Runecast Analyzer

https://docs.runecast.com
Admin
This project provides the user guide and documentation for Runecast Analyzer, a solution for...
Tokens:48,400
Snippets:677
Trust Score:9
Update:4 months ago
Show doc for...
Tokens:
Raw
### Install Apache and apt-mirror

Source: https://docs.runecast.com/advanced_configuration.html

Installs the necessary packages for setting up a local apt repository mirror. Ensure your system uses aptitude.

```bash
sudo apt update
sudo apt install apache2 apt-mirror

```

--------------------------------

### Example version.txt format

Source: https://docs.runecast.com/advanced_configuration.html

Illustrates the required format for the version.txt file used in custom Runecast update repositories.

```text
appversion=4.1.1.0
defversion=4.1.1.1
defdate=2020-01-16
appdate=2020-01-14

```

--------------------------------

### Install MySQL Server on Ubuntu

Source: https://docs.runecast.com/system_requirements.html?v=251015

This script installs the mysql-server package from public Ubuntu repositories. It requires SSH access to the Runecast VM and assumes the script is located at /opt/runecast/scripts/install_mysql.sh.

```bash
/opt/runecast/scripts/install_mysql.sh
```

--------------------------------

### Install Specific AWS Tools for PowerShell Modules

Source: https://docs.runecast.com/remediation.html?v=251015

Install specific AWS service modules using the AWS.Tools installer. This example installs modules for EC2, S3, Identity Management, RDS, and Redshift.

```powershell
Install-AWSToolsModule -Name AWS.Tools.EC2,AWS.Tools.S3,AWS.Tools.IdentityManagement,AWS.Tools.RDS,AWS.Tools.Redshift
```

--------------------------------

### Example OS Analysis Dataset Snippet

Source: https://docs.runecast.com/operating_systems_analysis.html?v=251015

This JSON snippet shows an example of the data structure returned when exploring the Operating Systems ecosystem via the API. It includes an 'id' and 'viewName'.

```json
{
  "id": 31,
  "viewName": "Operating Systems",
  "ecosystemType": "FLEET",
...
```

--------------------------------

### Ansible Playbook for Runecast OS Agent Installation

Source: https://docs.runecast.com/deployment.html?v=251015

This Ansible playbook automates the installation of the Runecast OS agent on Linux systems. It handles copying and extracting the agent package and then running the installation script.

```yaml
- name: Install Runecast OS agent
  hosts: all
  vars:
    package_name:
      Windows: runecast-osagent-windows-5.8.2.zip
      Linux: runecast-osagent-linux-5.8.2.tar.gz
  gather_facts: true
  tasks:
    - name: Copy and extract installation package (Linux)
      become: true
      when: ansible_system == 'Linux'
      ansible.builtin.unarchive:
        src: "{{ package_name['Linux'] }}"
        dest: /tmp/
        copy: yes
    - name: Create a temporary directory (Windows)
      when: ansible_os_family == 'Windows'    
      ansible.windows.win_tempfile:
        state: directory
      register: win_temp
    - name: Copy installation package (Windows)
      when: ansible_os_family == 'Windows'
      ansible.windows.win_copy:
        src: "{{ package_name['Windows'] }}"
        dest: '{{ win_temp.path }}'
    - name: Extract installation package (Windows)
      when: ansible_os_family == 'Windows'
      community.windows.win_unzip:
        src: '{{ win_temp.path }}\{{ package_name["Windows"] }}'
        dest: '{{ win_temp.path }}'
        delete_archive: yes
    - name: Install and configure OS agent (Linux)
      when: ansible_system == 'Linux'
      become: true
      ansible.builtin.shell:
        cmd: /tmp/{{ package_name['Linux'].split('.tar.gz')[0] }}/install-osagent.sh
    - name: Install and configure OS agent (Windows)
      when: ansible_os_family == 'Windows'
      ansible.windows.win_shell: '{{ win_temp.path }}\{{ package_name["Windows"].split(".zip")[0] }}\install-osagent.ps1'
    - name: Cleanup (Linux)
      when: ansible_system == 'Linux'    
      become: true
      ansible.builtin.file:
        path: /tmp/{{ package_name['Linux'].split('.tar.gz')[0] }}/
        state: absent
    - name: Cleanup (Windows)
      when: ansible_os_family == 'Windows'    
      ansible.windows.win_file:
        path: '{{ win_temp.path }}'
        state: absent
```

