From ac3f8d96b5dc7ad0f46cbeccfec6deb47b05cea9 Mon Sep 17 00:00:00 2001 From: Bertrand Gouny Date: Tue, 29 Apr 2014 09:37:22 +0200 Subject: [PATCH 1/5] [twgit] Init feature 'feature-ldaps'. From 3482221fb24cbb257cf836a3025629771cad8783 Mon Sep 17 00:00:00 2001 From: Bertrand Gouny Date: Tue, 29 Apr 2014 17:51:06 +0200 Subject: [PATCH 2/5] tls --- Dockerfile | 40 ++++++++++++++++++++++++++-------------- slapd.sh | 30 ++++++++++++++++++++++++------ 2 files changed, 50 insertions(+), 20 deletions(-) diff --git a/Dockerfile b/Dockerfile index 92def5b..a0c5027 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,21 @@ -FROM phusion/baseimage:0.9.8 -MAINTAINER Nick Stenning +FROM phusion/baseimage +MAINTAINER Bertrand Gouny +# From Nick Stenning's work +# https://github.com/nickstenning/docker-slapd + +# Default configuration: can be overridden at the docker command line +ENV LDAP_ADMIN_PWD toor +ENV LDAP_ORGANISATION Example Inc. +ENV LDAP_DOMAIN example.com + +# /!\ To store the data outside the container, mount /var/lib/ldap as a data volume +# add -v /some/host/directory:/var/lib/ldap to the run command + +# Set correct environment variables ENV HOME /root +ENV LC_ALL C +ENV DEBIAN_FRONTEND noninteractive # Disable SSH RUN rm -rf /etc/service/sshd /etc/my_init.d/00_regen_ssh_host_keys.sh @@ -9,25 +23,23 @@ RUN rm -rf /etc/service/sshd /etc/my_init.d/00_regen_ssh_host_keys.sh # Use baseimage-docker's init system. CMD ["/sbin/my_init"] -# Configure apt -RUN echo 'deb http://us.archive.ubuntu.com/ubuntu/ precise universe' >> /etc/apt/sources.list +# Resynchronize the package index files from their sources RUN apt-get -y update # Install slapd -RUN LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get install -y slapd - -# Default configuration: can be overridden at the docker command line -ENV LDAP_ROOTPASS toor -ENV LDAP_ORGANISATION Acme Widgets Inc. -ENV LDAP_DOMAIN example.com +RUN apt-get install -y slapd +# Expose ldap default port EXPOSE 389 +# Create TSL certificats directory +# /!\ If used the deamon must be lauch with a hostname matching the certificat common mame +# add -h my.hostname.com to the run command +RUN mkdir /etc/ldap/ssl + +# Add slapd deamon RUN mkdir /etc/service/slapd ADD slapd.sh /etc/service/slapd/run -# To store the data outside the container, mount /var/lib/ldap as a data volume - +# Clear out the local repository of retrieved package files RUN apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* - -# vim:ts=8:noet: diff --git a/slapd.sh b/slapd.sh index cb75656..96c98a9 100755 --- a/slapd.sh +++ b/slapd.sh @@ -7,7 +7,7 @@ status () { } set -x -: LDAP_ROOTPASS=${LDAP_ROOTPASS} +: LDAP_ADMIN_PWD=${LDAP_ADMIN_PWD} : LDAP_DOMAIN=${LDAP_DOMAIN} : LDAP_ORGANISATION=${LDAP_ORGANISATION} @@ -15,10 +15,10 @@ if [ ! -e /var/lib/ldap/docker_bootstrapped ]; then status "configuring slapd for first run" cat <> /usr/share/slapd/slapd.conf + echo 'TLSCACertificateFile /etc/ldap/ssl/ca.crt' >> /usr/share/slapd/slapd.conf + echo 'TLSCertificateFile /etc/ldap/ssl/ldap.crt' >> /usr/share/slapd/slapd.conf + echo 'TLSCertificateKeyFile /etc/ldap/ssl/ldap.key' >> /usr/share/slapd/slapd.conf + echo 'TLSVerifyClient never' >> /usr/share/slapd/slapd.conf + + sed -i "s/TLS_CACERT.