cat <<'EXE'| sudo bash
wget -cq https://github.com/aquasecurity/trivy/releases/download/v0.63.0/trivy_0.63.0_Linux-64bit.tar.gz -P ${HOME}/Downloads
tar -xzf ${HOME}/Downloads/trivy_0.63.0_Linux-64bit.tar.gz -C ${HOME}/Downloads
rm -rf ${HOME}/Downloads/trivy_0.63.0_Linux-64bit.tar.gz
mv ${HOME}/Downloads/trivy /usr/local/bin/
EXE
Trivy » Scan
trivy image haproxy:2.8-alpine
trivy image httpd:2.4-alpine
trivy image nginx:alpine
trivy image nginx:1.27
Trivy » Harbor
cat <<'EXE'| bash
wget -cq https://github.com/goharbor/harbor/releases/download/v2.13.1/harbor-online-installer-v2.13.1.tgz -P ${HOME}/Downloads/
tar -xzf ${HOME}/Downloads/harbor-online-installer-v2.13.1.tgz -C ${HOME}/Downloads/
rsync -az ${HOME}/Downloads/harbor/ ${HOME}/Documents/harbor-playground/
rm -rf ${HOME}/Downloads/harbor-online-installer-v2.13.1.tgz
rm -rf ${HOME}/Downloads/harbor/
EXE
Trivy » Harbor » Internal
cat <<'YML'| tee ${HOME}/Documents/harbor-playground/harbor.yml >/dev/null
---
http:
port: 1980
hostname: localhost
data_volume: ./harbor-data
harbor_admin_password: sadaqah!
database:
password: sadaqah!
max_idle_conns: 10
max_open_conns: 20
conn_max_lifetime: 5m
conn_max_idle_time: 0
trivy:
skip_java_db_update: false
ignore_unfixed: false
security_check: vuln
offline_scan: false
skip_update: false
insecure: false
jobservice:
max_job_workers: 5
max_job_duration_hours: 24
job_loggers:
- STD_OUTPUT
- FILE
logger_sweeper_duration: 1
notification:
webhook_job_max_retry: 3
webhook_job_http_client_timeout: 3
log:
level: warning
local:
rotate_count: 50
rotate_size: 200M
location: /var/log/harbor
upload_purging:
enabled: true
age: 168h
interval: 24h
dryrun: false
cache:
enabled: false
expire_hours: 24
YML
Trivy » Harbor » External
export DOCKER_HOST_IP=host.docker.internal
echo -n 'Password: ';read -s HARBOR_PASSWORD;export HARBOR_PASSWORD;echo
# Password: sadaqah!
|
|
cat <<'SQL'| psql
SELECT usename AS "user" FROM pg_catalog.pg_user WHERE usename LIKE '%harbor%' ORDER BY 1 ASC; -- \du+
SELECT datname as "database" FROM pg_database WHERE datname LIKE '%harbor%' ORDER BY 1 ASC; -- \l+
SQL
|
|
cat <<'DDL'| psql
\! printf '\n'
REVOKE ALL PRIVILEGES ON DATABASE harbor FROM harbor;
DROP OWNED BY harbor;
DROP DATABASE IF EXISTS harbor;
DROP USER IF EXISTS harbor;
DDL
|
cat << DDL | psql
SELECT 'CREATE DATABASE harbor'
WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'harbor')\gexec
CREATE USER harbor WITH ENCRYPTED PASSWORD '${HARBOR_PASSWORD}';
GRANT ALL PRIVILEGES ON DATABASE harbor TO harbor;
ALTER DATABASE harbor OWNER TO harbor;
DDL
|
|
echo -n 'Password: ';read -s PGPASSWORD; export PGPASSWORD; echo
# Password: sadaqah!
psql -p 5432 -U harbor -d harbor -h 10.20.0.1
psql -p 5432 -U harbor -d harbor -h 10.19.83.10
|
|
|
|
|
Trivy » Harbor » Manage
sudo ./install.sh
docker images|grep harbor
sudo docker compose logs -ft
sudo docker compose up -d
sudo docker compose down
Playground
|
|
trivy image haproxy:latest
trivy image httpd:latest
|
trivy image nginx:latest
trivy image php:latest
|
|
redis-cli flushall
redis-cli flushdb
|
|
|
References