diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..98c2c1b --- /dev/null +++ b/Dockerfile @@ -0,0 +1,41 @@ +# yubikey-validation-server +# Author : Maxime VISONNEAU - @mvisonneau +# +# VERSION 0.1 +# +# Prereq : rng-tools - rngd -r /dev/urandom +# BUILD : docker build -t /yubiserver +# RUN : docker run -d -p 8000:80 /yubiserver +# + +FROM ubuntu:14.04 +MAINTAINER Maxime VISONNEAU + +# Installation & Configuration + +RUN DEBIAN_FRONTEND=noninteractive +RUN apt-get update +RUN apt-get install -y --force-yes debconf software-properties-common supervisor +RUN mkdir -p /root /var/lock/apache2 /var/run/apache2 /var/log/supervisor +ADD ./conf/ /root/ +ADD ./conf/supervisord.conf /etc/supervisor/conf.d/supervisord.conf + +RUN debconf-set-selections /root/yubi.seed +RUN add-apt-repository ppa:yubico/stable +RUN apt-get update +RUN echo 'exit 0' > /usr/sbin/policy-rc.d +RUN apt-get install -y --force-yes yubikey-ksm yubikey-val +RUN gpg --no-tty --batch --trust-model always --gen-key /root/gpg.conf +RUN gpg --no-tty --import default.sec +RUN ykksm-gen-keys --urandom 1 10 > /root/keys.txt +RUN gpg --no-tty --trust-model always -a -s --encrypt -r `gpg --no-tty --list-keys | head -n 3 | tail -1 | awk '{print $2}' | cut -d '/' -f2` < /root/keys.txt > /root/encrypted_keys.txt +RUN /etc/init.d/mysql start && ykksm-import --database 'DBI:mysql:dbname=ykksm;host=127.0.0.1' --db-user ykksmreader --db-passwd unsecured < /root/encrypted_keys.txt +RUN /etc/init.d/mysql start && \ + echo "######### KEYS ###########" && \ + cat /root/keys.txt && rm -f /root/keys.txt && \ + echo "######## CLIENT ##########" && \ + ykval-export-clients + +# Expose and Startup +EXPOSE 80 +CMD ["/usr/bin/supervisord"] \ No newline at end of file diff --git a/conf/gpg.conf b/conf/gpg.conf new file mode 100644 index 0000000..41c77d8 --- /dev/null +++ b/conf/gpg.conf @@ -0,0 +1,14 @@ +%echo Generating a default key +Key-Type: RSA +Key-Length: 2048 +Subkey-Type: RSA +Subkey-Length: 2048 +Name-Real: John Doe +Name-Comment: no passphrase +Name-Email: john@foo.bar +Expire-Date: 0 +%pubring default.pub +%secring default.sec +# Do a commit here, so that we can later print "done" :-) +%commit +%echo done \ No newline at end of file diff --git a/conf/supervisord.conf b/conf/supervisord.conf new file mode 100644 index 0000000..357e45b --- /dev/null +++ b/conf/supervisord.conf @@ -0,0 +1,8 @@ +[supervisord] +nodaemon=true + +[program:mysql] +command=/etc/init.d/mysql start + +[program:apache2] +command=/bin/bash -c "source /etc/apache2/envvars && exec /usr/sbin/apache2 -DFOREGROUND" \ No newline at end of file diff --git a/conf/yubi.seed b/conf/yubi.seed new file mode 100644 index 0000000..da198b6 --- /dev/null +++ b/conf/yubi.seed @@ -0,0 +1,16 @@ +mysql-server-5.5 mysql-server/root_password_again password unsecured +mysql-server-5.5 mysql-server/root_password password unsecured +yubikey-ksm yubikey-ksm/db/dbname string ykksm +yubikey-ksm yubikey-ksm/db/app-user string ykksmreader +yubikey-ksm yubikey-ksm/database-type select mysql +yubikey-ksm yubikey-ksm/mysql/admin-pass password unsecured +yubikey-ksm yubikey-ksm/mysql/app-pass password unsecured +yubikey-ksm yubikey-ksm/mysql/admin-user string root +yubikey-ksm yubikey-ksm/mysql/method select unix socket +yubikey-val yubikey-val/db/dbname string ykval +yubikey-val yubikey-val/db/app-user string ykval_verifier +yubikey-val yubikey-val/mysql/admin-pass password unsecured +yubikey-val yubikey-val/mysql/app-pass password unsecured +yubikey-val yubikey-val/mysql/method select unix socket +yubikey-val yubikey-val/database-type select mysql +yubikey-val yubikey-val/mysql/admin-user string root