mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
59 lines
2.3 KiB
Markdown
59 lines
2.3 KiB
Markdown
# OpenVAS Authenticated Scan - Configuration Template
|
|
|
|
## Scan Service Account Requirements
|
|
|
|
### Linux SSH Scan Account
|
|
```bash
|
|
# Create dedicated scan user on target hosts
|
|
sudo useradd -r -s /bin/bash -m -c "OpenVAS Scan Account" openvas_scan
|
|
sudo usermod -aG sudo openvas_scan # Or grant specific sudoers entries
|
|
|
|
# Minimal sudoers entry for authenticated scanning
|
|
# /etc/sudoers.d/openvas_scan
|
|
openvas_scan ALL=(ALL) NOPASSWD: /usr/bin/dpkg -l
|
|
openvas_scan ALL=(ALL) NOPASSWD: /usr/bin/rpm -qa
|
|
openvas_scan ALL=(ALL) NOPASSWD: /bin/cat /etc/shadow
|
|
openvas_scan ALL=(ALL) NOPASSWD: /usr/sbin/dmidecode
|
|
openvas_scan ALL=(ALL) NOPASSWD: /sbin/ip addr
|
|
```
|
|
|
|
### Windows SMB Scan Account
|
|
```
|
|
Domain: CORP
|
|
Account: svc_openvas_scan
|
|
Groups: Domain Users, Local Administrators (on targets)
|
|
Password Policy: 32+ character randomly generated
|
|
Account Type: Service account (no interactive login)
|
|
Logon Hours: Restricted to scan window (e.g., Sunday 2-6 AM)
|
|
```
|
|
|
|
## Target Group Definitions
|
|
|
|
| Target Group | Hosts | Credential Type | Scan Schedule |
|
|
|-------------|-------|----------------|---------------|
|
|
| Linux Production | 10.1.0.0/24 | SSH Key | Weekly Sunday 2 AM |
|
|
| Linux Development | 10.2.0.0/24 | SSH Key | Monthly 1st Sunday |
|
|
| Windows Servers | 10.1.1.0/24 | SMB Domain | Weekly Sunday 3 AM |
|
|
| Windows Workstations | 10.3.0.0/16 | SMB Domain | Monthly 1st Sunday |
|
|
| ESXi Hosts | 10.1.2.10-20 | ESXi Root | Monthly 1st Sunday |
|
|
|
|
## Scan Configuration Selection Guide
|
|
|
|
| Scenario | Recommended Config | Max Concurrent NVTs | Notes |
|
|
|----------|-------------------|--------------------|----|
|
|
| Production (low impact) | Full and fast | 4 | Safe checks only |
|
|
| Staging/QA | Full and deep | 10 | May trigger IDS alerts |
|
|
| PCI Compliance | Full and fast + PCI NVTs | 4 | Map findings to PCI requirements |
|
|
| Post-Patch Validation | System Discovery + targeted | 20 | Quick verification scan |
|
|
|
|
## Pre-Scan Checklist
|
|
|
|
- [ ] Feed synchronization completed within last 24 hours
|
|
- [ ] Scan credentials tested and verified on sample hosts
|
|
- [ ] Change management ticket approved for scan window
|
|
- [ ] IDS/IPS exceptions configured for scanner IP
|
|
- [ ] Notification sent to system owners about scan window
|
|
- [ ] Previous scan results archived
|
|
- [ ] Sufficient disk space for report storage (>10GB)
|
|
- [ ] Scanner system health verified (CPU, memory, disk)
|