Ubuntu 16.04にVuls環境構築

VulsをUbuntu16.04LTSにインストールしてみたのでその時の構築手順をメモとして記載しておきます。

構築手順

環境

Ubuntu 16.04.3 LTS (Kernel 4.4.0-96-generic(4.4.0-96.119))
goval-dictionary
go-cve-dictionary
vuls

パッケージインストール

必要なパッケージをインストールします。たぶんminimal環境でも以下あたりを入れていれば大丈夫と思いますが、不足があれば都度追加します。

$ sudo apt install ca-certificates git openssh-server sqlite build-essential wget curl

ユーザ作成

vulsの環境構築、実行のためのユーザを作成します。ここでは uid/gid が 20001 の vuls ユーザ/グループを作成します。sudoを実行できるように sudo グループに所属させます。

$ sudo groupadd -g 20001 vuls
$ sudo useradd -u 20001 -g vuls -G sudo -d /home/vuls -m vuls -s /bin/bash

$ sudo vim /etc/sudoers.d/vuls
vuls ALL=NOPASSWD: ALL

以降の作業を vuls ユーザで行います。

$ sudo su - vuls

ssh鍵設定

$ pwd
/home/vuls

$ mkdir .ssh
$ chmod 700 .ssh

$ ssh-keygen -t rsa -b 4096 -C "foo@example.com"
Generating public/private rsa key pair.
Enter file in which to save the key (/home/vuls/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/vuls/.ssh/id_rsa.
Your public key has been saved in /home/vuls/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:Uca9EsmtA5Om5ThjJMb23CzI99//tOjbMU7cVtv0CKo foo@example.com
The key's randomart image is:
+---[RSA 4096]----+
|   .     +o+     |
|    = . *o= o    |
|   + * O.o o .   |
|    o @ +.+ .    |
|     o =S  o.   o|
|        .  . ..o*|
|         ...  .**|
|         .. . =o+|
|        E   .=o=.|
+----[SHA256]-----+

$ cat ~/.ssh/id_rsa.pub >> .ssh/authorized_keys

$ chmod 600 ~/.ssh/authorized_keys

goのインストール

$ wget https://storage.googleapis.com/golang/go1.8.2.linux-amd64.tar.gz

$ sudo tar -C /usr/local -xzf go1.8.2.linux-amd64.tar.gz

$ vim .bashrc
### 以下を追記
export GOROOT=/usr/local/go
export GOPATH=$HOME/go
export PATH=$PATH:$GOROOT/bin:$GOPATH/bin

$ mkdir ~/go

$ which go
/usr/local/go/bin/go

$ go version
go version go1.8.2 linux/amd64

ログ用のディレクトリ作成

$ sudo mkdir /var/log/vuls
$ sudo chown vuls:vuls /var/log/vuls
$ sudo chmod 700 /var/log/vuls

go-cve-dictionaryのインストール

go-cve-dictionaryというツールをインストールします。これはJVNのローカルコピーを構築するためのツールで、ローカルコピーはsqlite形式で生成されます。

まず必要なディレクトリを作成して、移動します。

$ mkdir -p $GOPATH/src/github.com/kotakanbe
$ cd $GOPATH/src/github.com/kotakanbe

GitHubからgo-cve-dictionaryをCloneして、そのディレクトリへ移動します。

$ git clone https://github.com/kotakanbe/go-cve-dictionary.git

$ cd go-cve-dictionary

ビルドします。

$ make install

ホームディレクトリへ戻ります。

$ cd

$ for i in {2002..2017}; do go-cve-dictionary fetchnvd -years $i; done
 0 / 1 [---------------------------------------------------------------]   0.00%
[Dec 16 11:21:04]  INFO Fetching... https://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-2002.xml.gz
 1 / 1 [============================================================] 100.00% 8s
[Dec 16 11:21:12]  INFO Fetched 6745 CVEs
[Dec 16 11:21:12]  INFO Inserting NVD into DB (sqlite3).
[Dec 16 11:21:12]  INFO Inserting CVEs...
 6745 / 6745 [======================================================] 100.00% 4s
[Dec 16 11:21:17]  INFO Refreshed 2 Nvds.
 0 / 1 [---------------------------------------------------------------]   0.00%
[Dec 16 11:21:17]  INFO Fetching... https://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-2003.xml.gz
 1 / 1 [============================================================] 100.00% 2s
:
:
:
[Dec 16 11:27:18]  INFO Fetching... https://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-2016.xml.gz
 1 / 1 [================================================================================================================================================================================] 100.00% 13s
[Dec 16 11:27:31]  INFO Fetched 9174 CVEs
[Dec 16 11:27:31]  INFO Inserting NVD into DB (sqlite3).
[Dec 16 11:27:31]  INFO Inserting CVEs...
 9174 / 9174 [==========================================================================================================================================================================] 100.00% 15s
[Jan 11 11:27:47]  INFO Refreshed 693 Nvds.
 0 / 1 [------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------]   0.00%[Jan 11 11:27:47]  INFO Fetching... https://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-2017.xml.gz
 1 / 1 [================================================================================================================================================================================] 100.00% 21s
[Dec 16 11:28:08]  INFO Fetched 11434 CVEs
[Dec 16 11:28:08]  INFO Inserting NVD into DB (sqlite3).
[Dec 16 11:28:08]  INFO Inserting CVEs...
 11434 / 11434 [======================================================================================================================================================================] 100.00% 1m38s
[Dec 16 11:29:47]  INFO Refreshed 1250 Nvds.

goval-dictionaryのインストール

OVALのローカルコピーを構築するためのツールです。これもgo-cve-dictionaryと同様にローカルコピーはsqlite形式で生成されます。

GitHubからgoval-dictionaryをCloneして、そのディレクトリへ移動します。

$ cd $GOPATH/src/github.com/kotakanbe
$ git clone https://github.com/kotakanbe/goval-dictionary.git

$ cd goval-dictionary

$ make install

$ cd

$ goval-dictionary fetch-ubuntu 14 16

[Dec 16 11:44:22]  INFO Fetching... https://people.canonical.com/~ubuntu-security/oval/com.ubuntu.xenial.cve.oval.xml

[Dec 16 11:44:22]  INFO Fetching... https://people.canonical.com/~ubuntu-security/oval/com.ubuntu.trusty.cve.oval.xml
com.ubuntu.xenial.cve.oval.xml: 32.43 MiB / 32.43 MiB [=====================================================================================================================================] 100.00%
com.ubuntu.trusty.cve.oval.xml: 42.16 MiB / 42.16 MiB [=====================================================================================================================================] 100.00%
[Dec 16 12:13:07]  INFO Finished to fetch OVAL definitions.
[Dec 16 12:13:09]  INFO Fetched: https://people.canonical.com/~ubuntu-security/o
val/com.ubuntu.xenial.cve.oval.xml
[Dec 16 12:13:09]  INFO   10369 OVAL definitions
[Dec 16 12:13:09]  INFO   Refreshing ubuntu 16...
[Dec 16 12:13:27]  INFO Fetched: https://people.canonical.com/~ubuntu-security/o
val/com.ubuntu.trusty.cve.oval.xml
[Dec 16 12:13:27]  INFO   13362 OVAL definitions
[Dec 16 12:13:27]  INFO   Refreshing ubuntu 14...

vulsのインストール

vulsをインストールします。

まず必要なディレクトリを作成して、移動します。

$ mkdir -p $GOPATH/src/github.com/future-architect
$ cd $GOPATH/src/github.com/future-architect

GitHubからvulsをCloneして、そのディレクトリへ移動します。

$ git clone https://github.com/future-architect/vuls.git
$ cd vuls