Docker安全扫描工具之Anchore
本篇简单介绍一款Docker安全扫描工具Anchore的安装和使用。
前言
下述过程是在CentOS 7.6的虚拟机上进行的。
[root@localhost ~]# cat /etc/redhat-release
CentOS Linux release 7.6. (Core)
Docker安装
安装步骤如下:参考Docker 学习入门
# yum remove docker docker-common docker-selinux # 如之前安装,先卸载
# yum install -y yum-utils device-mapper-persistent-data lvm2 # 安装依赖
# yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo # 配置软件包源
# yum install docker-ce -y # 安装docker
# systemctl start docker # 启动docker服务
# systemctl enable docker # 设置开机启动
# docker -v # 查看docker 版本
# docker info # 查看docker详细信息
添加dpkg支持
# yum install epel-release -y
# yum install dpkg -y
安装Anchore
Anchore安装使用需python支持,CentOS 7.6默认情况下已有python和pip,可能需要先更新一下pip。
# pip install --upgrade pip
Step1:安装Anchore
# pip install anchore
Step2:设置环境变量(临时添加)
# export PATH=~/.local/bin:$PATH
Step3:查看anchore版本
# anchore --version
Step4:查看订阅列表
[root@localhost ~]# anchore feeds list
initializing feed metadata: ...
Available:
nvd:
description: Feed record for type nvd
nvdv2:
description: Feed record for type nvdv2
packages:
description: Feed record for type packages
Subscribed:
vulnerabilities:
description: Feed record for type vulnerabilities
默认值订阅了最后一个。
Step5:同步订阅内容
[root@localhost ~]# anchore feeds sync
syncing data for subscribed feed (vulnerabilities) ...
syncing group data: debian:unstable: ...
syncing group data: ubuntu:16.04: ...
syncing group data: centos:: ...
syncing group data: centos:: ...
syncing group data: centos:: ...
syncing group data: amzn:: ...
syncing group data: ubuntu:14.04: ...
syncing group data: centos:: ...
syncing group data: ubuntu:14.10: ...
syncing group data: debian:: ...
syncing group data: debian:: ...
syncing group data: ubuntu:15.04: ...
syncing group data: debian:: ...
syncing group data: debian:: ...
syncing group data: ubuntu:12.04: ...
syncing group data: ubuntu:18.04: ...
syncing group data: ubuntu:17.10: ...
syncing group data: ubuntu:19.10: ...
syncing group data: debian:: ...
syncing group data: ubuntu:16.10: ...
syncing group data: alpine:3.3: ...
syncing group data: alpine:3.4: ...
syncing group data: alpine:3.5: ...
syncing group data: alpine:3.6: ...
syncing group data: alpine:3.7: ...
syncing group data: alpine:3.8: ...
syncing group data: alpine:3.9: ...
syncing group data: ubuntu:13.04: ...
syncing group data: ubuntu:15.10: ...
syncing group data: alpine:3.10: ...
syncing group data: ubuntu:12.10: ...
syncing group data: ubuntu:18.10: ...
syncing group data: ubuntu:17.04: ...
syncing group data: ol:: ...
syncing group data: ol:: ...
syncing group data: ol:: ...
syncing group data: ol:: ...
syncing group data: ubuntu:19.04: ...
skipping data sync for unsubscribed feed (nvd) ...
skipping data sync for unsubscribed feed (nvdv2) ...
skipping data sync for unsubscribed feed (packages) ...
这步可能只需要十分钟,也可能需要更久,目前没找到什么加速的方法。
添加订阅feed
通过查询anchore feeds --help,我们知道有个sub子命令用于订阅feed。如果想添加nvd订阅:
[root@localhost ~]# anchore feeds sub nvd # 添加nvd feed,可以通过这种方式订阅其它的
nvd: subscribed.
