本篇簡單介紹一款Docker安全掃描工具Anchore的安裝和使用，
前言
下述程序是在CentOS 7.6的虛擬機上進行的，
[root@localhost ~]# cat /etc/redhat-release CentOS Linux release 7.6.1810 (Core)
Docker安裝
安裝步驟如下：參考Docker 學習入門
# yum remove docker docker-common docker-selinux # 如之前安裝，先卸載# yum install -y yum-utils device-mapper-persistent-data lvm2 # 安裝依賴# yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo # 配置軟體包源# yum install docker-ce -y # 安裝docker# systemctl start docker # 啟動docker服務 # systemctl enable docker # 設定開機啟動# docker -v # 查看docker 版本# docker info # 查看docker詳細資訊
添加dpkg支持
# yum install epel-release -y# yum install dpkg -y安裝Anchore
Anchore安裝使用需python支持，CentOS 7.6默認情況下已有python和pip，可能需要先更新一下pip，
# pip install --upgrade pip
Step1:安裝Anchore
# pip install anchore
Step2:設定環境變數（臨時添加）
# export PATH=~/.local/bin:$PATH
Step3:查看anchore版本
# anchore --version
Step4:查看訂閱串列
[root@localhost ~]# anchore feeds listinitializing feed metadata: ...Available: nvd: description: Feed record for type nvd nvdv2: description: Feed record for type nvdv2 packages: description: Feed record for type packagesSubscribed: vulnerabilities: description: Feed record for type vulnerabilities
默認值訂閱了最后一個，
Step5:同步訂閱內容
[root@localhost ~]# anchore feeds syncsyncing data for subscribed feed (vulnerabilities) ... syncing group data: debian:unstable: ... syncing group data: ubuntu:16.04: ... syncing group data: centos:6: ... syncing group data: centos:7: ... syncing group data: centos:5: ... syncing group data: amzn:2: ... syncing group data: ubuntu:14.04: ... syncing group data: centos:8: ... syncing group data: ubuntu:14.10: ... syncing group data: debian:11: ... syncing group data: debian:10: ... syncing group data: ubuntu:15.04: ... syncing group data: debian:9: ... syncing group data: debian:8: ... syncing group data: ubuntu:12.04: ... syncing group data: ubuntu:18.04: ... syncing group data: ubuntu:17.10: ... syncing group data: ubuntu:19.10: ... syncing group data: debian:7: ... syncing group data: ubuntu:16.10: ... syncing group data: alpine:3.3: ... syncing group data: alpine:3.4: ... syncing group data: alpine:3.5: ... syncing group data: alpine:3.6: ... syncing group data: alpine:3.7: ... syncing group data: alpine:3.8: ... syncing group data: alpine:3.9: ... syncing group data: ubuntu:13.04: ... syncing group data: ubuntu:15.10: ... syncing group data: alpine:3.10: ... syncing group data: ubuntu:12.10: ... syncing group data: ubuntu:18.10: ... syncing group data: ubuntu:17.04: ... syncing group data: ol:8: ... syncing group data: ol:7: ... syncing group data: ol:6: ... syncing group data: ol:5: ... syncing group data: ubuntu:19.04: ...skipping data sync for unsubscribed feed (nvd) ...skipping data sync for unsubscribed feed (nvdv2) ...skipping data sync for unsubscribed feed (packages) ...
