|
1 | | -## Dockerfile for MalwareDB |
| 1 | +## Dockerfile for Postgres for MalwareDB |
2 | 2 |
|
3 | | -There are two Dockerfiles: |
4 | | -* `MalwareDB/Dockerfile` builds a container with both Postgres with the extensions and MalwareDB. |
5 | | -* `Postgres/Dockerfile` builds Postgres only with the extensions. This is for installations where MalwareDB should be separate from the database, or by those who'd like to use the similarity extensions. |
6 | | - |
7 | | -Both use Postgres 15 from Debian 12 Bookworm. |
| 3 | +This Docker file builds extensions for Postgres on Debian for use with MalwareDB. |
8 | 4 |
|
9 | 5 | ### Postgres Extensions |
10 | 6 | Postgres is installed, and extensions built with extensions for: |
11 | 7 | * [LZJD](https://github.com/malwaredb/LZJD) |
12 | 8 | * [SSDeep](https://github.com/malwaredb/ssdeep_psql) |
13 | | -* [SDHash](https://github.com/malwaredb/sdhash_psql) |
14 | 9 | * [TLSH](https://github.com/malwaredb/tlsh_pg) |
15 | 10 |
|
16 | 11 | To use the extensions, __you__ have to add them to __each__ database schema you wish to use them as the schema owner, or as the `postgres` user. SQL commands: |
17 | 12 | * `CREATE OR REPLACE FUNCTION lzjd_compare(TEXT, TEXT) RETURNS INTEGER AS 'lzjd_psql.so', 'pg_lzjd_compare' LANGUAGE 'c';` |
18 | 13 | * `CREATE OR REPLACE FUNCTION fuzzy_hash_compare(TEXT, TEXT) RETURNS INTEGER AS 'ssdeep_psql.so', 'pg_fuzzy_hash_compare' LANGUAGE 'c';` |
19 | | -* `CREATE OR REPLACE FUNCTION sdhash_compare(TEXT, TEXT) RETURNS INTEGER AS 'sdhash_psql.so', 'pg_sdhash_compare' LANGUAGE 'c';` |
20 | 14 | * `CREATE OR REPLACE FUNCTION tlsh_compare(TEXT, TEXT) RETURNS INTEGER AS 'tlsh_psql.so', 'pg_tlsh_compare' LANGUAGE 'c';` |
21 | 15 |
|
22 | 16 | Be sure to set the admin password for Postgres via the `POSTGRES_PASSWORD` environment variable, shown below. |
23 | 17 |
|
24 | 18 | ``` |
25 | 19 | $ git clone https://github.com/malwaredb/docker.git |
26 | | -$ cd docker/Postgres |
27 | 20 | $ docker build -t postgres-similarity/latest . |
28 | 21 | $ mkdir pg_data |
29 | 22 | $ docker run -v `pwd`/pg_data:/var/lib/postgresql/data -p 5432:5432 -e POSTGRES_PASSWORD=yoursecurepassword postgres-similarity/latest |
30 | 23 | ``` |
31 | | - |
32 | | -### MalwareDB |
33 | | -The images are about ~4GB, could probably be smaller. The SQL commands for adding the fuzzy hash functions above are added by the `start.sh` script at container start. The Postgres server won't be accessible outside the container. |
34 | | - |
35 | | -You should use this with an existing Postgres data instance so you can have the administrative settings in order (users, groups, sources). At present, the administrative functions aren't available over the HTTP API. |
36 | | - |
37 | | -``` |
38 | | -$ git clone https://github.com/malwaredb/docker.git |
39 | | -$ cd docker/MalwareDB |
40 | | -$ docker build -t malwaredb/latest . |
41 | | -$ mkdir mdb_data |
42 | | -$ mkdir mdb_data/db |
43 | | -$ mkdir mdb_data/samples |
44 | | -$ docker run -v `pwd`/mdb_data/db:/var/lib/postgresql/data -v `pwd`/samples:/malware_samples -p 8080:8080 malwaredb/latest |
45 | | -``` |
0 commit comments