Who should perform security scan:

If you are working on driver code, Vuls and Lynis are needed.

If you are developing container based application code, Vuls, Lynis and Kuber-Hunter are needed.

If you are developing VM based application code, Vuls (testing setup inside each VM) and Lynis (testing setup inside each VM) are needed.  

Vuls scan usually takes around 10 to 20 mins.

Kuber-Hunter usually takes about 10 mins. 

Lynis scan usually takes about 2 mins.    

Vuls

Vuls will be integrated with Blueprint Validation Framework (Bluval User Guide)

Below are the list of tasks for integration. 

Installation

Install Vuls containers (https://vuls.io/docs/en/install-with-docker.html). Vuls containers can be found at: https://hub.docker.com/u/vuls/

• Install go-cve-dictionary, run "docker pull vuls/go-cve-dictionary"
• Install goval-dictionary, run "docker pull vuls/goval-dictionary"
• Install gost, run "docker pull vuls/gost"
• Install vuls, run "docker pull vuls/vuls"

Set up and run

Detailed instruction can be found at https://vuls.io/docs/en/tutorial-docker.html

• Prepare log dir

$ cd /path/to/working/dir

$ mkdir go-cve-dictionary-log goval-dictionary-log gost-log

• Fetch NVD

$ for i in `seq 2002 $(date +"%Y")`; do \ docker run --rm -it \ -v $PWD:/vuls \ -v $PWD/go-cve-dictionary-log:/var/log/vuls \ vuls/go-cve-dictionary fetchnvd -years $i; \ done

• Fetch OVAL

$ docker run --rm -it \ -v $PWD:/vuls \ -v $PWD/goval-dictionary-log:/var/log/vuls \ vuls/goval-dictionary fetch-redhat 5 6 7

• Fetch gost

$ docker run --rm -i \ -v $PWD:/vuls \ -v $PWD/goval-log:/var/log/gost \ vuls/gost fetch redhat

• Config the SUT, configuration will be stored in config.toml
  • SSH key generation & distribution: As Vuls connects to target server through SSH, and Vuls has to use SSH key-based authentication. There needs to be a way to generate SSH key pair, save the private key for Vuls container and dispatch the public key to target server. We probably don’t want to store the private key with the container image if the container image is public accessible.

[servers]

[servers.c74]

host = "54.249.93.16"

port = "22"

user = "vuls-user"

keyPath = "/root/.ssh/id_rsa" # path to ssh private key in docker

• Start Vuls container to run tests
  • $ docker run --rm -it \ -v ~/.ssh:/root/.ssh:ro \ -v $PWD:/vuls \ -v $PWD/vuls-log:/var/log/vuls \ -v /etc/localtime:/etc/localtime:ro \ -e "TZ=Asia/Tokyo" \ vuls/vuls scan \ -config=./config.toml
• Write Bluval configuration file for security tests
• Push test results to LF Nexus
  • Todo: How to tell test success or fail
  • Todo: Sample Test result
• Show test results in Bluval UI

PASS/FAIL Criteria

All High and Medium vulnerabilities detected by Vuls must be patched/fixed.  After patches/fixes are applied Vuls must be run again to verify that the vulnerability is no longer detected.

Exceptions for vulnerabilities must be sent to the security sub-committee.

Lynis

Lynis requires to run on SUT (System Under Test). The overall test framework will the similar to that of Vuls. As to the Lynis installation, there are two options:

1. Lynis is pre-installed on SUT by project team.
2. Lynis is to be installed as part of test flow from Validation Framework. 

Considering the complexity of installing application on target system, it is recommended that option 1 is to be used. 

For more information about Lynis, please check the link below:

https://cisofy.com/documentation/lynis/get-started/

Install and Execute 

If you are using CentOS:

$  yum install lynis; lynis audit system

If you are using Ubuntu:

$ git clone https://github.com/CISOfy/lynis

$ cd lynis; ./lynis audit system

Report

After running, detailed test logs are stored in  /var/log/lynis.log, information for each test includes:

• Time of an action/event
• Reason(s) why a test failed or was skipped
• Output of (internal) tests
• Suggestions about configuration options or how to fix/improve things
• Threat/impact score

In addition to log file, Lynis also creates a report and stores it in /var/log/lynis-report.dat. The report file contains the following information:

• Remarks = #<remark>
• Section = [<section name>]
• Option/value = <option name>=<value of option>

PASS/FAIL Criteria

1. The Lynis Program Update test MUST pass with no errors.

2. The following list of tests MUST complete as passing as described below.

   In the lynis.log outputfile each test suite has one or more individual tests.  The beginning and ending of a test suite is marked with "====".  For example, the 'ID BOOT-5122' test suite should display:

   020-04-08 15:36:28 ====
   2020-04-08 15:36:28 Performing test ID BOOT-5122 (Check for GRUB boot password)
   ...

   2020-04-08 15:36:29 Hardening: assigned maximum number of hardening points for this item (3). 
   2020-04-08 15:36:29 ===

   If any tests in the test suit failed, there would be the following:

   2020-04-08 15:36:29 Suggestion: <Description of failed test>

   Also, the 'Hardening' line show above would not say 'assigned maximum number of hardening points', instead it would say 'assigned partial number of hardening points'.

Kuber-Hunter

PASS/FAIL Criteria

The kube-hunter vulnerabilities listed as 'Yes' in the 'Critical' column MUST be resolved.

Jira tickets tracking integration with Bluval:

https://jira.akraino.org/secure/RapidBoard.jspa?rapidView=5&projectKey=VAL&view=detail&selectedIssue=VAL-79

https://jira.akraino.org/secure/RapidBoard.jspa?rapidView=5&projectKey=VAL&view=detail&selectedIssue=VAL-80