Package: httpobs-alt-scanner
Mozilla HTTP Observatory -The Mozilla HTTP Observatory is a set of tools to analyze your website and inform you if you are utilizing the many available methods to secure it.It is split into three projects:http-observatory- scanner/graderobservatory-cli- command line interfacehttp-observatory-website- web interfaceScanning sites with the HTTP ObservatorySites can be scanned using:observatory.mozilla.org- the online interfaceobservatory-cli- the official node.js command line interfacejava-http-observatory-api- a third party java library and command line interfaceContributingPrerequisitesPython 3.7Gitpip3NotesThese instructions assume that you have a working Python3.7 development environment withpip3installed and capable of building requirements, which may require installing an additional python OS package (-dev,-devel).If this is not appropriate for your environment, you may install the appropriate requirements using your OS package manager (or other means) and skip thepip3 -r requirementscommand.Running a scan from the local codebase, without DB, for continuous integration# Install the HTTP Observatory$gitclonehttps://github.com/mozilla/http-observatory.git
$cdhttp-observatory
$pip3install--upgrade.
$pip3install--upgrade-rrequirements.txtUsing the local scanner function calls>>>fromhttpobs.scanner.localimportscan>>>scan('observatory.mozilla.org')# a scan with default options>>>scan('observatory.mozilla.org',# all the custom optionshttp_port=8080,# http server runs on port 8080https_port=8443,# https server runs on port 8443path='/foo/bar',# don't scan /, instead scan /foo/barcookies={'foo':'bar'},# set the "foo" cookie to "bar"headers={'X-Foo':'bar'},# send an X-Foo: bar HTTP headerverify=False)# treat self-signed certs as valid for tests like HSTS/HPKPThe same, but with the local CLI$httpobs-local-scan--http-port8080--https-port8443--path'/foo/bar'\--cookies'{"foo": "bar"}'--headers'{"X-Foo": "bar"}'--no-verifymozilla.orgRunning a local scanner with DockerInstallDocker ToolboxandVirtualBox# Install the HTTP Observatory client and requests library$gitclonehttps://github.com/mozilla/http-observatory.git
$cdhttp-observatory
$pip3install.
$pip3install--upgraderequests# Create docker machine$docker-machinecreate--drivervirtualbox--virtualbox-disk-size"40000"http-observatory# Save the URL to the API in your .profile, .bash_profile, or whatever$echoexportHTTPOBS_API_URL=http://$(docker-machineiphttp-observatory):57001/api/v1>>~/.profile
$.~/.profile# Start up the docker instance and install all the pieces$eval$(docker-machineenvhttp-observatory)$docker-composeup-dCreating a local installation (tested on Ubuntu 15)# Install git, postgresql, and redis
# sudo -s
# apt-get install -y git libpq-dev postgresql redis-server

# Clone the repo
# cd /opt
# git clone https://github.com/mozilla/http-observatory.git
# cd http-observatory

# Install the observatory and scanner
# pip install .
# pip3 install -r requirements.txt

# Install the database
# su - postgres
$ createdb http_observatory
$ psql http_observatory < httpobs/database/schema.sql
$ psql http_observatory
http_observatory=# \password httpobsapi
http_observatory=# \password httpobsscanner
# vi /etc/postgresql/9.4/main/postgresql.conf (set max_connections = 512, shared_buffers = 256MB)
# service postgresql restart

# Create the httpobs user, and log/pid directories
# useradd -m httpobs
# install -m 750 -o httpobs -g httpobs -d /var/run/httpobs /var/log/httpobs

# Update the environmental variables
# su - httpobs
$ echo export HTTPOBS_API_URL="http://localhost:57001/api/v1" >> ~/.profile

# Start the scanner
$ cd /opt/http-observatory
$ HTTPOBS_DATABASE_USER="httpobsscanner" HTTPOBS_DATABASE_PASS="....." \
    /opt/http-observatory/httpobs/scripts/httpobs-scan-worker

# Start the API (in another terminal)
# HTTPOBS_DATABASE_USER="httpobsapi" HTTPOBS_DATABASE_PASS="....." \
    uwsgi --http :57001 --wsgi-file httpobs/website/main.py --processes 8 --callable app --masterAuthorsApril KingLicenseMozilla Public License Version 2.0