Upgrade Greenbone to debian-master (Report outdated / end-of-life Scan Engine)

[devMarc5598]

Hello,
I want to update from my current alpine version (21.4.2) to the newest debian version. Is there a guide with some simple steps to follow?
A detailed guidance would be very good!?

I would be happy about any help.

GVM versions
gsad: Greenbone Security Assistant 21.4.2
gvmd: Greenbone Vulnerability Manager 21.4.3
openvas-scanner: OpenVAS 21.4.2
gvm-libs: gvm-libs 21.4.2

[Dexus]

You can now use the https://hub.docker.com/r/deineagenturug/gvm images, which are using the latest gvmd and components releases.

It use POSTGRESQL 13.

What are meaning the tags:

docker pull deineagenturug/gvm:latest               # is an not initialized basic image, that first start its initialization on the first start (short: no db & no PDF report support)
docker pull deineagenturug/gvm:latest-full          # is an not initialized basic image, that first start its initialization on the first start (short: no db, PDF report is support)
docker pull deineagenturug/gvm:latest-data          # is an initialized basic image, that can run directly without extra VOLUMES added (short: included db, but no PDF report support)
docker pull deineagenturug/gvm:latest-data-full     # is an initialized basic image, that can run directly without extra VOLUMES added (short: included db & PDF report is support)

It can be used as direct replacement for the here provided image, with the same arguments on docker run.

⚠️ I have not tested the migration from the alpine image, but this should work out of the box now. Maybe you can give a notice it it works as I expected.

[devMarc5598]

You can now use the https://hub.docker.com/r/deineagenturug/gvm images, which are using the latest gvmd and components releases.

It use POSTGRESQL 13.

What are meaning the tags:

docker pull deineagenturug/gvm:latest               # is an not initialized basic image, that first start its initialization on the first start (short: no db & no PDF report support)
docker pull deineagenturug/gvm:latest-full          # is an not initialized basic image, that first start its initialization on the first start (short: no db, PDF report is support)
docker pull deineagenturug/gvm:latest-data          # is an initialized basic image, that can run directly without extra VOLUMES added (short: included db, but no PDF report support)
docker pull deineagenturug/gvm:latest-data-full     # is an initialized basic image, that can run directly without extra VOLUMES added (short: included db & PDF report is support)

It can be used as direct replacement for the here provided image, with the same arguments on docker run.

warning I have not tested the migration from the alpine image, but this should work out of the box now. Maybe you can give a notice it it works as I expected.

Why do you switch from https://hub.docker.com/r/securecompliance/gvm to https://hub.docker.com/r/deineagenturug/gvm?

[Dexus]

Why do you switch from https://hub.docker.com/r/securecompliance/gvm to https://hub.docker.com/r/deineagenturug/gvm?

Because I feel like I'm the only one working on it. So I created my own fork so that I am able to push new versions and build all Docker images directly and correctly without having to wait for a merge. Unfortunately, that's what we've seen here in the past and again currently, no one cares. So someone has to do it who also has all the rights. And since I don't work for SCS LLC, I have no choice but to use my own fork and hardware so I can do my work and support best possible.

[Kelvinloucosta]

I'm using the "docker pull deineagenturug/gvm:latest-data-full" but when I go to check the openvas scan added, the service appears unavailable, does anyone have a link to openvas correct or have you faced this problem?

[FiveOFive]

I think I have had the same or a similar issue. The gvmd logs shows "osp_scanner_feed_version: failed to get scanner_feed_version. OSPd OpenVAS is still starting"

@Dexus - Any thoughts? Thanks for your efforts keeping this project going!

[Dexus]

I think I have had the same or a similar issue. The gvmd logs shows "osp_scanner_feed_version: failed to get scanner_feed_version. OSPd OpenVAS is still starting"

I will investigate, since It build the latest-data-full without problems I think not there is a problem.

But will check this.

I'm using the "docker pull deineagenturug/gvm:latest-data-full" but when I go to check the openvas scan added, the service appears unavailable, does anyone have a link to openvas correct or have you faced this problem?

How did you run the Image? What is your run command? While it is building the image successful I think there is a unknown problem which I can't currently reproduce.

