Vuls

Vuls checks the packages installed on a server and tells you which ones have known vulnerabilities. It is open source software that started at Future Architect in Japan, and it can also use JVN, Japan’s vulnerability database.

This review is for people who run their own Linux servers. After reading it, you can do the following:

• Scan your own Linux machine without SSH
• Read the results as a list or in a terminal UI
• Understand how Vuls scans other servers over SSH

##What Vuls is for

The official README describes Vuls this way:

• It tells you which vulnerabilities affect your systems
• It tells you which servers are affected
• It detects vulnerabilities automatically, so nothing gets overlooked
• It can produce reports on a schedule with cron or similar tools

Vuls uses NVD, JVN, and each distribution’s OVAL data, among other sources. The official support table lists Linux distributions such as Ubuntu, Debian, RHEL, AlmaLinux, Rocky Linux, and Amazon Linux, plus FreeBSD, Windows, and macOS as scan targets. Check the table for supported versions.

##Three ways to scan

The official docs describe three scan methods.

Remote scans don’t support SSH password authentication. Set up key-based authentication and add each target’s host key to known_hosts before scanning.

##Try it safely with a local scan

Start with one Linux machine of your own, or a virtual machine you built. A local scan doesn’t connect to other servers, so you can’t hit the wrong target.

1. Follow the official guide to install with vulsctl on the host and run sudo bash install.sh. Read the script before you run it.

2. Fetch the vulnerability databases with update-all.sh. Fetching everything takes a long time, so the docs recommend fetching only what you need.

3. Create config.toml in your home directory with the following content. port = "local" selects local scan mode.

   [servers]
   
   [servers.localhost]
   host = "localhost"
   port = "local"

4. Run vuls configtest to check the configuration and the environment.

5. Run vuls scan to scan.

6. Run vuls report -format-list to see the results.

##Read the results

vuls report has options for the output format. These come from the official tutorial.

Each CVE in the list comes with a CVSS score. Start with the highest scores and consider updating any packages that have fixes available.

##Choose how heavy the scan is

The scanMode setting in config.toml controls the load on the target and the privileges needed.

• fast scans without root privileges and puts almost no load on the target
• fast-root scans with root privileges, also with almost no load
• offline works with fast or fast-root to scan servers that have no internet access

##Cautions

##Read next

• cd ../trivyTrivyscans container images and dependencies for vulnerabilities
• cd ../wazuhWazuhmonitors logs and vulnerabilities through agents
• cat ~/guides/lab-setup.mdHow to set up a safe test lab