eliasgranderubio / dagda

a tool to perform static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in docker images/containers and to monitor the docker daemon and running docker containers for detecting anomalous activities
Apache License 2.0
1.15k stars 160 forks source link

failed to strat dagda #29

Closed CaosFR closed 6 years ago

CaosFR commented 6 years ago

Short description

I was trying to strat dagda with this command "python3 dagda.py start" but nothing happen (no error to). If I aviod this step and try "python3 dagda.py vuln --init" I have a newConnectionError .

Reproduction steps

  1. Installation of Docker
  2. Installation of MongoDB
  3. Installation of kernel headers in the host OS
  4. sudo pip3 install -r requirements.txt
  5. Avoid Syslog as your Docker Logging Driver
  6. sudo service mongod | falco | docker start
  7. python3 dagda.py start => nothing happen after more than one hours
  8. CTRL+C => no error
  9. export DAGDA_HOST='127.0.0.1'
  10. export DAGDA_PORT=5000
  11. python3 dagda.py vuln --init => <HTTPConnectionPool(host='127.0.0.1', port=5000): Max retries exceeded with url: /v1/vuln/init (Caused by NewConnectionError('<requests.packages.urllib3.connection.HTTPConnection object at 0x7fdcc67a9e10>: Failed to establish a new connection: [Errno 111] Connection refused',))> root@debian:~/dagda-master/dagda#

On which platforms did you notice this:

TY for your help ! :)

eliasgranderubio commented 6 years ago

Hi @CaosFR ,

When you type python3 dagda.py start, you will check that four processes are started. Type ps -ef for checking it:

Without shutdown the server (don't type "CTRL+C") from another terminal, you can run python3 dagda.py vuln --init for initializing the database. In this case, you must not get the "[Errno 111] Connection refused".

Please, check it and update me with more details if error persists.

CaosFR commented 6 years ago

TY for your reply and very sorry for my late response.

When I had type "type python3 dagda.py start" ans I had type "ps -ef" in other terminal I see something like that :

[...} root 13319 2 0 13:48 ? 00:00:00 [kworker/2:2] root 13453 12128 13 13:48 pts/0 00:00:00 python3 dagda.py start root 13457 13453 0 13:49 pts/0 00:00:00 python3 dagda.py start root 13458 13453 1 13:49 pts/0 00:00:00 python3 dagda.py start root 13459 13453 2 13:49 pts/0 00:00:00 python3 dagda.py start root 13479 1014 0 13:49 ? 00:00:00 docker-containerd-shim -namesp root 13494 13479 0 13:49 ? 00:00:00 /usr/bin/falco root 13555 12867 0 13:49 pts/1 00:00:00 ps -ef [...]

Docker events daemon monitor (docker-containerd-shim -namesp), Sysdig/Falco monitor (/usr/bin/falco) and Dagda web server (python3 dagda.py start) look strat but I dont see EDN listener. I have to install them ?

Without shutdown the server, I had run python3 dagda.py vuln --init form another terminal. I dont get " "[Errno 111] Connection refused"." (nice). This time I get this message very quickly:

{ "msg": "Accepted the init db request" }

It look good but the server dont start and the db dont look like populate. If I type command like "python3 dagda.py vuln --cve_info CVE-2009-2890" I had this message :

{ "err": 404, "msg": "CVE not found" }

TY for your help ! :)

eliasgranderubio commented 6 years ago

Dagda server runs four processes:

EDN listener and Dagda web server processes are Dagda internal features. The other processes watching /usr/bin/falco process and docker-containerd-shim process.

On other hand, python3 dagda.py vuln --init is not a syncronized method, I mean, only the update process is started. You can see if that process has finished with python3 dagda.py vuln --init_status and getting "Updated" state.

CaosFR commented 6 years ago

Oh I see, so my DAGDA strat correctly.

I have try type "python3 dagda.py vuln --init_status" and I get "Initializing". After more than one hours the state dont change. :[

My network work as well. I'm a bit lost now.

TY

eliasgranderubio commented 6 years ago

Step 1. Start Dagda server --> python3 dagda.py start

Step 2. Run init database process --> python3 dagda.py vuln --init

Step 3. Check init database process until it ends --> python3 dagda.py vuln --init_status

eliasgranderubio commented 6 years ago

This issue has not updated for a long time so I close it.

If you can update de information about this issue feel free for reopening it.