*/TLS_CACERT \/etc\/ldap\/ssl\/ca.crt/g" /etc/ldap/ldap.conf + sed -i '/TLS_CACERT/a\TLS_CIPHER_SUITE HIGH:MEDIUM:+SSLv3' /etc/ldap/ldap.conf + + fi + touch /var/lib/ldap/docker_bootstrapped + else status "found already-configured slapd" fi -status "starting slapd" +status "starting slapd on default port 389" set -x exec /usr/sbin/slapd -h "ldap:///" -u openldap -g openldap -d 0 From b020cc9cff86493215d0832c5cf94473238a0cc2 Mon Sep 17 00:00:00 2001 From: Bertrand Gouny Date: Fri, 2 May 2014 17:34:12 +0200 Subject: [PATCH 3/5] tls --- Dockerfile | 15 +++++++-------- config/auto/tls.ldif | 16 ++++++++++++++++ config/logging.ldif | 4 ++++ slapd.sh | 24 +++++++++++++----------- 4 files changed, 40 insertions(+), 19 deletions(-) create mode 100644 config/auto/tls.ldif create mode 100644 config/logging.ldif diff --git a/Dockerfile b/Dockerfile index a0c5027..bbd9723 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM phusion/baseimage +FROM osixia-baseimage MAINTAINER Bertrand Gouny # From Nick Stenning's work @@ -12,11 +12,6 @@ ENV LDAP_DOMAIN example.com # /!\ To store the data outside the container, mount /var/lib/ldap as a data volume # add -v /some/host/directory:/var/lib/ldap to the run command -# Set correct environment variables -ENV HOME /root -ENV LC_ALL C -ENV DEBIAN_FRONTEND noninteractive - # Disable SSH RUN rm -rf /etc/service/sshd /etc/my_init.d/00_regen_ssh_host_keys.sh @@ -26,8 +21,8 @@ CMD ["/sbin/my_init"] # Resynchronize the package index files from their sources RUN apt-get -y update -# Install slapd -RUN apt-get install -y slapd +# Install openldap (slapd) and ldap-utils +RUN LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get install -y slapd ldap-utils # Expose ldap default port EXPOSE 389 @@ -37,6 +32,10 @@ EXPOSE 389 # add -h my.hostname.com to the run command RUN mkdir /etc/ldap/ssl +# Add config directory +RUN mkdir /etc/ldap/config +ADD config /etc/ldap/config + # Add slapd deamon RUN mkdir /etc/service/slapd ADD slapd.sh /etc/service/slapd/run diff --git a/config/auto/tls.ldif b/config/auto/tls.ldif new file mode 100644 index 0000000..90178dd --- /dev/null +++ b/config/auto/tls.ldif @@ -0,0 +1,16 @@ +dn: cn=config +add: olcTLSCACertificateFile +olcTLSCACertificateFile: /etc/ldap/ssl/ca.crt +- +add: olcTLSCertificateFile +olcTLSCertificateFile: /etc/ldap/ssl/ldap.crt +- +add: olcTLSCertificateKeyFile +olcTLSCertificateKeyFile: /etc/ldap/ssl/ldap.key +- +add: olcTLSDHParamFile +olcTLSDHParamFile: /etc/ldap/ssl/dhparam.pem +- +add: olcTLSVerifyClient +olcTLSVerifyClient: never + diff --git a/config/logging.ldif b/config/logging.ldif new file mode 100644 index 0000000..bab9364 --- /dev/null +++ b/config/logging.ldif @@ -0,0 +1,4 @@ +dn: cn=config +changetype: modify +add: olcLogLevel +olcLogLevel: stats diff --git a/slapd.sh b/slapd.sh index 96c98a9..07781f1 100755 --- a/slapd.sh +++ b/slapd.sh @@ -31,24 +31,26 @@ slapd slapd/dump_database select when needed EOF dpkg-reconfigure -f noninteractive slapd + chown -R openldap:openldap /etc/ldap + + # Lauch slapd deamon + slapd -h "ldap:///" -u openldap -g openldap if [ -e /etc/ldap/ssl/ldap.crt ] && [ -e /etc/ldap/ssl/ldap.key ] && [ -e /etc/ldap/ssl/ca.crt ]; then status "certificates found" - - chown openldap /etc/ldap/ssl/ldap.key - chmod 400 /etc/ldap/ssl/ldap.key - echo 'TLSCipherSuite HIGH:MEDIUM:+SSLv3' >> /usr/share/slapd/slapd.conf - echo 'TLSCACertificateFile /etc/ldap/ssl/ca.crt' >> /usr/share/slapd/slapd.conf - echo 'TLSCertificateFile /etc/ldap/ssl/ldap.crt' >> /usr/share/slapd/slapd.conf - echo 'TLSCertificateKeyFile /etc/ldap/ssl/ldap.key' >> /usr/share/slapd/slapd.conf - echo 'TLSVerifyClient never' >> /usr/share/slapd/slapd.conf + chmod 600 /etc/ldap/ssl/ldap.key - sed -i "s/TLS_CACERT.*/TLS_CACERT \/etc\/ldap\/ssl\/ca.crt/g" /etc/ldap/ldap.conf - sed -i '/TLS_CACERT/a\TLS_CIPHER_SUITE HIGH:MEDIUM:+SSLv3' /etc/ldap/ldap.conf + # create DHParamFile if not found + [ -f /etc/ldap/ssl/dhparam.pem ] || openssl dhparam -out /etc/ldap/ssl/dhparam.pem 2048 + + ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/config/auto/tls.ldif fi + # kill slapd deamon + pkill -f slapd + touch /var/lib/ldap/docker_bootstrapped else @@ -57,4 +59,4 @@ fi status "starting slapd on default port 389" set -x -exec /usr/sbin/slapd -h "ldap:///" -u openldap -g openldap -d 0 +exec /usr/sbin/slapd -h "ldap:///" -u openldap -g openldap -d -1 From 2d0fd75ed81ee19e7dc1f1236a8cfd918ceb40af Mon Sep 17 00:00:00 2001 From: Bertrand Gouny Date: Mon, 5 May 2014 11:24:54 +0200 Subject: [PATCH 4/5] TLS --- Dockerfile | 4 +--- config/auto/tls.ldif | 11 +++++----- config/logging.ldif | 2 +- slapd.sh | 52 ++++++++++++++++++++++++++++---------------- 4 files changed, 41 insertions(+), 28 deletions(-) diff --git a/Dockerfile b/Dockerfile index bbd9723..d62e624 100644 --- a/Dockerfile +++ b/Dockerfile @@ -22,14 +22,12 @@ CMD ["/sbin/my_init"] RUN apt-get -y update # Install openldap (slapd) and ldap-utils -RUN LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get install -y slapd ldap-utils +RUN LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get install -y slapd ldap-utils openssl # Expose ldap default port EXPOSE 389 # Create TSL certificats directory -# /!\ If used the deamon must be lauch with a hostname matching the certificat common mame -# add -h my.hostname.com to the run command RUN mkdir /etc/ldap/ssl # Add config directory diff --git a/config/auto/tls.ldif b/config/auto/tls.ldif index 90178dd..55fb4ef 100644 --- a/config/auto/tls.ldif +++ b/config/auto/tls.ldif @@ -1,16 +1,17 @@ dn: cn=config -add: olcTLSCACertificateFile +changetype: modify +replace: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ldap/ssl/ca.crt - -add: olcTLSCertificateFile +replace: olcTLSCertificateFile olcTLSCertificateFile: /etc/ldap/ssl/ldap.crt - -add: olcTLSCertificateKeyFile +replace: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ldap/ssl/ldap.key - -add: olcTLSDHParamFile +replace: olcTLSDHParamFile olcTLSDHParamFile: /etc/ldap/ssl/dhparam.pem - -add: olcTLSVerifyClient +replace: olcTLSVerifyClient olcTLSVerifyClient: never diff --git a/config/logging.ldif b/config/logging.ldif index bab9364..5494c10 100644 --- a/config/logging.ldif +++ b/config/logging.ldif @@ -1,4 +1,4 @@ dn: cn=config changetype: modify -add: olcLogLevel +replace: olcLogLevel olcLogLevel: stats diff --git a/slapd.sh b/slapd.sh index 07781f1..4c2fce3 100755 --- a/slapd.sh +++ b/slapd.sh @@ -11,6 +11,7 @@ set -x : LDAP_DOMAIN=${LDAP_DOMAIN} : LDAP_ORGANISATION=${LDAP_ORGANISATION} +############ Base config ############ if [ ! -e /var/lib/ldap/docker_bootstrapped ]; then status "configuring slapd for first run" @@ -31,25 +32,6 @@ slapd slapd/dump_database select when needed EOF dpkg-reconfigure -f noninteractive slapd - chown -R openldap:openldap /etc/ldap - - # Lauch slapd deamon - slapd -h "ldap:///" -u openldap -g openldap - - if [ -e /etc/ldap/ssl/ldap.crt ] && [ -e /etc/ldap/ssl/ldap.key ] && [ -e /etc/ldap/ssl/ca.crt ]; then - status "certificates found" - - chmod 600 /etc/ldap/ssl/ldap.key - - # create DHParamFile if not found - [ -f /etc/ldap/ssl/dhparam.pem ] || openssl dhparam -out /etc/ldap/ssl/dhparam.pem 2048 - - ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/config/auto/tls.ldif - - fi - - # kill slapd deamon - pkill -f slapd touch /var/lib/ldap/docker_bootstrapped @@ -57,6 +39,38 @@ else status "found already-configured slapd" fi +############ Dynamic config ############ +slapd -h "ldap:/// ldapi:///" -u openldap -g openldap +chown -R openldap:openldap /etc/ldap + +# TLS +if [ -e /etc/ldap/ssl/ldap.crt ] && [ -e /etc/ldap/ssl/ldap.key ] && [ -e /etc/ldap/ssl/ca.crt ]; then + status "certificates found" + + chmod 600 /etc/ldap/ssl/ldap.key + + # create DHParamFile if not found + [ -f /etc/ldap/ssl/dhparam.pem ] || openssl dhparam -out /etc/ldap/ssl/dhparam.pem 2048 + + ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/config/auto/tls_add.ldif + + # add fake dnsmasq route to certificate cn + cn=$(openssl x509 -in /etc/ldap/ssl/ldap.crt -subject -noout | sed -n 's/.*CN=\(.*\).\^*/\1/p') + echo "127.0.0.1 " $cn >> /etc/dhosts + +fi + +# Replication +# todo + +# Other config files +for f in $(find /etc/ldap/config -maxdepth 1 -name \*.ldif -type f); do + status "Processing file ${f}" + ldapmodify -Y EXTERNAL -H ldapi:/// -f $f +done + +pkill slapd + status "starting slapd on default port 389" set -x exec /usr/sbin/slapd -h "ldap:///" -u openldap -g openldap -d -1 From 06653234d000d9063f9efc6ad0f44f6cf509f0ad Mon Sep 17 00:00:00 2001 From: Bertrand Gouny Date: Mon, 5 May 2014 11:39:38 +0200 Subject: [PATCH 5/5] [twgit] Init release 'release-0.2.0'.