Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add sudo support for prepare #11

Closed
rothgar opened this issue Apr 7, 2016 · 2 comments
Closed

Add sudo support for prepare #11

rothgar opened this issue Apr 7, 2016 · 2 comments

Comments

@rothgar
Copy link

rothgar commented Apr 7, 2016

When configuring a server I have ssh access via my user but package installation requires sudo.

There should be an option to use sudo to the config file to allow a non-root user to prepare the OS.

An example would be

[servers]

[servers.172-31-4-82]
host        = "172.31.4.82"
port        = "22"
user        = "ec2-user"
sudo        = "true"
keyPath     = "/home/ec2-user/.ssh/id_rsa"

There may be some consideration to add a sudo_password option if passwordless sudo ( NOPASSWD ) is not configured. I don't like having passwords in config files so maybe it would just be a pre-requirement of the user installing the packages or have vuls prompt for a sudo password before sshing into a system.

@kotakanbe
Copy link
Member

  • sudo
    Prepare subcommand installs required packages to scan vulnerabilities. (see https://github.com/future-architect/vuls#usage-prepare)
    So, sudo option is needed If your target server's OS is CentOS(yum-plugin-security, yum-plugin-changelog) or Debian(aptitude).
    Ubuntu, RHEL and Amazon Linux are no need to run prepare before scanning.
  • Plain password in config file
    Currently I think there are four options. I am going to implement in the near future :-)
    • -ask-sudo-password option
    • OS environment variable
    • something like aws configure
    • encrypt ( like chef data bag)

@kotakanbe
Copy link
Member

I implement -ask-sudo-password option and -ask-key-password option.
Now, you can avoid to define plain password in config.

see #35

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants