Getting Started

• 1: Introduction
• 2: Install Vulnman Server
• 3: Configuration
• 4: Updating Vulnman Server
• 5: Issue Tracking

1 - Introduction

What is Vulnman?

Features

More information

This page is just a brief introduction to what Vulnman is all about, and many technical details have been omitted here for the sake of presentation.

• If you're a current or potential Vulnman user, you may want to check out the documentation.
• If you're a developer, there's dedicated developer documentation.
• Need help, or just want to join the conversation? Learn more about help, support, and the community.

2 - Install Vulnman Server

Welcome to the vulnman installation guide! This guide will walk you through the process of installing vulnman.

Install Server

Create User

Since we do not want to run vulnman as root, we create a new user.

useradd -m vulnman

Install Dependencies

Debian

apt install git python3-pip nginx

Get Code

cd /opt
git clone https://github.com/vulnman/vulnman.git
cd vulnman/
chown vulnman:vulnman -R .

Install Requirements

Before we start to deploy vulnman, we need to install some dependencies.

pip install -r requirements.txt

Configure Vulnman

su - vulnman
cd /opt/vulnman
cp local_settings.template.py vulnman/conf/local_settings.py
exit

You may want to read how to configure your installation.

Setup Database (optionally)

This is an optional step, which depends on your setup and configuration. For example, if you plan to use a sqlite database, you do not need to do anything from this section.

PostgreSQL

To Be Done

Initializing Vulnman

In the next step, we need to initialize vulnman.

su - vulnman
cd /opt/vulnman
python manage.py migrate
python manage.py collectstatic
python manage.py createupseruser
exit

Systemd Service

If you want to run the vulnman-server using systemd, you can paste the following content into the /etc/systemd/system/vulnman-server.service file.

[Unit]
Description=vulnman server
After=network.target

[Service]
User=vulnman
Group=vulnman
WorkingDirectory=/opt/vulnman
ExecStart=gunicorn --bind 127.0.0.1:8000 vulnman.wsgi

[Install]
WantedBy=multi-user.target

To enable the service on boot and start the vulnman service, you can use the following commands:

systemctl start vulnman-server
systemctl enable vulnman-server

For the qcluster which is for example used to create the reports, create a file /etc/systemd/system/vulnman-qcluster.service file.

[Unit]
Description=vulnman server
After=network.target

[Service]
User=vulnman
Group=vulnman
WorkingDirectory=/opt/vulnman
ExecStart=python3 manage.py qcluster

[Install]
WantedBy=multi-user.target

systemctl start vulnman-qcluster
systemctl enable vulnman-qcluster

Setup Nginx

Paste the following content into the /etc/nginx/conf.d/vulnman.conf file. You may want to further hardening the TLS configuration, which is not part of this guide.

server {
    listen 80 default_server;
    server_tokens off;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name _;
    server_tokens off;

    ssl_certificate /etc/ssl/yourcert.crt;
    ssl_certificate_key /etc/ssl/yourcertkey.key;

    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header Host $host;
    }
    location /static/ {
        alias /opt/vulnman/static_files/;
    }

    location /uploads/ {
        alias /opt/vulnman/uploads/;
    }

    add_header X-XSS-Protection '1; mode=block';
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header Referer-Policy 'strict-origin';
    add_header X-Frame-Options 'SAMEORIGIN';
    add_header X-Content-Type-Options 'nosniff';
}

Import Default Templates (optionally)

If you want to use our (currently quite small) default templates, run the following command:

su - vulnman
cd /opt/vulnman
python3 manage.py import_vulnerability_templates vulnman_default_templates
exit

3 - Configuration

Have a look at the local_settings.template.py file for a more complete and commented example.

Database

PostgreSQL

DATABASES = {
  'default': {
    'ENGINE': 'django.db.backends.postgresql',
    'HOST': 'db',
    'NAME': 'vulnman',
    'USER': 'vulnman_db_user',
    'PASSWORD': 'dontusethispassword',
  }
}

Mail

EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'
EMAIL_HOST = "smtp.example.com"
EMAIL_PORT = 587
EMAIL_USE_TLS = True
EMAIL_HOST_USER = 'jdoe'
EMAIL_HOST_PASSWORD = 'changme'
DEFAULT_FROM_EMAIL = "jdoe@example.com"

Responsible Disclosure Application

RESPONSIBLE_DISCLOSURE_MAIL_FROM = "responsible-disclosure@example.com"
RESPONSIBLE_DISCLOSURE_VULNERABILITY_ID_PREFIX = "vulnman-"
# Amount of days for the planned publication of the vulnerability details
RESPONSIBLE_DISCLOSURE_PLANNED_PUBLICATION_INTERVAL = 60

# Templates that just provide advisory templates and not a report template
RESPONSIBLE_DISCLOSURE_ADVISORY_TEMPLATES = {
   "myadvisory": "my_ext.advisory.MyAdvisory"
}

4 - Updating Vulnman Server

cd /opt/vulnman
git pull
pip install -r requirements.txt
python3 manage.py migrate
python3 manage.py collectstatic

5 - Issue Tracking

To Be Done