[root@localhost ~]# anchore feeds list # 查看订阅的feeds
Available:
nvdv2:
description: Feed record for type nvdv2
packages:
description: Feed record for type packages
Subscribed:
nvd:
description: Feed record for type nvd # 已经订阅了nvd
vulnerabilities:
description: Feed record for type vulnerabilities [root@localhost ~]# anchore feeds sync # 同步更新
syncing data for subscribed feed (vulnerabilities) ...
skipping group data: debian:unstable: already synced
skipping group data: alpine:3.8: already synced
skipping group data: ubuntu:16.04: already synced
skipping group data: centos:: already synced
skipping group data: centos:: already synced
skipping group data: centos:: already synced
skipping group data: amzn:: already synced
skipping group data: ol:: already synced
skipping group data: centos:: already synced
skipping group data: ubuntu:14.10: already synced
skipping group data: debian:: already synced
skipping group data: debian:: already synced
skipping group data: ubuntu:15.04: already synced
skipping group data: debian:: already synced
skipping group data: debian:: already synced
skipping group data: ubuntu:12.04: already synced
skipping group data: ubuntu:18.04: already synced
skipping group data: ubuntu:17.10: already synced
skipping group data: ubuntu:19.10: already synced
skipping group data: debian:: already synced
skipping group data: ubuntu:16.10: already synced
skipping group data: alpine:3.3: already synced
skipping group data: alpine:3.4: already synced
skipping group data: alpine:3.5: already synced
skipping group data: alpine:3.6: already synced
skipping group data: alpine:3.7: already synced
skipping group data: ubuntu:14.04: already synced
skipping group data: alpine:3.9: already synced
skipping group data: ubuntu:15.10: already synced
skipping group data: alpine:3.10: already synced
skipping group data: ubuntu:12.10: already synced
skipping group data: ubuntu:18.10: already synced
skipping group data: ubuntu:17.04: already synced
skipping group data: ol:: already synced
skipping group data: ol:: already synced
skipping group data: ubuntu:13.04: already synced
skipping group data: ol:: already synced
skipping group data: ubuntu:19.04: already synced
syncing data for subscribed feed (nvd) ... # 同步nvd订阅
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
syncing group data: nvddb:: ...
skipping data sync for unsubscribed feed (nvdv2) ...
skipping data sync for unsubscribed feed (packages) ...
工具测验
先拉取一个镜像:mysql
[root@localhost ~]# docker pull mysql
[root@localhost ~]# docker images # 查看所有镜像列表
REPOSITORY TAG IMAGE ID CREATED SIZE
mysql latest c8ee894bd2bd days ago 456MB
nginx latest 5a9061639d0a days ago 126MB
busybox latest 19485c79a9bb weeks ago .22MB
镜像分析
分析mysql镜像。
[root@localhost ~]# anchore analyze --image mysql
Analyzing image: mysql
c8ee894bd2bd: analyzing ...
c8ee894bd2bd: analyzed.
生成报告
使用gate命令生成分析报告,默认输出到控制台。
gate命令没有看到输出报告格式,我这将输出重定向到mysql.html文件。
[root@localhost ~]# anchore gate --image mysql > mysql.html
查看报告
打开mysql.html报告查看具体内容。
关于命令的详细介绍,请使用--help进行查阅或参考第二个参考链接。感觉目前这款工具还不理想。
参考
Docker 学习入门:https://www.cnblogs.com/chiangchou/p/docker.html
Docker安全自动化扫描工具对比测试:https://blog.csdn.net/wutianxu123/article/details/83216219
以上!
Docker安全扫描工具之Anchore的更多相关文章
- Docker安全扫描工具之DockerScan
前言 本篇简单介绍Docker扫描工具DockerScan的安装使用.下述过程是在CentOS 7.6的虚拟机上进行的. [root@localhost ~]# cat /etc/redhat-rel ...
- Docker安全扫描工具之docker-bench-security
简介 Docker Bench for Security检查关于在生产环境中部署Docker容器的几十个常见最佳实践.这些测试都是自动化的,其灵感来自CIS Docker基准1.2.0版. 这种安全扫 ...
- Trivy 容器镜像扫描工具学习
简介 官方地址:https://github.com/aquasecurity/trivy Trivy是aqua(专注云原生场景下的安全)公司的一款开源工具,之前历史文章也有对aqua的一些介绍. T ...
- 域名扫描工具Fierce
域名扫描工具Fierce 该工具是一个域名扫描综合性工具.它可以快速获取指定域名的DNS服务器,并检查是否存在区域传输(Zone Transfer)漏洞.如果不存在该漏洞,会自动执行暴力破解,以获 ...
