LXC container support without LXD (#552)

* LXC container support without LXD

* Fix: LXC required root privilege

* Update README
This commit is contained in:
Mai MISHIRO
2017-12-18 22:54:32 +09:00
committed by Kota Kanbe
parent 19b581edef
commit 0e8736045e
5 changed files with 173 additions and 17 deletions

View File

@@ -75,9 +75,10 @@ Table of Contents
* [Example: Scan specific servers](#example-scan-specific-servers)
* [Example: Scan via shell instead of SSH.](#example-scan-via-shell-instead-of-ssh)
* [cronで動かす場合](#cronで動かす場合)
* [Example: Scan containers (Docker/LXD)](#example-scan-containers-dockerlxd)
* [Example: Scan containers (Docker/LXD/LXC)](#example-scan-containers-dockerlxdlxc)
* [Docker](#docker)
* [LXDコンテナをスキャンする場合](#lxdコンテナをスキャンする場合)
* [LXCコンテナをスキャンする場合](#lxcコンテナをスキャンする場合)
* [Usage: Report](#usage-report)
* [How to read a report](#how-to-read-a-report)
* [Example](#example-1)
@@ -734,7 +735,7 @@ host = "172.31.4.82"
# ["key", "value"],
#]
#[servers.172-31-4-82.containers]
#type = "lxd" # or "docker"
#type = "lxd" # or "docker" or "lxc"
#includes = ["${running}"]
#excludes = ["container_name", "container_id"]
```
@@ -819,7 +820,7 @@ host = "172.31.4.82"
# ["key", "value"],
#]
#[servers.172-31-4-82.containers]
#type = "lxd" # or "docker"
#type = "lxd" # or "docker" or "lxc"
#includes = ["${running}"]
#excludes = ["container_name", "container_id"]
```
@@ -1103,7 +1104,7 @@ RHEL/CentOSの場合、スキャン対象サーバの/etc/sudoersに以下を追
Defaults:vuls !requiretty
```
## Example: Scan containers (Docker/LXD)
## Example: Scan containers (Docker/LXD/LXC)
コンテナはSSHデーモンを起動しないで運用するケースが一般的。
@@ -1177,6 +1178,30 @@ type = "lxd"
includes = ["${running}"]
```
### LXC
Vulsは、ホストにSSHで接続し、`lxc-attach`でLXCコンテナにコマンドを発行して脆弱性をスキャンする。
```
[servers]
[servers.172-31-4-82]
host = "172.31.4.82"
user = "ec2-user"
keyPath = "/home/username/.ssh/id_rsa"
[servers.172-31-4-82.containers]
type = "lxc"
includes = ["${running}"]
```
LXCコンテナの操作にはroot権限が必要です。
スキャン対象サーバ上の`/etc/sudoers`のサンプル
```
vuls ALL=(ALL) NOPASSWD:/usr/bin/lxc-attach -n *, /usr/bin/lxc-ls *
```
# Usage: Report
```