Build Kerberos Docker Image from Ubuntu

Dockerfile

./Dockerfile

FROM ubuntu:16.04
MAINTAINER Chorke, Inc.<[email protected]>

ENV container=docker
ADD assets /root/.docker
RUN /root/.docker/setup.sh

EXPOSE 22 80 88 389 636 750 749

CMD /usr/sbin/startup.sh && /usr/sbin/sshd -D

Setup Script

./assets/setup.sh

#!/bin/bash
: '
 @author   "Chorke, Inc."<[email protected]>
 @web       http://chorke.org
 @vendor    Chorke, Inc.
 @version   1.0.00.GA
 @since     1.0.00.GA
'

# apt-get in not interactive mode
export DEBIAN_FRONTEND=noninteractive &&


# debconf tzdata settings
cat > /root/.docker/debconf_tzdata_settings.conf << EOF
tzdata tzdata/Areas select Asia
tzdata tzdata/Zones/Asia select Dhaka
EOF


# debconf slap settings
ADMN_PASS=chorkeinc &&
cat > /root/.docker/debconf_slapd_settings.conf << EOF
slapd slapd/root_password password $ADMN_PASS
slapd slapd/root_password_again password $ADMN_PASS
slapd slapd/internal/adminpw password $ADMN_PASS
slapd slapd/internal/generated_adminpw password $ADMN_PASS
slapd slapd/password2 password $ADMN_PASS
slapd slapd/password1 password $ADMN_PASS
slapd slapd/domain string chorke.org
slapd shared/organization string Chorke, Inc.
slapd slapd/backend string MDB
slapd slapd/purge_database boolean false
slapd slapd/move_old_database boolean true
slapd slapd/allow_ldap_v2 boolean false
slapd slapd/no_configuration boolean false
EOF


# debconf kerberos settings
KRB5_REALM=CHORKE.ORG
cat > /root/.docker/debconf_krb5_settings.conf << EOF
krb5-config krb5-config/default_realm string $KRB5_REALM
krb5-config krb5-config/add_servers_realm string $KRB5_REALM
krb5-config krb5-config/kerberos_servers string kdc.chorke.org
krb5-config krb5-config/admin_server string kad.chorke.org
krb5-config krb5-config/dns_for_default boolean true
krb5-config krb5-config/add_servers boolean true
krb5-config krb5-config/read_conf boolean true
heimdal-kdc heimdal/realm string $KRB5_REALM
EOF


# cat /root/.docker/debconf_tzdata_settings.conf|debconf-set-selections &&
# cat /root/.docker/debconf_slapd_settings.conf|debconf-set-selections &&
# cat /root/.docker/debconf_krb5_settings.conf|debconf-set-selections &&


# install slapd, openssh & phpldapadmin
apt-get update &&
# apt-get -y install ldap-utils slapd &&
apt-get -y install inetutils-ping &&
apt-get -y install openssh-{server,client} &&
# apt-get -y install phpldapadmin &&
apt-get clean &&


# config openssh
mkdir /var/run/sshd &&
echo "root:$ADMN_PASS" | chpasswd &&
sed -i 's/^PermitRootLogin .*/PermitRootLogin yes/' /etc/ssh/sshd_config &&
sed -i 's/session\s*required\s*pam_loginuid.so/session optional pam_loginuid.so/g' /etc/pam.d/sshd &&
echo 'export VISIBLE=now' >> /etc/profile &&


# apache server name config
# echo 'ServerName localhost' >> /etc/apache2/conf-enabled/fqdn.conf &&
# echo 'ServerName localhost' >> /etc/apache2/conf-available/fqdn.conf &&


# env settings for chorke
echo ''  >> /etc/bash.bashrc &&
echo ''  >> /etc/bash.bashrc &&
echo '# env settings for chorke'  >> /etc/bash.bashrc &&
echo 'export TMPDIR=/tmp' >> /etc/bash.bashrc &&
echo ''  >> /etc/bash.bashrc &&
echo ''  >> /etc/bash.bashrc &&


# install startup script for container
mv /root/.docker/startup.sh /usr/sbin/startup.sh &&
chmod +x /usr/sbin/startup.sh &&


# safe exit
exit $?

Startup Script

./assets/startup.sh

#!/bin/bash
: '
 @author   "Chorke, Inc."<[email protected]>
 @web       http://chorke.org
 @vendor    Chorke, Inc.
 @version   1.0.00.GA
 @since     1.0.00.GA
'

