Cvechecker - Revision history

Sertonix: replace /etc/init.d with rc-service

2023-11-17T10:09:17Z

replace /etc/init.d with rc-service

← Older revision		Revision as of 10:09, 17 November 2023
Line 60:		Line 60:

	{{Cmd\|apk add mysql mysql-client		{{Cmd\|apk add mysql mysql-client
	~~/etc/init.d/~~mysql setup		rc-service mysql setup
	~~/etc/init.d/~~mysql start && rc-update add mysql default		rc-service mysql start && rc-update add mysql default
	/usr/bin/mysqladmin -u root password 'new-password'}}		/usr/bin/mysqladmin -u root password 'new-password'}}

MaxPeal: update config urls form https://rawgit.com/sjvermeu/cvechecker/master/docs/userguide.html

2021-10-05T14:43:03Z

update config urls form https://rawgit.com/sjvermeu/cvechecker/master/docs/userguide.html

← Older revision		Revision as of 14:43, 5 October 2021
Line 28:		Line 28:
	datadir = "/usr/share/cvechecker";		datadir = "/usr/share/cvechecker";
	stringcmd = "/usr/bin/strings -n 3 '@file@'";		stringcmd = "/usr/bin/strings -n 3 '@file@'";
	version_url = "~~http~~://~~cvechecker~~.~~svn~~.~~sourceforge.net~~/~~viewvc~~/cvechecker/versions.dat";		version_url = "https://raw.github.com/sjvermeu/cvechecker/master/versions.dat";
	#userkey = "servertag";		#userkey = "servertag";
	#		#
Line 102:		Line 102:
	datadir = "/usr/share/cvechecker";		datadir = "/usr/share/cvechecker";
	stringcmd = "/usr/bin/strings -n 3 '@file@'";		stringcmd = "/usr/bin/strings -n 3 '@file@'";
	version_url = "~~http~~://~~cvechecker~~.~~svn~~.~~sourceforge.net~~/~~viewvc~~/cvechecker/versions.dat";		version_url = "https://raw.github.com/sjvermeu/cvechecker/master/versions.dat";
	#userkey = "servertag";		#userkey = "servertag";
	#		#

MaxPeal: http://cvechecker.sourceforge.net is moved to https://github.com/sjvermeu/cvechecker/wiki

2021-10-05T14:37:27Z

http://cvechecker.sourceforge.net is moved to https://github.com/sjvermeu/cvechecker/wiki

← Older revision		Revision as of 14:37, 5 October 2021
Line 1:		Line 1:
	{{Draft}}		{{Draft}}

	[~~http~~://cvechecker~~.sourceforge.net~~ cvechecker] is an useful tool which helps to compare packeges installed in your distribution with the Common Vulnerabilities Exposure. Is not a bullet-proof method and you will most likely have many false positives (vulnerability is fixed with a revision-release, but the tool isn’t able to detect the revision itself), yet it is still better than nothing. The idea is to automatize security check. But, clearly, this is not (and must not be) the only way to check security. With the proper reporting in place, you are immediately warned when a new CVE has been released that might match your system. You can then take the appropriate steps (acknowledge report, verify incident, fix package or mark as false positive).		[https://github.com/sjvermeu/cvechecker/wiki cvechecker] is an useful tool which helps to compare packeges installed in your distribution with the Common Vulnerabilities Exposure. Is not a bullet-proof method and you will most likely have many false positives (vulnerability is fixed with a revision-release, but the tool isn’t able to detect the revision itself), yet it is still better than nothing. The idea is to automatize security check. But, clearly, this is not (and must not be) the only way to check security. With the proper reporting in place, you are immediately warned when a new CVE has been released that might match your system. You can then take the appropriate steps (acknowledge report, verify incident, fix package or mark as false positive).
	Those are the steps:		Those are the steps:
	* pull in the latest CVE entries as well as software/version detection rules (Adminsitrative task only)		* pull in the latest CVE entries as well as software/version detection rules (Adminsitrative task only)

Fab: /* Create Report */

2013-01-08T13:01:17Z

Create Report

← Older revision		Revision as of 13:01, 8 January 2013
Line 209:		Line 209:
	the html generated is pretty ugly, because cvereport.xsl has hard-coded the css file which is stored in /usr/share/cvechecker dir. Filename is report.css		the html generated is pretty ugly, because cvereport.xsl has hard-coded the css file which is stored in /usr/share/cvechecker dir. Filename is report.css
	You can copy the report.css file into $WEBDIR in order to have a nicer html file.		You can copy the report.css file into $WEBDIR in order to have a nicer html file.

