网络安全应用安全云原生漏洞扫描【免费下载链接】ThreatMapperOpen Source Cloud Native Application Protection Platform (CNAPP)项目地址https://gitcode.com/gh_mirrors/th/ThreatMapper点击查看免费下载本篇技术指南聚焦 ThreatMapper开源云原生应用保护平台 CNAPP在Linux 裸机bare-metal与虚拟机VM工作负载上的传感器部署方式以 Linux 二进制而非容器镜像形态安装 ThreatMapper Sensor Agent并通过 systemd 将其注册为常驻守护服务。读完本文你将掌握完整的安装脚本逐段解析、管理控制台 API Key 的获取、底层“认证换取下载地址”的调用链、日志查看与彻底卸载的实操方法并能借助仓库源码理解每个环节的真实实现。部署形态为什么选择 Linux 二进制方式从架构文档 sensors.md 可以看出ThreatMapper 的传感器Sensor Agent按运行环境分为多种部署形态Kubernetes以 DaemonSet 形式随集群调度部署Docker在每个 Docker 主机上以容器形式运行裸机与虚拟机Bare metal / VM在每个 Linux 操作系统实例上以守护服务方式运行——即本文介绍的Linux 二进制部署AWS Fargate以守护进程方式伴随每个 Serverless 实例运行。官方支持 Linux 实例Windows Server 不被支持仅有实验性实现。因此对于不使用容器运行时托管传感器的裸金属或虚拟机ThreatMapper 提供install_deepfence.sh一键安装脚本将传感器二进制下载到/opt/deepfence并注册为deepfence-agent.service系统服务。需要说明原文档要求先在 Linux 主机上安装 Docker runtime参考 传感器前置条件 中的支持平台说明。这是因为传感器在保护容器工作负载时需要访问 Docker API——从容器形态的部署脚本 start-agent.sh 可以看到-v /var/run/docker.sock:/var/run/docker.sock挂载且 start_deepfence_agent.sh 在DF_PROXY_MODE1时会调用run_dind.sh启动容器内 Docker依赖宿主机 Docker runtime。前置准备管理控制台地址与 API Key安装前需要准备两个关键参数MGMT_CONSOLE_URLDeepfence 管理控制台的地址可以是域名如threatmapper.customer.com或 IP如65.65.65.65DEEPFENCE_KEYDeepfence API Key。在管理控制台界面中通过Setting User Management API Key路径创建并获取。从源码看这个 API Key 并非直接用于下载而是先通过管理控制台换取短期访问令牌access token详见下文“底层原理”一节。安装脚本全解将以下脚本完整复制并保存为install_deepfence.sh#!/bin/bash # MGMT_CONSOLE_URL: Example: threatmapper.customer.com or 65.65.65.65 export MGMT_CONSOLE_URL${MGMT_CONSOLE_URL} export DEEPFENCE_KEY${DEEPFENCE_KEY} if [[ -z $MGMT_CONSOLE_URL ]]; then echo env MGMT_CONSOLE_URL is not set exit 1 fi if [[ -z $DEEPFENCE_KEY ]]; then echo env DEEPFENCE_KEY is not set exit 1 fi export MGMT_CONSOLE_PORT443 export MGMT_CONSOLE_URL_SCHEMAhttps export DF_HOSTNAME$(hostname) export DF_LOG_LEVELinfo MANAGEMENT_CONSOLE_URL$MGMT_CONSOLE_URL_SCHEMA://$MGMT_CONSOLE_URL:$MGMT_CONSOLE_PORT OS_ID$(grep -oP (?^ID). /etc/os-release | tr -d ) if [[ $OS_ID amzn || $OS_ID centos ]]; then # Do necessary installs for Amazon Linux yum -y install logrotate jq curl if [[ $? ! 0 ]]; then echo Failed to install logrotate exit 1 fi else # Do necessary installs for Ubuntu apt-get -y install logrotate jq curl if [[ $? ! 0 ]]; then echo Failed to install logrotate exit 1 fi fi access_token_response$(curl -m 5 -s -k $MANAGEMENT_CONSOLE_URL/deepfence/auth/token \ --header Content-Type: application/json \ --data {\api_token\: \$DEEPFENCE_KEY\}) if [[ $access_token_response ]]; then echo Failed to connect to the management console exit 1 fi access_token$(jq -r .access_token $access_token_response) if [[ $access_token || $access_token null ]]; then echo Failed to authenticate echo $access_token_response exit 1 fi download_url_response$(curl -m 5 -s -k $MANAGEMENT_CONSOLE_URL/deepfence/agent-deployment/binary/download-url \ --header Authorization: Bearer $access_token) if [[ $download_url_response ]]; then echo Failed to get agent binary download url exit 1 fi start_agent_script_download_url$(jq -r .start_agent_script_download_url $download_url_response) if [[ $start_agent_script_download_url ]]; then echo Failed to get agent binary download url echo $download_url_response exit 1 fi cat EOF uninstall_deepfence.sh #!/bin/bash systemctl stop deepfence-agent.service systemctl disable deepfence-agent.service rm -f /etc/systemd/system/deepfence-agent.service rm -rf /opt/deepfence EOF echo Uninstalling existing Deepfence agent installation, if any chmod x uninstall_deepfence.sh bash uninstall_deepfence.sh if [[ ! -d /opt/deepfence ]]; then mkdir -p /opt/deepfence /opt/deepfence/var/log/ fi architecture case $(uname -m) in i386) architecture386 ;; i686) architecture386 ;; x86_64) architectureamd64 ;; arm) dpkg --print-architecture | grep -q arm64 architecturearm64 || architecturearm ;; aarch64) architecturearm64 ;; esac echo Detected architecture: $architecture agent_binary_download_url$(jq -r --arg architecture agent_binary_${architecture}_download_url .[$architecture] $download_url_response) agent_binary_filename$(basename $agent_binary_download_url) agent_binary_filename$(cut -f1 -d? $agent_binary_filename) if [[ $agent_binary_download_url || $agent_binary_filename ]]; then echo Failed to get agent binary download url echo $download_url_response exit 1 fi echo Downloading agent binary from $agent_binary_download_url to /opt/deepfence/$agent_binary_filename curl -k -o /opt/deepfence/$agent_binary_filename $agent_binary_download_url curl -k -o /opt/deepfence/start_deepfence_agent.sh $start_agent_script_download_url chmod x /opt/deepfence/start_deepfence_agent.sh tar -xzf /opt/deepfence/$agent_binary_filename -C /opt/deepfence/ echo MGMT_CONSOLE_URL: $MGMT_CONSOLE_URL echo MGMT_CONSOLE_PORT: $MGMT_CONSOLE_PORT echo DF_HOSTNAME: $DF_HOSTNAME echo Installing Deepfence agent as daemon service cat EOF /etc/systemd/system/deepfence-agent.service [Unit] DescriptionDeepfence Agent Service Afternetwork.target [Service] EnvironmentMGMT_CONSOLE_URL$MGMT_CONSOLE_URL EnvironmentDEEPFENCE_KEY$DEEPFENCE_KEY EnvironmentMGMT_CONSOLE_PORT$MGMT_CONSOLE_PORT EnvironmentMGMT_CONSOLE_URL_SCHEMA$MGMT_CONSOLE_URL_SCHEMA EnvironmentDF_HOSTNAME$(hostname) EnvironmentDF_LOG_LEVEL$DF_LOG_LEVEL Userroot Grouproot Restarton-failure Typeforking ExecStart/opt/deepfence/start_deepfence_agent.sh WorkingDirectory/opt/deepfence [Install] WantedBymulti-user.target EOF systemctl daemon-reload systemctl enable deepfence-agent.service systemctl start deepfence-agent.service systemctl status deepfence-agent.service设置管理控制台 URL 与 Deepfence Key 后以 root 权限执行sudo bash install_deepfence.sh脚本关键参数说明环境变量含义默认值/取值MGMT_CONSOLE_URL管理控制台域名或 IP必填如threatmapper.customer.comDEEPFENCE_KEY管理控制台 API Key必填在SettingUser ManagementAPI