--------------------------------

### Windows Group Policy Startup Script Configuration

Source: https://docs.runecast.com/deployment.html?v=251015

This example shows how to configure a PowerShell script to run at startup via Group Policy for deploying the Runecast OS agent on Windows. It involves adding the script to the GPO's startup scripts.

```powershell
install-osagent.ps1
```

--------------------------------

### Restart and Enable Apache

Source: https://docs.runecast.com/advanced_configuration.html

Restarts the Apache web server to apply configuration changes and enables it to start automatically on system boot.

```bash
sudo systemctl restart apache2

```

```bash
sudo systemctl enable apache2

```

--------------------------------

### Ansible Command to Deploy OS Agent to Linux

Source: https://docs.runecast.com/deployment.html

This command executes the Ansible playbook to install the OS agent on a list of Linux hosts. It prompts for the sudo password.

```bash
ansible-playbook --ask-become-pass -i host1,host2,host3 runecast-deploy-osquery-linux.yaml
```

--------------------------------

### Apply Validating Webhook Configuration (In-Cluster Runecast)

Source: https://docs.runecast.com/kubernetes_integration_examples.html?v=251015

Applies a ValidatingWebhookConfiguration for an in-cluster Runecast deployment. This example includes dynamic retrieval of Runecast service details and certificate, assuming the certificate is not trusted by the control plane.

```bash
RUNECAST_NAMESPACE='runecast'
RUNECAST_SERVICE=$(kubectl -n $RUNECAST_NAMESPACE get service -l app.kubernetes.io/name=nginx -o jsonpath='{.items[].metadata.name}')
RUNECAST_SERVICE_PORT=$(kubectl -n $RUNECAST_NAMESPACE get service -l app.kubernetes.io/name=nginx -ojsonpath={.items[].spec.ports[].port})
RUNECAST_SERVICE_CERTIFICATE=$(kubectl -n $RUNECAST_NAMESPACE get pod -l app.kubernetes.io/name=nginx -o jsonpath='{.items[].spec.volumes[?(@.name=="nginx-secret")].secret.secretName}' | xargs kubectl get secret -o jsonpath='{.data.tls\.crt}')

cat << EOF | kubectl apply -f -
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: "runecast-validating-webhook"
webhooks:
- name: "deny-fixed-critical-and-medium.runecast.com"
  rules:
  - apiGroups:   ["*"]
    apiVersions: ["v1"]
    operations:  ["CREATE","UPDATE"]

```

--------------------------------

### Install AWS Tools for PowerShell Installer Module

Source: https://docs.runecast.com/remediation.html?v=251015

Install the modularized version of AWS Tools for PowerShell. This module is used to install other AWS service modules as needed.

```powershell
Find-Module -Name AWS.Tools.Installer
Install-Module -Name AWS.Tools.Installer
```

