From 79387d1f4e5d02e8454320b187da34a7cb0d4144 Mon Sep 17 00:00:00 2001 From: Bertrand Gouny Date: Tue, 21 Oct 2014 16:58:49 +0200 Subject: [PATCH] add TLS by default --- Dockerfile | 1 + service/mmc-agent/mmc-agent.sh | 5 +-- .../slapd/assets/config/modify/auto/tls.ldif | 3 ++ service/slapd/slapd.sh | 32 +++++++++++++++---- test/db.sh | 2 ++ test/simple.sh | 1 + test/tls.sh | 1 + 7 files changed, 36 insertions(+), 9 deletions(-) diff --git a/Dockerfile b/Dockerfile index b8ff77b..01dccb7 100644 --- a/Dockerfile +++ b/Dockerfile @@ -5,6 +5,7 @@ MAINTAINER Bertrand Gouny # https://github.com/nickstenning/docker-slapd # Default configuration: can be overridden at the docker command line +ENV DOMAIN_NAME ldap.example.com ENV LDAP_DOMAIN example.com ENV LDAP_ADMIN_PWD toor ENV LDAP_ORGANISATION Example Inc. diff --git a/service/mmc-agent/mmc-agent.sh b/service/mmc-agent/mmc-agent.sh index db4dcbe..c630403 100755 --- a/service/mmc-agent/mmc-agent.sh +++ b/service/mmc-agent/mmc-agent.sh @@ -37,6 +37,7 @@ if [ "$WITH_MMC_AGENT" = true ]; then done } + DOMAIN_NAME=${DOMAIN_NAME} WITH_MMC_AGENT=${WITH_MMC_AGENT} LDAP_DOMAIN=${LDAP_DOMAIN} LDAP_ADMIN_PWD=${LDAP_ADMIN_PWD} @@ -44,13 +45,13 @@ if [ "$WITH_MMC_AGENT" = true ]; then MMC_AGENT_PASSWORD=${MMC_AGENT_PASSWORD} # mmc-agent config - sed -i -e "s/127.0.0.1/0.0.0.0/" /etc/mmc/agent/config.ini + sed -i -e "s/127.0.0.1/172.17.0.0/" /etc/mmc/agent/config.ini #listen on docker default network sed -i -e "s/login = mmc/login = $MMC_AGENT_LOGIN/" /etc/mmc/agent/config.ini sed -i -e "s/password = s3cr3t/password = $MMC_AGENT_PASSWORD/" /etc/mmc/agent/config.ini # generate ssl certificate rm /etc/mmc/agent/keys/cacert.pem /etc/mmc/agent/keys/localcert.pem - /sbin/create-ssl-cert $LDAP_DOMAIN /etc/mmc/agent/keys/cacert.pem /etc/mmc/agent/keys/localcert.pem + /sbin/create-ssl-cert $DOMAIN_NAME /etc/mmc/agent/keys/cacert.pem /etc/mmc/agent/keys/localcert.pem # Get base dn from ldap domain getBaseDn ${LDAP_DOMAIN} diff --git a/service/slapd/assets/config/modify/auto/tls.ldif b/service/slapd/assets/config/modify/auto/tls.ldif index 55fb4ef..63b9b8a 100644 --- a/service/slapd/assets/config/modify/auto/tls.ldif +++ b/service/slapd/assets/config/modify/auto/tls.ldif @@ -1,5 +1,8 @@ dn: cn=config changetype: modify +add: olcTLSCipherSuite +olcTLSCipherSuite: SECURE256:-VERS-SSL3.0 +- replace: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ldap/ssl/ca.crt - diff --git a/service/slapd/slapd.sh b/service/slapd/slapd.sh index b188a19..7ed8e06 100755 --- a/service/slapd/slapd.sh +++ b/service/slapd/slapd.sh @@ -11,6 +11,7 @@ set -x : LDAP_ADMIN_PWD=${LDAP_ADMIN_PWD} : LDAP_DOMAIN=${LDAP_DOMAIN} : LDAP_ORGANISATION=${LDAP_ORGANISATION} +: DOMAIN_NAME=${DOMAIN_NAME} ############ Base config ############ @@ -35,6 +36,10 @@ EOF dpkg-reconfigure -f noninteractive slapd + # Enable