Preview
This guide is a preview. Its content may change.
Planning 3: Check Your Environment#
For Everyone
Before you register servers, check the OS and network conditions of your target servers, as well as your internal procedures. What you check here determines the scan method you will use in Setup 2: Register Servers and Products.
Six Things to Check#
| # | What to check | What to look for | Where to record it in the Onboarding Preparation Sheet |
|---|---|---|---|
| 1 | Where your servers are | Whether you have on-premises, AWS, Azure, or Google Cloud environments, or closed networks with no internet access | Server locations (C-1) |
| 2 | OS breakdown | Example: "100 RHEL-based, 30 Ubuntu, 50 Windows Server." Approximate numbers are fine. Check the supported operating systems in Supported Environments | OS breakdown (C-2) |
| 3 | What you want to manage besides servers | Network devices, containers, commercial middleware, libraries used in in-house applications, and so on | Targets other than servers (C-3) |
| 4 | Outbound communication | Whether your servers can communicate externally over HTTPS, whether traffic goes through a proxy, and whether the proxy requires authentication | Outbound communication and proxy (C-4, C-5) |
| 5 | Internal procedures | Whether installing software on production servers requires a change management request or prior testing in a staging environment, and if so, how long it takes | Internal procedures (C-7) |
| 6 | Times to avoid scanning | Batch processing windows, the end and start of each month, and so on | Times to avoid scanning (C-8) |
Start Internal Procedures Early#
Item 5, internal procedures, can significantly affect your onboarding schedule. If approval takes several weeks, starting the request as soon as you read this page makes it easier to register your initial scope on time (target: by week 4).
Network Conditions Are a Common Stumbling Block#
The scanner uses outbound HTTPS communication to download the program at installation and to send results every day. In environments that go through a proxy, you need to configure the proxy settings. Before onboarding, confirm which destinations you can reach and whether a proxy is used and requires authentication. The required destinations (hosts and ports) are listed in Service Connectivity Requirements. Failed installations or scans behind a proxy are a common stumbling block during onboarding. Be sure to check this before onboarding.
Questions You May Be Asked in Internal Reviews#
When you install the scanner on production servers, your IT or security department may ask the following questions during their review. Here is a summary of the key points and the pages with more details.
| Question | Key points | Page with details |
|---|---|---|
| Data sent | The scanner sends configuration information, such as the OS type and version and the installed packages. Vulnerability detection is performed on the FutureVuls side | About Scanning |
| Destinations | The server where the scanner is installed communicates with FutureVuls over HTTPS (port 443). The scanner can also be downloaded over HTTP (port 80). In addition, DNS (port 53) and communication with OS repositories and Windows Update (HTTP or HTTPS) are required. For remote scanning, the server where the scanner is installed connects to the target servers over SSH (port 22). FutureVuls does not connect to your servers | Service Connectivity Requirements, Scanner Installation Requirements |
| Required permissions | On Linux, installation requires root privileges. You can choose to run scans with or without root privileges. With root privileges, the scanner can also check for packages that require a restart and running processes. On Windows, you install the scanner from a Command Prompt run as administrator. Scheduled scans run as the SYSTEM user | Scanner Installation |
| What is added to the server | On Linux: a user and group for running the scanner (vuls-saas), files under /opt/vuls-saas, a log directory /var/log/vuls, a sudoers setting (/etc/sudoers.d/vuls-saas), a cron job for scheduled runs, and any required dependency packages. On Windows: files under C:\Program Files\vuls-saas and a Task Scheduler task for scheduled runs |
Scanner Installation |
| Where data is stored | Uploaded configuration information and scan results are stored on AWS in Japan. Some features, such as email delivery, use services outside Japan | Data Storage Location |
| Scanner source code | The scanner is a dedicated program based on the OSS "Vuls," and its source code is publicly available | Vuls (GitHub) |
If you need answers to questions not covered here, such as filling out a security checklist, contact us through the support contact form.
Check Connectivity Before Installing#
Run the following command on the server where you will install the scanner. If it displays 200, the communication required for installation is working. If you get any other value, check your proxy and firewall settings (Scanner Installation Requirements).
curl -o /dev/null -s -w "%{http_code}\n" https://installer.vuls.biz/vuls-installer.sh
Choosing a Scan Method Based on What You Checked#
For servers, answer the following questions from top to bottom to determine which scan method to use.
| Question | If "Yes" | Updates |
|---|---|---|
| 1. The server can connect to the internet, and you can install the scanner on it | Local Scan (start here; you can install it with a single command) | Automatic |
| 2. You can install the scanner on a relay server that can connect to the target servers via SSH | Remote Scan | Automatic |
| 3. The server is an EC2 instance with Amazon Inspector enabled | Inspector integration | Automatic |
| 4. You can prepare an SBOM (software bill of materials) for the server | SBOM import | Manual |
| None of the above apply (closed networks, etc.) | Paste Scan | Manual |
With "Manual" methods, you need to re-register each time the server's configuration changes. Choosing an "Automatic" method whenever possible saves you daily effort.
For the steps for each method, including how to register container images, application libraries, network devices, and so on, go to Setup 2: Register Servers and Products and follow the links to each method's page.
Troubleshooting#
- Not sure about proxy or network conditions: Checking Proxy Environments and Connectivity Requirements
If that doesn't solve the problem, contact us through the support contact form.
Next Page#
Next, prepare your groups and members. Continue to Setup 1: Structure Your Account.