--------------------------------

### Create Namespace, Service Account, ClusterRole, and Bindings (PowerShell)

Source: https://docs.runecast.com/system_requirements.html

Sets up a Kubernetes environment by creating a namespace, service account, cluster role for API collection, and associated role bindings using PowerShell. Includes token validity configuration.

```powershell
# set the namespace where the service account will be created and the token validity, 8760h = 1 year 
$namespace = 'runecast'
$token_validity = '8760h'

# create the namespace and the service account
kubectl create namespace $namespace
kubectl create serviceaccount runecast-scan -n $namespace

# create the clusterrole (API collection)
kubectl create clusterrole runecast-scan --verb=get,list,watch --resource=nodes,namespaces,pods,replicationcontrollers,serviceaccounts,services,daemonsets.apps,deployments.apps,replicasets.apps,statefulsets.apps,cronjobs.batch,jobs.batch,networkpolicies.networking.k8s.io,clusterrolebindings.rbac.authorization.k8s.io,clusterroles.rbac.authorization.k8s.io,rolebindings.rbac.authorization.k8s.io,roles.rbac.authorization.k8s.io

# bind the clusterrole (API collection)
kubectl create clusterrolebinding runecast-scan --clusterrole=runecast-scan --serviceaccount="$($namespace):runecast-scan"

# create the role (node collection)
kubectl create role runecast-node-collection -n $namespace --verb=create,update,patch,delete --resource=daemonsets.apps

# bind the role (node collection)
kubectl create rolebinding runecast-node-collection -n $namespace --role=runecast-node-collection --serviceaccount=${NAMESPACE}:runecast-scan

# create and output the service account token
kubectl create token runecast-scan --duration=$token_validity -n $namespace
```

--------------------------------

### Create Namespace, Service Account, ClusterRole, and Bindings (Bash)

Source: https://docs.runecast.com/system_requirements.html?v=251015

Sets up a namespace, service account, cluster role for API collection, and binds them. This script is intended for Bash environments.

```bash
# set the namespace where the service account will be created and the token validity, 8760h = 1 year
NAMESPACE='runecast'
TOKEN_VALIDITY='8760h'

# create the namespace and the service account
kubectl create namespace ${NAMESPACE}
kubectl create serviceaccount runecast-scan -n ${NAMESPACE}

# create the clusterrole (API collection)
kubectl create clusterrole runecast-api-collection --verb=get,list,watch --resource=nodes,namespaces,pods,replicationcontrollers,serviceaccounts,services,daemonsets.apps,deployments.apps,replicasets.apps,statefulsets.apps,cronjobs.batch,jobs.batch,networkpolicies.networking.k8s.io,clusterrolebindings.rbac.authorization.k8s.io,clusterroles.rbac.authorization.k8s.io,rolebindings.rbac.authorization.k8s.io,roles.rbac.authorization.k8s.io

# bind the clusterrole (API collection)
kubectl create clusterrolebinding runecast-api-collection --clusterrole=runecast-api-collection --serviceaccount=${NAMESPACE}:runecast-scan

# create the role (node collection)
kubectl create role runecast-node-collection -n ${NAMESPACE} --verb=create,update,patch,delete --resource=daemonsets.apps

# bind the role (node collection)
kubectl create rolebinding runecast-node-collection -n ${NAMESPACE} --role=runecast-node-collection --serviceaccount=${NAMESPACE}:runecast-scan

# create and output the service account token
kubectl create token runecast-scan --duration=${TOKEN_VALIDITY} -n ${NAMESPACE}
```

--------------------------------

### Run apt-mirror Manual Sync

Source: https://docs.runecast.com/advanced_configuration.html

Initiates a manual synchronization of the configured repositories using apt-mirror. This downloads the actual package files.

```bash
sudo -u apt-mirror apt-mirror

```

--------------------------------

### Install and Import VMware PowerCLI Module

Source: https://docs.runecast.com/remediation.html?v=251015

Install and import the VMware PowerCLI module for PowerShell. This is required for executing generated PowerCLI remediation scripts.

```powershell
Find-Module -Name VMware.PowerCLI
Install-Module -Name VMware.PowerCLI -Scope CurrentUser
Import-Module VMware.PowerCLI
```

--------------------------------

### Backup and Configure apt-mirror list

Source: https://docs.runecast.com/advanced_configuration.html

Backs up the current mirror list and configures it to mirror Runecast updates. This ensures you have a restore point and specifies the correct source.

```bash
sudo cp /etc/apt/mirror.list /etc/apt/mirror.list.bak
sudo vi /etc/apt/mirror.list

```

```text
set base_path /var/spool/apt-mirror
set run_postmirror 0
set nthreads 20
set _tilde 0

deb https://updates.runecast.com/runecast-analyzer-vmware /
clean https://updates.runecast.com/runecast-analyzer-vmware

