Skip to content

OVA Appliances

Audience: Client owners and managers · Where: Administration → OVA Management (in the Scanning group). The tab appears only if your organization has an internal network license.

Overview

Canima reaches internet-facing targets from the cloud. To test inside your network (internal pentests, Active Directory audits, internal vulnerability scans, and web applications that are only reachable internally), you deploy a small OVA appliance on a machine in that network. The appliance runs the tests locally and reports results back to your Canima portal.

You can deploy several appliances, for example one per site or network segment, and choose which one to use for each assessment.

Before you start

  • A Linux virtual machine (or server) on the network you want to test, with root access. Supported distributions are Ubuntu, Debian, the RHEL family (RHEL, CentOS, Rocky, AlmaLinux), Fedora and Amazon Linux.
  • Recommended host specs: 6 vCPU · 8 GB RAM minimum (16 GB recommended) · 160 GB disk.
  • Outbound internet access from that machine, so the appliance can install and connect to Canima.

Provisioning an appliance

  1. Go to Administration → OVA Management and click Provision OVA.
  2. In Provision New OVA, enter an Appliance Name (for example Office Network OVA).
  3. Choose a Vulnerability scanning mode:
    • Default (Local OpenVAS engine on this appliance): installs a vulnerability-scanning engine on the appliance for deeper coverage. Its vulnerability feed syncs in the background, which can take a few hours before the first scan of that kind can run.
    • nuclei + searchsploit only: a lighter install without the local engine.
  4. Click Provision.
  5. The dialog changes to OVA Credentials and shows the OVA Identifier, an API Key and the exact install command. Copy the install command and run it as root on the machine you prepared.

Save the credentials now

The API key is shown only once and cannot be retrieved later. Copy it, or the full install command, before you click Done.

Once installed, the appliance connects to Canima and appears in the table with a recent Last Heartbeat.

The appliance table

Column What it shows
Name The appliance name. Click the pencil icon to rename it.
Identifier The appliance's unique identifier.
Status online, stale (no recent heartbeat) or offline. While an appliance is being removed it shows wiping…, and a removed one shows deregistered.
Last Heartbeat When the appliance last checked in (Never if it has not connected yet).
Network Info The network details the appliance reports.
Scanner The vulnerability scanning mode (Default or Local OpenVAS), plus the engine's readiness.

Use Search appliances… to find an appliance by name or identifier.

Scanner readiness

With the local engine enabled, a readiness badge shows whether it can scan yet. Hover over it for details.

  • ready: feeds synced and the engine is scan-ready.
  • syncing feeds / syncing: still preparing. Feed sync can legitimately take hours.
  • not applied: the appliance is still running its previous mode. Click Reconcile to push the change down.
  • blocked or unknown: the appliance reported a problem, or the readiness check couldn't run. Hover for the reason, and contact support if it persists.

You can switch an appliance between Default and Local OpenVAS at any time from the Scanner column. The appliance reconfigures itself automatically, and switching to Local OpenVAS starts a new feed sync.

Using an appliance

  • Internal and Active Directory assessments: choose the OVA appliance in the assessment's Scope section when you create the assessment. Internal retests also run on one of your appliances.
  • Internal web applications: if web-app testing is enabled on one of your appliances, a web application assessment shows an Access method choice:
    • Canima cloud: for apps reachable from the internet (the default).
    • Through your OVA: for internal apps. The tests run from your appliance, inside your network. Pick the OVA appliance. The target can be a private address.

Enabling web-app testing on an appliance

Web-app testing through an appliance is enabled by Canima. If you want to test internal web applications, contact your Canima account manager. The Access method choice appears only once at least one of your appliances has it enabled.

Removing an appliance

Click the remove icon on an appliance's row. What happens depends on its state:

Remove OVA? The appliance has never connected to Canima, so it can't be wiped remotely. It is removed immediately and its API key is revoked. If you installed it on a VM, delete that VM yourself.

Remove and wipe OVA? The appliance is uninstalled and wiped from its host: its containers, volumes, images and all Canima files are removed, and its API key is revoked. If the appliance is offline, the wipe runs the next time it connects. While this happens the status shows wiping….

If an offline appliance never confirms the wipe, a Force remove option appears. Force remove OVA? deletes it from Canima now and revokes its API key. Any Canima data left on the VM is not wiped remotely, so delete the VM yourself if it still exists.

All three actions are permanent.

MSSPs and pentest firms

Appliances belong to the client organization whose network they sit in. The OVA Management tab is not shown at firm level. Open the client first. See For MSSPs & Pentest Firms.

Related: Running an Assessment · Vulnerability Scanning · Licenses & Credits