本篇简单介绍一款Docker安全扫描工具Anchore的安装和使用

前言

  下述过程是在CentOS 7.6的虚拟机上进行的。

[root@localhost ~]# cat /etc/redhat-release
CentOS Linux release 7.6. (Core)

Docker安装

  安装步骤如下:参考Docker 学习入门

# yum remove docker docker-common docker-selinux                                            # 如之前安装,先卸载
# yum install -y yum-utils device-mapper-persistent-data lvm2                   # 安装依赖
# yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo # 配置软件包源
# yum install docker-ce -y                                        # 安装docker
# systemctl start docker                                         # 启动docker服务 
# systemctl enable docker                                        # 设置开机启动
# docker -v                                                 # 查看docker 版本
# docker info                                                # 查看docker详细信息

添加dpkg支持

# yum install epel-release -y
# yum install dpkg -y

安装Anchore

  Anchore安装使用需python支持,CentOS 7.6默认情况下已有python和pip,可能需要先更新一下pip。

# pip install --upgrade pip

  Step1:安装Anchore

# pip install anchore

  Step2:设置环境变量(临时添加)

# export PATH=~/.local/bin:$PATH

  Step3:查看anchore版本

# anchore --version        

  Step4:查看订阅列表

[root@localhost ~]# anchore feeds list
initializing feed metadata: ...
Available:
nvd:
description: Feed record for type nvd
nvdv2:
description: Feed record for type nvdv2
packages:
description: Feed record for type packages
Subscribed:
vulnerabilities:
description: Feed record for type vulnerabilities

  默认值订阅了最后一个。

  Step5:同步订阅内容

[root@localhost ~]# anchore feeds sync
syncing data for subscribed feed (vulnerabilities) ...
syncing group data: debian:unstable: ...
syncing group data: ubuntu:16.04: ...
syncing group data: centos:: ...
syncing group data: centos:: ...
syncing group data: centos:: ...
syncing group data: amzn:: ...
syncing group data: ubuntu:14.04: ...
syncing group data: centos:: ...
syncing group data: ubuntu:14.10: ...
syncing group data: debian:: ...
syncing group data: debian:: ...
syncing group data: ubuntu:15.04: ...
syncing group data: debian:: ...
syncing group data: debian:: ...
syncing group data: ubuntu:12.04: ...
syncing group data: ubuntu:18.04: ...
syncing group data: ubuntu:17.10: ...
syncing group data: ubuntu:19.10: ...
syncing group data: debian:: ...
syncing group data: ubuntu:16.10: ...
syncing group data: alpine:3.3: ...
syncing group data: alpine:3.4: ...
syncing group data: alpine:3.5: ...
syncing group data: alpine:3.6: ...
syncing group data: alpine:3.7: ...
syncing group data: alpine:3.8: ...
syncing group data: alpine:3.9: ...
syncing group data: ubuntu:13.04: ...
syncing group data: ubuntu:15.10: ...
syncing group data: alpine:3.10: ...
syncing group data: ubuntu:12.10: ...
syncing group data: ubuntu:18.10: ...
syncing group data: ubuntu:17.04: ...
syncing group data: ol:: ...
syncing group data: ol:: ...
syncing group data: ol:: ...
syncing group data: ol:: ...
syncing group data: ubuntu:19.04: ...
skipping data sync for unsubscribed feed (nvd) ...
skipping data sync for unsubscribed feed (nvdv2) ...
skipping data sync for unsubscribed feed (packages) ...

  这步可能只需要十分钟,也可能需要更久,目前没找到什么加速的方法。

添加订阅feed

  通过查询anchore feeds --help,我们知道有个sub子命令用于订阅feed。如果想添加nvd订阅:

[root@localhost ~]# anchore feeds sub nvd         # 添加nvd feed,可以通过这种方式订阅其它的
nvd: subscribed.
[root@localhost ~]# anchore feeds list # 查看订阅的feeds
Available:
nvdv2:
description: Feed record for type nvdv2
packages:
description: Feed record for type packages
Subscribed:
nvd:
description: Feed record for type nvd      # 已经订阅了nvd
vulnerabilities:
description: Feed record for type vulnerabilities [root@localhost ~]# anchore feeds sync        # 同步更新
syncing data for subscribed feed (vulnerabilities) ...
skipping group data: debian:unstable: already synced
skipping group data: alpine:3.8: already synced
skipping group data: ubuntu:16.04: already synced
skipping group data: centos:: already synced
skipping group data: centos:: already synced
skipping group data: centos:: already synced
skipping group data: amzn:: already synced
skipping group data: ol:: already synced
skipping group data: centos:: already synced
skipping group data: ubuntu:14.10: already synced
skipping group data: debian:: already synced
skipping group data: debian:: already synced
skipping group data: ubuntu:15.04: already synced
skipping group data: debian:: already synced
skipping group data: debian:: already synced
skipping group data: ubuntu:12.04: already synced
skipping group data: ubuntu:18.04: already synced
skipping group data: ubuntu:17.10: already synced
skipping group data: ubuntu:19.10: already synced
skipping group data: debian:: already synced
skipping group data: ubuntu:16.10: already synced
skipping group data: alpine:3.3: already synced
skipping group data: alpine:3.4: already synced
skipping group data: alpine:3.5: already synced
skipping group data: alpine:3.6: already synced
skipping group data: alpine:3.7: already synced
skipping group data: ubuntu:14.04: already synced
skipping group data: alpine:3.9: already synced
skipping group data: ubuntu:15.10: already synced
skipping group data: alpine:3.10: already synced
skipping group data: ubuntu:12.10: already synced
skipping group data: ubuntu:18.10: already synced
skipping group data: ubuntu:17.04: already synced
skipping group data: ol:: already synced
skipping group data: ol:: already synced
skipping group data: ubuntu:13.04: already synced
skipping group data: ol:: already synced
skipping group data: ubuntu:19.04: already synced
syncing data for subscribed feed (nvd) ...            # 同步nvd订阅
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
skipping data sync for unsubscribed feed (nvdv2) ...
skipping data sync for unsubscribed feed (packages) ...

工具测验

  先拉取一个镜像:mysql

[root@localhost ~]# docker pull mysql
[root@localhost ~]# docker images       # 查看所有镜像列表
REPOSITORY TAG IMAGE ID CREATED SIZE
mysql latest c8ee894bd2bd days ago 456MB
nginx latest 5a9061639d0a days ago 126MB
busybox latest 19485c79a9bb weeks ago .22MB

镜像分析

  分析mysql镜像。

[root@localhost ~]# anchore analyze --image mysql
Analyzing image: mysql
c8ee894bd2bd: analyzing ...
c8ee894bd2bd: analyzed.

生成报告

  使用gate命令生成分析报告,默认输出到控制台。

  gate命令没有看到输出报告格式,我这将输出重定向到mysql.html文件。

[root@localhost ~]# anchore gate --image mysql > mysql.html

查看报告

  打开mysql.html报告查看具体内容。

  关于命令的详细介绍,请使用--help进行查阅或参考第二个参考链接。感觉目前这款工具还不理想。

参考

  Docker 学习入门:https://www.cnblogs.com/chiangchou/p/docker.html

  Docker安全自动化扫描工具对比测试:https://blog.csdn.net/wutianxu123/article/details/83216219

以上!

Docker安全扫描工具之Anchore的更多相关文章

  1. Docker安全扫描工具之DockerScan

    前言 本篇简单介绍Docker扫描工具DockerScan的安装使用.下述过程是在CentOS 7.6的虚拟机上进行的. [root@localhost ~]# cat /etc/redhat-rel ...

  2. Docker安全扫描工具之docker-bench-security

    简介 Docker Bench for Security检查关于在生产环境中部署Docker容器的几十个常见最佳实践.这些测试都是自动化的,其灵感来自CIS Docker基准1.2.0版. 这种安全扫 ...

  3. Trivy 容器镜像扫描工具学习

    简介 官方地址:https://github.com/aquasecurity/trivy Trivy是aqua(专注云原生场景下的安全)公司的一款开源工具,之前历史文章也有对aqua的一些介绍. T ...

  4. 域名扫描工具Fierce

    域名扫描工具Fierce   该工具是一个域名扫描综合性工具.它可以快速获取指定域名的DNS服务器,并检查是否存在区域传输(Zone Transfer)漏洞.如果不存在该漏洞,会自动执行暴力破解,以获 ...

