Malice issue ubuntu 16.04 #79
Comments
|
does the same thing happen if you use the deb package? https://github.com/maliceio/malice/releases/tag/v0.3.24 |
|
Yep, just installed it, below is the log: malice@malice:~$ malice -D scan eicar.pdf goroutine 1 [running]: |
|
docker : malice@malice:~$ docker ps -a |
|
other people have said the first scan fails because it also tries to create/start the database, but that subsequent scans do work, because the db is already running? |
|
When trying to install/update plugins: malice@malice:~$ malice -D plugin update --all goroutine 1 [running]: |
|
I think it was a bad design decision on my part to have malware create the DBs 🤔 |
haha, what should I do in this scenario now? |
|
can you tell me more about your host? I ran this on an AWS node when I filled the demo.malice.io instance will all of its data |
|
I used debian package and it worked perfectly :( |
It's running ubuntu 16.04 on a KVM based vm, installed docker-engine, followed te following doc to install go & malice using source https://github.com/maliceio/malice/blob/master/docs/installation/linux/install.md then also started elastic search container. |
|
I can give you access to the vm if you need to take a look and issue a fix for future releases? |
|
did you do this step: https://github.com/maliceio/malice#known-issues-warning |
Yes, as soon as I setup the vm lol |
|
Another thing you can do is get elasticsearch running outside of docker/malice, then you can point malice to it with the env var |
I don't think that's gonna work, should I send you the vm credentials via email to take a look in your free time? I'm sure this will help a lot of people out there struggling with the same issue. |
|
I'm going to spin up a vagrantbox for xenial and check real quick |
Perfecto! |
|
Ok so I have a solution... but you are NOT going to like it! 😬 It's a friggin BUG in one of the docker src code dependancies! I was able to recreate your issue and the fix for me was: $ TERM="" malice plugin update clamav |
|
It looks like docker-it-self had the SAME issue and they solved a while back and it fixed it by overriding the dep with another repo since the repo is dead. I copied their solution and cut another release. Can you please test and let me know. That was a VERY embarrassing bug, thank you for pointing that out to me! |
Hey there! Your fix worked wonders, everything is fixed except for the elasticsearch: here are a few outputs: The container was created when I ran malice scan first time: |
|
can you check the elastic logs. please see #80 |
|
Next steps: removed elastic container and redeployed manually: |
|
It might also be that malice isn't giving elasticsearch enough time to start on your machine |
There you go: |
|
whoa I don't understand how you can have so many elastics running at the same time, docker should have complained that you already had something listening on port 9200 ?? |
|
so that looks like it needs your to run I assume if you DID run |
Oh no, take a look again, I kept running ps -a to see when the container dies, check the result of last ps -a (container died after 38 secs of startup): |
|
ah ok, also I think malice expects the container to be called |
Oh crap! I had reinstalled the vm and forgot to update max map count :D |
|
So ya, when the It means you need to run: |
|
Try the vm I sent you, it's not docker |
|
I can see it working on your vm at least the webui. I can update defs in docker but scanning keeps saying Operation not permited? |
|
the VM's cli is working great too! |
|
Did the install go fine on your docker? |
|
you should use your awesome google-fu and tell me why this would be happening: |
|
I can install and add a key AND update the definitions, but not scan?? |
|
Also this: |
|
add to file /etc/sudoers this string: username ALL=NOPASSWD: /opt/kaspersky/kav4fs/bin/kav4fs-control username - name of existing user that you want to use for on demand scan and then $sudo /opt/kaspersky/kav4fs/bin/kav4fs-control --scan-file /my/path/to/testfile.dump.gz |
|
docker is different than a real VM: but I agree that it might be because I am running it all as root in docker |
|
I also know that docker blacklists some types of syscalls and that also might be it? |
|
Yes that could be, also Kaspersky says they do not support docker for ka4fs |
|
guess who has two thumbs and just got kaspersky to work inside docker..... |
THIS GUY 👍 😎 👍 |
|
Holy crap, how did you do it? :D |
|
locale.... the whole friggin reason NOTHING was working..... locale locale locale |
|
Wtfff :o |
I AM THE DOCKER MASTER!!!!!! ✊ |
|
hahahaah no doubt :D |
|
@blacktop your next target should be quick heal Linux version: https://www.seqrite.com/seqrite-for-linux |
|
and trend micro! https://www.trendmicro.com/en_us/business/products/user-protection/sps/endpoint/serverprotect-linux.html Malice will be complete :D |
|
I opened this issue to get those AVs you suggested and this page takes sooooo long to load. 🤣 Issues aren't supposed to get this big!! |
|
Haha this issue will go on and on and on until we have 1000 comments in here :D |
|
[root@***]# docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -e MALICE_VT_API=$MALICE_VT_API malice/engine lookup SOMEHASH immediate retry HELP PLEACE!! |
|
I think you might need to add |
[root@*** ~]# docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -e MALICE_VT_API=$MALICE_VT_API -e ES_JAVA_OPTS="-Xms4g -Xmx4g" --network="host" malice/engine lookup SOMEHASH [root@*** ~]# docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -e MALICE_VT_API=$MALICE_VT_API -e ES_JAVA_OPTS="-Xms4g -Xmx4g" --network="host" malice/engine lookup SOMEHASH [root@*** ~]# docker ps -a :( |
malice@malice:
$ go version$ malice scan eicar.pdfgo version go1.11.2 linux/amd64
malice@malice:
ERRO[0000] database is NOT running, starting now...
