OSPD-OpenVAS(8)

✨ OSPD-OpenVAS 💅

okay bestie, welcome to the ospd-openvas(8) page — section 8 of the User Manuals, iykyk. this is the glow-up doc for the OpenVAS Wrapper of the Greenbone Vulnerability Management. grab a strawberry drink 🍓 and let's go.

---

🌸 NAME 🌸

ospd-openvas — the OpenVAS Wrapper of the Greenbone Vulnerability Management. that's it, that's the whole name, and honestly? iconic.

---

🦋 SYNOPSIS 🦋

ospd-openvas [-v] [-h]  [-c config-file] [--log-file log-file]

---

👑 DESCRIPTION 👑

Greenbone Vulnerability Management (GVM) is a vulnerability auditing and management framework that's made up of several modules — think of it like a friend group, everybody has a job. and the OSPD OpenVAS Wrapper, ospd-openvas, is the one in charge of the communication between the scanner OpenVAS and the clients (GVMd and gvm-tools). she's the group chat admin, fr fr. 💖

ospd-openvas inspects the remote hosts to list all the vulnerabilities and common misconfigurations that affect them. not to be dramatic but she will literally find out everything. 😭

it's a command line tool with parameters to start a daemon which keeps waiting for instructions to update the feed of vulnerability tests and to start a scan. the second part of the interface is the redis store — that's where the parameters about a scan task need to be placed and from where the results can be retrieved, and it's the unique communication channel between OSPD-OpenVAS and OpenVAS. one channel, no side quests. periodt.

---

✨ OPTIONS ✨

• -s <config-file>, --config-file <config-file> — use the alternate configuration file instead of ~/.config/ospd.conf. main character config energy.
• --log-config <log-config-path> — log configuration file path. default: ~/.config/ospd-logging.conf
• --version — print the version number and exit. short and sweet, we love a quick exit. 🎀
• -h, --help — show a summary of the commands. when in doubt, ask for help bestie.
• -p PORT, --port PORT — TCP port to listen on. default: 0
• -b ADDRESS, --bind-address ADDRESS — address to listen on. default: 0.0.0.0
• -u UNIX_SOCKET, --unix-socket UNIX_SOCKET — Unix file socket to listen on. default: /var/run/ospd/ospd.sock
• -m SOCKET_MODE, --socket-mode SOCKET_MODE — Unix file socket mode. default: 0o770
• --pid-file PID_FILE — location of the file for the process ID. default: /var/run/ospd.pid
• --lock-file-dir LOCK_FILE_DIR — directory where the feed lock file is placed. default: /var/run/ospd
• -k KEY_FILE, --key-file KEY_FILE — server key file. default: /usr/var/lib/gvm/private/CA/serverkey.pem
• -c CERT_FILE, --cert-file CERT_FILE — server cert file. default: /usr/var/lib/gvm/CA/servercert.pem
• --ca-file CA_FILE — CA cert file. default: /usr/var/lib/gvm/CA/cacert.pem
• -L LOG_LEVEL, --log-level LOG_LEVEL — desired level of logging. default: WARNING
• -f, --foreground — run in foreground and log all messages to console. no disappearing acts.
• -l LOG_FILE, --log-file LOG_FILE — path to the logging file.
• -t TIMEOUT, --stream-timeout TIMEOUT — set a timeout on socket operations. default 10 seconds
• --niceness NICENESS — start the scan with the given niceness. default 10
• --mqtt-broker-address ADDRESS — broker address to connect to for MQTT communication. neccessary to get results from Notus-Scanner. default: localhost
• --mqtt-broker-port PORT — broker port to connect to for MQTT communication. neccessary to get results from Notus-Scanner. default: 1883
• --mqtt-broker-username USERNAME — username to connect to MQTT broker for MQTT communication.
• --mqtt-broker-password PASSWORD — password to connect to MQTT broker for MQTT communication.
• --scaninfo-store-time TIME — time in hours a scan is stored before being considered forgotten and being delete from the scan table. default 0, disabled.
• --max-scans VALUE — max. amount of parallel task that can be started. default 0, disabled.
• --min-free-mem-scan-queue MB — minimum free memory in MB required to run the scan. if no enough free memory is available, the scan is queued. default 0, disabled.
• --max-queued-scans VALUE — maximum number allowed of queued scans before starting to reject new scans. default 0, disabled.
• --feed-updater METHOD — sets the method of updating the feed. can either be openvas or nasl-cli. default: openvas
• -x, --signature-check — enable feed signature check.
• --notus-feed-dir DIRECTORY — directory where notus feed is placed. default: /var/lib/notus/advisories
• --disable-notus-hashsum-verification BOOLEAN — disable hashsum verification for notus advisories. default: false
• --list-commands — display all protocol commands. the full menu, chef's kiss. 🔥

---

🧚 THE CONFIGURATION FILE 🧚

the default ospd-openvas configuration file, ~/.config/ospd.conf, contains these options under the section [OSPD - openvas]:

• log_config — log configuration file path.
• port — TCP port to listen on.
• address — address to listen on (this corresponds to --bind-address).
• unix_socket — this option specifies the socket path.
• socket_mode — this option defines the permissions on a socket. it must be set in octal format. e.g. socket_mode = 0o770
• pid_file — location of the file for the process ID.
• lock_file_dir — directory where the feed lock file is placed.
• key_file — server key file.
• cert_file — server cert file.
• ca_file — CA cert file.
• log_level — desired level of logging.
• foreground — set to true to run in foreground and log all messages to console.
• log_file — path to the log file. if no log file is given, the system log facility is used by default.
• stream_timeout — set a timeout on socket operations. default 10 seconds
• niceness — start the scan with the given niceness. default 10
• scaninfo_store_time — time in hours a scan is stored before being considered forgotten and being delete from the scan table. default 0, disabled.
• max_scans — maximum amount of parallel task that can be started. default 0, disabled.
• max_queued_scans — maximum number allowed of queued scans before starting to reject new scans. default 0, disabled.
• min_free_mem_scan_queue — minimum free memory in MB required to run the scan. if insufficient free memory is available, the scan is queued. default 0, disabled.
• mqtt_broker_address — broker address to connect to for MQTT communication.
• mqtt_broker_port — broker port to connect to for MQTT communication.
• mqtt_broker_username — username to connect to MQTT broker for MQTT communication.
• mqtt_broker_password — password to connect to MQTT broker for MQTT communication.
• feed_updater — sets the method of updating the feed.
• signature_check — set to true to enable feed signature check.
• notus_feed_dir — directory where notus feed is placed.
• disable_notus_hashsum_verification — set to true to disable hashsum verification for notus advisories.

---

🫶 SEE ALSO 🫶

openvas(8), gsad(8), gvmd(8), greenbone-nvt-sync(8),

---

🌈 MORE INFORMATION 🌈

the canonical places where you will find more information about OSPD-OpenVAS are:

• Community Portal
• Development Platform
• Traditional home site

---

💜 AUTHORS 💜

ospd-openvas code is developed by Greenbone AG.

---

and that's the whole thing bestie!! 🎀 source/version vibes: Greenbone Vulnerability Manage... (yes it literally got cut off like that, we're keeping it, no notes 💀) and the date on the tin is August 2019. section 8, User Manuals. go forth and scan responsibly. ✨🦋