Deprecate prepare subcommand to minimize the root authority defined by /etc/sudoers

[kotakanbe]

Note: Support of centos 5 has ended, so please do not update Vuls if you are using CentOS 5.

Dependent packages can be easily installed manually, Ansible, etc.

I want to minimize the root authority defined by /etc/sudoers, but the content of /etc/sudoers differs between prepare and scan.

For security reasons, I do not want to define allow yum install in /etc/sudoers.
If Vuls user need to change /etc/sudoers after executing prepare, setup becomes complicated.

Modify configtest subcommand.
In configtest subcommand, check the following

• Check if dependencies are installed
• Confirm whether the command issued by scan can be executed normally

TODO List

• Remove prepare subcomamnd
• Check tightly with configtest subcommand
• #README

configtest Subcommand

• Check if dependencies are installed
• Check if dependencies available
• Check sudo permissions

Dependency Packages

Distribution	Release	Requirements
Ubuntu	12, 14, 16	-
Debian	7, 8	aptitude
CentOS	6, 7	yum-plugin-changelog
Amazon	All	-
RHEL	5	yum-security
RHEL	6, 7	-
FreeBSD	10	-
Raspbian	Wheezy, Jessie	-

Minimize root authority

• CentOS

vuls ALL=(ALL) NOPASSWD:/usr/bin/yum --changelog --assumeno update *
Defaults:vuls env_keep="http_proxy https_proxy HTTP_PROXY HTTPS_PROXY"

• RHEL 5

vuls ALL=(ALL) NOPASSWD:/usr/bin/yum --color=never repolist, /usr/bin/yum --color=never list-security --security, /usr/bin/yum --color=never check-update, /usr/bin/yum --color=never info-security
Defaults:vuls env_keep="http_proxy https_proxy HTTP_PROXY HTTPS_PROXY"

• RHEL 6, 7

vuls ALL=(ALL) NOPASSWD:/usr/bin/yum --color=never repolist, /usr/bin/yum --color=never --security updateinfo list updates, /usr/bin/yum --color=never check-update, /usr/bin/yum --color=never --security updateinfo updates
Defaults:vuls env_keep="http_proxy https_proxy HTTP_PROXY HTTPS_PROXY"

• Amazon Linux

• Debian

vuls ALL=(ALL) NOPASSWD: /usr/bin/apt-get update
Defaults:vuls env_keep="http_proxy https_proxy HTTP_PROXY HTTPS_PROXY"

• Ubuntu/Raspbian

vuls ALL=(ALL) NOPASSWD: /usr/bin/apt-get update
Defaults:vuls env_keep="http_proxy https_proxy HTTP_PROXY HTTPS_PROXY"

• FreeBSD

test

Distribution	/sudoers	OS
Ubuntu	OK	12, 14, 16
Debian	OK	7, 8
CentOS	OK	6, 7
Amazon	OK	All
RHEL	OK	5
RHEL	OK	6, 7
FreeBSD		10
Raspbian		Jessie

What did you implement:

Closes #365

How did you implement it:

How can we verify it:

Todos:

You don't have to satisfy all of the following.

• Write tests
• Write documentation
• Check that there aren't other open pull requests for the same issue/feature
• Format your source code by make fmt
• Pass the test by make test
• Provide verification config / commands
• Enable "Allow edits from maintainers" for this PR
• Update the messages below

Is this ready for review?: NO
Is it a breaking change?: YES