I've been trying to set up OpenVAS on a tiny PC like the RPi lately. Based on this post: https://dayne.broderson.org/2018/05/24/RPi_Vulnerability_Scanner.html
I wasn't expecting much success. And that's what I found. It wasn't really usable. I saw the TinkerBoard and the extra performance and RPi compatibility and thought that might be a good thing to try. I was never able to get a working mix of software on the Tinker. The repositories aren't quite the same and some of the necessary packages, OpenVAS in particular, are not maintained.
Then the RPi4 was announced. I knew this might be the ticket to making this work. 4GB of RAM!!! Unfortunately, the 4GB model isn't available yet, as far as I can tell. I decided to wait. Then I found out my sometimes partner in crime, Steve, had ordered a pair of 2GB models. Of course, I asked if I could borrow one.
I'm happy to report that the install is simple and it was able to scan my /24 that averages about 75 IP's in about 3 hours! I didn't modify anything performance related and didn't have any of the problems that Dayne referenced.
I do need to sort through a few logistic issues to make this functional in the way I'm thinking. For one thing, I want to run this headless. No problem, except OpenVAS (specifically the GSA web management) is finicky about identifying the IP address it's listening on. So far I have to manually set it and haven't figured out how to make it work with 0.0.0.0. I'll find a way. I also had a problem with the management interface failing due to memory starvation. I think. The scan will continue to run, so it's not a showstopper. I'm hoping the 4GB will help with that. I also think it'll be helpful to throw some heatsinks on. It seemed to get pretty hot.
Without further pre-amble, the steps I took. This is very similar to Dayne's post with a few exceptions:
sudo apt update
sudo apt upgrade
sudo apt autoremove //habit for me
sudo apt-get install openvas
sudo openvas-setup //this took a good hour, maybe more, to run. Lots of errors, but it seems to have been ok.
sudo openvas-start
This is the part I haven't sorted out yet. You need to update the service config files to reflect something other than 127.0.0.1. I tried 0.0.0.0 and was unsuccessful. When I changed it to the DHCP IP address it worked. I don't see this as being a good solution as I intend on using this in different environments. Regardless, here are the commands until I can sort out the right answer:
sudo nano /lib/systemd/system/greenbone-security-assistant.service
sudo systemctl daemon-reload
sudo service greenbone-security-assistant restart
sudo nano /lib/systemd/system/openvas-manager.service
sudo systemctl daemon-reload
sudo service greenbone-security-assistant restart
sudo service openvas-manager restart
sudo service openvas-scanner restart
And my GS service line that I edited in the above command:
ExecStart=/usr/sbin/gsad --foreground --listen=0.0.0.0 --port=9392 --mlisten=0.0.0.0 --mport=9390 --allow-header-host=192.168.169.198
The --allow-header-host is the problem I need to fix. I'll update as I make improvements. One of my goals is to attach a small LCD that will display the IP address.