panic: runtime error: index out of range
goroutine 1 [running]:
github.com/maliceio/malice/vendor/github.com/Nvveen/Gotty.readTermInfo(0xc000020960, 0x1e, 0x0, 0x0, 0x0)
/Users/blacktop/go/src/github.com/maliceio/malice/vendor/github.com/Nvveen/Gotty/gotty.go:232 +0xcdf
github.com/maliceio/malice/vendor/github.com/Nvveen/Gotty.OpenTermInfo(0xc000020065, 0xe, 0xc000020065, 0xe, 0xc000379790)
/Users/blacktop/go/src/github.com/maliceio/malice/vendor/github.com/Nvveen/Gotty/gotty.go:45 +0x287
github.com/maliceio/malice/vendor/github.com/docker/docker/pkg/jsonmessage.DisplayJSONMessagesStream(0xbbc740, 0xc00005e580, 0xbbc940, 0xc000092008, 0x1, 0x1, 0x0, 0x0, 0x0)
/Users/blacktop/go/src/github.com/maliceio/malice/vendor/github.com/docker/docker/pkg/jsonmessage/jsonmessage.go:225 +0x55c
github.com/maliceio/malice/malice/docker/client/image.Pull(0xc00001c720, 0xc00028b660, 0x18, 0xb0ef8b, 0x6)
/Users/blacktop/go/src/github.com/maliceio/malice/malice/docker/client/image/image.go:43 +0x181
github.com/maliceio/malice/malice/docker/client/container.checkContainerRequirements(0xc00001c720, 0xc00028b620, 0xe, 0xc00028b660, 0x18, 0x0)
/Users/blacktop/go/src/github.com/maliceio/malice/malice/docker/client/container/utils.go:189 +0x92a
github.com/maliceio/malice/malice/docker/client/container.Start(0xc00001c720, 0x0, 0x0, 0x0, 0xc00028b620, 0xe, 0xc00028b660, 0x18, 0x0, 0xc0003d8040, ...)
/Users/blacktop/go/src/github.com/maliceio/malice/malice/docker/client/container/start.go:36 +0xf9
github.com/maliceio/malice/malice/database.Start(0xc00001c720, 0x0, 0x0, 0x0, 0x0, 0xc00028b6a0, 0x15, 0x0, 0x0, 0x0, ...)
/Users/blacktop/go/src/github.com/maliceio/malice/malice/database/database.go:45 +0x273
github.com/maliceio/malice/commands.cmdScan(0x7ffc360d46ce, 0x9, 0x0, 0xc00022b600, 0x0)
/Users/blacktop/go/src/github.com/maliceio/malice/commands/scan.go:62 +0xe26
github.com/maliceio/malice/commands.glob..func1(0xc0000aac60, 0x0, 0xc0000aac60)
/Users/blacktop/go/src/github.com/maliceio/malice/commands/commands.go:25 +0x88
github.com/maliceio/malice/vendor/github.com/urfave/cli.HandleAction(0xa10320, 0xb37b88, 0xc0000aac60, 0xc00022b600, 0x0)
/Users/blacktop/go/src/github.com/maliceio/malice/vendor/github.com/urfave/cli/app.go:490 +0xc8
github.com/maliceio/malice/vendor/github.com/urfave/cli.Command.Run(0xb0e2b0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb1188e, 0xb, 0x0, ...)
/Users/blacktop/go/src/github.com/maliceio/malice/vendor/github.com/urfave/cli/command.go:210 +0x990
github.com/maliceio/malice/vendor/github.com/urfave/cli.(*App).Run(0xc0000a5380, 0xc000086060, 0x3, 0x3, 0x0, 0x0)
/Users/blacktop/go/src/github.com/maliceio/malice/vendor/github.com/urfave/cli/app.go:255 +0x687
main.main()
/Users/blacktop/go/src/github.com/maliceio/malice/main.go:88 +0x4b2
I tried with multiple GO versions but nothing, any ideas?
Regards,
The text was updated successfully, but these errors were encountered: