search

vmware-archive / scantron

scan bosh deployments for deployment security issues
Apache License 2.0
12 stars 4 forks source link

Error scanning CF deployment #9

Open cwb124 opened 3 years ago

cwb124 commented 3 years ago

Hi folks,

Hoping to get some quick guidance on getting past a scantron error. I am running it from my opsman VM because that is the only host with access to the non-routable bosh director URL. I am running the following command:

./scantron bosh-scan --director-url https://<BOSH_IP> --bosh-deployment cf-4ed2eab9b54759d10742 --client scantron --client-secret <PASSWORD> --ca-cert /var/tempest/workspaces/default/root_ca_certificate

For seemingly every VM in the CF deployment I see the following:

2020-11-02 22:01:40 INFO Starting VM scan {"job": "diego_cell", "id": "e888d192-cfc1-4a8d-9c63-ad0453a39ef1", "index": "5", "address": ""} 2020-11-02 22:01:40 INFO VM scan complete {"job": "diego_cell", "id": "e888d192-cfc1-4a8d-9c63-ad0453a39ef1", "index": "5", "address": ""} 2020-11-02 22:01:40 ERROR Failed to scan machine: file does not exist {"job": "diego_cell", "id": "e888d192-cfc1-4a8d-9c63-ad045 3a39ef1", "index": "5", "address": ""}

I did see in the doc that it says "The scan expects to be able to reach the BOSH machines directly". How is it attempting that? Is our non-routable architecture prohibiting the scanner from accessing the VMs? The opsman VM I am running the scan from can ping the CF deployment VMs so there is network connectivity. Just not sure what's limiting the access.

Any guidance would be absolutely appreciated. Thanks!

cf-gitbot commented 3 years ago

We have created an issue in Pivotal Tracker to manage this. Unfortunately, the Pivotal Tracker project is private so you may be unable to view the contents of the story.

The labels on this github issue will be updated when the story is started.