這步可能只需要十分鐘，也可能需要更久，目前沒找到什么加速的方法，
添加訂閱feed
通過查詢anchore feeds --help，我們知道有個sub子命令用于訂閱feed，如果想添加nvd訂閱：
[root@localhost ~]# anchore feeds sub nvd # 添加nvd feed，可以通過這種方式訂閱其它的nvd: subscribed.[root@localhost ~]# anchore feeds list # 查看訂閱的feedsAvailable: nvdv2: description: Feed record for type nvdv2 packages: description: Feed record for type packagesSubscribed: nvd: description: Feed record for type nvd # 已經訂閱了nvd vulnerabilities: description: Feed record for type vulnerabilities[root@localhost ~]# anchore feeds sync # 同步更新syncing data for subscribed feed (vulnerabilities) ... skipping group data: debian:unstable: already synced skipping group data: alpine:3.8: already synced skipping group data: ubuntu:16.04: already synced skipping group data: centos:6: already synced skipping group data: centos:7: already synced skipping group data: centos:5: already synced skipping group data: amzn:2: already synced skipping group data: ol:6: already synced skipping group data: centos:8: already synced skipping group data: ubuntu:14.10: already synced skipping group data: debian:11: already synced skipping group data: debian:10: already synced skipping group data: ubuntu:15.04: already synced skipping group data: debian:9: already synced skipping group data: debian:8: already synced skipping group data: ubuntu:12.04: already synced skipping group data: ubuntu:18.04: already synced skipping group data: ubuntu:17.10: already synced skipping group data: ubuntu:19.10: already synced skipping group data: debian:7: already synced skipping group data: ubuntu:16.10: already synced skipping group data: alpine:3.3: already synced skipping group data: alpine:3.4: already synced skipping group data: alpine:3.5: already synced skipping group data: alpine:3.6: already synced skipping group data: alpine:3.7: already synced skipping group data: ubuntu:14.04: already synced skipping group data: alpine:3.9: already synced skipping group data: ubuntu:15.10: already synced skipping group data: alpine:3.10: already synced skipping group data: ubuntu:12.10: already synced skipping group data: ubuntu:18.10: already synced skipping group data: ubuntu:17.04: already synced skipping group data: ol:8: already synced skipping group data: ol:7: already synced skipping group data: ubuntu:13.04: already synced skipping group data: ol:5: already synced skipping group data: ubuntu:19.04: already syncedsyncing data for subscribed feed (nvd) ... # 同步nvd訂閱 syncing group data: nvddb:2007: ... syncing group data: nvddb:2003: ... syncing group data: nvddb:2013: ... syncing group data: nvddb:2012: ... syncing group data: nvddb:2011: ... syncing group data: nvddb:2010: ... syncing group data: nvddb:2017: ... syncing group data: nvddb:2009: ... syncing group data: nvddb:2015: ... syncing group data: nvddb:2014: ... syncing group data: nvddb:2004: ... syncing group data: nvddb:2005: ... syncing group data: nvddb:2006: ... syncing group data: nvddb:2018: ... syncing group data: nvddb:2002: ... syncing group data: nvddb:2019: ... syncing group data: nvddb:2008: ... syncing group data: nvddb:2016: ... skipping data sync for unsubscribed feed (nvdv2) ... skipping data sync for unsubscribed feed (packages) ...
工具測驗
先拉取一個鏡像:mysql
[root@localhost ~]# docker pull mysql[root@localhost ~]# docker images # 查看所有鏡像串列REPOSITORY TAG IMAGE ID CREATED SIZEmysql latest c8ee894bd2bd 5 days ago 456MBnginx latest 5a9061639d0a 5 days ago 126MBbusybox latest 19485c79a9bb 6 weeks ago 1.22MB
鏡像分析
分析mysql鏡像，
[root@localhost ~]# anchore analyze --image mysqlAnalyzing image: mysqlc8ee894bd2bd: analyzing ...c8ee894bd2bd: analyzed.生成報告
使用gate命令生成分析報告，默認輸出到控制臺，
gate命令沒有看到輸出報告格式，我這將輸出重定向到mysql.html檔案，
[root@localhost ~]# anchore gate --image mysql > mysql.html
查看報告
打開mysql.html報告查看具體內容，
關于命令的詳細介紹，請使用--help進行查閱或參考第二個參考鏈接，感覺目前這款工具還不理想，
參考
Docker 學習入門：https://www.cnblogs.com/chiangchou/p/docker.html
Docker安全自動化掃描工具對比測驗：https://blog.csdn.net/wutianxu123/article/details/83216219
以上！
轉載請註明出處，本文鏈接：https://www.uj5u.com/qita/59918.html
標籤：其他
上一篇：存盤器與cpu相連中看不懂的地方
下一篇：嵌入式STM32C8T6