Skip to content

docs(connectors): document GMP over SSH for OpenVAS / Greenbone - #15754

Merged
devGregA merged 2 commits into
DefectDojo:bugfixfrom
devGregA:sc-14681_openvas_ssh_docs
Aug 20, 2026
Merged

docs(connectors): document GMP over SSH for OpenVAS / Greenbone#15754
devGregA merged 2 commits into
DefectDojo:bugfixfrom
devGregA:sc-14681_openvas_ssh_docs

Conversation

@devGregA

Copy link
Copy Markdown
Contributor

What

Documents the GMP over SSH transport in the OpenVAS / Greenbone connector reference, and splits the transport choice out from the rest of the setup.

Why

Greenbone carries GMP two ways, and the reference only described the older one:

  • TLS on port 9390 was the default transport only through GOS 3.1.
  • SSH is what Greenbone documents from GOS 4 onwards.

A current Greenbone commonly exposes no TLS listener at all — the Community Edition compose stack fronts gvmd with a unix socket and nothing on 9390 — so a reader following the existing instructions had no way to connect a modern instance.

What the section now says

  • The transport choice up front, with which Greenbone version needs which.
  • SSH prerequisites, covering both arrangements found in the field, since the connector detects which one a host uses rather than making the reader declare it: an appliance-style account whose forced command connects the session to gvmd (what gvm-tools expects, default account name gmp), or an ordinary account permitted to forward to gvmd's unix socket.
  • That the GMP user is still required on SSH. This is the easiest thing to get wrong: SSH only carries the connection, and GMP still authenticates over it, so there are two sets of credentials rather than one.
  • That the host key fingerprint field takes all of a server's fingerprints. A host usually offers several key types and there is no telling in advance which gets negotiated, so a single fingerprint read off the wrong key fails; ssh-keyscan <host> | ssh-keygen -lf - output pastes as-is.
  • That Skip TLS Verification covers the TLS certificate only and does not accept SSH host keys — those have their own setting. Worth stating explicitly, because skipping the certificate check is routine against gvmd's self-signed cert, and it would be easy to assume that setting also governs host keys.
  • The TLS instructions are kept, with the caveat that the Community Edition stack needs something in front of the socket (for example a socat TLS bridge) for that transport to be reachable.

Notes for review

Docs-only — one file, no code and no screenshots. The connector fields described here (Transport, the SSH * fields, gvmd Socket Path) ship in an upcoming connectors release, so you may want to land this alongside it rather than ahead of it.

Greenbone deprecated TLS/GMP - it was the default only through GOS 3.1 - in
favour of GMP over SSH from GOS 4 on, and a current Greenbone commonly exposes
no TLS listener at all. The section described only the TLS transport, which
left the reader with no way to connect a modern instance.

Splits the transport choice out, says which version needs which, and documents
the SSH setup: either arrangement found in the field (an appliance-style
forced-command account, or an ordinary account permitted to forward to gvmd's
unix socket) works and is detected automatically.

Calls out that the GMP user is still required on SSH - SSH only carries the
connection, GMP authenticates over it - and that the host key fingerprint
field takes all of a server's fingerprints, since there is no telling which
key type gets negotiated.

The TLS instructions stay, with the caveat that the Community Edition compose
stack has no TLS listener and needs something in front of the socket.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@devGregA
devGregA enabled auto-merge August 20, 2026 20:18
@devGregA
devGregA disabled auto-merge August 20, 2026 20:29
@devGregA
devGregA merged commit 6526986 into DefectDojo:bugfix Aug 20, 2026
31 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant