Différences
Ci-dessous, les différences entre deux révisions de la page.
| Prochaine révision | Révision précédente | ||
| elearning:workbooks:docker3:drf06 [2021/11/21 11:48] – created admin | elearning:workbooks:docker3:drf06 [2024/02/21 13:40] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| ~~PDF: | ~~PDF: | ||
| - | Version : **2021.01** | + | Version : **2024.01** |
| Dernière mise-à-jour : ~~LASTMOD~~ | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| - | ======DOF607 - Gestion | + | ======DOF607 - Gestion |
| =====Contenu du Module===== | =====Contenu du Module===== | ||
| - | * **DOF607 - Gestion | + | * **DOF607 - Gestion |
| * Contenu du Module | * Contenu du Module | ||
| - | * L'Approche Réseau | + | * LAB #1 - Utilisation des Docker Secrets |
| - | * LAB #1 - Les Réseaux | + | * LAB #2 - Création d'un Utilisateur de Confiance pour Contrôler le Daemon |
| - | * 1.1 - Bridge | + | * LAB #3 - Le Script docker-bench-security.sh |
| - | * Liens | + | * LAB #4 - Sécurisation de la Configuration de l' |
| - | * 1.2 - Host | + | * LAB #5 - Sécurisation de la Configuration du daemon |
| - | * 1.3 - None | + | * 5.1 - Le Fichier / |
| - | * 1.4 - Lancer Wordpress dans un container | + | * LAB #6 - Sécurisation des Images et les Fichiers de Construction |
| - | * 1.5 - Gestion d'une Architecture de Microservices | + | * LAB #7 - Sécurisation du Container Runtime |
| - | * LAB #2 - Gestion | + | * LAB #8 - Sécurisation des Images avec Docker Content Trust |
| - | * 2.1 - Création | + | * 8.1 - DOCKER_CONTENT_TRUST |
| - | * 2.2 - Création | + | * 8.2 - DCT et la commande docker pull |
| - | * 2.3 - Déplacer le Service vers un autre Réseau overlay | + | * L' |
| - | * 2.4 - DNS container discovery | + | * 8.3 - DCT et la commande docker push |
| - | * 2.5 - Création d'un Réseau overlay Personnalisé | + | * 8.4 - DCT et la commande docker build |
| - | * LAB #3 - Gestion de l' | + | * Créer |
| - | * 3.1 - Mise en Place avec Docker Swarm avec des réseaux Overlay | + | * Supprimer |
| + | * LAB #9 - Sécurisation | ||
| + | * 9.1 - Création | ||
| + | * 9.2 - Création | ||
| + | * 9.3 - Création du Certificat du Client | ||
| + | * 9.4 - Démarrage du Daemon Docker avec une Invocation Directe | ||
| + | * 9.5 - Configuration du Client | ||
| - | =====L' | + | =====LAB #1 - Utilisation des Docker |
| - | L'approche réseau | + | Les secrets Docker sont une façon sécurisée de stocker des informations sensibles telles les noms d'utiisateurs, |
| - | * Sandbox, | + | Considérez l' |
| - | * contient la configuration réseau du conteneur à savoir, la gestion des interfaces, la table de routage et le DNS, | + | |
| - | * Endpoint, | + | |
| - | * relie un sandbox | + | |
| - | * Network, | + | |
| - | * un groupe d' | + | |
| - | {{ :elearning: | + | < |
| + | version: '3.1' | ||
| - | =====LAB #1 - Les Réseaux Docker ayant un Scope Local===== | + | services: |
| - | Docker fournit trois réseaux par défaut | + | db: |
| + | image: postgres | ||
| + | environment: | ||
| + | POSTGRES_USER: | ||
| + | POSTGRES_PASSWORD: | ||
| + | POSTGRES_DB: | ||
| - | < | + | adminer: |
| - | root@debian9:~# docker network ls | + | image: adminer |
| - | NETWORK ID NAME DRIVER | + | |
| - | 495b3db75b0d | + | - 8080:8080 |
| - | e1ed4de2f947 | + | </file> |
| - | 6bda460c97c6 | + | |
| - | </code> | + | |
| - | ====1.1 | + | On peut constater dans ce fichier la présence des informations sensibles en non-sécurisées : |
| - | Ce type de réseau est limité aux conteneurs d'un hôte unique exécutant Docker. Les conteneurs ne peuvent communiquer qu' | + | * POSTGRES_USER |
| + | * POSTGRES_PASSWORD | ||
| + | * POSTGRES_DB | ||
| - | Par défaut Docker fonctionne en mode **Pont** ou (// | + | Afin de sécuriser ces informations, |
| < | < | ||
| - | root@debian9:~# ip addr show docker0 | + | root@manager:~# mkdir postgres |
| - | 3: docker0: < | + | |
| - | link/ether 02: | + | |
| - | inet 172.17.0.1/ | + | |
| - | | + | |
| </ | </ | ||
| - | Démarrez | + | Créez ensuite |
| < | < | ||
| - | root@debian9:~# docker | + | root@manager:~# cd postgres |
| - | 2169360fcbfdbd6e68ea969a95edeb6fc42603c23ee42f03ceec286276519855 | + | root@manager: |
| + | lpk8eq80qvfiqw7z1686fmj5t | ||
| </ | </ | ||
| - | Lancez ensuite | + | <WRAP center round important 50%> |
| + | **Important** : Notez l' | ||
| + | </ | ||
| + | |||
| + | Pour visualiser | ||
| < | < | ||
| - | root@debian9:~# docker | + | root@manager:~/postgres# docker |
| - | [ | + | ID NAME DRIVER |
| - | { | + | lpk8eq80qvfiqw7z1686fmj5t |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| </ | </ | ||
| - | <WRAP center round important> | + | <WRAP center round important |
| - | **Important** : Notez ici que le conteneur **resotest** ne dispose pas de la même adresse que l' | + | **Important** : Notez que la colonne |
| </ | </ | ||
| - | Vous pouvez déconnecter un conteneur du réseau en utilisant la commande suivante | + | Créez maintenant les secrets **pg_password** et **pg_database** |
| < | < | ||
| - | root@debian9:~# docker | + | root@manager:~/postgres# echo " |
| - | root@debian9:~# docker network inspect bridge | + | h9tsfbfwz6o0sd35roklwpopi |
| - | [ | + | root@manager:~/postgres# echo "database" |
| - | { | + | 5lx4zydpfocwgpdto0yy1jod9 |
| - | | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| </ | </ | ||
| - | Créez maintenant votre propre réseau ponté appelé | + | <WRAP center round important 50%> |
| + | **Important** : Notez qu'un secret Docker est immuable. | ||
| + | </ | ||
| + | |||
| + | Vérifiez la prise en compte de vos commandes | ||
| < | < | ||
| - | root@debian9:~# docker network create -d bridge --subnet 172.25.0.0/16 --gateway 172.25.0.1 my-bridged-network | + | root@manager:~/postgres# docker |
| - | ceb7ba7493933c55d181bc92b1f799ca07bfe84b168d52a6ac648c1a906093f3 | + | ID NAME DRIVER |
| - | root@debian9: | + | 5lx4zydpfocwgpdto0yy1jod9 |
| - | NETWORK | + | h9tsfbfwz6o0sd35roklwpopi |
| - | 495b3db75b0d | + | lpk8eq80qvfiqw7z1686fmj5t |
| - | e1ed4de2f947 | + | |
| - | ceb7ba749393 | + | |
| - | 6bda460c97c6 | + | |
| </ | </ | ||
| - | Bien évidement, ce réseau est actuellement vide : | + | Pour obtenir de l' |
| < | < | ||
| - | root@debian9:~# docker | + | root@manager:~/postgres# docker |
| [ | [ | ||
| { | { | ||
| - | "Name": "my-bridged-network", | + | "ID": "5lx4zydpfocwgpdto0yy1jod9", |
| - | "Id": " | + | "Version": { |
| - | " | + | "Index": |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | "IPAM": { | + | |
| - | "Driver": | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| }, | }, | ||
| - | "Internal": | + | "CreatedAt": |
| - | "Attachable": | + | "UpdatedAt": "2021-04-15T03: |
| - | | + | "Spec": { |
| - | "ConfigFrom": { | + | "Name": "pg_database", |
| - | "Network": "" | + | "Labels": {} |
| - | }, | + | } |
| - | "ConfigOnly": | + | |
| - | " | + | |
| - | | + | |
| - | " | + | |
| } | } | ||
| ] | ] | ||
| </ | </ | ||
| - | Lancez maintenant deux conteneurs et consultez les informations | + | <WRAP center round important 50%> |