	~~That's all. Enjoy Alpine!~~



	[[Category:Monitoring]]		[[Category:Monitoring]]
	[[Category:Security]]		[[Category:Security]]

Fab: /* Using CVEChecker */

2013-01-08T13:00:58Z

Using CVEChecker

← Older revision		Revision as of 13:00, 8 January 2013
Line 130:		Line 130:
	After the db is created, you have to pull the necessary data from the Internet:		After the db is created, you have to pull the necessary data from the Internet:

	pullcves pull		{{Cmd\|pullcves pull}}


	According with the manual, "This will take a very long time, so please be patient (loading over half a million CVE entries in a database is a time consuming - but one-time - activity).		According with the manual, "This will take a very long time, so please be patient (loading over half a million CVE entries in a database is a time consuming - but one-time - activity).
Line 141:		Line 140:
	Insert the following to run pullcves every day at 5:00 AM		Insert the following to run pullcves every day at 5:00 AM

	* 5 * * * /usr/bin/pullcves pull		* 5 * * * /usr/bin/pullcves pull

	Now, make a list of executables file as well as /proc/version and allows cvechecker to verify if there are kernel-related CVE entries for your Linux kernel and software installed.		Now, make a list of executables file as well as /proc/version and allows cvechecker to verify if there are kernel-related CVE entries for your Linux kernel and software installed.

	find / -type f -perm -o+x > /tmp/cvecheck.tmp		{{Cmd\|find / -type f -perm -o+x > /tmp/cvecheck.tmp
	cat /proc/version >> /tmp/cvecheck.tmp		cat /proc/version >> /tmp/cvecheck.tmp}}

	Now, in /tmp/cvecheck.tmp you'll have all the binaries of your system with their version.		Now, in /tmp/cvecheck.tmp you'll have all the binaries of your system with their version.
	Check if there are cve with the following:		Check if there are cve with the following:

	cvechecker -b /tmp/cvecheck.tmp		{{Cmd\|cvechecker -b /tmp/cvecheck.tmp}}

	If you want, you can create a report with the entries (if they are found):		If you want, you can create a report with the entries (if they are found):

	cvechecker -r		{{Cmd\|cvechecker -r}}


	Simple script that helps to do it automatically. Copy and past it, save it as run_cvecheck.sh and give it exec permissions.		Simple script that helps to do it automatically. Copy and past it, save it as run_cvecheck.sh and give it exec permissions.
Line 172:		Line 170:
	rm $tempfile		rm $tempfile

			{{Note\|If you want to send emails, you have to add mailx and configure an smtp server (like ssmtp). But this information goes beyond the purpose of this doc.}}
	~~'''~~Note~~''':~~
	if you want to send ~~email~~, ~~syou~~ have to add mailx and configure an smtp server (like ssmtp). But this information goes beyond the purpose of this doc.

	In order to make the last rows sent via email, you should configure an smtp server. Widely used is ssmtp.		In order to make the last rows sent via email, you should configure an smtp server. Widely used is ssmtp.
			Could be a good idea run this script as cronjob.
	~~Coul~~ be a good idea run this script as cronjob.

	So, you can do the same you did with pullcves: become the cvecheker user and run "crontab -e".		So, you can do the same you did with pullcves: become the cvecheker user and run "crontab -e".

