Scanner Installation Requirements#

This page explains the scanner installation requirements when the scan target is connected to the internet. For other use cases, please refer to "Scan Method Options and Features".

Server Requirements#

Server Specifications#

During Scanner Installation#

The following storage capacity is required when installing the scanner on a server.

Scanner Type	Size
Linux Scanner	Approx. 120MB
Windows Scanner	Approx. 100MB

During Scan Execution#

There are no specific CPU requirements for scanner operation.

When running a scan on AlmaLinux, AmazonLinux, Fedora Linux, Oracle Linux, RHEL, RockyLinux operating systems, the repoquery command is executed. Depending on your environment, this process may consume memory in the gigabyte range.

When scanning on an applicable OS, please measure the memory consumed by the following command and ensure the same amount of memory is available before executing the scan.

[For Fedora]

OS Condition	Command
Major version is 41 or later, or `dnf` is available	`repoquery --upgrades --qf='%{NAME} %{EPOCH} %{VERSION} %{RELEASE} %{REPONAME}' -q`
Major version is 40 or earlier AND `dnf` is not available	`repoquery --all --pkgnarrow=updates --qf='%{NAME} %{EPOCH} %{VERSION} %{RELEASE} %{REPO}'`

[For Other OSes]

OS Condition	Command
`dnf` is available	`repoquery --upgrades --qf='%{NAME} %{EPOCH} %{VERSION} %{RELEASE} %{REPONAME}' -q`
`dnf` is not available	`repoquery --all --pkgnarrow=updates --qf='%{NAME} %{EPOCH} %{VERSION} %{RELEASE} %{REPO}'`

How to measure memory consumption by repoquery

After executing the command below, open another shell and run the appropriate command from the tables above to measure the memory consumption of repoquery.

while true; do
  date >> ./repoquery.log
  ps aux --sort=-%mem | head -n 10 >> ./repoquery.log
  echo "------------------------" >> ./repoquery.log
  sleep 0.5
done

If you wish to avoid executing repoquery, you can do so by selecting offline as the scan mode. However, please note that some information cannot be acquired in offline mode.

For details on offline mode, please see "Configuring Scanner Behavior > Offline Scan".

[Linux] File and Log Output#

Path	File	Description
`/opt/vuls-saas/`	vuls	Scanner executable
`/opt/vuls-saas/`	vuls-saas.sh	Shell script for scan execution
`/opt/vuls-saas/`	config.toml	Scan configuration file
`/opt/vuls-saas/`	config.toml.bak	Automatic backup of the scan configuration file
`/etc/cron.d/`	vuls-saas	Cron for scan execution
`/opt/vuls-saas/`	vuls-saas.log	Summary of scan.log and report.log
`/opt/vuls-saas/`	scan.log	Latest scan status
`/opt/vuls-saas/`	report.log	Latest file upload status
`/opt/vuls-saas/results/`	/.json ex. 2024-11-19T17-37-32+0900/UserAAA.json	List of packages detected by the scanner. This file is automatically deleted when the file upload process from the scanner to FutureVuls runs.

[Windows] File and Log Output#

Path	File	Description
`C:\Program Files\vuls-saas`	vuls.exe	Scanner executable
`C:\Program Files\vuls-saas`	vuls-saas.bat	Batch file for scan execution
`C:\Program Files\vuls-saas`	config.toml	Scan configuration file
`C:\Program Files\vuls-saas`	config.toml.bak	Automatic backup of the scan configuration file
`Task Scheduler`	vuls-saas-scan	Scan execution schedule
`C:\Program Files\vuls-saas`	batch_config.toml	Proxy settings file
`C:\Program Files\vuls-saas`	vuls-saas.log	Summary of scan.log and report.log
`C:\Program Files\vuls-saas`	scan.log	Latest scan status
`C:\Program Files\vuls-saas`	report.log	Latest file upload status
`C:\Program Files\vuls-saas\results\`	/.json ex. 2024-11-19T17-37-32+0900/UserAAA.json	List of packages detected by the scanner. This file is automatically deleted when the file upload process from the scanner to FutureVuls runs.

Network Requirements#

When downloading and running the scanner, the following communications will occur from your environment.

Purpose	Protocol	Port	Source	Direction	Destination
DNS Query	DNS	53	Scanner installation server Scan target server	Outgoing	DNS server for external address resolution within your system
Installer Download Scanner Program Download	HTTPS	443	Scanner installation server	Outgoing	installer.vuls.biz Required only during scanner installation and updates
Scan Result Upload	HTTPS	443	Scanner installation server	Outgoing	auth.vuls.biz vuls-results-tmp-prd.s3.ap-northeast-1.amazonaws.com
OS Distribution Repository Data Download Only if scan target is Linux	HTTP(S)	80 or 443	Scan target server	Outgoing	Package repository servers provided by each OS distributor
Windows Update Only if scan target is Windows	HTTPS	443	Scan target server	Outgoing	Microsoft Windows Update distribution sites

Communication Requirements for the Entire Service

If you want to know the communication requirements for the entire service, please refer to "Service Communication Requirements".

Notes#

Network Issues and Troubleshooting During Scanner Installation

We cannot provide support for issues that arise during scanner installation due to factors within the user's network environment.
Users are responsible for troubleshooting network-related issues.

DNS Query#

The installer and the scanner program connect to the internet during execution. Standard "DNS queries" are used for name resolution during internet connections. Please verify whether name resolution via DNS query is possible using the following command.

nslookup installer.vuls.biz

If an Address (Addresses) is returned for the Name installer.vuls.biz, then the DNS query is functioning correctly.

[Linux] DNS Query Check Command#

$ nslookup installer.vuls.biz
Server:         x.xx.xxx.xxxx
Address:        x.xx.xxx.xxxx#53
Non-authoritative answer:
Name:   installer.vuls.biz
Address: 3.164.110.24
Name:   installer.vuls.biz
Address: 3.164.110.50
Name:   installer.vuls.biz
Address: 3.164.110.28
Name:   installer.vuls.biz
Address: 3.164.110.23

[Windows] DNS Query Check Command#

Execute the following command in Command Prompt.

$ nslookup installer.vuls.biz
サーバー:  server
Address:  x.xx.xxx.xxxx
権限のない回答:
名前:    installer.vuls.biz
Addresses:  3.164.110.28
          3.164.110.50
          3.164.110.23
          3.164.110.24

Installer and Scanner Program Download#

The "scanner" and "installation script" used by FutureVuls are distributed from the following URL.

https://installer.vuls.biz/

Please use the [Linux] and [Windows] connectivity check commands below to verify whether downloads are possible in your environment. If an internet connection is difficult due to a closed network, please refer to "When the Scan Target is on a Closed Network".

[Linux] Download Connectivity Check Command#

If you execute the following command in the environment where the scanner will be installed and a status code of 200 is returned, the scanner can be installed.

curl -o /dev/null -s -w "%{http_code}\n" https://installer.vuls.biz/vuls-installer.sh

$ curl -o /dev/null -s -w "%{http_code}\n" https://installer.vuls.biz/vuls-installer.sh
200 #Scanner can be installed
$ curl -o /dev/null -s -w "%{http_code}\n" https://installer.vuls.biz/vuls-installer.sh
500 #If not in the 200s, scanner cannot be installed

You can check the contents of the installer script with the following command.

$ curl -s https://installer.vuls.biz/vuls-installer.sh
(omitted)

[Windows] Download Connectivity Check Command#

If you execute the following command in Command Prompt and a status code of 200 is returned, the scanner can be installed.

curl -o NUL -s -w "%{http_code}\n" https://installer.vuls.biz/vuls-installer.sh

$ curl -o NUL -s -w "%{http_code}\n" https://installer.vuls.biz/vuls-installer.sh
200 #Scanner can be installed
$ curl -o NUL -s -w "%{http_code}\n" https://installer.vuls.biz/vuls-installer.sh
500 #If not in the 200s, scanner cannot be installed

You can check the contents of the installer script with the following command.

$ curl -s https://installer.vuls.biz/vuls-installer-v2.bat
(omitted)

Scan Result Upload#

After the scanner acquires asset information, communication and file uploads are made to the following destinations.

https://auth.vuls.biz/
vuls-results-tmp-prd.s3.ap-northeast-1.amazonaws.com

If you receive a response from the commands below, it means that name resolution for auth.vuls.biz/one-time-auth and vuls-results-tmp-prd.s3.ap-northeast-1.amazonaws.com is functioning correctly.

Item	Meaning
`http_code: %{http_code}`	Displays the HTTP status code returned by the server.
`time_namelookup: %{time_namelookup}`	Shows the time taken for DNS name resolution (from request start to DNS resolution completion).
`time_connect: %{time_connect}`	Shows the time taken to establish the TCP connection (from request start to TCP connection completion).
`time_appconnect: %{time_appconnect}`	Shows the time taken for the SSL/TLS handshake (from TCP connection completion to SSL/TLS handshake completion).
`time_pretransfer: %{time_pretransfer}`	Shows the time until the client is ready to send the request to the server (includes TCP connection and SSL/TLS handshake).
`time_starttransfer: %{time_starttransfer}`	Shows the time until the server sends the first byte of data to the client (from sending the request to receiving the first byte of the response).
`time_total: %{time_total}`	Shows the total time from the start of the request to the completion of the response.

[Linux] Upload Connectivity Check Command#

$ curl -X POST https://auth.vuls.biz/one-time-auth -d "test" -w"http_code: %{http_code}\ntime_namelookup: %{time_namelookup}\ntime_connect: %{time_connect}\ntime_appconnect: %{time_appconnect}\ntime_pretransfer: %{time_pretransfer}\ntime_starttransfer: %{time_starttransfer}\ntime_total: %{time_total}\n" -o /dev/null
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100    16  100    12  100     4     56     18 --:--:-- --:--:-- --:--:--    75
http_code: 400
time_namelookup: 0.013480     #DNS name resolution complete
time_connect: 0.020119        #TCP connection complete
time_appconnect: 0.148787     #SSL/TLS handshake complete
time_pretransfer: 0.148951    #Ready to send request
time_starttransfer: 0.212617  #Server sends first response
time_total: 0.212655          #Entire request complete


$ curl -I https://vuls-results-tmp-prd.s3.ap-northeast-1.amazonaws.com   -w "http_code: %{http_code}\ntime_namelookup: %{time_namelookup}\ntime_connect: %{time_connect}\ntime_appconnect: %{time_appconnect}\ntime_pretransfer: %{time_pretransfer}\ntime_starttransfer: %{time_starttransfer}\ntime_total: %{time_total}\n" -o /dev/null
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
http_code: 403
time_namelookup: 0.013480     #DNS name resolution complete
time_connect: 0.020119        #TCP connection complete
time_appconnect: 0.148787     #SSL/TLS handshake complete
time_pretransfer: 0.148951    #Ready to send request
time_starttransfer: 0.212617  #Server sends first response
time_total: 0.212655          #Entire request complete

[Windows] Upload Connectivity Check Command#

$ curl -X POST https://auth.vuls.biz/one-time-auth -d "test" -w "http_code: %{http_code}\ntime_namelookup: %{time_namelookup}\ntime_connect: %{time_connect}\ntime_appconnect: %{time_appconnect}\ntime_pretransfer: %{time_pretransfer}\ntime_starttransfer: %{time_starttransfer}\ntime_total: %{time_total}\n" -o NUL
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100    16  100    12  100     4     58     19 --:--:-- --:--:-- --:--:--    79
http_code: 400
time_namelookup: 0.013773
time_connect: 0.028131
time_appconnect: 0.187459
time_pretransfer: 0.187599
time_starttransfer: 0.204314
time_total: 0.204376

$ curl -I https://vuls-results-tmp-prd.s3.ap-northeast-1.amazonaws.com -w "http_code: %{http_code}\ntime_namelookup: %{time_namelookup}\ntime_connect: %{time_connect}\ntime_appconnect: %{time_appconnect}\ntime_pretransfer: %{time_pretransfer}\ntime_starttransfer: %{time_starttransfer}\ntime_total: %{time_total}\n" -o NUL
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
http_code: 403
time_namelookup: 0.040354
time_connect: 0.058266
time_appconnect: 0.585818
time_pretransfer: 0.585984
time_starttransfer: 0.607664
time_total: 0.607736

[Linux] OS Distribution/Repository Download#

Depending on the OS distribution, a "repository download" may occur when the scanner runs. Please verify whether you can display a list of packages using the dpkg-query or rpm commands below. Note: Supported Environments

Ubuntu-based#

dpkg-query -W -f="\${binary:Package},\${db:Status-Abbrev},\${Version},\${source:Package},\${source:Version}\n"

RedHat-based#

rpm -qa --queryformat "%{NAME} %{EPOCHNUM} %{VERSION} %{RELEASE} %{ARCH} %{MODULARITYLABEL}\n"

[Windows] Windows Update#

During a scan, the Windows scanner communicates with Windows Update (http://update.microsoft.com/microsoftupdate) over the internet. By default, the scanner communicates over the internet, but if you are using a WSUS environment, please refer to "Scanning Windows under WSUS".