```

--------------------------------

### Configure apt-mirror Sources

Source: https://docs.runecast.com/advanced_configuration.html?v=251015

Sets the base path, disables post-mirror actions, defines the number of threads, and specifies the Runecast repository URL for apt-mirror.

```text
set base_path /var/spool/apt-mirror
set run_postmirror 0
set nthreads 20
set _tilde 0

deb https://updates.runecast.com/runecast-analyzer-vmware /
clean https://updates.runecast.com/runecast-analyzer-vmware

```

--------------------------------

### Ansible Playbook for Runecast OS Agent Installation on Linux

Source: https://docs.runecast.com/deployment.html?v=251015

This Ansible playbook installs the Runecast OS agent on Linux hosts. Ensure the agent package is downloaded and placed in the same directory as this playbook.

```yaml
--- 
- hosts: all
  become: yes
  tasks:
    - name: Install Runecast OS agent
      ansible.builtin.package: 
        name: "{{ playbook_dir }}/runecast-osagent-{{ runecast_version }}.x86_64.rpm"
        state: present
      register: install_result

    - name: Ensure Runecast agent service is started and enabled
      ansible.builtin.systemd: 
        name: runecast-agent
        state: started
        enabled: yes
      when: install_result.changed
```

--------------------------------

### Install AWS CLI Version 2 on Linux

Source: https://docs.runecast.com/remediation.html?v=251015

Download and install AWS CLI version 2 on a Linux system. This is recommended by AWS for new features and is required for executing generated AWS CLI remediation scripts.

```bash
$ curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
$ unzip awscliv2.zip
$ sudo ./aws/install
```

--------------------------------

### Create Directory for Configuration Files

Source: https://docs.runecast.com/kubernetes_integration_examples.html?v=251015

Creates a directory to store authentication configuration files for the Kubernetes API server.

```bash
sudo mkdir /etc/kubernetes/config
```

--------------------------------

### Deploy New Certificate and Key and Restart Service

Source: https://docs.runecast.com/operating_systems_analysis.html?v=251015

Copies the generated server key and certificate to the fleet directory, sets appropriate ownership and permissions, and restarts the fleet service. This step assumes the CA-signed certificate has been obtained and named 'server.crt'.

```bash
sudo cp /tmp/server.key /etc/runecast/fleet
sudo cp /tmp/server.crt /etc/runecast/fleet
sudo chown root:fleet /etc/runecast/fleet/server.key /etc/runecast/fleet/server.crt
sudo chmod 640 /etc/runecast/fleet/server.key /etc/runecast/fleet/server.crt
sudo systemctl restart fleet.service

```

--------------------------------

### Create Admission Configuration File

Source: https://docs.runecast.com/kubernetes_integration_examples.html?v=251015

Creates an admission configuration file that directs the admission controller to use the provided kubeconfig file for authentication.

```bash
echo | cat | sudo tee /etc/kubernetes/config/runecast-admission-configuration.yaml > /dev/null << EOF
apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: ValidatingAdmissionWebhook
  configuration:
    apiVersion: apiserver.config.k8s.io/v1
    kind: WebhookAdmissionConfiguration
    kubeConfigFile: "/etc/kubernetes/config/runecast-validating-webhook-kubeconfig.yaml"
EOF
```

--------------------------------

### Get Current ESXi Syslog Configuration

Source: https://docs.runecast.com/advanced_configuration.html

Retrieve the current syslog configuration on ESXi servers to verify remote host settings.

```bash
esxcli system syslog config get | grep "Remote Host:"

