<?xml version="1.0" standalone='no'?>
<!DOCTYPE manpage SYSTEM "/usr/share/xmltoman/xmltoman.dtd">
<?xml-stylesheet type="text/xsl" href="/usr/share/xmltoman/xmltoman.xsl" ?>

<!--
Copyright (C) 2009-2022 Greenbone AG

SPDX-License-Identifier: AGPL-3.0-or-later

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU Affero General Public License for more details.

You should have received a copy of the GNU Affero General Public License
along with this program.  If not, see <http://www.gnu.org/licenses/>.
-->

<!-- gvmd manpage -->

<manpage name="gvmd" section="8" desc="Greenbone Vulnerability Manager daemon">

  <synopsis>
    <cmd>gvmd OPTIONS</cmd>
  </synopsis>

  <description>
    <p>
      The Greenbone Vulnerability Manager is the central management service between security scanners
      and the user clients.
    </p>

    <p>
      It manages the storage of any vulnerability management configurations and of the
      scan results. Access to data, control commands and workflows is offered via the
      XML-based Greenbone Management Protocol (GMP). The primary scanner 'OpenVAS Scanner'
      is controlled directly via protocol OTP while any other remote scanner is coupled
      with the Open Scanner Protocol (OSP).
    </p>

  </description>

  <options>
    <option>
      <p><opt>-h, --help</opt></p>
      <optdesc>
        <p>Show help options.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--broker-address=<arg>ADDRESS</arg></opt></p>
      <optdesc>
        <p>
          Sets the address for the publish-subscribe message (MQTT) broker.
          Defaults to localhost:9138. Set to empty to disable.
        </p>
      </optdesc>
    </option>
    <option>
      <p><opt>--check-alerts</opt></p>
      <optdesc>
        <p>Check SecInfo alerts.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--client-watch-interval=<arg>NUMBER</arg></opt></p>
      <optdesc>
        <p>Check if client connection was closed every NUMBER seconds.
           0 to disable. Defaults to 1 second.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--create-encryption-key</opt></p>
      <optdesc>
        <p>
          Create a new credential encryption key, set it as the new default
           and exit.
          With no other options given, a 4096 bit RSA key is created.
        </p>
      </optdesc>
    </option>
    <option>
      <p><opt>--create-scanner=<arg>SCANNER</arg></opt></p>
      <optdesc>
        <p>Create global scanner SCANNER and exit.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--create-user=<arg>USERNAME</arg></opt></p>
      <optdesc>
        <p>Create admin user USERNAME and exit.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>-d, --database=<arg>NAME</arg></opt></p>
      <optdesc>
        <p>Use NAME as database for PostgreSQL.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--db-host=<arg>HOST</arg></opt></p>
      <optdesc>
        <p>Use HOST as database host or socket directory for PostgreSQL.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--db-port=<arg>PORT</arg></opt></p>
      <optdesc>
        <p>Use PORT as database port or socket extension for PostgreSQL.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--delete-scanner=<arg>SCANNER-UUID</arg></opt></p>
      <optdesc>
        <p>Delete scanner SCANNER-UUID and exit.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--delete-user=<arg>USERNAME</arg></opt></p>
      <optdesc>
        <p>Delete user USERNAME and exit.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--dh-params=<arg>FILE</arg></opt></p>
      <optdesc>
        <p>Diffie-Hellman parameters file</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--disable-cmds=<arg>COMMANDS</arg></opt></p>
      <optdesc>
        <p>Disable comma-separated COMMANDS.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--disable-encrypted-credentials</opt></p>
      <optdesc>
        <p>Do not encrypt or decrypt credentials.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--disable-password-policy</opt></p>
      <optdesc>
        <p>Do not restrict passwords to the policy.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--disable-scheduling</opt></p>
      <optdesc>
        <p>Disable task scheduling.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--encryption-key-length=<arg>LENGTH</arg></opt></p>
      <optdesc>
        <p>
          Set key length to LENGTH bits when creating a new RSA
          credential encryption key. Defaults to 4096.
        </p>
      </optdesc>
    </option>
    <option>
      <p><opt>--encryption-key-type=<arg>TYPE</arg></opt></p>
      <optdesc>
        <p>
          Use the key type TYPE when creating a new credential
          encryption key. Currently only RSA is supported.
        </p>
      </optdesc>
    </option>
    <option>
      <p><opt>--encrypt-all-credentials</opt></p>
      <optdesc>
        <p>(Re-)Encrypt all credentials.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--feed-lock-path=<arg>PATH</arg></opt></p>
      <optdesc>
        <p>Sets the path to the feed lock file.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--feed-lock-timeout=<arg>TIMEOUT</arg></opt></p>
      <optdesc>
        <p>
          Sets the number of seconds to retry for if the feed is locked
          in contexts (like migration or rebuilds) that do not retry
          on their own (like automatic syncs). Defaults to 0 (no retry).
        </p>
      </optdesc>
    </option>
    <option>
      <p><opt>-f, --foreground</opt></p>
      <optdesc>
        <p>Run in foreground.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--get-scanners</opt></p>
      <optdesc>
        <p>List scanners and exit.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--get-users</opt></p>
      <optdesc>
        <p>List users and exit.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--gnutls-priorities=<arg>PRIORITIES-STRING</arg></opt></p>
      <optdesc>
        <p>Sets the GnuTLS priorities for the Manager socket.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--inheritor=<arg>USERNAME</arg></opt></p>
      <optdesc>
        <p>Have USERNAME inherit from deleted user.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>-a, --listen=<arg>ADDRESS</arg></opt></p>
      <optdesc>
        <p>Listen on ADDRESS.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--ldap-debug</opt></p>
      <optdesc>
        <p>Enable debugging of LDAP authentication.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--listen2=<arg>ADDRESS</arg></opt></p>
      <optdesc>
        <p>Listen also on ADDRESS.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--listen-group=<arg>STRING</arg></opt></p>
      <optdesc>
        <p>Group of the unix socket</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--listen-mode=<arg>STRING</arg></opt></p>
      <optdesc>
        <p>File mode of the unix socket</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--listen-owner=<arg>STRING</arg></opt></p>
      <optdesc>
        <p>Owner of the unix socket</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--max-concurrent-scan-updates=<arg>NUMBER</arg></opt></p>
      <optdesc>
        <p>
          Maximum number of scan updates that can run at the same time.
          Default: 0 (unlimited).
        </p>
      </optdesc>
    </option>
    <option>
      <p><opt>--max-email-attachment-size=<arg>NUMBER</arg></opt></p>
      <optdesc>
        <p>Maximum size of alert email attachments, in bytes.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--max-email-include-size=<arg>NUMBER</arg></opt></p>
      <optdesc>
