Release v0.15.0 ???

[viengogo-orange]

[kotakanbe]

Hi, @viengogo-orange

I deleted v0.15.0, please let me know if there are any problems.

[viengogo-orange]

With vuls v 0.15.0, I currently try to run vuls-server:
docker run -d --name vuls-server -v $PWD:/vuls -v $PWD/vuls-server-log:/var/log/vuls -v /etc/localtime:/etc/localtime:ro -e "TZ=Europe/Paris" --expose 5515 -p 5515:5515 vuls/vuls server -lang=en -debug -listen=0.0.0.0:5515 -format-json -cvedb-type=http -cvedb-url=http://172.17.0.1:1323 -ovaldb-type=http -ovaldb-url=http://172.17.0.1:1324

but vuls-server is exited :
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
b827c30b951c vuls/vuls "vuls server -lang=e…" 5 seconds ago Exited (2) 4 seconds ago vuls-server

in logs I having :
live@live:~/vuls$ docker logs b827c30b951c
flag provided but not defined: -cvedb-type

Could you help me about this issue ?

[kotakanbe]

Hi, @viengogo-orange

Please define it in config.toml.
https://vuls.io/docs/en/config.toml.html

[fredericg78]

Hi @kotakanbe , we know that it is possible to use a config.toml config file to define [cveDict] and [ovalDict] http type and url, but in our CI/CD chain we do not have this config file (and we don't want to generate it), we juste have parameters in the vuls command to launch vuls in server mode:
docker run -d
--name vuls-server
-v $PWD:/vuls
-v $PWD/vuls-server-log:/var/log/vuls
-v /etc/localtime:/etc/localtime:ro
-e "TZ=Europe/Paris"
--expose 5515
-p 5515:5515
vuls/vuls server
-lang=en
-listen=0.0.0.0:5515
-format-json
-cvedb-type=http
-cvedb-url=http://ip parameter:1323
-ovaldb-type=http
-ovaldb-url=http://other ip parameter:1324

Please could you reintroduce these last four parameters in v0.15.x as it is very convenient to define them directly in the launch command ? Or do you planify to remove them permanently ?

Best regards

[kotakanbe]

Hi, @fredericg78

These parameters can also be set by environment variables.
https://vuls.io/docs/en/config.toml.html#database-section

Updated the manual.
Please try it.

[fredericg78]

Hi @kotakanbe
In version 0.15.6, these env var are not taken into account, tested with vuls container launched with:
docker run -d
--env CVEDB_TYPE='http'
--env CVEDB_URL='http://:1323'
--env OVALDB_TYPE='http'
--env OVALDB_URL='http://:1324'
--name vuls-server
... (other options)

Error: level=error msg="Error loading /vuls/config.toml. err: open /vuls/config.toml: no such file or directory"

However, in the code it seems to be managed.

[kotakanbe]

Hi, @fredericg78

I think you need -v for docker volumes, because it shows that config.toml is not found in log msg.

I tried it, and it worked.

 ✗  ubuntu@dev  ~│g│s│g│f│vuls  ⎇ diff~  docker run --rm -v $PWD:/vuls --env CVEDB_TYPE='http' --env CVEDB_URL='http://:1323' --name vuls-server vuls/vuls server -config=/vuls/config.toml
time="Feb  2 22:32:35" level=info msg="Validating config..." 
time="Feb  2 22:32:35" level=info msg="Validating db config..." 
time="2021-02-02T22:32:35Z" level=info msg="-cvedb-type: http, -cvedb-url: http://:1323, -cvedb-path: /home/ubuntu/go/src/github.com/kotakanbe/go-cve-dictionary/cve.sqlite3"
time="2021-02-02T22:32:35Z" level=info msg="-ovaldb-type: sqlite3, -ovaldb-url: , -ovaldb-path: /home/ubuntu/go/src/github.com/kotakanbe/goval-dictionary/oval.sqlite3"
time="2021-02-02T22:32:35Z" level=info msg="-gostdb-type: sqlite3, -gostdb-url: , -gostdb-path: /vuls/gost.sqlite3"
time="2021-02-02T22:32:35Z" level=info msg="-exploitdb-type: sqlite3, -exploitdb-url: , -exploitdb-path: /home/ubuntu/go/src/github.com/vulsio/go-exploitdb/go-exploitdb.sqlite3"
time="2021-02-02T22:32:35Z" level=info msg="-msfdb-type: sqlite3, -msfdb-url: , -msfdb-path: /home/ubuntu/go/src/github.com/takuzoo3868/go-msfdb/go-msfdb.sqlite3"
time="Feb  2 22:32:35" level=error msg="Run as server mode before reporting: Failed to request to CVE server. url: http://:1323/health, errs: [Get \"http://:1323/health\": dial tcp :1323: connect: connection refused]:\n    github.com/future-architect/vuls/config.(*GoCveDictConf).CheckHTTPHealth\n        /go/src/github.com/future-architect/vuls/config/gocvedictconf.go:70" 

time="2021-02-02T22:32:35Z" level=info msg="-cvedb-type: http, -cvedb-url: http://:1323, -cvedb-path: /home/ubuntu/go/src/github.com/kotakanbe/go-cve-dictionary/cve.sqlite3"

Please refer to vulsctl/server

https://github.com/vulsio/vulsctl/blob/master/docker/server.sh

[fredericg78]

Hi @kotakanbe ,
thanks for your answer. I wished to be able to launch vuls server without any config.toml file if env var are valued, but it is not possible. The trick is to create a void config.toml file and to launch the container with env var, it works.
Best regards.