```

--------------------------------

### Create Namespace, Service Account, ClusterRole, and Bindings (PowerShell)

Source: https://docs.runecast.com/system_requirements.html?v=251015

Sets up a namespace, service account, cluster role for API collection, and binds them. This script is intended for PowerShell environments.

```powershell
# set the namespace where the service account will be created
$namespace = 'runecast'

# create the namespace and the service account
kubectl create namespace $namespace
kubectl create serviceaccount runecast-scan -n $namespace

# create the clusterrole (API collection)
kubectl create clusterrole runecast-scan --verb=get,list,watch --resource=nodes,namespaces,pods,replicationcontrollers,serviceaccounts,services,daemonsets.apps,deployments.apps,replicasets.apps,statefulsets.apps,cronjobs.batch,jobs.batch,networkpolicies.networking.k8s.io,podsecuritypolicies.policy,clusterrolebindings.rbac.authorization.k8s.io,clusterroles.rbac.authorization.k8s.io,rolebindings.rbac.authorization.k8s.io,roles.rbac.authorization.k8s.io

# bind the clusterrole (API collection)
kubectl create clusterrolebinding runecast-scan --clusterrole=runecast-scan --serviceaccount="$($namespace):runecast-scan"

# create the role (node collection)
kubectl create role runecast-node-collection -n $namespace --verb=create,update,patch,delete --resource=daemonsets.apps

# bind the role (node collection)
kubectl create rolebinding runecast-node-collection -n $namespace --role=runecast-node-collection --serviceaccount=${NAMESPACE}:runecast-scan

# output the service account token
$secretname = kubectl get serviceaccounts runecast-scan -n $namespace -o json | ConvertFrom-json | % { $_.secrets.name }
$token = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($(kubectl get secret $secretname -n $namespace -o json | ConvertFrom-Json | % { $_.data.token})))
$token | Set-Clipboard
Write-Host "the service account token was copied to clipboard:`n$($token)`n"
```

--------------------------------

### Ansible Command for Linux Deployment

Source: https://docs.runecast.com/deployment.html?v=251015

This command executes the Ansible playbook to install the OS agent on Linux machines. It prompts for the sudo password.

```bash
ansible-playbook --ask-become-pass -i host1,host2,host3 runecast-deploy-osquery-linux.yaml

```

--------------------------------

### Create Namespace, Service Account, ClusterRole, and Bindings (PowerShell)

Source: https://docs.runecast.com/system_requirements.html?v=251015

Sets up a namespace, service account, cluster role for API collection, and binds them. This script is intended for PowerShell environments.

```powershell
# set the namespace where the service account will be created and the token validity, 8760h = 1 year 
$namespace = 'runecast'
$token_validity = '8760h'

# create the namespace and the service account
kubectl create namespace $namespace
kubectl create serviceaccount runecast-scan -n $namespace

# create the clusterrole (API collection)
kubectl create clusterrole runecast-scan --verb=get,list,watch --resource=nodes,namespaces,pods,replicationcontrollers,serviceaccounts,services,daemonsets.apps,deployments.apps,replicasets.apps,statefulsets.apps,cronjobs.batch,jobs.batch,networkpolicies.networking.k8s.io,clusterrolebindings.rbac.authorization.k8s.io,clusterroles.rbac.authorization.k8s.io,rolebindings.rbac.authorization.k8s.io,roles.rbac.authorization.k8s.io

# bind the clusterrole (API collection)
kubectl create clusterrolebinding runecast-scan --clusterrole=runecast-scan --serviceaccount="$($namespace):runecast-scan"

# create the role (node collection)
kubectl create role runecast-node-collection -n $namespace --verb=create,update,patch,delete --resource=daemonsets.apps

# bind the role (node collection)
kubectl create rolebinding runecast-node-collection -n $namespace --role=runecast-node-collection --serviceaccount=${NAMESPACE}:runecast-scan
```

--------------------------------

### Assign Role to NSX-V CLI User

Source: https://docs.runecast.com/system_requirements.html?v=251015

Example of a POST request to assign the 'auditor' privilege to a newly created CLI user in NSX-V Manager.

```JSON
<accessControlEntry>
<role>auditor</role>
<resource>
<resourceId>globalroot-0</resourceId>
</resource>
</accessControlEntry>
```

