-
-
Notifications
You must be signed in to change notification settings - Fork 1.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
11 changed files
with
192 additions
and
90 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,77 +1,94 @@ | ||
| # Vuls on Docker | ||
|
|
||
| ## Index | ||
| ## What's Vuls-On-Docker | ||
|
|
||
| - テスト環境 | ||
| - サーバーセットアップ | ||
| - Dockerのインストール | ||
| - Docker Composeのインストール | ||
| - vulsセットアップ | ||
| - sshキーの配置 | ||
| - tomlの編集 | ||
| - Vuls 起動 | ||
| - Vuls scan実行 | ||
| - ブラウザから動作確認 | ||
| - 数個のコマンドを実行するだけでVulsとvulsrepoのセットアップが出来るスクリプト | ||
| - Dockerコンテナ上にVulsと[vulsrepo](https://github.com/usiusi360/vulsrepo)をセットアップ可能 | ||
| - スキャン結果をvulsrepoでブラウザで分析可能 | ||
| - 脆弱性データベースの更新が可能 | ||
| - モジュールのアップデートが可能 | ||
|
|
||
| ## Setting up your machine | ||
|
|
||
| 1. [Install Docker](https://docs.docker.com/engine/installation/) | ||
| 2. [Install Docker-Compose](https://docs.docker.com/compose/install/) | ||
| 3. 実行前に以下のコマンドが実行可能なことを確認する | ||
|
|
||
| ##テスト環境 | ||
| ``` | ||
| $ docker version | ||
| $ docker-compose version | ||
| ``` | ||
|
|
||
| - Server OS: ubuntu 14.04 | ||
| ## Start A Vuls Container | ||
|
|
||
| ## サーバーセットアップ | ||
| - 以下のコマンドを実行してコンテナをビルドする | ||
|
|
||
| 1. Dockerのインストール | ||
| 2. Docker Composeのインストール | ||
| ``` | ||
| $ cd $GOPATH/src/github.com/future-architect/vuls/setup/docker | ||
| $ docker-compose up -d | ||
| ``` | ||
|
|
||
| ### 作業ディレクトリの作成 | ||
| ## Setting up Vuls | ||
|
|
||
| ``` | ||
| mkdir work | ||
| cd work | ||
| git clone https://github.com/hikachan/vuls | ||
| cd vuls | ||
| ``` | ||
| 1. スキャン対象サーバのSSH秘密鍵を保存(vuls/setup/docker/conf/)する | ||
| 2. config.toml(vuls/docker/conf/config.toml) を環境に合わせて作成する | ||
|
|
||
| ``` | ||
| [servers] | ||
|
|
||
| ## Vuls セットアップ | ||
| [servers.172-31-4-82] | ||
| host = "172.31.4.82" | ||
| user = "ec2-user" | ||
| keyPath = "conf/id_rsa" | ||
| ``` | ||
|
|
||
| ### sshキーの配置(vuls/docker/conf/id_rsa) | ||
| ## Fetch Vulnerability database | ||
|
|
||
| ### tomlの編集(vuls/docker/conf/config.toml) | ||
| - NVDから脆弱性データベースを取得する | ||
| ``` | ||
| $ docker exec -t vuls scripts/fetch_nvd_all.sh | ||
| ``` | ||
|
|
||
| ``` | ||
| [servers] | ||
| #This is a sample | ||
| [servers.172.17.0.1] | ||
| host = "172.17.0.1" | ||
| port = "22" | ||
| user = "ubuntu" | ||
| keyPath = "/root/.ssh/id_rsa" | ||
| #containers = ["target_container"] | ||
| ``` | ||
| - レポートを日本語化する場合は、JVNから脆弱性データを取得する | ||
| ``` | ||
| $ docker exec -t vuls scripts/fetch_jvn_all.sh | ||
| ``` | ||
|
|
||
| ## Vuls 起動 | ||
| ## Scan servers with Vuls-On-Docker | ||
|
|
||
| ``` | ||
| docker-compose up -d | ||
| ``` | ||
| - スキャンを実行する | ||
|
|
||
| ``` | ||
| $ docker exec -t vuls vuls prepare -config=conf/config.toml | ||
| $ docker exec -t vuls scripts/scan_for_vulsrepo.sh | ||
| ``` | ||
|
|
||
| ## Update cve | ||
| ## See the results in a browser | ||
|
|
||
| ``` | ||
| docker exec -t vuls scripts/update_cve.sh | ||
| http://${Vuls_Host}/vulsrepo/ | ||
| ``` | ||
|
|
||
| ## Vuls Scan 実行 | ||
| # Update modules | ||
|
|
||
| ``` | ||
| docker exec -t vuls vuls prepare -config=conf/config.toml | ||
| docker exec -t vuls scripts/scan_for_vulsrepo.sh | ||
| ``` | ||
| - vuls, go-cve-dictionary, vulsrepoのモジュールをアップデートする | ||
| ``` | ||
| $ docker exec -t vuls scripts/update_modules.sh | ||
| ``` | ||
|
|
||
| ### Vuls Repo 接続確認 | ||
| # Update Vulnerability database | ||
|
|
||
| ``` | ||
| http://${Vuls_Host}/vulsrepo/ | ||
| ``` | ||
| - NVDの過去２年分の脆弱性データベースを更新する | ||
| ``` | ||
| $ docker exec -t vuls scripts/fetch_nvd_last2y.sh | ||
| ``` | ||
|
|
||
| - JVNの過去１ヶ月分の脆弱性データベースを更新する | ||
| ``` | ||
| $ docker exec -t vuls scripts/fetch_jvn_month.sh | ||
| ``` | ||
|
|
||
| - JVNの過去1週間分の脆弱性データベースを更新する | ||
| ``` | ||
| $ docker exec -t vuls scripts/fetch_jvn_week.sh | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| #!/bin/bash | ||
| VULS_ROOT=/opt/vuls | ||
| #VULS_CONF=${VULS_ROOT}/conf | ||
| cd $VULS_ROOT | ||
| go-cve-dictionary fetchjvn -entire | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| #!/bin/bash | ||
| VULS_ROOT=/opt/vuls | ||
| #VULS_CONF=${VULS_ROOT}/conf | ||
| cd $VULS_ROOT | ||
| go-cve-dictionary fetchjvn -month | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| #!/bin/bash | ||
| VULS_ROOT=/opt/vuls | ||
| #VULS_CONF=${VULS_ROOT}/conf | ||
| cd $VULS_ROOT | ||
| go-cve-dictionary fetchjvn -week | ||
|
|
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| #!/bin/bash | ||
| VULS_ROOT=/opt/vuls | ||
| #VULS_CONF=${VULS_ROOT}/conf | ||
| cd $VULS_ROOT | ||
| go-cve-dictionary fetchnvd -last2y | ||
|
|
Oops, something went wrong.