  5. NMAP分布式扫描工具dnmap

    NMAP分布式扫描工具dnmap   NMAP是一款知名的网络扫描工具.它提供丰富和强大的网络扫描功能.但很多时候,需要渗透测试人员从多个终端发起扫描任务,以快速扫描大型网络,或规避IP限制等安全策略 ...

  6. Nikto是一款Web安全扫描工具,可以扫描指定主机的web类型,主机名,特定目录,cookie,特定CGI漏洞,XSS漏洞,SQL注入漏洞等,非常强大滴说。。。

    Nikto是一款Web安全扫描工具,可以扫描指定主机的web类型,主机名,特定目录,cookie,特定CGI漏洞,XSS漏洞,SQL注入漏洞等,非常强大滴说... root@xi4ojin:~# cd ...

  7. 网站安全扫描工具--Netsparker的使用

    Netsparker是一款安全简单的web应用安全漏电扫描工具.该软件功能非常强大,使用方便.Netsparker与其他综合 性的web应用安全扫描工具相比的一个特点是它能够更好的检测SQL Inje ...

  8. 小白日记34:kali渗透测试之Web渗透-扫描工具-Burpsuite(二)

    扫描工具-Burpsuite 公共模块 0.Spider 爬网 手动爬网 先禁用截断功能 手动将页面中点击所有连接,对提交数据的地方,都进行提交[无论内容] 自动爬网[参数设置] 指定爬网路径,否则其 ...

  9. 小白日记32:kali渗透测试之Web渗透-扫描工具-QWASP_ZAP

    扫描工具-QWASP_ZAP 十大安全工具之一,集成性工具,功能完善,而且强大.既可做主动扫描,也可做截断代理.开源免费跨平台,简单易用,体验相对混乱,但在主动扫描方面,相对占优.[kali集成] # ...

随机推荐

  1. Git基础用法

    从远程仓库拉取代码: git clone https://xxxx.xxx.xx 进入拉取到代码的路径下,(文件夹中含有 .git 隐藏文件夹) 查看当前是否关联到远git代码管理 git statu ...

  2. JQuery基础之获取和设置标签内容

    JQuery基础之获取和设置标签内容方法,如下图: 代码实现: <script src="JS/jquery-1.12.4.min.js"></script> ...

  3. 在阿里云购买SSL证书,让网站支持HTTPS

    SSL简介 引自:https://baike.baidu.com/item/ssl/320778?fr=aladdin SSL SSL(Secure Sockets Layer 安全套接层),及其继任 ...

  4. libcurl库浅析

    先放上libcurl官方文档:链接 第一步:全局初始化 #include <curl/curl.h> CURLcode curl_global_init(long flags ); 在使用 ...

  5. [TimLinux] JavaScript BOM浏览器对象模型

    1. 简介 ECMAScript是JavaScript的核心,但是如果要在WEB中使用JavaScript,那么BOM则无疑才是真的的核心.BOM提供了很多对象,用于访问浏览器的功能,这些功能与任何网 ...

  6. cf round 598div3 D.Binary String Minimizing

    题目:https://codeforces.com/contest/1256/problem/D 题意:给你长度为n的01串,能将任意两相邻字符交换k次,求最小字典序的交换结果. 思路:贪心...甚至 ...

  7. HDU-1595Find the longest of shortest(最短路径的最长路Dijkstra+记录路径)

    Marica is very angry with Mirko because he found a new girlfriend and she seeks revenge.Since she do ...

  8. 用.NET模拟天体运动

    用.NET模拟天体运动 这将是一篇罕见而偏极客的文章. 我上大学时就见过一些模拟太阳系等天体运动的软件和网站,觉得非常酷炫,比如这个(http://www.astronoo.com/en/articl ...

  9. C#实现在foreach遍历中删除集合中的元素(方法总结)

    目录 方法一:采用for循环,并且从尾到头遍历 方法二:使用递归 方法三:通过泛型类实现IEnumerator 在foreach中删除元素时,每一次删除都会导致集合的大小和元素索引值发生变化,从而导致 ...

  10. Webpack基础知识总结

    本文将从多个方面回顾下自己了解的Webpack知识,包括常见的配置项,前端搭建的一些方法和项目实际优化方法,有错误的地方还请指出并多多包涵. 一.关于Webpack 1.概念 本质上,webpack ...