			* 6 * * * /var/cvechecker/run_cvecheck.sh
	* 6 * * * /var/cvechecker/run_cvecheck.sh


	=== Create Report ===		=== Create Report ===

Fab at 12:59, 8 January 2013

2013-01-08T12:59:13Z

← Older revision		Revision as of 12:59, 8 January 2013
Line 1:		Line 1:
	{{Draft}}		{{Draft}}

	~~= How to check Alpine Security with CVEChecker =~~		[http://cvechecker.sourceforge.net cvechecker] is an useful tool which helps to compare packeges installed in your distribution with the Common Vulnerabilities Exposure. Is not a bullet-proof method and you will most likely have many false positives (vulnerability is fixed with a revision-release, but the tool isn’t able to detect the revision itself), yet it is still better than nothing. The idea is to automatize security check. But, clearly, this is not (and must not be) the only way to check security. With the proper reporting in place, you are immediately warned when a new CVE has been released that might match your system. You can then take the appropriate steps (acknowledge report, verify incident, fix package or mark as false positive).
			Those are the steps:
	~~== How Does it works ==~~		* pull in the latest CVE entries as well as software/version detection rules (Adminsitrative task only)
			* generate a list of files to scan
	~~From the homepage of cvechecker:~~ http://cvechecker.sourceforge.net/		* gather installed software/version information
			* output which CVE entries might affect your system
	cvechecker is an useful tool which helps to compare packeges installed in your distribution with the Common Vulnerabilities Exposure.		* generate a report informing you about the CVE entries
	Is not a bullet-proof method and you will most likely have many false positives (vulnerability is fixed with a revision-release, but the tool isn’t able to detect the revision itself),
	yet it is still better than nothing.
	The idea is to automatize security check. But, clearly, this is not (and must not be) the only way to check security.
	With the proper reporting in place, you are immediately warned when a new CVE has been released that might match your system.
	You can then take the appropriate steps (acknowledge report, verify incident, fix package or mark as false positive).
	Those are the steps:
	- pull in the latest CVE entries as well as software/version detection rules (Adminsitrative task only)
	- generate a list of files to scan
	- gather installed software/version information
	- output which CVE entries might affect your system
	- generate a report informing you about the CVE entries


	== Installation ==		== Installation ==

	cvechecker is available in edge main repo. If you are running a stable version of alpine, you can add the package from edge in this way:		cvechecker is available in edge main repo. If you are running a stable version of alpine, you can add the package from edge in this way:

	apk ~~update -X http://rsync.alpinelinux.org/alpine/edge/main && apk add -X http://rsync.alpinelinux.org/alpine/edge/main~~ cvechecker		{{Cmd\|apk install cvechecker}}

	== Configuration with sqlite ==		== Configuration with sqlite ==

	CVEChecker's installation scripts create an user and a group, both called "cvechecker", in order to have a user with minimum privileges to run cvechecker.		CVEChecker's installation scripts create an user and a group, both called "cvechecker", in order to have a user with minimum privileges to run cvechecker.
	In this folder cvechecker will creates the database (according with the cvechecker.conf, we use sqlite3. But also mysql is supported. This could be useful if you want to share only one DB with many routers/servers running Alpine)		In this folder cvechecker will creates the database (according with the cvechecker.conf, we use sqlite3. But also mysql is supported. This could be useful if you want to share only one DB with many routers/servers running Alpine)
Line 64:		Line 50:
	Now, you can initialize the DB with:		Now, you can initialize the DB with:

	cvechecker -i		{{Cmd\|cvechecker -i}}

	DB is ready.		DB is ready.
Line 73:		Line 59:
	MySQL is another backend that cvechecker is able to use. Could be useful if you have several cvechecker installed in your network. In that way, you have only one "repository" of CVEs that needs to be updated.		MySQL is another backend that cvechecker is able to use. Could be useful if you have several cvechecker installed in your network. In that way, you have only one "repository" of CVEs that needs to be updated.

