From 1a27e08fc5f478e0e5c2c9e841d562753565f694 Mon Sep 17 00:00:00 2001 From: doron Date: Mon, 17 Jan 2022 08:00:06 -0800 Subject: [PATCH 1/5] Fix chkrootkit installation failure --- src/remote_scripts.py | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/src/remote_scripts.py b/src/remote_scripts.py index 2e66908..d9c3f93 100644 --- a/src/remote_scripts.py +++ b/src/remote_scripts.py @@ -7,9 +7,7 @@ mkdir -p /home/ubuntu/vuls cd /home/ubuntu/ wget https://downloads.cisofy.com/lynis/lynis-3.0.3.tar.gz -wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz -mkdir -p chkrootkit && cd chkrootkit -tar xvf /home/ubuntu/chkrootkit.tar.gz --strip-components 1 +sudo apt install chkrootkit -y make sense cd /home/ubuntu/vuls @@ -257,9 +255,7 @@ sudo su -c "chroot /vol /root/lynis/run.sh" | ansi2html -l > /home/ubuntu/nginx/html/lynis_report.html # Chkrootkit scan -cd /home/ubuntu/chkrootkit -# sudo ./chkrootkit -r /vol | sed -n '/INFECTED/,/Searching/p' | head -n -1 | ansi2html -l > /home/ubuntu/nginx/html/chkrootkit_report.html -sudo ./chkrootkit -r /vol | ansi2html -l > /home/ubuntu/nginx/html/chkrootkit_report.html +sudo chkrootkit -r /vol | ansi2html -l > /home/ubuntu/nginx/html/chkrootkit_report.html # Vuls scan sudo su -c "chroot /vol /usr/sbin/sshd -p 2222 -o 'AuthorizedKeysFile=/root/.ssh/tmp_authorized_keys' -o 'AuthorizedKeysCommand=none' -o 'AuthorizedKeysCommandUser=none' -o 'GSSAPIAuthentication=no' -o 'UseDNS=no'" From 4c4cfd8ee6f8dc6c82d36b7a0e2999fafcbd30a2 Mon Sep 17 00:00:00 2001 From: doron Date: Tue, 18 Jan 2022 01:49:19 -0800 Subject: [PATCH 2/5] Update vuls/goval-dictionary scan commands --- src/remote_scripts.py | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/src/remote_scripts.py b/src/remote_scripts.py index d9c3f93..d3e6dcc 100644 --- a/src/remote_scripts.py +++ b/src/remote_scripts.py @@ -8,7 +8,6 @@ cd /home/ubuntu/ wget https://downloads.cisofy.com/lynis/lynis-3.0.3.tar.gz sudo apt install chkrootkit -y -make sense cd /home/ubuntu/vuls docker pull vuls/go-cve-dictionary @@ -29,42 +28,42 @@ docker run --rm -i \ -v $PWD:/vuls \ -v $PWD/goval-dictionary-log:/var/log/vuls \ - vuls/goval-dictionary fetch-redhat 5 6 7 8 + vuls/goval-dictionary fetch redhat 5 6 7 8 docker run --rm -i \ -v $PWD:/vuls \ -v $PWD/goval-dictionary-log:/var/log/vuls \ - vuls/goval-dictionary fetch-debian 7 8 9 10 + vuls/goval-dictionary fetch debian 7 8 9 10 docker run --rm -i \ -v $PWD:/vuls \ -v $PWD/goval-dictionary-log:/var/log/vuls \ - vuls/goval-dictionary fetch-alpine 3.3 3.4 3.5 3.6 3.7 3.8 3.9 3.10 3.11 + vuls/goval-dictionary fetch alpine 3.3 3.4 3.5 3.6 3.7 3.8 3.9 3.10 3.11 docker run --rm -i \ -v $PWD:/vuls \ -v $PWD/goval-dictionary-log:/var/log/vuls \ - vuls/goval-dictionary fetch-ubuntu 14 16 18 19 20 + vuls/goval-dictionary fetch ubuntu 14 16 18 19 20 docker run --rm -i \ -v $PWD:/vuls \ -v $PWD/goval-dictionary-log:/var/log/vuls \ - vuls/goval-dictionary fetch-suse -opensuse 13.2 + vuls/goval-dictionary fetch suse -opensuse 13.2 docker run --rm -i \ -v $PWD:/vuls \ -v $PWD/goval-dictionary-log:/var/log/vuls \ - vuls/goval-dictionary fetch-suse -suse-enterprise-server 12 + vuls/goval-dictionary fetch suse -suse-enterprise-server 12 docker run --rm -i \ -v $PWD:/vuls \ -v $PWD/goval-dictionary-log:/var/log/vuls \ - vuls/goval-dictionary fetch-oracle + vuls/goval-dictionary fetch oracle docker run --rm -i \ -v $PWD:/vuls \ -v $PWD/goval-dictionary-log:/var/log/vuls \ - vuls/goval-dictionary fetch-amazon + vuls/goval-dictionary fetch amazon docker run --rm -i \ -v $PWD:/vuls \ From 4061c2f3e05a4fa903f4222fdbff0291742f29aa Mon Sep 17 00:00:00 2001 From: doron Date: Tue, 18 Jan 2022 02:08:59 -0800 Subject: [PATCH 3/5] Update go-cve-dictionary to fetch from nvd - functionality saved still bringing docs from 2002 till today --- src/remote_scripts.py | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/src/remote_scripts.py b/src/remote_scripts.py index d3e6dcc..595f56b 100644 --- a/src/remote_scripts.py +++ b/src/remote_scripts.py @@ -18,12 +18,10 @@ docker pull vuls/vuls PWD=/home/ubuntu/vuls/ -for i in `seq 2002 $(date +"%Y")`; do \ - docker run --rm -i\ - -v $PWD:/vuls \ - -v $PWD/go-cve-dictionary-log:/var/log/vuls \ - vuls/go-cve-dictionary fetchnvd -years $i; \ - done +docker run --rm -i\ +-v $PWD:/vuls \ +-v $PWD/go-cve-dictionary-log:/var/log/vuls \ +vuls/go-cve-dictionary fetch nvd docker run --rm -i \ -v $PWD:/vuls \ From 10126076f720c438010fe73e4a19d18998e1a589 Mon Sep 17 00:00:00 2001 From: doron Date: Tue, 18 Jan 2022 03:13:26 -0800 Subject: [PATCH 4/5] pull images with fixed version --- src/remote_scripts.py | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/src/remote_scripts.py b/src/remote_scripts.py index 595f56b..2401ed9 100644 --- a/src/remote_scripts.py +++ b/src/remote_scripts.py @@ -10,15 +10,15 @@ sudo apt install chkrootkit -y cd /home/ubuntu/vuls -docker pull vuls/go-cve-dictionary -docker pull vuls/goval-dictionary -docker pull vuls/gost -docker pull vuls/go-exploitdb -docker pull vuls/gost -docker pull vuls/vuls +docker pull vuls/go-cve-dictionary:v0.8.1 +docker pull vuls/goval-dictionary:v0.6.1 +docker pull docker pull vuls/go-exploitdb:v0.4.1 +docker pull docker pull vuls/gost:v0.4.0 + +docker pull vuls/vuls:v0.19.2 PWD=/home/ubuntu/vuls/ -docker run --rm -i\ +docker run --rm -i \ -v $PWD:/vuls \ -v $PWD/go-cve-dictionary-log:/var/log/vuls \ vuls/go-cve-dictionary fetch nvd From 54dfdea4a1806ce8392bc1f8a124bc2a291ebc21 Mon Sep 17 00:00:00 2001 From: doron Date: Tue, 18 Jan 2022 03:32:28 -0800 Subject: [PATCH 5/5] upgrade go-cve-dictionary to v0.9.0 --- src/remote_scripts.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/remote_scripts.py b/src/remote_scripts.py index 2401ed9..e498886 100644 --- a/src/remote_scripts.py +++ b/src/remote_scripts.py @@ -10,7 +10,7 @@ sudo apt install chkrootkit -y cd /home/ubuntu/vuls -docker pull vuls/go-cve-dictionary:v0.8.1 +docker pull vuls/go-cve-dictionary:v0.9.0 docker pull vuls/goval-dictionary:v0.6.1 docker pull docker pull vuls/go-exploitdb:v0.4.1 docker pull docker pull vuls/gost:v0.4.0