# env settings for chorke
export TMPDIR=/tmp &&


# failure safe start slapd
if [ -f '/etc/init.d/slapd' ];then
  service slapd start
fi

# failure safe start apache2
if [ -f '/etc/init.d/apache2' ];then
  service apache2 start
fi

# failure safe start kerberos admin server and kdc
if [ -f '/etc/krb5kdc/stash' ]&&[ -f '/etc/krb5kdc/kadm5.acl' ]&&[ -f '/var/lib/krb5kdc/principal' ];then
  if [ -f '/etc/init.d/krb5-admin-server' ]&&[ -f '/etc/init.d/krb5-kdc' ];then
    service krb5-admin-server start && service krb5-kdc start
  fi
fi


# safe exit
exit $?

Init Script

./assets/init.sh

#!/bin/bash
: '
 @author   "Chorke, Inc."<[email protected]>
 @web       http://chorke.org
 @vendor    Chorke, Inc.
 @version   1.0.00.GA
 @since     1.0.00.GA
'

# apt-get in not interactive mode
export DEBIAN_FRONTEND=noninteractive &&


# debconfig set selections
cat /root/.docker/debconf_slapd_settings.conf|debconf-set-selections &&
cat /root/.docker/debconf_krb5_settings.conf|debconf-set-selections &&


# install slapd, openssh & phpldapadmin
apt-get update &&
apt-get -y install ldap-utils slapd &&
apt-get -y install phpldapadmin &&
apt-get -y install ntp ntpdate &&
apt-get -y install krb5-{admin-server,kdc-ldap,user} &&
apt-get clean &&


# openldap(slap) client configuration
chmod 777 /etc/ldap/ldap.conf &&
cat > /etc/ldap/ldap.conf <<'EOF'
#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

BASE   dc=chorke,dc=org
URI    ldap://localhost ldap://localhost:666

#SIZELIMIT      12
#TIMELIMIT      15
#DEREF          never

# TLS certificates (needed for GnuTLS)
TLS_CACERT      /etc/ssl/certs/ca-certificates.crt
EOF
chmod 744 /etc/ldap/ldap.conf &&


# apache server name config
echo 'ServerName localhost' >> /etc/apache2/conf-enabled/fqdn.conf &&
echo 'ServerName localhost' >> /etc/apache2/conf-available/fqdn.conf &&


# phpldapadmin config update for localhost
PHPC_FILE='/etc/phpldapadmin/config.php' &&
TMPL_FILE='/usr/share/phpldapadmin/lib/TemplateRender.php' &&

# ldap server name change (line 286)
LDAP_NAME_FIND="$servers->setValue('server','name','My LDAP Server');" &&
LDAP_NAME_FILL="$servers->setValue('server','name','IHE LDAP Server');" &&
sed -i "s@$LDAP_NAME_FIND.*@$LDAP_NAME_FILL@" "$PHPC_FILE" &&

# ldap server host change (line 293)
LDAP_HOST_FIND="$servers->setValue('server','host','127.0.0.1');" &&
LDAP_HOST_FILL="$servers->setValue('server','host','127.0.0.1');" &&
sed -i "s@$LDAP_HOST_FIND.*@$LDAP_HOST_FILL@" "$PHPC_FILE" &&

# ldap server base chagne (line 300)
LDAP_BASE_FIND="$servers->setValue('server','base',array('dc=example,dc=com'));" &&
LDAP_BASE_FILL="$servers->setValue('server','base',array('dc=chorke,dc=org'));" &&
sed -i "s@$LDAP_BASE_FIND.*@$LDAP_BASE_FILL@" "$PHPC_FILE" &&

# ldap server base chagne (line 326)
LDAP_BASE_FIND="$servers->setValue('login','bind_id','cn=admin,dc=example,dc=com');" &&
LDAP_BASE_FILL="$servers->setValue('login','bind_id','cn=admin,dc=chorke,dc=org');" &&
sed -i "s@$LDAP_BASE_FIND.*@$LDAP_BASE_FILL@" "$PHPC_FILE" &&

# ldap password hash change (line 2469)
LDAP_HASH_FIND="$default = $this->getServer()->getValue('appearance','password_hash');" &&
LDAP_HASH_FILL="$default = $this->getServer()->getValue('appearance','password_hash_custom');" &&
sed -i "s@$LDAP_HASH_FIND.*@$LDAP_HASH_FILL@g" "$TMPL_FILE" &&