Key生成MGMT_CONSOLE_PORT管理控制台端口443MGMT_CONSOLE_URL_SCHEMA通信协议httpsDF_HOSTNAME传感器在控制台展示的主机名默认取hostname命令输出DF_LOG_LEVEL传感器日志级别info可参考 start-agent.sh 注释取debug/info/error脚本执行流程逐步拆解环境校验检查MGMT_CONSOLE_URL与DEEPFENCE_KEY是否设置未设置即报错退出系统依赖安装读取/etc/os-release的ID字段区分发行版——amzn/centos使用yum其余如 Ubuntu使用apt-get统一安装logrotate、jq、curl三个工具换取访问令牌调用管理控制台的/deepfence/auth/token接口携带 API Key用jq提取access_token获取下载地址携带 Bearer Token 调用/deepfence/agent-deployment/binary/download-url接口得到传感器启动脚本与各架构二进制的下载 URL清理旧安装动态生成uninstall_deepfence.sh停服务、删 systemd 单元、删/opt/deepfence先执行一次以保证环境干净架构检测与下载通过uname -m识别386/amd64/arm/arm64按agent_binary_架构_download_url字段下载对应二进制tar.gz并解压到/opt/deepfence同时下载start_deepfence_agent.sh启动脚本注册 systemd 服务写入/etc/systemd/system/deepfence-agent.servicedaemon-reload后enable、start并以systemctl status展示服务状态。底层原理认证与下载链路源码印证安装脚本中的两步 HTTP 调用在管理控制台deepfence_server侧均有对应实现1./deepfence/auth/tokenAPI Key 换取访问令牌路由定义于 router.gor.Post(/auth/token, dfHandler.APIAuthHandler)属于公开 API无需登录即可调用因为请求本身携带 API Key 凭据。处理函数 APIAuthHandler 的实现要点对请求体中的api_token做 Base64 原始解码将 Token 按:拆分前半部分是命名空间namespace后半部分是 UUID据此确定租户上下文并到 PostgreSQL 中查询对应的用户与 API Token 记录校验通过后调用user.GetAccessToken(...)签发 JWT 访问令牌并作为access_token字段返回——这正是脚本中jq -r .access_token取值的来源。2./deepfence/agent-deployment/binary/download-url下发下载地址路由定义于 router.gor.Route(/agent-deployment, ...)下的GET /binary/download-url需携带 Bearer Token 访问。处理函数 getAgentBinaryDownloadURL 的核心逻辑通过directory.FileServerClient获取文件服务器客户端调用ExposeFile为每个文件生成带签名、24 小时有效期getAgentBinaryDownloadURLExpiry 24 * time.Hour见 settings.go的临时下载 URL下发 4 个下载地址对应返回模型 GetAgentBinaryDownloadURLResponse 的 JSON 字段JSON 字段内容文件名约定start_agent_script_download_url传感器启动脚本start_deepfence_agent.shuninstall_agent_script_download_url卸载脚本uninstall_deepfence_agent.shagent_binary_amd64_download_urlamd64 架构二进制deepfence-agent-amd64-版本.tar.gzagent_binary_arm64_download_urlarm64 架构二进制deepfence-agent-arm64-版本.tar.gz二进制文件存放于文件服务器的agent-binary路径常量FileServerPathAgentBinary agent-binary见 constants.go。脚本中使用jq -r --arg architecture agent_binary_${architecture}_download_url .[$architecture]动态按检测到的架构取值即是对应上述字段的 amd64/arm64 分支。3. 二进制包的内容从构建侧脚本 copy-bin-from-agent.sh 可以看出发布到文件服务器的 tar.gz 是一个自包含的传感器运行目录包含bin/下的deepfenced主守护进程以及面向 arm64 用 busybox 软链出的cat、chmod、cp、gzip、tar等基础工具保证最小化系统也能运行home/、opt/、usr/bin/、usr/local/bin/等目录下的辅助二进制与配置如扫描插件、发现脚本etc/下的filebeat证书、logrotate.d轮转配置、supervisor配置。启动脚本与 systemd 服务剖析安装脚本生成的 deepfence-agent.service 单元使用Typeforking与ExecStart/opt/deepfence/start_deepfence_agent.sh以 root 身份运行Restarton-failure保证失败自动重启并将管理控制台地址、Key、端口、主机名、日志级别等以Environment注入。