[xenago]

Thanks for your efforts, @Dexus! Unfortunately I'm unable to start up deineagenturug/gvm:latest-full and deineagenturug/gvm:latest-data-full (versions published today) on top of my existing install. I will continue to use securecompliance/gvm:debian-master-data-full in the meantime.

Hopefully this info helps...

With latest-data-full, it throws repo signature errors:
E: The repository 'http://deb.debian.org/debian bullseye-backports InRelease' is not signed.
W: GPG error: http://apt.postgresql.org/pub/repos/apt bullseye-pgdg InRelease: At least one invalid signature was encountered.

With latest-full, it throws postgres startup errors:
2022-03-21 15:08:32,173 INFO spawned: 'postgresql' with pid 653
2022-03-21 15:08:32,188 INFO exited: postgresql (exit status 1; not expected)
....
2022-03-21 15:08:52,251 INFO gave up: postgresql entered FATAL state, too many start retries too quickly

Docker-compose:

services:
    gvm:
#        image: securecompliance/gvm:debian-master-data-full
        image: deineagenturug/gvm:latest-data-full
    restart: unless-stopped
    volumes:
      - /gvm_data/database:/opt/database
      - /gvm_data/plugins:/var/lib/openvas/plugins
      - /gvm_data/gvm:/var/lib/gvm
      - /gvm_data/ssh:/etc/ssh
    ports:
      - "443:9392"
      - "5432:5432"
      - "2222:22"
    environment:
      - DB_PASSWORD="passwordhere"
      - USERNAME="admin"
      - PASSWORD="passwordhere"
      - TZ="America/Toronto"
      - SSHD=true
      - HTTPS=false
      - AUTO_SYNC=true
      - RELAYHOST=172.17.0.1
      - SMTPPORT=25

[Dexus]

Thanks for your efforts, @Dexus! Unfortunately I'm unable to start up deineagenturug/gvm:latest-full and deineagenturug/gvm:latest-data-full (versions published today) on top of my existing install. I will continue to use securecompliance/gvm:debian-master-data-full in the meantime.

Hopefully this info helps...

With latest-full, it throws postgres startup errors:
2022-03-21 15:08:32,173 INFO spawned: 'postgresql' with pid 653
2022-03-21 15:08:32,188 INFO exited: postgresql (exit status 1; not expected)
....
2022-03-21 15:08:52,251 INFO gave up: postgresql entered FATAL state, too many start retries too quickly

hi @xenago i think you have to migrate your DB something like: https://www.kostolansky.sk/posts/upgrading-to-postgresql-12/

currently we have no automatic ways for this - what makes me a bit unhappy but without full time work on it, it will take a while :(

If you use latest-data-full or latest-data together with volumes, you can simply run latest-full or latest as image tag. Because you don't will benefit from the pre-initalized images.

With latest-data-full, it throws repo signature errors:
E: The repository 'http://deb.debian.org/debian bullseye-backports InRelease' is not signed.
W: GPG error: http://apt.postgresql.org/pub/repos/apt bullseye-pgdg InRelease: At least one invalid signature was encountered.

When you get this message? On my local system I never get this message.

[xenago]

Ok thanks for the info regarding the DB upgrade, I appreciate it!

When you get this message?

I see the repo errors in the docker logs when running the docker-compose as-included in my previous comment. I'm not sure if it has anything to do with the environment variables or volumes I used or if it has something to do with the image itself.

[Dexus]

Ok thanks for the info regarding the DB upgrade, I appreciate it!

When you get this message?

I see the repo errors in the docker logs when running the docker-compose as-included in my previous comment. I'm not sure if it has anything to do with the environment variables or volumes I used or if it has something to do with the image itself.

are you behind an proxy? I'm not able here to reproduce this, maybe a newer image will solve this issue.

[Dexus]

For further support, use https://github.com/DeineAgenturUG/greenbone-gvm-openvas-for-docker

[devMarc5598]

@Dexus
Using the image deineagenturug/gvm:latest-full worked for me. Now I have the version 21.4.3.
1)
But I cant do Scans without an error...
It shows "Task interrupted unexpectedly "and "Scan process Failure" after I run a task.
2)
I cant start the container with a preinitialized volume...
So I don't have some of the old data in the current version.