Set up security scanning in MSR¶

Prerequisites¶

These instructions assume that you have already installed Mirantis Secure Registry, and have access to an account on the MSR instance with administrator access.

Before you begin, make sure that you or your organization has purchased a MSR license that includes Docker Security Scanning, and that your Docker ID can access and download this license from the Docker Hub.

If you are using a license associated with an individual account, no additional action is needed. If you are using a license associated with an organization account, you may need to make sure your Docker ID is a member of the Owners team. Only Owners team members can download license files for an Organization.

If you will be allowing the Security Scanning database to update itself automatically, make sure that the server hosting your MSR instance can access https://dss-cve-updates.docker.com/ on the standard https port 443.

Get the security scanning license¶

If your MSR instance already has a license that includes Security Scanning, skip this section and proceed to ** Enable MSR security scanning**.

If your current MSR license doesn’t include scanning, you must first download the new license.

1. Log in to the Docker Hub using a Docker ID with access to the license you need.

2. In the top right corner, click your user account icon, and select My Content.

3. Locate Docker Enterprise Edition in the content list, and click Setup.

4. Click License Key to download the license.

   

Next, install the new license on the MSR instance.

1. Log in to your MSR instance using an administrator account.

2. Click Settings in the left navigation.

3. On the General tab click Apply new license.

   A file browser dialog displays.

4. Navigate to where you saved the license key (.lic) file, select it, and click Open.

   

Enable MSR security scanning¶

To enable security scanning in MSR:

1. Log in to your MSR instance with an administrator account.

2. Click Settings in the left navigation.

3. Click the Security tab.

4. Click the Enable scanning toggle so that it turns blue and says “on”.

   

5. Next, provide a security database for the scanner. Security scanning will not function until MSR has a security database to use.

   By default, security scanning is enabled in Online mode. In this mode, MSR attempts to download a security database from a Docker server. If your installation cannot access https://dss-cve-updates.docker.com/ you must manually upload a .tar file containing the security database.

   • If you are using Online mode, the MSR instance will contact a Docker server, download the latest vulnerability database, and install it. Scanning can begin once this process completes.
   • If you are using Offline mode, use the instructions in Update scanning database - offline mode to upload an initial security database.

By default when Security Scanning is enabled, new repositories will automatically scan on docker push. If you had existing repositories before you enabled security scanning, you might want to change repository scanning behavior.

Set repository scanning mode¶

Two modes are available when Security Scanning is enabled:

• Scan on push & Scan manually: the image is re-scanned on each docker push to the repository, and whenever a user with write access clicks the Start Scan links or Scan button.
• Scan manually: the image is scanned only when a user with write access clicks the Start Scan links or Scan button.

By default, new repositories are set to Scan on push & Scan manually, but you can change this setting during repository creation.

Any repositories that existed before scanning was enabled are set to Scan manually mode by default. If these repositories are still in use, you can change this setting from each repository’s Settings page.

To change an individual repository’s scanning mode:

1. Navigate to the repository, and click the Settings tab.

2. Scroll down to the Image scanning section.

3. Select the desired scanning mode.

   

Update the CVE scanning database¶

Docker Security Scanning indexes the components in your MSR images and compares them against a known CVE database. When new vulnerabilities are reported, Docker Security Scanning matches the components in new CVE reports to the indexed components in your images, and quickly generates an updated report.

Users with administrator access to MSR can check when the CVE database was last updated from the Security tab in the MSR Settings pages.

Enable or disable automatic database updates¶

To change the update mode:

1. Log in to MSR as a user with administrator rights.
2. Click Settings in the left navigation and click Security.
3. Click Online/Offline.

Your choice is saved automatically.