einyx / helm-vuls Goto Github PK

System administrators need to constantly monitor NVD (National Vulnerability Database) or similar databases for new vulnerabilities.
It might be impossible for the system administrator to monitor all software if there is a large number of installed packages on the server.
It is expensive to perform analysis to determine the servers affected by new vulnerabilities. The possibility of overlooking a server or two during analysis is there.

Informs users of the vulnerabilities that are related to the system.
Informs users of the servers that are affected.
Vulnerability detection is done automatically to prevent any oversight.
Report is generated on regular basis using CRON or other methods to manage vulnerability.

[slack]
hookURL      = "https://hooks.slack.com/services/XXXXXXXXX/XXXXXXXXXX/XXXXXXXXXXXXXXXXXXX"
channel      = "#vuls_results"
authUser     = "vuls report"

[servers]
[servers.k8s-master1]
host        = "192.168.1.21"
port        = "22"
user        = "root"
keyPath     = "/root/.ssh/id_rsa"

# sudo docker-compose exec db bash
# mysql -u root -p password
create database exploitdb;
create database gost;
create database oval;
exit

# (CVE)
for i in `seq 2002 $(date +"%Y")`; do  sudo docker-compose run --rm cve fetchnvd -dbtype=mysql -dbpath="root:password@tcp(db:3306)/cve?parseTime=true" -years $i;   done

# (JVN)
for i in `seq 1998 $(date +"%Y")`; do sudo docker-compose run --rm cve fetchjvn -dbtype=mysql -dbpath="root:password@tcp(db:3306)/cve?parseTime=true" -years $i; done

# OVAL (RHEL)
sudo docker-compose run --rm oval fetch-redhat -dbtype=mysql -dbpath="root:password@tcp(db:3306)/oval?parseTime=true" 6 7

## gost (RHEL)
sudo docker-compose run --rm gost fetch redhat --dbtype=mysql --dbpath="root:password@tcp(db:3306)/gost?parseTime=true"

## exploitdb
sudo docker-compose run --rm go-exploitdb fetch exploitdb --dbtype=mysql --dbpath="root:password@tcp(db:3306)/exploitdb?parseTime=true"

# (CVE)
docker-compose run --rm cve fetchnvd -dbtype=mysql -dbpath="root:password@tcp(db:3306)/cve?parseTime=true" -latest
# (JVN)
docker-compose run --rm cve fetchjvn -dbtype=mysql -dbpath="root:password@tcp(db:3306)/cve?parseTime=true" -latest
# OVAL (RHEL)
docker-compose run --rm oval fetch-redhat -dbtype=mysql -dbpath="root:password@tcp(db:3306)/oval?parseTime=true" 6 7
## gost (RHEL)
docker-compose run --rm gost fetch redhat --dbtype=mysql --dbpath="root:password@tcp(db:3306)/gost?parseTime=true"
## expliotdb
docker-compose run --rm go-exploitdb fetch exploitdb --dbtype=mysql --dbpath="root:password@tcp(db:3306)/exploitdb?parseTime=true"

docker-compose run --rm vuls configtest -config=./config.toml

docker-compose run --rm vuls scan -config=./config.toml

docker-compose run --rm vuls report -ignore-unfixed -lang ja -config=./config.toml -cvedb-type=mysql -cvedb-url="root:password@tcp(db:3306)/cve?parseTime=true" -ovaldb-type=mysql -ovaldb-url="root:password@tcp(db:3306)/oval?parseTime=true" -gostdb-type=mysql -gostdb-url="root:password@tcp(db:3306)/gost?parseTime=true" -exploitdb-type=mysql -exploitdb-url="root:password@tcp(db:3306)/exploitdb?parseTime=true"

docker-compose run --rm vuls tui -ignore-unfixed -config=./config.toml -cvedb-type=mysql -cvedb-url="root:password@tcp(db:3306)/cve?parseTime=true" 
-ovaldb-type=mysql -ovaldb-url="root:password@tcp(db:3306)/oval?parseTime=true" -gostdb-type=mysql -gostdb-url="root:password@tcp(db:3306)/gost?parseTime=true" -exploitdb-type=mysql -exploitdb-url="root:password@tcp(db:3306)/exploitdb?parseTime=true"