			{{Cmd\|apk add mysql mysql-client
	apk add mysql mysql-client		/etc/init.d/mysql setup
			/etc/init.d/mysql start && rc-update add mysql default
	/etc/init.d/mysql setup		/usr/bin/mysqladmin -u root password 'new-password'}}

	/etc/init.d/mysql start && rc-update add mysql default

	/usr/bin/mysqladmin -u root password 'new-password'

	create a db user for cvechecker:		create a db user for cvechecker:
			{{Cmd\|mysql -u root -p
	mysql -u root -p		mysql>CREATE DATABASE cvechecker;
	mysql>CREATE DATABASE cvechecker;		mysql>CREATE USER 'cvechecker'@'%' IDENTIFIED BY 'cvecheckpass';
	mysql>CREATE USER 'cvechecker'@'%' IDENTIFIED BY 'cvecheckpass';		mysql>GRANT ALL ON cvechecker.* TO 'cvechecker'@'localhost';
	mysql>GRANT ALL ON cvechecker.* TO 'cvechecker'@'localhost';		mysql>GRANT ALL ON cvechecker.* TO 'cvechecker'@'%';
	mysql>GRANT ALL ON cvechecker.* TO 'cvechecker'@'%';		mysql>FLUSH PRIVILEGES;}}
	mysql>FLUSH PRIVILEGES;

	I set % because the DB and the users should allow access from other hosts. You can restrict this to allow only your domain.		I set % because the DB and the users should allow access from other hosts. You can restrict this to allow only your domain.
Line 99:		Line 80:
	Login as cvechecker into mysql:		Login as cvechecker into mysql:

	mysql -D cvechecker -u cvechecker -p		{{Cmd\|mysql -D cvechecker -u cvechecker -p
	mysql>source /usr/share/cvechecker/mysql_cvechecker.sql;		mysql>source /usr/share/cvechecker/mysql_cvechecker.sql;}}

	DB is ready.		DB is ready.
Line 109:		Line 90:
	After you configured the DB, you can create tables with:		After you configured the DB, you can create tables with:

	cvechecker -i		{{Cmd\|cvechecker -i}}

	But in order to make it works, you have to configure DB settings in cvechecker.conf.		But in order to make it works, you have to configure DB settings in cvechecker.conf.

Dubiousjim: add Category:Monitoring

2012-06-01T12:55:38Z

add Category:Monitoring

← Older revision		Revision as of 12:55, 1 June 2012
Line 240:		Line 240:


			[[Category:Monitoring]]
	[[Category:Security]]		[[Category:Security]]

Fcolista at 07:49, 25 May 2012

2012-05-25T07:49:05Z

@@ Line 191: / Line 191: @@
       rm $tempfile
 In order to make the last rows sent via email, you should configure an smtp server. Widely used is ssmtp.
@@ Line 201: / Line 204: @@
       *       6       *       *       *       /var/cvechecker/run_cvecheck.sh
 That's all. Enjoy Alpine!
 [[Category:Security]]

Fcolista at 11:39, 17 May 2012

2012-05-17T11:39:20Z

← Older revision		Revision as of 11:39, 17 May 2012
Line 92:		Line 92:

	I set % because the DB and the users should allow access from other hosts. You can restrict this to allow only your domain.		I set % because the DB and the users should allow access from other hosts. You can restrict this to allow only your domain.

			You have two way to create tables into DB:

			=== Via .sql script ===

	Login as cvechecker into mysql:		Login as cvechecker into mysql:
Line 101:		Line 105:
	Now, we should configure cvechecker to use mysql then populate the DB with cve entries.		Now, we should configure cvechecker to use mysql then populate the DB with cve entries.

			=== Via cvechecker ===

			After you configured the DB, you can create tables with:

			cvechecker -i

			But in order to make it works, you have to configure DB settings in cvechecker.conf.
	According with our settings, /etc/cvechecker.conf would looks like:		According with our settings, /etc/cvechecker.conf would looks like:

Fcolista at 13:49, 16 May 2012

2012-05-16T13:49:49Z

← Older revision		Revision as of 13:49, 16 May 2012
Line 192:		Line 192:

	That's all. Enjoy Alpine!		That's all. Enjoy Alpine!


			[[Category:Security]]