- NMAP分布式扫描工具dnmap
NMAP分布式扫描工具dnmap NMAP是一款知名的网络扫描工具.它提供丰富和强大的网络扫描功能.但很多时候,需要渗透测试人员从多个终端发起扫描任务,以快速扫描大型网络,或规避IP限制等安全策略 ...
- Nikto是一款Web安全扫描工具,可以扫描指定主机的web类型,主机名,特定目录,cookie,特定CGI漏洞,XSS漏洞,SQL注入漏洞等,非常强大滴说。。。
Nikto是一款Web安全扫描工具,可以扫描指定主机的web类型,主机名,特定目录,cookie,特定CGI漏洞,XSS漏洞,SQL注入漏洞等,非常强大滴说... root@xi4ojin:~# cd ...
- 网站安全扫描工具--Netsparker的使用
Netsparker是一款安全简单的web应用安全漏电扫描工具.该软件功能非常强大,使用方便.Netsparker与其他综合 性的web应用安全扫描工具相比的一个特点是它能够更好的检测SQL Inje ...
- 小白日记34:kali渗透测试之Web渗透-扫描工具-Burpsuite(二)
扫描工具-Burpsuite 公共模块 0.Spider 爬网 手动爬网 先禁用截断功能 手动将页面中点击所有连接,对提交数据的地方,都进行提交[无论内容] 自动爬网[参数设置] 指定爬网路径,否则其 ...
- 小白日记32:kali渗透测试之Web渗透-扫描工具-QWASP_ZAP
扫描工具-QWASP_ZAP 十大安全工具之一,集成性工具,功能完善,而且强大.既可做主动扫描,也可做截断代理.开源免费跨平台,简单易用,体验相对混乱,但在主动扫描方面,相对占优.[kali集成] # ...
随机推荐
- Git基础用法
从远程仓库拉取代码: git clone https://xxxx.xxx.xx 进入拉取到代码的路径下,(文件夹中含有 .git 隐藏文件夹) 查看当前是否关联到远git代码管理 git statu ...
- JQuery基础之获取和设置标签内容
JQuery基础之获取和设置标签内容方法,如下图: 代码实现: <script src="JS/jquery-1.12.4.min.js"></script> ...
- 在阿里云购买SSL证书,让网站支持HTTPS
SSL简介 引自:https://baike.baidu.com/item/ssl/320778?fr=aladdin SSL SSL(Secure Sockets Layer 安全套接层),及其继任 ...
- libcurl库浅析
先放上libcurl官方文档:链接 第一步:全局初始化 #include <curl/curl.h> CURLcode curl_global_init(long flags ); 在使用 ...
- [TimLinux] JavaScript BOM浏览器对象模型
1. 简介 ECMAScript是JavaScript的核心,但是如果要在WEB中使用JavaScript,那么BOM则无疑才是真的的核心.BOM提供了很多对象,用于访问浏览器的功能,这些功能与任何网 ...
- cf round 598div3 D.Binary String Minimizing
题目:https://codeforces.com/contest/1256/problem/D 题意:给你长度为n的01串,能将任意两相邻字符交换k次,求最小字典序的交换结果. 思路:贪心...甚至 ...
- HDU-1595Find the longest of shortest(最短路径的最长路Dijkstra+记录路径)
Marica is very angry with Mirko because he found a new girlfriend and she seeks revenge.Since she do ...
- 用.NET模拟天体运动
用.NET模拟天体运动 这将是一篇罕见而偏极客的文章. 我上大学时就见过一些模拟太阳系等天体运动的软件和网站,觉得非常酷炫,比如这个(http://www.astronoo.com/en/articl ...
- C#实现在foreach遍历中删除集合中的元素(方法总结)
目录 方法一:采用for循环,并且从尾到头遍历 方法二:使用递归 方法三:通过泛型类实现IEnumerator 在foreach中删除元素时,每一次删除都会导致集合的大小和元素索引值发生变化,从而导致 ...
- Webpack基础知识总结
本文将从多个方面回顾下自己了解的Webpack知识,包括常见的配置项,前端搭建的一些方法和项目实际优化方法,有错误的地方还请指出并多多包涵. 一.关于Webpack 1.概念 本质上,webpack ...