        <p>Maximum size of inlined content in alert emails, in bytes.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--max-email-message-size=<arg>NUMBER</arg></opt></p>
      <optdesc>
        <p>Maximum size of user-defined message text in alert emails,
           in bytes.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--max-ips-per-target=<arg>NUMBER</arg></opt></p>
      <optdesc>
        <p>Maximum number of IPs per target.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--mem-wait-retries=<arg>NUMBER</arg></opt></p>
      <optdesc>
        <p>
          How often to try waiting for available memory. Default: 30.
          Each retry will wait for 10 seconds.
        </p>
      </optdesc>
    </option>
    <option>
      <p><opt>-m, --migrate</opt></p>
      <optdesc>
        <p>Migrate the database and exit.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--min-mem-feed-update=<arg>NUMBER</arg></opt></p>
      <optdesc>
        <p>
          Minimum memory in MiB for feed updates. Default: 0.
          Feed updates are skipped if less physical memory is available.
        </p>
      </optdesc>
    </option>
    <option>
      <p><opt>--modify-scanner=<arg>SCANNER-UUID</arg></opt></p>
      <optdesc>
        <p>Modify scanner SCANNER-UUID and exit.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--modify-setting=<arg>UUID</arg></opt></p>
      <optdesc>
        <p>Modify setting UUID and exit.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--new-password=<arg>PASSWORD</arg></opt></p>
      <optdesc>
        <p>Modify user's password and exit.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--new-password=<arg>PASSWORD</arg></opt></p>
      <optdesc>
        <p>Modify user's password and exit.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--optimize=<arg>NAME</arg></opt></p>
      <optdesc>
        <p>Run an optimization: vacuum, add-feed-permissions, analyze,
           cleanup-config-prefs, cleanup-feed-permissions,
           cleanup-port-names, cleanup-report-formats, cleanup-result-nvts,
           cleanup-result-severities, cleanup-schedule-times, cleanup-sequences,
           cleanup-tls-certificate-encoding, migrate-relay-sensors,
           rebuild-report-cache or update-report-cache.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--osp-vt-update=<arg>SCANNER-SOCKET</arg></opt></p>
      <optdesc>
        <p>Unix socket for OSP NVT update.  Defaults to the path of the 'OpenVAS Default' scanner if it is an absolute path.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--password=<arg>PASSWORD</arg></opt></p>
      <optdesc>
        <p>Password, for --create-user.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>-p, --port=<arg>NUMBER</arg></opt></p>
      <optdesc>
        <p>Use port number NUMBER.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--port2=<arg>NUMBER</arg></opt></p>
      <optdesc>
        <p>Use port number NUMBER for address 2.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--rebuild-gvmd-data=<arg>TYPES</arg></opt></p>
      <optdesc>
        <p>
          Reload all gvmd data objects of a given types from feed.
        </p>
        <p>
          The types must be &quot;all&quot; or a comma-separated of the
          following: &quot;configs&quot;, &quot;port_lists&quot; and
          &quot;report_formats&quot;.
        </p>
      </optdesc>
    </option>
    <option>
      <p><opt>--rebuild-scap</opt></p>
      <optdesc>
        <p>
          Rebuild all SCAP data.
        </p>
      </optdesc>
    </option>
    <option>
      <p><opt>--relay-mapper=<arg>FILE</arg></opt></p>
      <optdesc>
        <p>Executable for mapping scanner hosts to relays.
          Use an empty string to explicitly disable.
          If the option is not given, $PATH is checked for gvm-relay-mapper.
        </p>
      </optdesc>
    </option>
    <option>
      <p><opt>--role=<arg>ROLE</arg></opt></p>
      <optdesc>
        <p>Role for --create-user and --get-users.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--scanner-ca-pub=<arg>SCANNER-CA-PUB</arg></opt></p>
      <optdesc>
        <p>Scanner CA Certificate path for --[create|modify]-scanner.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--scanner-credential=<arg>SCANNER-CREDENTIAL</arg></opt></p>
      <optdesc>
        <p>Scanner credential for --create-scanner and --modify-scanner.</p>
        <p>Can be blank to unset or a credential UUID. If omitted, a new
          credential can be created instead.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--scanner-host=<arg>SCANNER-HOST</arg></opt></p>
      <optdesc>
        <p>Scanner host or socket for --create-scanner and --modify-scanner.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--scanner-key-priv=<arg>SCANNER-KEY-PRIVATE</arg></opt></p>
      <optdesc>
        <p>Scanner private key path for --[create|modify]-scanner
          if --scanner-credential is not given.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--scanner-key-pub=<arg>SCANNER-KEY-PUBLIC</arg></opt></p>
      <optdesc>
        <p>Scanner Certificate path for --[create|modify]-scanner
          if --scanner-credential is not given.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--scanner-name=<arg>NAME</arg></opt></p>
      <optdesc>
        <p>Name for --modify-scanner.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--scanner-port=<arg>SCANNER-PORT</arg></opt></p>
      <optdesc>
        <p>Scanner port for --create-scanner and --modify-scanner.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--scanner-type=<arg>SCANNER-TYPE</arg></opt></p>
      <optdesc>
        <p>Scanner type for --create-scanner and --modify-scanner.</p>
        <p>Either 'OpenVAS', 'GMP', 'OSP-Sensor' or a number
           as used in GMP.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--scanner-connection-retry=<arg>NUMBER</arg></opt></p>
      <optdesc>
        <p>Number of auto retries if scanner connection is lost
           in a running task.</p>
      </optdesc>
    </option>    
    <option>
      <p><opt>--schedule-timeout=<arg>TIME</arg></opt></p>
      <optdesc>
        <p>Time out tasks that are more than TIME minutes overdue.
           -1 to disable, 0 for minimum time.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--secinfo-commit-size=<arg>NUMBER</arg></opt></p>
      <optdesc>
        <p>During CERT and SCAP sync, commit updates to the database every
           NUMBER items, 0 for unlimited.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>-c, --unix-socket=<arg>FILENAME</arg></opt></p>
      <optdesc>
        <p>Listen on UNIX socket at FILENAME.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--user=<arg>USERNAME</arg></opt></p>
      <optdesc>
        <p>User for --new-password.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--value=<arg>VALUE</arg></opt></p>
      <optdesc>
        <p>Value for --modify-setting.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--verbose</opt></p>
      <optdesc>
        <p>Has no effect.  See INSTALL.md for logging config.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--verify-scanner=<arg>SCANNER-UUID</arg></opt></p>
      <optdesc>
        <p>Verify scanner SCANNER-UUID and exit.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--version</opt></p>
      <optdesc>
        <p>Print version and exit.</p>
      </optdesc>
    </option>
    <option>
      <p><opt>--vt-verification-collation=<arg>COLLATION</arg></opt></p>
      <optdesc>
        <p>
          Set collation for VT verification to COLLATION, omit or leave empty
          to choose automatically. Should be 'ucs_default' if DB uses UTF-8
          or 'C' for single-byte encodings.
        </p>
      </optdesc>
    </option>
  </options>

