Linux Host
Getting started
If you're looking to run the scanner on a Linux system, setting it up to run as a systemd unit is a good way to ensure that it:
- starts automatically when the node starts up, and automatically restarts as well
- uses centralized system logging with rotation
- can be isolated if needed for security purposes
Most modern Linux distributions include systemd to manage daemons and system services.
By default, systemd services run as the root user of a system, thus inheriting root user permissions. While this is a perfectly valid configuration for many services, it could potentially represent an increased security risk. If you wish to configure the service to run as a non-root user, you will need to ensure you specify User= in the service configuration (similar to the example below), and that the user has permissions to:
- Read and write to the directory in which the scanner binary is located
- Read any directories that you would like to scan for secrets
If you would like to create a specific user for the scanner to run as, perform the following command on Debian-based systems (using truffle as an example):
sudo adduser truffleFor other Linux distributions:
sudo useradd -m truffleThe user running TruffleHog must have write access to the folder that contains it in order for the updater to work properly.
chown -R truffle: /path-containing-trufflehog/Continue on to the following sections for the rest of the setup.
Debian-based systems
Cloud providers like AWS have a default user already configured on Debian and Ubuntu machine images. The example below references ubuntu
- Debian: admin
- Ubuntu: ubuntu
If you've created a special user for running the scanner, substitute it in the configuration below.
- Extract the TruffleHog scanner archive to /home/ubuntu
- Copy your config.yaml into /home/ubuntu
- Copy the Systemd Unit file given below into /etc/systemd/system/trufflehog.service
Amazon Linux
For Amazon Linux-based nodes, the default user is: ec2-user.
If you've created a special user for running the scanner, substitute it in the configuration below.
- Extract the TruffleHog scanner archive to /home/
- Copy your config.yaml into /home/ec2-user
- Copy the Systemd Unit file given below into /etc/systemd/system/trufflehog.service
[Unit]
Description=Run the TruffleHog scanner as a daemon
[Service]
Type=simple
ExecStart=/home/ec2-user/scanner scan --config=/home/ec2-user/config.yaml
Restart=on-failure
RestartSec=15s
User=ec2-user
[Install]
WantedBy=multi-user.target- Reload Systemd to make it aware of the new service unit file: sudo systemctl daemon-reload
- Configure the Systemd to run TruffleHog at boot: sudo systemctl enable trufflehog.service
- Start TruffleHog right now: sudo systemctl start trufflehog.service
- View the status of TruffleHog sudo systemctl status trufflehog.service
- View the TruffleHog logs: sudo journalctl -u trufflehog
- Tail the TruffleHog logs: sudo journalctl -fu trufflehog
Configuring proxy connections when running as a Systemd service
In some instances, you may want to run a local scanner on a node that does not have outbound connectivity due to firewall configuration or other network topology. In that instance, you can configure systemd services with a proxy by making use of the Environment= setting. Using the above ubuntu example again:
[Unit]
Description=Run the TruffleHog scanner as a daemon
[Service]
Environment="HTTP_PROXY=http://proxy.server.com:8000"
Environment="HTTPS_PROXY=https://proxy.server.com:8000"
Type=simple
ExecStart=/home/ubuntu/scanner scan --config=/home/ubuntu/config.yaml
Restart=on-failure
RestartSec=15s
User=ubuntu
[Install]
WantedBy=multi-user.targetBe sure to change the URL to the actual address or IP of your proxy server.