OpenVAS Vulnerability Management

What I set out to do

Deploy OpenVAS as a containerized stack in Portainer and use it to scan the home network end to end. Run both credentialed scans, which authenticate into hosts for a deeper look, and uncredentialed scans, which see only what's exposed from the outside. The goal was to understand how endpoints look from both angles and get practical experience defending them.

What it took

• A host, an LXC container or machine to run the stack on
• Docker via Portainer, for deploying and managing the OpenVAS containers
• A defined target range, the home network IPs to scan
• A service account, for the credentialed scans to authenticate with
• OpenVAS / Greenbone, the scanning engine and its web interface

What came out of it

• Ran vulnerability scans across the home network, both credentialed and uncredentialed
• Got real insight into monitoring and defending the endpoints on the network
• Reviewed the system logs the scans generated to understand the traffic they produced
• Scoped a logging pipeline, Graylog, as the planned next step for centralizing those logs

The stack

It running

Screenshots from the deployment: the container stack, the Greenbone interface, the scan targets, and the logs the scans produced.