access only from docker default network and localhost + echo "slapd: 172.17.0.0/255.255.0.0 127.0.0.1 : ALLOW" >> /etc/hosts.allow + echo "slapd: ALL : DENY" >> /etc/hosts.allow + touch /var/lib/ldap/docker_bootstrapped else @@ -69,18 +74,31 @@ if [ ! -e /etc/ldap/slapd.d/docker_bootstrapped ]; then status "certificates found" chmod 600 /etc/ldap/ssl/ldap.key + else - # create DHParamFile if not found - [ -f /etc/ldap/ssl/dhparam.pem ] || openssl dhparam -out /etc/ldap/ssl/dhparam.pem 2048 + #generate default tls certificates / set domain name + DOMAIN_ESC=`echo $DOMAIN_NAME | sed 's/\./_/g'` + DOMAIN_ESC_UPPER=`echo $DOMAIN_ESC | tr '[a-z]' '[A-Z]'` + export SSL_${DOMAIN_ESC_UPPER}_COMMON_NAME=${DOMAIN_NAME} + export SSL_${DOMAIN_ESC_UPPER}_ORGANIZATION="${LDAP_ORGANISATION}" - ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/config/modify/auto/tls.ldif -Q - - # add fake dnsmasq route to certificate cn - cn=$(openssl x509 -in /etc/ldap/ssl/ldap.crt -subject -noout | sed -n 's/.*CN=\(.*\)\/*\(.*\)/\1/p') - echo "127.0.0.1 " $cn >> /etc/dhosts + /sbin/create-ssl-cert $DOMAIN_NAME /etc/ldap/ssl/ldap.crt /etc/ldap/ssl/ldap.key + cp /etc/ldap/ssl/ldap.crt /etc/ldap/ssl/ca.crt fi + # Fix permission on certificates + chown openldap:openldap -R /etc/ldap/ssl + + # create DHParamFile if not found + [ -f /etc/ldap/ssl/dhparam.pem ] || openssl dhparam -out /etc/ldap/ssl/dhparam.pem 2048 + + ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/config/modify/auto/tls.ldif -Q + + # add fake dnsmasq route to certificate cn + cn=$(openssl x509 -in /etc/ldap/ssl/ldap.crt -subject -noout | sed -n 's/.*CN=\(.*\)\/*\(.*\)/\1/p') + echo "127.0.0.1 " $cn >> /etc/dhosts + # Replication # todo :) diff --git a/test/db.sh b/test/db.sh index 79b1f59..00e99cb 100755 --- a/test/db.sh +++ b/test/db.sh @@ -12,10 +12,12 @@ mkdir $testDir/config runOptions="-e LDAP_DOMAIN=otherdomain.com -v $testDir/db:/var/lib/ldap -v $testDir/config:/etc/ldap/slapd.d" . $dir/tools/run-container.sh +sleep 30 $dir/tools/delete-container.sh runOptions="-v $testDir/db:/var/lib/ldap -v $testDir/config:/etc/ldap/slapd.d" . $dir/tools/run-container.sh +sleep 30 echo "ldapsearch -x -h $IP -b dc=otherdomain,dc=com" ldapsearch -x -h $IP -b dc=otherdomain,dc=com diff --git a/test/simple.sh b/test/simple.sh index 4186276..3fa5842 100755 --- a/test/simple.sh +++ b/test/simple.sh @@ -4,6 +4,7 @@ dir=$(dirname $0) . $dir/tools/run-container.sh echo "ldapsearch -x -h $IP -b dc=example,dc=com" +sleep 30 ldapsearch -x -h $IP -b dc=example,dc=com $dir/tools/delete-container.sh diff --git a/test/tls.sh b/test/tls.sh index 0ee296d..5b2b842 100755 --- a/test/tls.sh +++ b/test/tls.sh @@ -4,6 +4,7 @@ dir=$(dirname $0) . $dir/tls/run.sh echo "ldapsearch -x -h $certCN -b dc=example,dc=com -ZZ" +sleep 30 ldapsearch -x -h $certCN -b dc=example,dc=com -ZZ . $dir/tls/end.sh