From 20802b66663eef446f20c7f43c9850aa7cfd616f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20N=C4=9Bmec?= Date: Thu, 6 May 2021 14:32:56 +0200 Subject: [PATCH] Add docker compose and helper scripts --- Dockerfile | 33 ++++++++++++++++++--------------- conf/generate_keys.sh | 12 ++++++++++++ conf/yubi.seed | 12 ++++++------ docker-compose.yml | 13 +++++++++++++ 4 files changed, 49 insertions(+), 21 deletions(-) create mode 100755 conf/generate_keys.sh create mode 100644 docker-compose.yml diff --git a/Dockerfile b/Dockerfile index ae22011..c20a42a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -12,8 +12,8 @@ FROM ubuntu:14.04 MAINTAINER Maxime VISONNEAU ## Custom variables -ENV KEYS_AMOUNT = 10 # Total of keys that will be generated = Amount of Yubikey you want to manage with this KSM -ENV DB_PASSWORD = unsecured # Database password +ENV KEYS_AMOUNT = 0 # Total of keys that will be generated = Amount of Yubikey you want to manage with this KSM +ENV DB_PASSWORD = unsecure # Database password # Installation & Configuration @@ -31,19 +31,22 @@ RUN echo 'exit 0' > /usr/sbin/policy-rc.d RUN apt-get install -y --force-yes yubikey-ksm yubikey-val RUN gpg --no-tty --batch --trust-model always --gen-key /root/gpg.conf RUN gpg --no-tty --import default.sec -RUN ykksm-gen-keys --urandom 1 $KEYS_AMOUNT > /root/keys.txt -RUN gpg --no-tty --trust-model always -a -s --encrypt -r `gpg --no-tty --list-keys | head -n 3 | tail -1 | awk '{print $2}' | cut -d '/' -f2` < /root/keys.txt > /root/encrypted_keys.txt -RUN /etc/init.d/mysql start && ykksm-import < /root/encrypted_keys.txt -RUN /etc/init.d/mysql start && \ - echo "######### KEYS ###########" && \ - echo "---" && \ - for i in `grep -v ^# /root/keys.txt`; do echo "key`echo $i | cut -d',' -f1`:"; echo " public_id: `echo $i | cut -d',' -f2`"; echo " private_id: `echo $i | cut -d',' -f3`"; echo " secret_key: `echo $i | cut -d',' -f4`"; done; \ - rm -f /root/keys.txt && \ - echo "######## CLIENT ##########" && \ - echo "---\nclient:" && \ - echo " id: `ykval-export-clients | cut -d',' -f1`" && \ - echo " key: `ykval-export-clients | cut -d',' -f4`" +#COPY generate_keys.sh /root/ +RUN chmod +x /root/generate_keys.sh && /root/generate_keys.sh $KEYS_AMOUNT + +# RUN ykksm-gen-keys --urandom 1 $KEYS_AMOUNT > /root/keys.txt +# RUN gpg --no-tty --trust-model always -a -s --encrypt -r `gpg --no-tty --list-keys | head -n 3 | tail -1 | awk '{print $2}' | cut -d '/' -f2` < /root/keys.txt > /root/encrypted_keys.txt +# RUN /etc/init.d/mysql start && ykksm-import < /root/encrypted_keys.txt +# RUN /etc/init.d/mysql start && \ +# echo "######### KEYS ###########" && \ +# echo "---" && \ +# for i in `grep -v ^# /root/keys.txt`; do echo "key`echo $i | cut -d',' -f1`:"; echo " public_id: `echo $i | cut -d',' -f2`"; echo " private_id: `echo $i | cut -d',' -f3`"; echo " secret_key: `echo $i | cut -d',' -f4`"; done; \ +# rm -f /root/keys.txt && \ +# echo "######## CLIENT ##########" && \ +# echo "---\nclient:" && \ +# echo " id: `ykval-export-clients | cut -d',' -f1`" && \ +# echo " key: `ykval-export-clients | cut -d',' -f4`" # Expose and Startup EXPOSE 80 -ENTRYPOINT ["/usr/bin/supervisord"] \ No newline at end of file +ENTRYPOINT ["/usr/bin/supervisord"] diff --git a/conf/generate_keys.sh b/conf/generate_keys.sh new file mode 100755 index 0000000..c7c275d --- /dev/null +++ b/conf/generate_keys.sh @@ -0,0 +1,12 @@ +ykksm-gen-keys --urandom 1 $1 > /root/keys.txt +gpg --no-tty --trust-model always -a -s --encrypt -r `gpg --no-tty --list-keys | head -n 3 | tail -1 | awk '{print $2}' | cut -d '/' -f2` < /root/keys.txt > /root/encrypted_keys.txt +/etc/init.d/mysql start && ykksm-import < /root/encrypted_keys.txt +/etc/init.d/mysql start && \ + echo "######### KEYS ###########" && \ + echo "---" && \ + for i in `grep -v ^# /root/keys.txt`; do echo "key`echo $i | cut -d',' -f1`:"; echo " public_id: `echo $i | cut -d',' -f2`"; echo " private_id: `echo $i | cut -d',' -f3`"; echo " secret_key: `echo $i | cut -d',' -f4`"; done; \ + rm -f /root/keys.txt && \ + echo "######## CLIENT ##########" && \ + echo "---\nclient:" && \ + echo " id: `ykval-export-clients | cut -d',' -f1`" && \ + echo " key: `ykval-export-clients | cut -d',' -f4`" diff --git a/conf/yubi.seed b/conf/yubi.seed index da198b6..156a5bc 100644 --- a/conf/yubi.seed +++ b/conf/yubi.seed @@ -1,16 +1,16 @@ -mysql-server-5.5 mysql-server/root_password_again password unsecured -mysql-server-5.5 mysql-server/root_password password unsecured +mysql-server-5.5 mysql-server/root_password_again password unsecure +mysql-server-5.5 mysql-server/root_password password unsecure yubikey-ksm yubikey-ksm/db/dbname string ykksm yubikey-ksm yubikey-ksm/db/app-user string ykksmreader yubikey-ksm yubikey-ksm/database-type select mysql -yubikey-ksm yubikey-ksm/mysql/admin-pass password unsecured -yubikey-ksm yubikey-ksm/mysql/app-pass password unsecured +yubikey-ksm yubikey-ksm/mysql/admin-pass password unsecure +yubikey-ksm yubikey-ksm/mysql/app-pass password unsecure yubikey-ksm yubikey-ksm/mysql/admin-user string root yubikey-ksm yubikey-ksm/mysql/method select unix socket yubikey-val yubikey-val/db/dbname string ykval yubikey-val yubikey-val/db/app-user string ykval_verifier -yubikey-val yubikey-val/mysql/admin-pass password unsecured -yubikey-val yubikey-val/mysql/app-pass password unsecured +yubikey-val yubikey-val/mysql/admin-pass password unsecure +yubikey-val yubikey-val/mysql/app-pass password unsecure yubikey-val yubikey-val/mysql/method select unix socket yubikey-val yubikey-val/database-type select mysql yubikey-val yubikey-val/mysql/admin-user string root diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..d4e6446 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,13 @@ +version: "3.5" +services: + yubikey-val: + container_name: yubikey_val + build: . + ports: + - 8889:80 + networks: + - bitwarden +networks: + bitwarden: + external: true + name: bitwarden