SSH Access for gvm-tools

[armorello]

Hello I have a master and sensor up running 21.4.3 and operationally the product works great.

What we are trying to accomplish is being able to use gvm-tools (gvm-scripts,pyshell,gvm-cli) from the docker host running the master to remotely control the API. This is where we have gotten stuck. Alot of the GVM documentation around these tools mention using the gvm user which we didn't set the password on. We have tried copping keys of the gvm user for password less access from outside of the container with no luck. Would someone be able to share of their basic config for api access into the container ? Users and port forwarding settings needed?

Docker-compose file:

version: "3"
services:
gvm:
image: securecompliance/gvm:21.4.3-v1-data-full
container_name: odvm
volumes:
- ./volumes/opt_database:/opt/database
- ./volumes/var_lib_gvm:/var/lib/gvm
- ./volumes/var_lib_openvas_plugins:/var/lib/openvas/plugins
- ./volumes/etc_ssh:/etc/ssh
environment:
- USERNAME=admin
- PASSWORD=admin
- RELAYHOST=smtp.b.com
- SMTPPORT=25
- AUTO_SYNC=true
- HTTPS=true
- TZ=CST
- SSHD=true
- DB_PASSWORD=admin
ports:
- "8080:9392" # Web interface
#- "5432:5432" # Access PostgreSQL database from external tools
- "2222:22" # SSH ifor remote sensors
#- "9390:9390" #GMP / API port
restart: unless-stopped

[Dexus]

run docker compose exec -u gvm gvm <gvm-cli command with parameter....>

btw. you use a outdated version have a look to https://github.com/DeineAgenturUG/greenbone-gvm-openvas-for-docker for supported and updated versions

[Dexus]

btw. expose the GMP Port and use a local gvm-cli installed from pip and use it from where ever you like. we have not build the image to connect to the docker container via ssh and execute there your stuff.

[BTuma]

Hello I am working on the same issue.

With this GVM container image I am not clear on how to connect to the host via SSH. I am simply trying to establish an SSH connection from a user on the host server with gvm-tools installed and then SSH into the container.

I have tried to connect via 2222 which is mapped to port 22 SSH on the container and I tried generating my own SSH key and added it to the authorization file in the container: /var/lib/gvm/.ssh/authorized_keys
testuser@localhost:~/.ssh$ ssh gvm@localhost -p 2222
channel 0: open failed: connect failed: open failed
Connection to localhost closed.
** the channel 0 error above is a bit odd which tells me that I am missing something?

I also notice there are a number of keys in this mapped volume on the container. Am I supposed to use one of these private keys to connect via SSH? /etc/ssh
contents in that directory were generated at the creation of the container.
-rw------- 1 root root 1.4K Apr 13 10:22 ssh_host_dsa_key
-rw-r--r-- 1 root root 607 Apr 13 10:22 ssh_host_dsa_key.pub
-rw------- 1 root root 513 Apr 13 10:22 ssh_host_ecdsa_key
-rw-r--r-- 1 root root 179 Apr 13 10:22 ssh_host_ecdsa_key.pub
-rw------- 1 root root 411 Apr 13 10:22 ssh_host_ed25519_key
-rw-r--r-- 1 root root 99 Apr 13 10:22 ssh_host_ed25519_key.pub
-rw------- 1 root root 2.6K Apr 13 10:22 ssh_host_rsa_key
-rw-r--r-- 1 root root 571 Apr 13 10:22 ssh_host_rsa_key.pub
-rw-r--r-- 1 root root 562 Apr 17 18:51 sshd_config

I also tried what was in the FAQ with the SSH mapped to 9222 and port forwarding to 9390 and it is not clear to me how that will work going forward. I did follow the steps, but honestly I am not clear how I would use that in an scripted routine as I would have to have that forwarding established all the time. Couldn't I just open up port 9390 as an open port on the host and leverage that? There is also mention of using TLS and I not clear on how to set that up either.

Any help to connect via SSH to this container to do gvm-cli, gvm-scripts or gvm-pyshell would be greatly appreciated.

I have tried doing the SSH port forwarding from 9222 to 9390 but it

[Dexus]

If you need to change the current behavior overwrite the ssh config file located at /opt/setup/config/sshd_config

If you not know how to configure this file to make it work and also secure you should not touch it. SSH is not supported to execute commands in the container.

Use the GMP/API port with the GVM clients that you can install where you need it. And then connect to the port.

It is simple and works. Your ssh tries are hard and will not work nor will it ever ever supported.

[Dexus]

If you read the comments on the ssh port you will know it is only configured to support sensors (openvas) external.