  <section name="SIGNALS">
    <p>SIGHUP causes gvmd to rebuild the database with information from
       the Scanner (openvas).</p>
  </section>

  <section name="EXAMPLES">
    <p>gvmd --port 1241</p>
    <p>Serve GMP clients on port 1241 and connect to an OpenVAS scanner via the
       default OTP file socket.</p>
  </section>

  <section name="SEE ALSO">
    <p>
      <manref name="openvas" section="8"/>,
      <manref name="gsad" section="8"/>,
      <manref name="ospd-openvas" section="8"/>,
      <manref name="greenbone-certdata-sync" section="8"/>,
      <manref name="greenbone-scapdata-sync" section="8"/>,
    </p>
  </section>

  <section name="MORE INFORMATION">
    <p>
      The canonical places where you will find more information
      about the Greenbone Vulnerability Manager are:
    </p>
    <p>
      <url href="https://community.greenbone.net"/>
        (Community Portal)
    </p>
    <p>
      <url href="https://github.com/greenbone"/>
        (Development Platform)
    </p>
    <p>
      <url href="https://www.greenbone.net"/>
        (Greenbone Website)
    </p>
  </section>

  <section name="COPYRIGHT">
    <p>
      The Greenbone Vulnerability Manager is released under the GNU GPL,
      version 2, or, at your option, any later version.
    </p>
  </section>

</manpage>