# kdc master key prompt
krb5_newrealm &&


# start slapd & apache2
service slapd start &&
service apache2 start &&


# failure safe start kerberos kdc and admin server
if [ -f '/etc/krb5kdc/stash' ]&&[ -f '/etc/krb5kdc/kadm5.acl' ]&&[ -f '/var/lib/krb5kdc/principal' ];then
  if [ -f '/etc/init.d/krb5-kdc' ]&&[ -f '/etc/init.d/krb5-admin-server' ];then
    service krb5-kdc start && service krb5-admin-server start
  fi
fi


# safe exit
exit $?

How to Build

# continuous integration and deployment
docker stop kerber;docker rm kerber;\
docker build --rm -t 'chorke/krb5:16.04' ./;\
docker rmi $(docker images -qa -f 'dangling=true');\
docker run --name='kerber' -d -p 9030:80 -p 389:389 chorke/krb5:16.04;\
docker exec -it kerber bash

How to Create

# for first time to create container from docker image and shell access
docker run --name='kerber' -d -p 9030:80 -p 389:389 chorke/krb5:16.04
docker exec -it kerber bash
/root/.docker/init.sh

How to Control

# access, start, stop & restart
docker exec -it kerber bash
docker restart kerber
docker start kerber
docker stop kerber

Kerberos Admin

kadmin.local:  addprinc root/admin
# WARNING: no policy specified for root/[email protected]; defaulting to no policy
# Enter password for principal "root/[email protected]":
# Re-enter password for principal "root/[email protected]":
# Principal "root/[email protected]" created.

kadmin.local:  addprinc shohel
# WARNING: no policy specified for [email protected]; defaulting to no policy
# Enter password for principal "[email protected]":
# Re-enter password for principal "[email protected]":
# Principal "[email protected]" created.

kadmin.local:  getprinc root/admin
# Principal: root/[email protected]
# Expiration date: [never]
# Last password change: Mon May 28 04:05:46 UTC 2018
# Password expiration date: [none]
# Maximum ticket life: 0 days 10:00:00
# Maximum renewable life: 7 days 00:00:00
# Last modified: Mon May 28 04:05:46 UTC 2018 (root/[email protected])
# Last successful authentication: [never]
# Last failed authentication: [never]
# Failed password attempts: 0
# Number of keys: 8
# Key: vno 1, aes256-cts-hmac-sha1-96
# Key: vno 1, arcfour-hmac
# Key: vno 1, des3-cbc-sha1
# Key: vno 1, des-cbc-crc
# Key: vno 1, des-cbc-md5:v4
# Key: vno 1, des-cbc-md5:norealm
# Key: vno 1, des-cbc-md5:onlyrealm
# Key: vno 1, des-cbc-md5:afs3
# MKey: vno 1
# Attributes: REQUIRES_PRE_AUTH
# Policy: [none]

Good to Know

# filter and remove docker images, containers 
docker rm $(docker ps --all -q -f status=dead)
docker rmi $(docker images -qa -f 'dangling=true')
docker rm kerber && docker rmi chorke/krb5:16.04

# docker container debug, checking history & service
docker run --name='kerber' -it chorke/krb5:16.04 bash
docker history chorke/krb5:16.04
docker exec -it kerber bash
service --status-all
apachectl -t

# openldap(slapd) configuration check
ls -la /etc/ldap/slapd.d/cn\=config
ls -la /etc/ldap/slapd.d/
ls -la /usr/share/slapd/
ls -la /var/lib/ldap/
ls -la /var/backups/*

# openldap(slapd) check
ldapwhoami -H ldap:// -x
cat /etc/ldap/ldap.conf
dpkg-reconfigure tzdata
dpkg-reconfigure slapd
nmap -p 389 localhost
slaptest
slapcat

# kerberos installation check
nmap -sU -sT -p U:88,464,T:464,749 localhost
ls -la /var/lib/krb5kdc/principal
ls -la /etc/krb5kdc/kadm5.acl
ls -la /etc/krb5kdc/stash
kdb5_util list_mkeys
krb5_newrealm

Build Kerberos Docker Image from Ubuntu

Contents

Dockerfile

Setup Script

Startup Script

Init Script

How to Build

How to Create

How to Control

Kerberos Admin

Good to Know

References

Navigation menu

Build Kerberos Docker Image from Ubuntu

Dockerfile

Setup Script

Startup Script

Init Script

How to Build

How to Create

How to Control

Kerberos Admin

Good to Know

References

Navigation menu

Search