OpenVAS is a comprehensive, open-source vulnerability scanner — systematically checking your infrastructure against a large, regularly-updated database of known vulnerabilities, providing scheduled automated coverage beyond manual spot-checks.
What OpenVAS Provides Beyond Basic Tools
While Lynis (see How to Set Up Security Auditing with Lynis) audits system configuration, OpenVAS specifically scans for known CVE-mapped vulnerabilities across a broad range of software and services — complementary tools serving somewhat different purposes.
Prerequisites
- Ubuntu 22.04/24.04 VPS: 4 vCPU, 8 GB+ RAM (OpenVAS/GVM is resource-intensive)
- Docker installed (simplifies deployment considerably)
Step 1 — Run OpenVAS/GVM via Docker
docker run -d -p 443:443 --name openvas mikesplain/openvasSeveral Docker-based OpenVAS/Greenbone Vulnerability Management (GVM) distributions exist — the specific image and setup steps vary; consult current documentation for your chosen distribution's exact setup process, since this ecosystem evolves.
Step 2 — Wait for Initial Vulnerability Feed Download
First startup downloads the vulnerability database (NVT feed) — this can take a substantial amount of time on first run; allow this to complete before expecting functional scanning.
Step 3 — Access the Web Interface
https://YOUR_SERVER_IPStep 4 — Create a Scan Target
Define the target(s) you want to scan — your own server(s) specifically; never configure a target you don't have authorization to scan.
Step 5 — Create and Run a Scan Task
Configure a scan task against your defined target, selecting an appropriate scan configuration (full and fast is a reasonable general-purpose starting point).
Step 6 — Review Scan Results
Results are categorized by severity (critical, high, medium, low) with specific CVE references and remediation guidance for each finding.
Prioritizing Findings
Focus first on critical/high-severity findings affecting internet-facing services — not every finding warrants identical urgency; prioritize based on actual exploitability and exposure.
Scheduling Regular Automated Scans
Configure recurring scans (weekly or monthly, depending on your infrastructure's change rate) rather than one-time manual scans — new vulnerabilities are discovered continuously; ongoing scanning catches newly-relevant issues in already-deployed software.
Isolating the Scanner Itself
OpenVAS/GVM has significant access and capability — run it on isolated infrastructure with restricted access, similar security consideration to other powerful administrative tools.
Resource Requirements Are Genuinely Significant
OpenVAS/GVM's resource requirements are notably higher than many other security tools covered in this Knowledge Base — verify your VPS has adequate capacity before deployment, or consider running it on infrastructure separate from your production servers being scanned.
Integrating Findings into Your Remediation Workflow
See How to Audit Installed Packages for Known Vulnerabilities and your broader patch management process — OpenVAS findings should feed into the same systematic remediation tracking as other vulnerability sources, not exist as an isolated, disconnected report.
Common Errors
Scan takes an extremely long time or times out — verify adequate server resources are actually available, and consider narrowing scan scope (specific ports/services) rather than always running the most comprehensive scan configuration.
Continue Reading
- How to Set Up Security Auditing with Lynis
- How to Audit Installed Packages for Known Vulnerabilities
- How to Conduct a Penetration Test on Your Own VPS (Legal and Ethical Basics)
Browse more articles in Advanced Security & Compliance.
