Configuring Nessus/OpenVAS for Infrastructure Vulnerability Scanning

Configuring Nessus/OpenVAS for Infrastructure Vulnerability Scanning

In our practice, every unpatched host, every open port with default credentials, every outdated SSL certificate is a potential entry point. We configure Nessus Professional or OpenVAS (Greenbone Vulnerability Manager) for a systematic solution: not manual auditing once a quarter, but continuous monitoring with CVSS-based prioritization. Our certified team has 7+ years of experience and over 50 completed projects in infrastructure security. We guarantee a comprehensive scan coverage for up to 1,000 hosts per scan, with alerting delays under 1 minute.

What Gets Scanned and What's Found

A typical picture during the first scan of a production cluster: Elasticsearch without authentication listening on 0.0.0.0:9200, Redis with no password accessible from within the network (and the network is flat), Jenkins on port 8080 with an old plugin carrying a known critical vulnerability. This is not hypothetical—it's a real set of findings on an average project that "works and we don't touch it."

OpenVAS breaks down detections by categories: Network Vulnerability Tests (NVT), of which the Greenbone Security Feed contains over 80,000. Each NVT is a specific check: anonymous FTP attempt, TLS 1.0/1.1 check, ShellShock test, Heartbleed detection, brute-force of default SNMP community strings. Nessus adds compliance auditing against CIS Benchmarks and PCI DSS on top, with over 100,000 checks.

The most common issue during configuration is false positives and incorrect scope configuration. If you run a scan without exclusions on an AWS cloud infrastructure, Nessus will discover "open ports" on AWS-managed services and clutter the report with irrelevant findings. Precise scoping is needed: CIDR blocks, excluded hosts, separation by asset groups. Safe checks reduce false positives by 40% compared to full scans.

Why Credentialed Scan Is 3-5 Times More Effective Than Network Scan?

Credentialed scan is fundamentally more important than network scan. Without credentials, the scanner only sees what's exposed externally. With an SSH key (or WinRM for Windows), it checks installed packages, kernel versions, configs like /etc/ssh/sshd_config, permissions on sensitive files. The difference in the number of findings is 3-5 times.

For Nessus, credentialed scan configuration under Linux:

Scan Settings → Credentials → SSH Method: public key
Username: nessus-scanner
Private Key: /path/to/nessus_key
Elevate privileges with: sudo

For OpenVAS, the equivalent is SSH credential in Configuration → Credentials, then bind to a scan config via Scan Configs → Edit → Credentials.

How to Configure a Scan Policy for Production?

Scan policy affects the load on hosts. Full and quick modes are aggressive, not suitable for production during business hours. Safe checks are more gentle but miss some DoS vectors. Practice: Full scan once a week at night plus continuous lightweight scan (ports + versions only) daily.

For OpenVAS, the scan config can be exported as XML and stored in git.

<scan_config>
  <name>Weekly Production Full</name>
  <comment>Credentialed, safe checks disabled for vuln validation</comment>
  <preferences>
    <preference>
      <name>max_hosts</name>
      <value>10</value>
    </preference>
    <preference>
      <name>max_checks</name>
      <value>5</value>
    </preference>
  </preferences>
</scan_config>

Integration into CI/CD and Alerting

One-off scans are a half-measure. Real security is when a new host automatically enters the scan scope and a critical CVE triggers an alert in Slack/PagerDuty before it gets exploited.

Integration via Nessus API:

# Launch a scan via API
curl -X POST https://nessus-host:8834/scans \
  -H "X-ApiKeys: accessKey=XXX; secretKey=YYY" \
  -H "Content-Type: application/json" \
  -d '{"uuid": "template-uuid", "settings": {"name": "Auto-scan", "scanner_id": 1, "targets": "10.0.1.0/24"}}'

For Greenbone/OpenVAS — GVM CLI (gvm-cli) or Python library python-gvm:

from gvm.connections import TLSConnection
from gvm.protocols.gmp import Gmp

with Gmp(connection=TLSConnection(hostname='openvas-host')) as gmp:
    gmp.authenticate('admin', 'password')
    task_id = gmp.create_task(name='nightly-scan', config_id='...', target_id='...')
    gmp.start_task(task_id)

Results are parsed from the XML report and filtered by severity: CVSS >= 7.0 — alert immediately, 4.0–6.9 — weekly digest. Reports can be stored in S3/MinIO and visualized via Grafana (there's a datasource for OpenVAS) or Defect Dojo for remediation tracking.

Comparison of Nessus and OpenVAS

What's Included in the Configuration Work

• Environment audit: host inventory, scope definition (prod/staging/dev separate), tool selection.
• Scanner deployment: dedicated VM or container, network rules, credentialed access setup (SSH keys, WinRM, SNMP).
• Policy configuration: scan templates, scheduling, exclusions, severity thresholds.
• Alerting integration: webhook to messenger or SIEM (Splunk, Wazuh, ELK).
• Documentation: runbook for handling findings, SLA on remediation by severity, suppression procedure for accepted risks.
• Team training: report analysis, Defect Dojo usage.

Stages and Timeline

1. Audit and planning: 1 day
2. Deployment and configuration: 1-2 days
3. Integration and testing: 1 day
4. Documentation and training: 1 day

Total timeline: from 2 to 5 days depending on environment complexity. Cost is calculated individually, but our clients save on average 60% of their security budget through automation and prioritization. Typical project cost ranges from $2,000 to $10,000 depending on scope. We'll assess your project within one day—contact us. Order turnkey configuration: we'll prepare your infrastructure for continuous vulnerability monitoring.

Additional Information

• More about OpenVAS: Wikipedia