Questions[openvas](server)

I am looking at a particular Azure SQL Database that has Server level firewall rules. I am told there are no database level firewall rules. Nmap reported open ports on the database even though the IP address i ran it from was not allowed according to the firewall rules. Furthermore, i scanned the same IP with OpenVAS and it reported back the version of MS SQL that was running. I examined Server level firewall rules list for bad entries, and it only has single entries (no ranges), and from & to IP addresses match. What could be wrong?

Here are the nmap results:

nmap xxxxxxxx.database.windows.net
PORT STATE SERVICE
443/tcp open https
1433/tcp open ms-sql-s
1434/tcp open ms-sql-m
1443/tcp open ies-lm
3306/tcp open mysql
4343/tcp open unicall
5002/tcp open rfe
5432/tcp open postgresql
7443/tcp open oracleas-https
16000/tcp open fmsas
16001/tcp open fmsascon
16012/tcp open unknown
16016/tcp open unknown
16018/tcp open unknown

I get the "SecInfo Database Missing" error:

SCAP and/or CERT database missing on OMP server.

Even though I manually started a sync task and in the status it appears they are all complete (and have been for 20 minutes)

And in the console "about": Feed Version: Thu Feb 7 13:52:00 2019

I'm using the ISO from https://www.greenbone.net/en/install_use_gce/. Brand new installation.

I've just installed OpenVAS ... however when I checked on Feed Status, I found that OpenVAS CERT Feed is too old as shown in the screenshot below.

Too old (14 days) - Please check the automatic synchronization of your system

The solution suggested was to check automatic synchronization in the system. Unfortunately I was not sure how to do that.

I've searched around but couldn't find similar problem. So I guess posting the question here might be helpful.

OpenVAS CERT Feed Status: Please check the automatic synchronization of your system

I am trying to configure Openvas 9 to use LDAP, for the login to the Greenbone software. It appears as based off of other threads, this issue with LDAP in unresolved unless I am seriously mistaken.

My problems is that I am trying to allow multiple users based on active directory, access to Greenbone.

However, no configuration of mine seems to be working.

This is the output when I attempt to login with a user created and specified for LDAP use in Greenbone:

 lib  serv: DEBUG:2016-11-15   19h47.35 utc:9786:     Shook hands with peer.
 md   main: DEBUG:2016-11-15   19h47.35 utc:9786:     sql_open: db open, max retry sleep time is 0
 lib  ldap: WARNING:2016-11-15 19h47.35 utc:9786: StartTLS failed, trying to establish ldaps connection.
 lib  ldap: WARNING:2016-11-15 19h47.35 utc:9786: LDAP Authentication failure: Can't contact LDAP server
 lib  ldap: DEBUG:2016-11-15   19h47.35 utc:9786: Could not bind to ldap host my.host.example:389
 md    omp: WARNING:2016-11-15 19h47.35 utc:9786: Authentication failure for 'myuser' from 127.0.0.1

As shown, the LDAP cannot bind to my host, I am not sure why and am curious as to how I am supposed to configure LDAP correctly, allowing created users to login using AD credentials.

Apparently OpenVAS originated as a fork of Nessus. It is very easy to install and use OpenVAS because it's, well, open. However, am I kidding myself if I just use that instead of Nessus? Should I be using both, or if I use Nessus then is OpenVAS surplus to requirements?

To break it down into non-subjective sub-questions: * Is openvas a superset or subset of nessus? * Is one updated more often than the other? * Does one have a bigger vulnerability database than the other? * ...or are there other qualitative differences that I may be missing?