启动脚本start_deepfence_agent.sh仓库维护版位于 binary-install-scripts/start_deepfence_agent.sh在启动时完成的关键工作环境路径初始化设置DF_BASE_DIR/opt/deepfence默认主机名SCOPE_HOSTNAME$(hostname)若启用INSTANCE_ID_SUFFIXY还会调用getCloudInstanceId将云实例 ID 追加为后缀用于区分同名主机安装目录编排将二进制包解压后的内容拷贝到$DF_INSTALL_DIR/df-agents/$SCOPE_HOSTNAME并把bin、usr/local/bin等加入PATHcgroup 资源控制调用create-cgroups.sh创建 cgroup 以便对传感器做资源限制日志轮转配置通过 cron 每 5 分钟执行一次logrotate对应脚本中安装logrotate依赖的原因轮转配置文件见 fenced_logrotate.confFluent Bit 配置注入用envsubst将DEEPFENCE_KEY、MGMT_CONSOLE_URL、MGMT_CONSOLE_PORT、MGMT_CONSOLE_URL_SCHEMA、SCOPE_HOSTNAME、DF_INSTALL_DIR写入td-agent-bit配置文件用于日志采集上报拉起主进程调用start_deepfenced.sh见 start_deepfenced.sh——该脚本是一个while true循环以ulimit -l unlimited运行/opt/deepfence/bin/deepfenced日志写入$DF_INSTALL_DIR/var/log/supervisor/deepfenced.log进程异常退出 5 秒后自动重启与 systemd 的Restarton-failure形成双重保障。查看日志服务由 systemd 托管可通过journalctl查看服务日志sudo journalctl -u deepfence-agent.service若需跟踪传感器主进程运行日志可查看启动脚本输出的deepfenced.logsudo tail -f /opt/deepfence/df-agents/$(hostname)/var/log/supervisor/deepfenced.log各扫描子任务恶意软件扫描、密钥扫描、合规扫描的日志目录在启动脚本中预创建于$DF_INSTALL_DIR/var/log/fenced/下分别对应malware-scan、malware-scan-log、secret-scan、secret-scan-log、compliance、compliance-scan-logs等子目录。卸载传感器如需彻底移除 ThreatMapper 传感器依次执行sudo systemctl stop deepfence-agent.service sudo systemctl disable deepfence-agent.service sudo rm -f /etc/systemd/system/deepfence-agent.service sudo rm -rf /opt/deepfence执行完毕后管理控制台拓扑中该主机将随心跳超时不再显示。仓库还维护了一个更“激进”的卸载脚本 uninstall_deepfence_agent.sh它会先按进程名df-agent强制结束残留进程再删除/opt/deepfence适用于进程未被 systemd 正常回收的异常场景。常见问题与排查建议env MGMT_CONSOLE_URL is not set执行脚本前未导出环境变量或未在脚本中填入实际值可先执行export MGMT_CONSOLE_URL...与export DEEPFENCE_KEY...再运行。Failed to connect to the management console/deepfence/auth/token无响应。检查管理控制台地址/端口是否可达、443 端口是否开放、网络与防火墙是否放行。Failed to authenticateAPI Key 无效或已过期。重新在SettingUser ManagementAPI Key生成 Key注意脚本会对api_token做 Base64 原始解码见 auth.go请使用控制台导出的原始 Key 格式。Failed to get agent binary download url携带令牌访问下载地址接口失败令牌可能已过期或文件服务器deepfence_file_server不可用。服务启动失败先执行sudo journalctl -u deepfence-agent.service与sudo tail -f /opt/deepfence/df-agents/$(hostname)/var/log/supervisor/deepfenced.log定位若主机名包含特殊字符可显式设置DF_HOSTNAME后再安装。升级/重装安装脚本会自动生成并执行uninstall_deepfence.sh清理旧实例因此重复运行脚本即可完成覆盖安装无需手动清理。小结Linux 主机裸机/虚拟机是 ThreatMapper 传感器矩阵中除 Kubernetes、Docker、Fargate 之外的重要落点。通过install_deepfence.sh脚本传感器以原生二进制形态落地到/opt/deepfence由 systemd 托管为deepfence-agent.service并借助管理控制台/deepfence/auth/token与/deepfence/agent-deployment/binary/download-url两个 API 完成“API Key → 访问令牌 → 签名下载地址 → 二进制拉取”的自动化安装链路。理解这一链路与启动脚本的内部行为能帮助你在排障、升级与大规模批量部署时快速定位问题。赞分享网络安全应用安全云原生漏洞扫描【免费下载链接】ThreatMapperOpen Source Cloud Native Application Protection Platform (CNAPP)项目地址https://gitcode.com/gh_mirrors/th/ThreatMapper点击查看免费下载相关推荐AlphaFold 多聚体预测从 Docker 环境到 PAE 热图判读四个任务跑通你的第一条多链 PDBAlphaFold 多聚体预测从 Docker 环境到 PAE 热图判读四个任务跑通你的第一条多链 PDB AlphaFold 开源仓库里同时包含单体和多聚网络安全应用安全云原生漏洞扫描RustFS systemd 服务化部署指南从二进制安装到 journald 日志运维RustFS systemd 服务化部署指南从二进制安装到 journald 日志运维 RustFS 是一款开源的、兼容 S3 协议的高性能对象存储系统其服后端对象存储分布式存储x64dbg 界面操作技巧全解从相对寻址、高亮模式到字符串搜索的实用指南x64dbg 界面操作技巧全解从相对寻址、高亮模式到字符串搜索的实用指南 x64dbg 是一款面向 Windows 用户态的开源调试器针对逆向工程与恶意软件网络安全应用安全云原生漏洞扫描上一篇【永久免费】7步释放Convert-Lite全部潜力从0到1的离线文档转换大师指南下一篇Xiu实战案例从零搭建百万并发直播平台创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考