas and replace them at the end, 1 = drop old schemas at update start, swap them in at the end.
  • -c, --unix-socket=FILENAME — listen on UNIX socket at FILENAME.
  • --user=USERNAME — user for --new-password.
  • --value=VALUE — value for --modify-setting.
  • --verbose — has no effect. see INSTALL.md for logging config. 💀 she literally does nothing but she's still invited to the party.
  • --verify-scanner=SCANNER-UUID — verify scanner SCANNER-UUID and exit.
  • --version — print version and exit.
  • --vt-verification-collation=COLLATION — set collation for VT verification to COLLATION, omit or leave empty to choose automatically. should be 'ucs_default' if DB uses UTF-8 or 'C' for single-byte encodings.

🎀 SIGNALS 🎀

SIGHUP causes gvmd to rebuild the database with information from the Scanner (openvas). so like... a little poke and she refreshes herself. healthy communication honestly.

🌈 EXAMPLES 🌈

gvmd --port 1241

Serve GMP clients on port 1241 and connect to an OpenVAS scanner via the default OTP file socket. one line, one legend 🫶

💜 SEE ALSO 💜

openvas(8), gsad(8), ospd-openvas(8), greenbone-certdata-sync(8), greenbone-scapdata-sync(8),

(and yes, that trailing comma is canon. we do not edit canon.)

⭐ MORE INFORMATION ⭐

The canonical places where you will find more information about the Greenbone Vulnerability Manager are:

go read, bestie, the lore is deep 📚✨

The Greenbone Vulnerability Manager is released under the GNU GPL, version 2, or, at your option, any later version. open source and unbothered 💅

and that's the whole page!! sourced from the Manuals set, filed under the User corner of your friendly neighbourhood gvmd(8). love u, go secure something 🦋💖

📦 where this page comes from