add some pages

vulsdoc · Dec 26, 2017 · 1cd139c · 1cd139c
1 parent ec19661
commit 1cd139c
Show file tree

Hide file tree

Showing 40 changed files with 8,316 additions and 349 deletions.
diff --git a/docs/abstract.md b/docs/abstract.md
@@ -1,7 +1,7 @@
 ---
 id: abstract
 title: Abstract
-sidebar_label: Introduction
+sidebar_label: Abstract
 ---
 
 For a system administrator, having to perform security vulnerability analysis and software update on a daily basis can be a burden.
@@ -18,5 +18,5 @@ Vuls is a tool created to solve the problems listed above. It has the following
 - Vulnerability detection is done automatically to prevent any oversight.
 - Report is generated on regular basis using CRON or other methods. to manage vulnerability.
 
-![Vuls-Motivation](/img/vuls-motivation.png)
+![Vuls-Motivation](/vuls/img/docs/vuls-motivation.png)
 
diff --git a/docs/architecture-deep-scan.md b/docs/architecture-deep-scan.md
@@ -0,0 +1,36 @@
+---
+id: architecture-deep-scan
+title: Deep Scan
+sidebar_label: Deep Scan
+---
+
+![Vuls-Scan-Flow](/vuls/img/docs/vuls-scan-flow.png)
+
+| Distribution|                            Scan Speed |       Need Root Privilege |      OVAL | Need Internet Access <br>on scan tareget|
+|:------------|:-------------------------------------:|:-------------------------:|:---------:|:---------------------------------------:|
+| Alpine      |                                  Fast |　                      No | Supported |                                    Need |
+| CentOS      |                                  Slow |　                      No | Supported |                                    Need |
+| RHEL        |                                  Slow |　                    Need | Supported |                                    Need |
+| Oracle      |                                  Slow |　                    Need | Supported |                                    Need |
+| Ubuntu      |1st time: Slow <br> From 2nd time: Fast|                      Need | Supported |                                    Need |
+| Debian      |1st time: Slow <br> From 2nd time: Fast|                      Need | Supported |                                    Need |
+| Raspbian    |1st time: Slow <br> From 2nd time: Fast|                      Need |        No |                                    Need |
+| FreeBSD     |                                  Fast |　                      No |        No |                                    Need |
+| Amazon      |                                  Slow |　                      No |        No |                                    Need |
+| SUSE Enterprise |                              Fast |　                      No |  Supported |                                     No |
+
+
+- On Ubuntu, Debian and Raspbian
+Vuls issues `apt-get changelog` for each upgradable packages and parse the changelog.  
+`apt-get changelog` is slow and resource usage is heavy when there are many updatable packages on target server.   
+Vuls stores these changelogs to KVS([boltdb](https://github.com/boltdb/bolt)).  
+From the second time on, the scan speed is fast by using the local cache.
+
+- On CentOS
+Vuls issues `yum changelog` to get changelogs of upgradable packages at once and parse the changelog.  
+
+- On RHEL, Oracle, Amazon and FreeBSD
+Detect CVE IDs by using package manager.
+
+- On SUSE Enterprise Linux and Alpine Linux
+Same as fast scan mode for now.
diff --git a/docs/architecture-fast-scan.md b/docs/architecture-fast-scan.md
@@ -0,0 +1,24 @@
+---
+id: architecture-fast-scan
+title: Fast Scan (No root privileges)
+sidebar_label: Fast Scan (No root privileges)
+---
+
+![Vuls-Scan-Flow](/vuls/img/docs/vuls-scan-flow-fast.png)
+
+- Scan without Root Privilege
+- Scan with No internet access on some OS.
+
+| Distribution|                             Scan Speed | Need Root Privilege |       OVAL | Need Internet Access <br>on scan tareget|
+|:------------|:--------------------------------------:|:-------------------:|:----------:|:---------------------------------------:|
+| Alpine      |                                   Fast |　                No |  Supported |                                    Need |
+| CentOS      |                                   Fast |　                No |  Supported |                                      No |
+| RHEL        |                                   Fast |　                No |  Supported |                                      No |
+| Oracle      |                                   Fast |　                No |  Supported |                                      No |
+| Ubuntu      |                                   Fast |　                No |  Supported |                                      No |
+| Debian      |                                   Fast |　                No |  Supported |                                      No |
+| Raspbian    |1st time: Slow <br> From 2nd time: Fast |                Need |         No |                                    Need |
+| FreeBSD     |                                   Fast |　                No |         No |                                    Need |
+| Amazon      |                                   Fast |　                No |         No |                                    Need |
+| SUSE Enterprise |                               Fast |　                No |  Supported |                                      No |
+
diff --git a/docs/architecture-local-scan.md b/docs/architecture-local-scan.md
@@ -0,0 +1,14 @@
+---
+id: architecture-local-scan
+title: Local Scan Mode(Scan without SSH)
+sidebar_label: Local Scan Mode
+---
+
+Deploy Vuls to the scan target server. Vuls issues a command to the local host (not via SSH). Aggregate the JSON of the scan result into another server. Since it is necessary to access the CVE database in order to refine the scan result, start go-cve-dictionary in server mode beforehand.
+On the aggregation server, you can refer to the scanning result of each scan target server using WebUI or TUI.
+
+![Vuls-Architecture Local Scan Mode](/vuls/img/docs/vuls-architecture-localscan.png)
+
+TODO change link
+[Details](#example-scan-via-shell-instead-of-ssh)
+
diff --git a/docs/architecture-remote-scan.md b/docs/architecture-remote-scan.md
@@ -0,0 +1,8 @@
+---
+id: architecture-remote-scan
+title: Remote Scan Mode (Scan via SSH)
+sidebar_label: Remote Scan Mode
+---
+
+![Vuls-Architecture](/vuls/img/docs/vuls-architecture.png)
+
diff --git a/docs/doc1.md b/docs/doc1.md
diff --git a/docs/doc2.md b/docs/doc2.md
diff --git a/docs/doc3.md b/docs/doc3.md
diff --git a/docs/exampledoc4.md b/docs/exampledoc4.md
diff --git a/docs/exampledoc5.md b/docs/exampledoc5.md
diff --git a/docs/install-manually.md b/docs/install-manually.md
@@ -0,0 +1,114 @@
+---
+id: install-manually-centos
+title: Install Manually on CentOS
+sidebar_label: Install Manually on CentOS
+---
+
+## Install requirements
+
+Vuls requires the following packages.
+
+- SQLite3, MySQL, PostgreSQL, Redis
+- git
+- gcc
+- GNU Make
+- go v1.8.3 or later (The latest version is recommended)
+    - https://golang.org/doc/install
+
+```bash
+$ ssh [email protected]  -i ~/.ssh/private.pem
+$ sudo yum -y install sqlite git gcc make wget
+$ wget https://storage.googleapis.com/golang/go1.8.3.linux-amd64.tar.gz
+$ sudo tar -C /usr/local -xzf go1.8.3.linux-amd64.tar.gz
+$ mkdir $HOME/go
+```
+Add these lines into /etc/profile.d/goenv.sh
+
+```bash
+export GOROOT=/usr/local/go
+export GOPATH=$HOME/go
+export PATH=$PATH:$GOROOT/bin:$GOPATH/bin
+```
+
+Set the OS environment variable to current shell
+```bash
+$ source /etc/profile.d/goenv.sh
+```
+## Deploy go-cve-dictionary
+
+[go-cve-dictionary](https://github.com/kotakanbe/go-cve-dictionary)
+
+```bash
+$ sudo mkdir /var/log/vuls
+$ sudo chown centos /var/log/vuls
+$ sudo chmod 700 /var/log/vuls
+$
+$ mkdir -p $GOPATH/src/github.com/kotakanbe
+$ cd $GOPATH/src/github.com/kotakanbe
+$ git clone https://github.com/kotakanbe/go-cve-dictionary.git
+$ cd go-cve-dictionary
+$ make install
+```
+The binary was built under `$GOPATH/bin`
+
+Then Fetch vulnerability data from NVD.  
+It takes about 10 minutes (on AWS).  
+
+```bash
+$ cd $HOME
+$ for i in `seq 2002 $(date +"%Y")`; do go-cve-dictionary fetchnvd -years $i; done
+... snip ...
+$ ls -alh cve.sqlite3
+-rw-r--r--. 1 centos centos  51M Aug  6 08:10 cve.sqlite3
+-rw-r--r--. 1 centos centos  32K Aug  6 08:10 cve.sqlite3-shm
+-rw-r--r--. 1 centos centos 5.1M Aug  6 08:10 cve.sqlite3-wal
+```
+
+## Deploy goval-dictionary
+
+[goval-dictionary](https://github.com/kotakanbe/goval-dictionary)
+
+```bash
+$ mkdir -p $GOPATH/src/github.com/kotakanbe
+$ cd $GOPATH/src/github.com/kotakanbe
+$ git clone https://github.com/kotakanbe/goval-dictionary.git
+$ cd goval-dictionary
+$ make install
+```
+The binary was built under `$GOPATH/bin`
+
+ Then fetch OVAL data of RedHat since the server to be scanned is CentOS. [README](https://github.com/kotakanbe/goval-dictionary#usage-fetch-oval-data-from-redhat)
+
+```bash
+$ goval-dictionary fetch-redhat 7
+```
+
+If you want to scan other than CentOS 7, fetch OVAL data according to the OS type and version of scan target server in advance.
+- [Alpine](https://github.com/kotakanbe/goval-dictionary#usage-fetch-alpine-secdb-as-oval-data-type)
+- [RedHat, CentOS](https://github.com/kotakanbe/goval-dictionary#usage-fetch-oval-data-from-redhat)
+- [Debian](https://github.com/kotakanbe/goval-dictionary#usage-fetch-oval-data-from-debian)
+- [Ubuntu](https://github.com/kotakanbe/goval-dictionary#usage-fetch-oval-data-from-ubuntu)
+- [Oracle Linux](https://github.com/kotakanbe/goval-dictionary#usage-fetch-oval-data-from-oracle)
+- [SUSE](https://github.com/kotakanbe/goval-dictionary#usage-fetch-oval-data-from-suse)
+
+## Deploy Vuls
+
+```
+$ mkdir -p $GOPATH/src/github.com/future-architect
+$ cd $GOPATH/src/github.com/future-architect
+$ git clone https://github.com/future-architect/vuls.git
+$ cd vuls
+$ make install
+```
+If you have previously installed vuls and want to update, please do the following
+```
+$ rm -rf $GOPATH/pkg/linux_amd64/github.com/future-architect/vuls/
+$ rm -rf $GOPATH/src/github.com/future-architect/vuls/
+$ cd $GOPATH/src/github.com/future-architect
+$ git clone https://github.com/future-architect/vuls.git
+$ cd vuls
+$ make install
+```
+
+The binary was built under `$GOPATH/bin`
+