docs(connectors): document GMP over SSH for OpenVAS / Greenbone

docs/content/connectors/upstream/toolreference.md

@@ -1726,19 +1726,45 @@ DefectDojo maps each PDCP **scan** as a separate Record and imports that scan's
 
 ## **OpenVAS / Greenbone**
 
-The OpenVAS / Greenbone connector imports **network vulnerability findings** from a Greenbone (Greenbone Community Edition or Greenbone Enterprise) instance. It talks to `gvmd` over **GMP (Greenbone Management Protocol)** — an XML protocol over a TLS socket, not HTTP — and syncs the whole instance: it enumerates scan **tasks** and creates a DefectDojo product for each, importing the results of each task's latest report.
+The OpenVAS / Greenbone connector imports **network vulnerability findings** from a Greenbone (Greenbone Community Edition or Greenbone Enterprise) instance. It talks to `gvmd` over **GMP (Greenbone Management Protocol)** — an XML protocol, not HTTP — and syncs the whole instance: it enumerates scan **tasks** and creates a DefectDojo product for each, importing the results of each task's latest report.
+
+GMP can be carried two ways, and which one you need depends on your Greenbone version:
+
+* **SSH** — what Greenbone documents from **GOS 4** onwards, and the right choice for a current instance.
+* **TLS** — gvmd's older transport on port **9390**. It was the default only through GOS 3.1, and a current Greenbone commonly exposes no TLS listener at all.
 
 #### Prerequisites
 
-A Greenbone **GMP user** (username + password) and network access to gvmd's GMP TLS port (default **9390**). The Greenbone Community Edition compose stack fronts gvmd via a unix socket, so to reach it from a networked connector you either run the connector where it can reach the socket or expose the GMP TLS port (for example a `socat` TLS bridge to `gvmd.sock`).
+A Greenbone **GMP user** (username + password) in all cases. The GMP user is always required: SSH only carries the connection to `gvmd`, and GMP still authenticates over it.
+
+For the **SSH** transport, an SSH account on the Greenbone host that reaches `gvmd`, plus its host key fingerprint. Either arrangement works and the connector detects which one your host uses:
+
+* An account whose forced command connects the session to `gvmd` — the arrangement Greenbone appliances ship, and the one `gvm-tools` uses. The default account name is `gmp`.
+* An ordinary account permitted to forward to gvmd's unix socket (`AllowStreamLocalForwarding`), which suits self\-managed and containerised installs.
+
+For the **TLS** transport, network access to gvmd's GMP TLS port (default **9390**). Note that the Greenbone Community Edition compose stack fronts `gvmd` with a unix socket and no TLS listener, so this transport needs something in front of the socket — for example a `socat` TLS bridge to `gvmd.sock`.
 
 #### Connector Mappings
 
-1. Enter the gvmd host in the **Location** field (host or `host:port`).
+1. Enter the Greenbone host in the **Location** field.
 2. Enter the GMP **Username** and **Password**.
-3. Optionally set the **GMP Port** (defaults to 9390).
-4. For gvmd's default self\-signed certificate, either provide a **CA Certificate (PEM)** to verify against, or set **Skip TLS Verification** to `true`.
-5. Optionally, set a **Minimum Severity** to limit which findings are imported.
+3. Optionally, set a **Minimum Severity** to limit which findings are imported.
+
+Then configure one transport.
+
+**For SSH:**
+
+1. Set **Transport** to `ssh`.
+2. Enter the **SSH Username** (defaults to `gmp`) and, if it is not 22, the **SSH Port**.
+3. Provide either an **SSH Private Key** — with its **SSH Key Passphrase** if the key is encrypted — or an **SSH Password**. A key is preferred.
+4. Enter the **SSH Host Key Fingerprint**. A server usually offers host keys of several types and there is no telling in advance which one gets negotiated, so paste **all** of them, separated by commas or spaces. `ssh-keyscan <host> | ssh-keygen -lf -` prints them for every key the host offers, and its output can be pasted as\-is. Setting **Skip SSH Host Key Check** to `true` accepts any host key instead, which is not recommended. Note that **Skip TLS Verification** does *not* do this \- it covers the TLS certificate only, so that routinely skipping the check on gvmd's self\-signed certificate cannot quietly un\-pin your host keys.
+5. Optionally set the **gvmd Socket Path** if your host permits socket forwarding but keeps the socket somewhere non\-standard. Left blank, the connector probes the usual locations.
+
+**For TLS:**
+
+1. Leave **Transport** blank.
+2. Optionally set the **GMP Port** (defaults to 9390).
+3. For gvmd's default self\-signed certificate, either provide a **CA Certificate (PEM)** to verify against, or set **Skip TLS Verification** to `true`.
 
 Each Greenbone task becomes a Record. Findings come from the task's latest finished report — one per `<result>`. Severity is taken from the result's threat level (Greenbone's `Log`/`Debug` informational levels map to Info), with the numeric CVSS score recorded; CVE references become vulnerability ids, the NVT solution becomes the mitigation, and each result's host/port becomes an endpoint.