KNEL/compliance

Fork 0

Files

T

History

mrcharles 8eab675c74

ci / audit (push) Successful in 20s

Details

[#389 ] GLPI→OpenVAS feed pilot: script (fixture-tested, 63 targets) + GVM app-test compose + pipeline docs

Feed reads GLPI computers read-only (mglpi identity), parses ts=/mgmt IP
comment convention, emits CSV or GMP create_target fragments. Dual
shellcheck green. GVM stack = Greenbone community containers, loopback.
https://projects.knownelement.com/issues/389

2026-09-05 06:56:00 -05:00

fixtures

[#389 ] GLPI→OpenVAS feed pilot: script (fixture-tested, 63 targets) + GVM app-test compose + pipeline docs

2026-09-05 06:56:00 -05:00

glpi-to-openvas.sh

[#389 ] GLPI→OpenVAS feed pilot: script (fixture-tested, 63 targets) + GVM app-test compose + pipeline docs

2026-09-05 06:56:00 -05:00

README.md

[#389 ] GLPI→OpenVAS feed pilot: script (fixture-tested, 63 targets) + GVM app-test compose + pipeline docs

2026-09-05 06:56:00 -05:00

README.md

openvas/ — vulnerability scanning fed from the GLPI CMDB

Ticket #389 (Greenbone on kali-tsys) · umbrella #311 · lane index https://community.turnsys.com/t/297

Pipeline (GLPI → scan targets)

GLPI CMDB (computers, read-only via mglpi identity)
  └─ glpi-to-openvas.sh --format csv   # review artifact
  └─ glpi-to-openvas.sh --format gmp   # <create_target> fragments
        └─ GVM (OpenVAS) — app-test stack: ../docker/gvm-test/

glpi-to-openvas.sh reads the computer inventory (GLPI REST, read-only), parses the ts=<ip> | mgmt <ip> comment convention (mixed = and space — both accepted), and emits GMP <create_target> fragments or a review CSV.
--fixture FILE transforms a saved GLPI response offline (deterministic test path — fixtures/glpi-computers-sample.json is a real 80-record pull).
Verified 2026-09-05: 63 scan targets parsed from 80 GLPI records (the rest have no parsable IP and are skipped; --include-no-ip overrides).

Rules of engagement (non-negotiable)

Scans against PROD hosts require an approved GLPI Change + an Uptime Kuma maintenance window. sectestbed VMs are always fair game (that is their job).
Tailscale addresses are included in targets deliberately — scanning runs over tailnet, not LAN, unless a CR says otherwise.
Findings stay in this PRIVATE repo and Redmine. Never leave the boundary.
App-test GVM binds loopback only (127.0.0.1:9392). Production engine placement = kali-tsys VM per #389, deployed under its own CR.

Status

GLPI feed script, dual-shellcheck green, fixture-tested (2026-09-05)
GVM app-test compose (loopback, pinned version tags; digest-pin at proof)
GVM bring-up + first feed import (next run: feeds download several GB)
First sectestbed scan + findings triage into Redmine
kali-tsys production engine under CR (#389)