--------------------------------

### Get Kubernetes API Server Address (Bash)

Source: https://docs.runecast.com/system_requirements.html?v=251015

This script retrieves the API server address for the current Kubernetes context. Ensure kubectl is configured.

```bash
CURRENT_CONTEXT=$(kubectl config view -o jsonpath="{.current-context}")
CURRENT_CLUSTER=$(kubectl config view -o jsonpath="{.contexts[?(@.name=='$CURRENT_CONTEXT')].context.cluster}")
echo $(kubectl config view -o jsonpath="{.clusters[?(@.name=='$CURRENT_CLUSTER')].cluster.server}")
```

--------------------------------

### Backup and Edit apt-mirror Configuration

Source: https://docs.runecast.com/advanced_configuration.html?v=251015

Creates a backup of the apt-mirror configuration file before editing it to specify repository sources.

```bash
sudo cp /etc/apt/mirror.list /etc/apt/mirror.list.bak
sudo vi /etc/apt/mirror.list

```

--------------------------------

### Check Certificate File Permissions

Source: https://docs.runecast.com/advanced_configuration.html

List the permissions of the certificate and key files in the /etc/runecast/cert directory to verify ownership and access rights.

```bash
ls -la /etc/runecast/cert/

```

--------------------------------

### Check Current Definitions Repository

Source: https://docs.runecast.com/advanced_configuration.html

Uses curl to make a GET request to retrieve the current configuration of the definitions update repository from a Runecast Analyzer appliance.

```bash
curl -X GET -H "Authorization: <your API token>" -H 'Accept: application/json;charset=UTF-8' http://<appliance IP>/rc2/api/v1/user-settings/definitions-repository'

```

--------------------------------

### Get Image Scan Results

Source: https://docs.runecast.com/main_menu.html

Retrieves detailed information about a specific image scan using its ID. This includes overall status and per-image scan details.

```APIDOC
## GET /rc2/api/v2/images-scans/{imagesScanId}

### Description
Retrieves detailed results for a previously initiated image scan using its unique `imagesScanId`.

### Method
GET

### Endpoint
`https://<appliance IP>/rc2/api/v2/images-scans/{imagesScanId}`

### Parameters
#### Path Parameters
- **imagesScanId** (integer) - Required - The ID of the image scan to retrieve details for.

### Response
#### Success Response (200)
- Contains detailed information about the overall scan status and specific details for each image scanned.

#### Response Example
(Response structure not explicitly provided in source, but will contain detailed scan information.)
```

--------------------------------

### Create Namespace and Label

Source: https://docs.runecast.com/kubernetes_integration_examples.html?v=251015

Use these kubectl commands to create a new namespace and apply a label to it, which is required for the admission policy to take effect.

```bash
kubectl create namespace runecast-test
kubectl label namespace runecast-test runecast-admission-policy=2
```

--------------------------------

### Configure Apache DocumentRoot

Source: https://docs.runecast.com/advanced_configuration.html

Links the local mirror directory to Apache's web root and configures the default virtual host to serve the mirror content. This makes the mirror accessible over HTTP.

```bash
sudo ln -s /var/spool/apt-mirror/mirror /var/www/html/mirror
sudo vi /etc/apache2/sites-enabled/000-default.conf

```

```text
DocumentRoot /var/www/html/mirror/updates.runecast.com

```

--------------------------------

### Get Kubernetes API Server Address (PowerShell)

Source: https://docs.runecast.com/system_requirements.html?v=251015

This script retrieves the API server address for the current Kubernetes context using PowerShell. Ensure kubectl is configured.

```powershell
$CURRENT_CONTEXT=(kubectl config view -o jsonpath="{.current-context}")
$CURRENT_CLUSTER=(kubectl config view -o jsonpath="{.contexts[?(@.name=='$CURRENT_CONTEXT')].context.cluster}")
Write-Host (kubectl config view -o jsonpath="{.clusters[?(@.name=='$CURRENT_CLUSTER')].cluster.server}")
```
Tokens:
Raw