vulsをjail環境へインストールした記録。

設定ファイル、脆弱性DBは~monitor/vuls/に置くものとする

# pkg install sudo go git sqlite3 gmake

# pw add group -n monitor
# pw add user -n monitor  -g monitor -m

# mkdir /var/log/vuls
# chown monitor /var/log/vuls
# chmod 700 /var/log/vuls

# mkdir ~monitor/.ssh
# cd ~monitor
# chown monitor:monitor .ssh
# sudo -u monitor ssh-keygen -t ed25519
# cat ~monitor/.ssh/id_ed25519.pub >> ~monitor/.ssh/authorized_keys
# chown monitor:monitor ~monitor/.ssh/authorized_keys
# chmod 600 ~monitor/.ssh/authorized_keys

なお、公開鍵はVulsの検査対象になるサーバのauthorized_keysにも転記する

/home/monitor/.profile に以下の値を設定¹⁾

GOPATH=$HOME/go;            export GOPATH
PATH=$PATH:$GOPATH/bin;     export PATH

ここで、一旦monitorユーザに切り替える²⁾

# jexec <jail名> su - monitor

$ mkdir -p $GOPATH/src/github.com/kotakanbe
$ cd $GOPATH/src/github.com/kotakanbe/
$ git clone https://github.com/kotakanbe/go-cve-dictionary.git
$ cd $GOPATH/src/github.com/kotakanbe/go-cve-dictionary
$ gmake install

公式文書ではmakeとなっていますがgnu makeなので、FreeBSDではgmake installとなります。³⁾

$ mkdir ~monitor/vuls
$ cd ~monitor/vuls
$ for i in `seq 2002 $(date +"%Y")`; do go-cve-dictionary fetchnvd -years $i;go-cve-dictionary fetchjvn -years $i; done

両方で15～20分くらいかかります。

Deploy goval-dictionary

Deploy gost

Deploy go-exploitdb

$ mkdir -p $GOPATH/src/github.com/future-architect
$ cd $GOPATH/src/github.com/future-architect
$ git clone https://github.com/future-architect/vuls.git
$ cd $GOPATH/src/github.com/future-architect/vuls
$ gmake install

公式文書ではmakeとなっていますがgnu makeなので、FreeBSDではgmake installとなります。⁴⁾

~monitor/vuls/config.toml

[servers]
 
[servers.example]
host         = "192.0.2.1"
port        = "22"
user        = "monitor"
keyPath     = "/home/monitor/.ssh/id_ed25519"

1. config.tomlに記述したユーザを作成する⁵⁾
2. ~monitor/.ssh/authorized_keysに公開鍵を設定する
3. Scanされる側がLinuxの場合はsudoが可能であるように設定する。⁶⁾⁷⁾
   • 一部のLinuxではScanされる側にもインストールが必要なパッケージがあるので注意

$ cd ~monitor/vuls
$ vuls configtest
[Aug  8 09:19:13]  INFO [localhost] Validating config...
[Aug  8 09:19:13]  INFO [localhost] Detecting Server/Container OS... 
[Aug  8 09:19:13]  INFO [localhost] Detecting OS of servers... 
[Aug  8 09:19:15]  INFO [localhost] (1/1) Detected: <server>: FreeBSD 10.3-RELEASE-p20
[Aug  8 09:19:15]  INFO [localhost] Detecting OS of containers... 
[Aug  8 09:19:15]  INFO [localhost] Checking dependendies...
[Aug  8 09:19:15]  INFO [localhost] Checking sudo settings...
[Aug  8 09:19:15]  INFO [chives] sudo ... No need
[Aug  8 09:19:15]  INFO [localhost] Scannable servers are below...

$ vuls scan
[Aug  8 09:32:29]  INFO [localhost] Start scanning
.........snip
[Aug  8 09:32:43]  INFO [localhost] Scanning vulnerabilities... 
[Aug  8 09:32:43]  INFO [localhost] Scanning vulnerable OS packages...

One Line Summary
================
S1      FreeBSD10.3-RELEASE-p20 1 CVEs  1 updatable packages
S2      FreeBSD10.3-RELEASE-p20 0 CVEs  0 updatable packages

To view the detail, vuls tui is useful.
To send a report, run vuls report -h.

one-line

$ vuls report -format-one-line-text
......snip

One Line Summary
================
S1      Total: 1 (High:0 Medium:1 Low:0 ?:0)    1 updatable packages
S2      Total: 0 (High:0 Medium:0 Low:0 ?:0)    0 updatable packages

short-text

$ vuls report -format-short-text
......snip
S1 (FreeBSD10.3-RELEASE-p20)
==============================
Total: 1 (High:0 Medium:1 Low:0 ?:0)    1 updatable packages

CVE-2017-7529   5.0  (Medium)   Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer 
                                overflow vulnerability in nginx range filter module resulting into leak of      
                                potentially sensitive information triggered by specially crafted request.       
                                http://www.cvedetails.com/cve/CVE-2017-7529                                     
                                https://vuxml.freebsd.org/freebsd/b28adc5b-6693-11e7-ad43-f0def16c5c1b.html     
                                nginx-1.12.0_4,2 -> nginx                                                       
                                Confidence: 100 / PkgAuditMatch                                                 
             


S2 (FreeBSD10.3-RELEASE-p20)
================================
Total: 0 (High:0 Medium:0 Low:0 ?:0)    0 updatable packages

No CVE-IDs are found in updatable packages.

$ vuls report -format-one-line-text
......snip

One Line Summary
================
S1      Total: 0 (High:0 Medium:0 Low:0 ?:0)    1 updatable packages
S2      Total: 0 (High:0 Medium:0 Low:0 ?:0)    0 updatable packages

Vuls README

[改訂版]vulsを使って脆弱性の自動スキャンを実現する

vuls on FreeBSD