[#389] GLPI→OpenVAS feed pilot: script (fixture-tested, 63 targets) + GVM app-test compose + pipeline docs

Feed reads GLPI computers read-only (mglpi identity), parses ts=/mgmt IP comment convention, emits CSV or GMP create_target fragments. Dual shellcheck green. GVM stack = Greenbone community containers, loopback. https://projects.knownelement.com/issues/389
2026-09-05 06:56:00 -05:00
parent 7822abf2eb
commit 8eab675c74
4 changed files with 209 additions and 0 deletions
@@ -0,0 +1,40 @@
+# openvas/ — vulnerability scanning fed from the GLPI CMDB
+
+> Ticket [#389](https://projects.knownelement.com/issues/389) (Greenbone on
+> kali-tsys) · umbrella [#311](https://projects.knownelement.com/issues/311) ·
+> lane index https://community.turnsys.com/t/297
+
+## Pipeline (GLPI → scan targets)
+
+```
+GLPI CMDB (computers, read-only via mglpi identity)
+  └─ glpi-to-openvas.sh --format csv   # review artifact
+  └─ glpi-to-openvas.sh --format gmp   # <create_target> fragments
+        └─ GVM (OpenVAS) — app-test stack: ../docker/gvm-test/
+```
+
+- `glpi-to-openvas.sh` reads the computer inventory (GLPI REST, read-only),
+  parses the `ts=<ip> | mgmt <ip>` comment convention (mixed `=` and space —
+  both accepted), and emits GMP `<create_target>` fragments or a review CSV.
+- `--fixture FILE` transforms a saved GLPI response offline (deterministic
+  test path — `fixtures/glpi-computers-sample.json` is a real 80-record pull).
+- Verified 2026-09-05: 63 scan targets parsed from 80 GLPI records (the rest
+  have no parsable IP and are skipped; `--include-no-ip` overrides).
+
+## Rules of engagement (non-negotiable)
+
+1. Scans against PROD hosts require an approved GLPI Change + an Uptime Kuma
+   maintenance window. sectestbed VMs are always fair game (that is their job).
+2. Tailscale addresses are included in targets deliberately — scanning runs
+   over tailnet, not LAN, unless a CR says otherwise.
+3. Findings stay in this PRIVATE repo and Redmine. Never leave the boundary.
+4. App-test GVM binds loopback only (127.0.0.1:9392). Production engine
+   placement = kali-tsys VM per #389, deployed under its own CR.
+
+## Status
+
+- [x] GLPI feed script, dual-shellcheck green, fixture-tested (2026-09-05)
+- [x] GVM app-test compose (loopback, pinned version tags; digest-pin at proof)
+- [ ] GVM bring-up + first feed import (next run: feeds download several GB)
+- [ ] First sectestbed scan + findings triage into Redmine
+- [ ] kali-tsys production engine under CR (#389)