Vulnerability Host Scanner

Prerequisites

• Retrieve your access key to use for SYSDIG_ACCESS_KEY=<your-access-key>
• Check your Sysdig Secure endpoint by region to use for SYSDIG_API_URL=https://<sysdig-url>
• See Host Scanner installation requirements for remaining requirements.
• If you are using an RPM-based operating system, ensure RPM and YUM are installed.

Installation

RPM-Based Operating System

1. Configure the RPM repository and Sysdig GPG key:

   sudo rpm --import https://download.sysdig.com/DRAIOS-GPG-KEY.public
   sudo curl -o /etc/yum.repos.d/draios.repo https://download.sysdig.com/stable/rpm/draios.repo
   

2. Install the vuln-host-scanner package:

   sudo yum install vuln-host-scanner --refresh -y
   

Note: On RHEL/CentOS platforms, use sudo yum clean expire-cache && sudo yum install vuln-host-scanner -y

3. Create the vuln-host-scanner configuration file:

   cat << EOF | sudo tee /opt/draios/etc/vuln-host-scanner/env
   SYSDIG_ACCESS_KEY=<access-key>
   SYSDIG_API_URL=<api-url>
   # optional
   SCAN_ON_START=true
   EOF
   

4. Enable and start the vuln-host-scanner.service service:

   sudo systemctl enable --now vuln-host-scanner.service
   

5. Check logs to see if everything is working as it should:

   sudo journalctl -fu vuln-host-scanner.service
   

Scan for Containers

You can extend the host scanner to scan for containers such as Docker and Podman.

See Container Scanning for details.

For Other Operating Systems and Raw Binary

1. Download the latest version of sysdig-host-scanner with:

   Intel Processor (AMD64)

   curl -LO "https://download.sysdig.com/scanning/bin/sysdig-host-scanner/$(curl -L -s https://download.sysdig.com/scanning/sysdig-host-scanner/latest_version.txt)/linux/amd64/sysdig-host-scanner"
   

   ARM Processor (ARM64)

   curl -LO "https://download.sysdig.com/scanning/bin/sysdig-host-scanner/$(curl -L -s https://download.sysdig.com/scanning/sysdig-host-scanner/latest_version.txt)/linux/arm64/sysdig-host-scanner"
   

2. Optionally, you can check the sha256sum as follows:

   Intel Processor (AMD64)

   sha256sum -c <(curl -sL "https://download.sysdig.com/scanning/bin/sysdig-host-scanner/$(curl -L -s https://download.sysdig.com/scanning/sysdig-host-scanner/latest_version.txt)/linux/amd64/sysdig-host-scanner.sha256")
   

   ARM Processor (ARM64)

   sha256sum -c <(curl -sL "https://download.sysdig.com/scanning/bin/sysdig-host-scanner/$(curl -L -s https://download.sysdig.com/scanning/sysdig-host-scanner/latest_version.txt)/linux/arm64/sysdig-host-scanner.sha256")
   

3. Set the executable flag on the file:

   chmod +x ./sysdig-host-scanner
   

   You only need to download and set the executable once.

4. You can scan the host by running the sysdig-host-scanner command:

   SYSDIG_ACCESS_KEY=<access-key> SYSDIG_API_URL=<api-url> ./sysdig-host-scanner
   

Optionally, create an environment file to store the configuration and a systemd unit file to run the binary as a service:

sudo mv ./sysdig-host-scanner /usr/local/bin/vuln-host-scanner
sudo restorecon -Rv /usr/local/bin/vuln-host-scanner
sudo mkdir -p /opt/draios/etc/vuln-host-scanner/

cat << EOF | sudo tee /opt/draios/etc/vuln-host-scanner/env
SYSDIG_ACCESS_KEY=<access-key>
SYSDIG_API_URL=<api-url>
# optional
SCAN_ON_START=true
EOF

cat << EOF | sudo tee /etc/systemd/system/vuln-host-scanner.service
[Unit]
Description=Sysdig Vuln Host Scanner component

[Service]
EnvironmentFile=/opt/draios/etc/vuln-host-scanner/env
ExecStart=/usr/local/bin/vuln-host-scanner

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable --now vuln-host-scanner.service

Option: Scan for Containers

You can extend the host scanner to scan for containers such as Docker and Podman.

See Container Scanning for details.

Additional Configurations

You can include additional configuration options in the configuration file.

These options are added to /opt/draios/etc/vuln-host-scanner/env:

#required
SYSDIG_ACCESS_KEY=<access-key>

SYSDIG_API_URL=<api-url>

# optional

HOST_DIRS_TO_SCAN=<comma-separated list of directories of the host filesystem that will be analyzed> (Using this will override the default directories) (Default directories - /etc,/var/lib/dpkg,/usr/local,/usr/lib/sysimage/rpm,/var/lib/rpm,/lib/apk/db)

ADDITIONAL_HOST_DIRS_TO_SCAN=<comma-separated list of directories of the host filesystem that will be analyzed in addition to the default ones>

SCAN_ON_START=<true/valse on whether to perform the first analysis immediately after teh service is started rathe than waiting for the schedule> (Default is false)

HTTP_PROXY=<address of proxy>

HTTPS_PROXY=<address of proxy>

NO_PROXY=<comma-separated list of addresses to exclude from the defined proxy>

Kubernetes Metadata

If your node is part of an existing Kubernetes installation and you’re not using the official Helm chart, you’ll be in charge of setting node name and cluster name via:

K8S_CLUSTER_NAME
K8S_NODE_NAME

Next Steps

Install the Agent using a package

Use the Host Scanner in the Sysdig Secure UI