Install the Internal Scanner on Linux
The HostedScan Internal Scanner is designed to run on Linux systems; both x64 and ARM processor builds are available.
This secure solution does not require any open ports, tunnels, or other access to your network.
Scanning Server
To run vulnerability scans on an internal network, you will install trusted vulnerability scanners that are widely used across the industry by millions of cybersecurity professionals, alongside the lightweight HostedScan Internal Scanner application.
The internal scanner is installed on a scanning server alongside the underlying vulnerability scanners. It coordinates the running of scans and the collection of results, and connects to HostedScan to enable full command and control from your HostedScan dashboard.
System requirements
Recommended resources
To run scans effectively, we recommend that the scanning machine scales based on the number of active IPs scanned:
| Active IPs | CPU | RAM | Disk Space |
|---|---|---|---|
| ~ 512 | 4 cores | 16 GB | 80 GB |
| ~ 2,500 | 6 cores | 20 GB | 100 GB |
| ~ 10,000 | 8 cores | 24 GB | 120 GB |
Additional resources may improve scan performance.
Operating System
The HostedScan Internal Scanner runs on most common Linux distributions. Officially tested and supported on:
| OS | Version |
|---|---|
| Debian | 12 or later LTS |
| Ubuntu | 24.04 or later LTS |
| RHEL/CentOS | 9 or later LTS |
Docker
The recommended setup uses Docker Compose with Greenbone Community Edition containers. The install script installs Docker and Docker Compose for you; if you would rather install them yourself first, see https://docs.docker.com/compose/install/.
Alternatively, you can run your own OpenVAS/GVM installation and interface the internal scanner with it.
Network
The HostedScan Internal Scanner and OpenVAS access these domains:
| Domain | Port | Protocol | Reason | Required |
|---|---|---|---|---|
| api.hostedscan.com | 443 | HTTPS | Allows the internal scanner to receive commands and send scan results | yes |
| api.hostedscan.com | 443 | WSS | Real-time communication with the internal scanner via websockets | no |
| registry.community.greenbone.net | 443 | HTTPS | Install OpenVAS/GVM Scanner and update vulnerability feeds | yes |
Install the internal scanner
Run our single install script on the scanning server. It creates the hostedscan service user, installs Docker and the internal scanner binary under /opt/hostedscan, configures the systemd services, the feed-update timer, and log rotation, starts the OpenVAS containers, and performs any cleanup when upgrading an existing install.
To do so, follow these quick setup steps.
The first launch of OpenVAS may take an hour or longer before it is ready. Subsequent restarts are faster but may still take a few minutes. The internal scanner monitors OpenVAS and will start scans when it is ready.
Feed Updates
It is important to update OpenVAS feeds regularly to ensure you have the latest vulnerability tests and security data. The internal scanner generates an update_feed.sh script that downloads and updates the Greenbone Community Edition feed data containers.
Manual Feed Update
To manually update the feeds, run:
cd /opt/hostedscan
./update_feed.sh
Automated Feed Updates
The install script sets up hostedscan-update-feed.service and hostedscan-update-feed.timer, which update the OpenVAS feeds automatically.
The feed updates are set to occur at 2 AM by default. You can adjust this time by modifying hostedscan-update-feed.timer.
Helpful Commands
Commands are shown for root users. Use sudo if running as a less privileged user.
Check internal scanner status:
systemctl status hostedscan-agent.service
Restart the internal scanner:
systemctl restart hostedscan-agent.service
Stop the internal scanner:
systemctl stop hostedscan-agent.service
View the internal scanner logs:
journalctl -u hostedscan-agent.service -n 1000
Check the automatic feed update logs:
journalctl -u hostedscan-update-feed.service -n 1000
To view the OpenVAS container logs, from /opt/hostedscan run:
docker compose logs -f