Scanning Your Home Lab with OpenVAS (Greenbone) in Proxmox

Introduction

Maintaining security in a home lab environment is just as important as securing production infrastructure. As systems grow, vulnerabilities can appear due to outdated software, insecure configurations, exposed services, or missing security patches.

Vulnerability scanning helps identify these weaknesses before they can be exploited by attackers.

In this guide, we will deploy OpenVAS (Greenbone Vulnerability Management) inside a Proxmox virtual machine running Ubuntu and use it to scan another virtual machine within the home lab environment.

The goal is to create a practical vulnerability management workflow:

• Deploy a vulnerability scanner.
• Update vulnerability feeds.
• Scan internal systems.
• Analyze security findings.
• Improve the security posture of the environment.

Why OpenVAS?

“

OpenVAS, now part of the Greenbone Vulnerability Management (GVM) platform, is an open-source vulnerability assessment solution used to identify security weaknesses across networks, operating systems, and applications.

It provides:

• Vulnerability detection using Network Vulnerability Tests (NVTs).
• CVE-based vulnerability identification.
• Risk scoring using CVSS.
• Security reports and remediation recommendations.
• Web-based management through Greenbone Security Assistant (GSA).

OpenVAS is a great choice for home labs because it provides many enterprise-level vulnerability scanning capabilities without requiring expensive commercial licenses.

Prerequisites

Before starting, ensure you have:

Infrastructure Requirements

• A working Proxmox VE server.
• Basic knowledge of Linux administration.
• Basic understanding of networking and IP addressing.

Virtual Machines

Two virtual machines are required:

OpenVAS Scanner VM

Recommended:

• OS: Ubuntu Server 22.04 LTS or newer
• CPU: 2-4 cores
• RAM: Minimum 4GB (8GB recommended)
• Storage: Minimum 30GB

Target VM

Any operating system can be used:

Examples:

• Ubuntu Server
• Windows Server
• Windows 11
• Security testing machines

Both VMs must be able to communicate through the same Proxmox network bridge.

Example:

OpenVAS VM 192.168.1.50 | | Proxmox Bridge (vmbr0) | | Target VM 192.168.1.100

Create the OpenVAS VM in Proxmox

Create a New Virtual Machine

From the Proxmox web interface:

1. Select your Proxmox node.
2. Click Create VM.
3. Upload an Ubuntu Server ISO.
4. Configure the VM resources.

Recommended configuration:

CPU: 2-4 cores Memory: 4096 MB RAM Disk: 30 GB+

Configure Network Settings

Ensure the VM is connected to the same network as your target machine.

Example:

Network Bridge: vmbr0 IP Address: 192.168.1.50

Start the VM and connect through:

• Proxmox Console
• SSH

Install Greenbone OpenVAS on Ubuntu

Update Ubuntu Packages

Run:

sudo apt update sudo apt upgrade -y

Install Greenbone Vulnerability Management

Install required packages:

sudo apt install gvm -y

The installation process may take several minutes depending on system resources.

Initialize GVM

Run:

sudo gvm-setup

During setup:

• Database initialization will occur.
• Certificates will be created.
• Vulnerability feeds will be downloaded.
• Administrator credentials will be generated.

Save the administrator password shown at the end of the setup process.

Verify Installation

Check the installation:

sudo gvm-check-setup

A successful installation should show that all required components are configured correctly.

Update Vulnerability Feeds

Vulnerability feeds contain the latest security checks and vulnerability information.

Update the feeds:

sudo greenbone-feed-sync

Depending on your internet connection and hardware, this process may take a significant amount of time.

The update downloads:

• CVE information.
• Network Vulnerability Tests (NVTs).
• Security advisories.
• Compliance data.

Access Greenbone Security Assistant (GSA)

After setup is complete, start the GVM services:

sudo gvm-start

Find your OpenVAS VM IP address:

ip addr

Access the web interface:

https://<OPENVAS_VM_IP>:9392

Example:

https://192.168.1.50:9392

Login using the administrator account created during setup.

Configure a Scan Target

1. Open the GSA Web Interface and log in.
2. Navigate to: Configuration → Targets
3. Click: Create Target (+)
4. Enter the target details:
   Name: Provide a descriptive name for the system you want to scan.
   Example: My Home Lab VM
Hosts: Enter the IP address or hostname of the device you want to scan.
5. Leave the remaining options as default unless you need to customize the scan settings.
6. Click: Save
7. Confirm that the target appears in the Targets list.

The target is now ready to be selected when creating a vulnerability scan task.

Create and Run a Vulnerability Scan

1. Open the GSA Web Interface and log in.
2. Navigate to: Scans → Tasks
3. Click: Create Task (+)
4. Enter the task details:
   Name: Provide a name for your scan task.
   Example: Home Lab Scan
5. Target: Select the target you created in the previous step.
6. Review the scan settings:
   You can customize options such as Scan Type and NVT selection if needed.
   For a basic vulnerability scan, the default settings are usually sufficient.
7. Click: Save
8. Start the scan by clicking the Start/Play button (▶) next to the created task.
9. Monitor the progress and wait for the scan to complete.

After completion, the results will be available in the Reports section.

Analyze Scan Results

The scanning duration depends on:

• Number of services running.
• Target operating system.
• Scan profile.
• Available resources.

After completion, review:

• Vulnerability severity.
• CVSS score.
• Affected services.
• Recommended remediation.

Example findings:

Critical - Remote Code Execution High - Missing Security Updates Medium - Weak TLS Configuration Low - Information Disclosure

Scan Evidence

Vulnerability Overview

Scan Results

Vulnerability Details

Important Considerations

Resource Requirements

OpenVAS is resource-intensive.

During scans monitor:

top

or:

htop

Recommended:

• More RAM improves scanning performance.
• Additional CPU cores reduce scan duration.

Keep Vulnerability Feeds Updated

Regular updates are required because new vulnerabilities are discovered daily.

Run:

sudo greenbone-feed-sync

regularly.

Credentialed vs Non-Credentialed Scans

A normal network scan only detects externally visible vulnerabilities.

Credentialed scans provide deeper visibility by allowing OpenVAS to check:

• Installed software versions.
• Missing patches.
• Local configurations.
• Operating system security settings.

For internal home labs, credentialed scanning provides more accurate results.

Firewall Considerations

Ensure:

• The OpenVAS VM can communicate with target machines.
• The GSA interface port is accessible.

Greenbone web interface: TCP 9392

Scanning traffic depends on the services running on the target system.

Ethical Scanning

Only scan systems that you own or have explicit permission to test.

Unauthorized vulnerability scanning may violate laws and organizational policies.

Conclusion

Deploying OpenVAS inside a Proxmox home lab provides a practical way to learn vulnerability management and improve security skills.

By regularly scanning systems, analyzing findings, and applying remediation steps, you can develop a security workflow similar to enterprise environments.

A vulnerability scanner is not a replacement for proper security practices, but it is an important tool for identifying weaknesses before attackers discover them.