Import or update the vulnerability database with Swarm or Podman

This procedure describes how to update the vulnerability database of a Cyberwatch instance deployed in offline mode with Docker Swarm or Podman.

The vulnerability database can be updated from a web browser or from the command line. Browser-based import from a browser is suitable for occasional update of the vulnerability database, while command line import will be more suitable for frequent use as it can be automated.

Prerequisites

The procedure for importing the vulnerability database requires:

a machine connected to the Internet
valid credentials to access the Cyberwatch repository
a Cyberwatch instance up to date deployed in offline mode with Swarm or Podman

From a web browser

This section describes how to retrieve and import the vulnerability database from a web browser. It is suitable for occasional use.

Download the vulnerability database from URL https://dl.cyberwatch.com/download_database. The access is authenticated. The credentials are those sent by Cyberwatch
Log in to the web interface of your Cyberwatch instance with an Administrator account
Go to the admin overview
Click the “upload” button, near the “Security Database” title
Import the previously downloaded database file and click on “Update”

From the command line

This section describes how to retrieve and import the vulnerability database from the command line. It is designed to be automated.

Download the database

Export the Cyberwatch’s credentials (complete the commands):
```
 export CBW_USER=
 export CBW_PASSWORD=
```

Download the vulnerability database:

curl -u "$CBW_USER:$CBW_PASSWORD" \
   -sf https://dl.cyberwatch.com/download_database \
   -o vulnerability_db.zip

(Optional) Verify the integrity of the vulnerability database:

Extract the archive:
```
unzip vulnerability_db.zip
```

Download Cyberwatch’s public key:

curl https://dl.cyberwatch.com/securitydb/cyberwatch.pub -o cyberwatch.pub

Compute the sha256sum of the database:

head -c -1 cyberwatch.db | sha256sum | cut -f1 -d' '| tr -d '\n' > cyberwatch.db.sha256

Verify the signature:

openssl dgst -sha256 -verify cyberwatch.pub -signature cyberwatch.sig cyberwatch.db.sha256

The output of this command must be Verified OK.

Import the archive in Cyberwatch

Import the archive vulnerability_db.zip in the machine where Cyberwatch is deployed
Connect with SSH to the machine where Cyberwatch is deployed
Move the archive .zip to /var/lib/cyberwatch/security_database:
```
mv vulnerability_db.zip /var/lib/cyberwatch/security_database/vulnerability_db.zip
```
With Podman, it’s necessary to give permission access on the archive to the cyberwatch user:
sudo chown cyberwatch:cyberwatch /var/lib/cyberwatch/security_database/vulnerability_db.zip
Restart Cyberwatch:
```
sudo cyberwatch restart
```

Load the vulnerability database:

sudo cyberwatch exec sidekiq_master security_database_import_task

Automate the import using a cron task

It is possible to automate the security database import using a scheduled cron task for example.

The cyberwatch executable allows to execute commands directly in our containers using the command cyberwatch exec. This command is equivalent to the command docker exec -it that can be used to execute a command on a container through an interactive shell.

However, this approach does not work for scripts executed from a crontab, cron not being able to use an interactive shell.

Default use of the cyberwatch exec command in a script called by cron will therefore have no effect.

The solution consists of calling the cyberwatch command in non-interactive mode. The database synchronization command could therefore be:

sudo exec_interactive=false cyberwatch exec sidekiq_master security_database_import_task

Setting up a cron task can be done using the following example, with sudoer rights:

# Open the crontab editor
sudo crontab -e

# To the end of the file, put the following line that launches the import task every day at 8 A.M.
0 8 * * * exec_interactive=false cyberwatch exec sidekiq_master security_database_import_task