docker.recipes

OpenVAS Vulnerability Scanner

advanced

Greenbone OpenVAS for vulnerability scanning and management.

Overview

OpenVAS (Open Vulnerability Assessment Scanner) is a comprehensive vulnerability management platform developed by Greenbone Networks, offering enterprise-grade security scanning capabilities as open source software. The platform consists of three core components: the OpenVAS scanner engine that performs the actual vulnerability detection using a database of over 50,000 Network Vulnerability Tests (NVTs), the Greenbone Vulnerability Manager Daemon (gvmd) that orchestrates scan operations and manages results, and the Greenbone Security Assistant (gsad) web interface that provides intuitive scan configuration and reporting capabilities. This integrated stack transforms raw vulnerability data into actionable security intelligence through automated scanning, risk assessment, and compliance reporting. The combination of OpenVAS scanner's deep technical detection capabilities with gvmd's centralized management and gsad's user-friendly interface creates a powerful vulnerability management solution that rivals commercial alternatives. Security teams benefit from this stack's ability to perform authenticated and unauthenticated scans across network infrastructure, web applications, and system configurations while maintaining detailed audit trails and generating compliance reports for standards like PCI DSS, ISO 27001, and NIST frameworks.

Key Features

  • Over 50,000 continuously updated Network Vulnerability Tests (NVTs) covering CVE database entries
  • Authenticated scanning with credential-based access for deeper system analysis
  • Advanced scan configuration with custom policies, schedules, and target management
  • Comprehensive reporting engine with PDF, XML, and CSV export formats
  • Real-time scan progress monitoring with detailed vulnerability classification
  • Integration with Greenbone's commercial security feed for enhanced threat intelligence
  • Multi-target scanning capabilities supporting IP ranges, hostnames, and network segments
  • Role-based access control with customizable user permissions and scan visibility

Common Use Cases

  • 1Enterprise security teams conducting regular vulnerability assessments across corporate infrastructure
  • 2Compliance officers generating automated reports for PCI DSS, SOX, and regulatory audits
  • 3Penetration testers performing preliminary reconnaissance and vulnerability identification
  • 4DevOps teams implementing security scanning in CI/CD pipelines for application deployment
  • 5Managed security service providers offering vulnerability assessment services to clients
  • 6Educational institutions teaching cybersecurity concepts with hands-on vulnerability scanning
  • 7Small to medium businesses establishing baseline security posture assessments

Prerequisites

  • Minimum 4GB RAM (8GB+ recommended) for comprehensive scan operations and NVT database
  • 50GB+ available disk space for vulnerability feeds, scan results, and PostgreSQL database
  • Port 9392 available for Greenbone Security Assistant web interface access
  • Understanding of network topology and target system credentials for authenticated scans
  • Basic familiarity with vulnerability management concepts and CVE scoring systems
  • Reliable internet connection for initial NVT feed synchronization (several hours required)

For development & testing. Review security settings, change default credentials, and test thoroughly before production use. See Terms

docker-compose.yml

docker-compose.yml
1services: 
2  openvas: 
3    image: greenbone/openvas-scanner:latest
4    container_name: openvas
5    restart: unless-stopped
6    volumes: 
7      - openvas_data:/var/lib/openvas
8    networks: 
9      - openvas-network
10
11  gvmd: 
12    image: greenbone/gvmd:latest
13    container_name: gvmd
14    restart: unless-stopped
15    volumes: 
16      - gvmd_data:/var/lib/gvm
17      - openvas_data:/var/lib/openvas
18    depends_on: 
19      - openvas
20      - postgres
21    networks: 
22      - openvas-network
23
24  gsad: 
25    image: greenbone/gsad:latest
26    container_name: gsad
27    restart: unless-stopped
28    ports: 
29      - "${GSAD_PORT:-9392}:9392"
30    depends_on: 
31      - gvmd
32    networks: 
33      - openvas-network
34
35  postgres: 
36    image: greenbone/pg-gvm:latest
37    container_name: openvas-postgres
38    restart: unless-stopped
39    volumes: 
40      - postgres_data:/var/lib/postgresql
41    networks: 
42      - openvas-network
43
44volumes: 
45  openvas_data: 
46  gvmd_data: 
47  postgres_data: 
48
49networks: 
50  openvas-network: 
51    driver: bridge

.env Template

.env
1# OpenVAS
2GSAD_PORT=9392

Usage Notes

  1. 1Web UI at https://localhost:9392
  2. 2Initial feed sync takes hours
  3. 3Default login: admin/admin
  4. 4Schedule regular scans

Individual Services(4 services)

Copy individual services to mix and match with your existing compose files.

openvas
openvas:
  image: greenbone/openvas-scanner:latest
  container_name: openvas
  restart: unless-stopped
  volumes:
    - openvas_data:/var/lib/openvas
  networks:
    - openvas-network
gvmd
gvmd:
  image: greenbone/gvmd:latest
  container_name: gvmd
  restart: unless-stopped
  volumes:
    - gvmd_data:/var/lib/gvm
    - openvas_data:/var/lib/openvas
  depends_on:
    - openvas
    - postgres
  networks:
    - openvas-network
gsad
gsad:
  image: greenbone/gsad:latest
  container_name: gsad
  restart: unless-stopped
  ports:
    - ${GSAD_PORT:-9392}:9392
  depends_on:
    - gvmd
  networks:
    - openvas-network
postgres
postgres:
  image: greenbone/pg-gvm:latest
  container_name: openvas-postgres
  restart: unless-stopped
  volumes:
    - postgres_data:/var/lib/postgresql
  networks:
    - openvas-network

Quick Start

terminal
1# 1. Create the compose file
2cat > docker-compose.yml << 'EOF'
3services:
4  openvas:
5    image: greenbone/openvas-scanner:latest
6    container_name: openvas
7    restart: unless-stopped
8    volumes:
9      - openvas_data:/var/lib/openvas
10    networks:
11      - openvas-network
12
13  gvmd:
14    image: greenbone/gvmd:latest
15    container_name: gvmd
16    restart: unless-stopped
17    volumes:
18      - gvmd_data:/var/lib/gvm
19      - openvas_data:/var/lib/openvas
20    depends_on:
21      - openvas
22      - postgres
23    networks:
24      - openvas-network
25
26  gsad:
27    image: greenbone/gsad:latest
28    container_name: gsad
29    restart: unless-stopped
30    ports:
31      - "${GSAD_PORT:-9392}:9392"
32    depends_on:
33      - gvmd
34    networks:
35      - openvas-network
36
37  postgres:
38    image: greenbone/pg-gvm:latest
39    container_name: openvas-postgres
40    restart: unless-stopped
41    volumes:
42      - postgres_data:/var/lib/postgresql
43    networks:
44      - openvas-network
45
46volumes:
47  openvas_data:
48  gvmd_data:
49  postgres_data:
50
51networks:
52  openvas-network:
53    driver: bridge
54EOF
55
56# 2. Create the .env file
57cat > .env << 'EOF'
58# OpenVAS
59GSAD_PORT=9392
60EOF
61
62# 3. Start the services
63docker compose up -d
64
65# 4. View logs
66docker compose logs -f

One-Liner

Run this command to download and set up the recipe in one step:

terminal
1curl -fsSL https://docker.recipes/api/recipes/openvas-vulnerability-scanner/run | bash

Troubleshooting

  • Initial setup stuck at 'Updating NVT cache': Allow 2-6 hours for first-time feed synchronization and avoid restarting containers during this process
  • Web interface shows 'Service Unavailable' error: Check that gvmd container has completed database initialization by examining logs with docker logs gvmd
  • Scans fail with 'No NVT available' message: Verify feed synchronization completed successfully and restart openvas scanner container
  • PostgreSQL connection errors in gvmd logs: Ensure postgres container is fully started before gvmd by increasing depends_on delay or using healthchecks
  • High memory usage during large scans: Limit concurrent scan targets and adjust OpenVAS scanner process limits in container environment variables
  • Cannot login with default admin credentials: Reset admin password by executing gvmd user creation commands directly in the gvmd container

Community Notes

Loading...
Loading notes...

Download Recipe Kit

Get all files in a ready-to-deploy package

Includes docker-compose.yml, .env template, README, and license

Components

openvasgvmdgsad

Tags

#openvas#vulnerability#scanning#security#compliance

Category

Security & Networking

Related Recipes

Ad Space