| + | **Important** : On peut constater dans la sortie de cette commande la valeur **CreatedAt** qui correspond à la date de création du secret ainsi que **UpdatedAt** qui correspond à la date de modification du secret. | ||
| + | </ | ||
| + | |||
| + | L' | ||
| < | < | ||
| - | root@debian9:~# docker | + | root@manager:~/postgres# docker |
| - | 9f36a628c72b383edfd4dc13ee4e4b2eaf5be0078d780f0334fcb8be0d977d0e | + | ID: 5lx4zydpfocwgpdto0yy1jod9 |
| + | Name: pg_database | ||
| + | Driver: | ||
| + | Created at: 2021-04-15 03: | ||
| + | Updated at: 2021-04-15 03: | ||
| + | </ | ||
| - | root@debian9:~# docker run -itd --name=centos2 centos | + | Créez maintenant le fichier compose **postgres-secrets.yaml** |
| - | aaed3bc8e404ee1bccd6c87b39de32332940b5391514691fc70188edb17c1d7c | + | |
| - | root@debian9:~# docker inspect | + | < |
| - | {" | + | root@manager:~/postgres# vi postgres-secrets.yaml |
| + | root@manager: | ||
| + | version: '3.1' | ||
| - | root@debian9:~# docker inspect --format=' | + | services: |
| - | {" | + | |
| - | root@debian9:~# docker inspect | + | db: |
| - | 172.17.0.3 | + | image: postgres |
| + | restart: always | ||
| + | environment: | ||
| + | POSTGRES_USER_FILE: | ||
| + | POSTGRES_PASSWORD_FILE: | ||
| + | POSTGRES_DB_FILE: | ||
| + | secrets: | ||
| + | - pg_password | ||
| + | - pg_user | ||
| + | - pg_database | ||
| - | root@debian9:~# docker inspect | + | adminer: |
| - | 172.17.0.4 | + | image: adminer |
| + | ports: | ||
| + | - 8080:8080 | ||
| + | |||
| + | secrets: | ||
| + | pg_user: | ||
| + | external: true | ||
| + | pg_password: | ||
| + | external: true | ||
| + | pg_database: | ||
| + | external: true | ||
| </ | </ | ||
| - | Mettez le conteneur | + | Notez que dans ce fichier les trois variables |
| - | < | + | Deuxièmement la section suivantes spécifie les noms des secrets à utiliser avec le service |
| - | root@debian9:~# docker network connect my-bridged-network centos1 | + | |
| - | root@debian9: | + | < |
| - | [ | + | |
| - | { | + | - pg_password |
| - | | + | - pg_user |
| - | " | + | |
| - | " | + | </file> |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | root@debian9:~# docker inspect --format=' | + | La dernière section spécifie que les secrets sont **externes** |
| - | 172.17.0.3172.25.0.2 | + | |
| - | </ | + | |
| - | <WRAP center round important> | + | < |
| - | **Important** : Notez | + | secrets: |
| + | pg_user: | ||
| + | external: true | ||
| + | pg_password: | ||
| + | external: true | ||
| + | pg_database: | ||
| + | external: true | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important | ||
| + | **Important** : Le terme **externe** indique | ||
| </ | </ | ||
| - | Faites la même chose pour le conteneur | + | Déployez maintenant |
| < | < | ||
| - | root@debian9:~# docker | + | root@manager:~/postgres# docker |
| + | Ignoring unsupported options: restart | ||
| - | root@debian9: | + | Creating |
| - | [ | + | Creating service postgres_db |
| - | { | + | Creating service postgres_adminer |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | + | ||
| - | root@debian9: | + | |
| - | 172.17.0.4172.25.0.3 | + | |
| </ | </ | ||
| - | Connectez-vous au conteneur | + | <WRAP center round important 50%> |
| + | **Important** : Notez a présence de l' | ||
| + | </ | ||
| - | < | + | Connectez-vous maintenant à Apache Guacamole et ouvrez un navigateur web dans la machine virtuelle. Naviguez ensuite à l' |
| - | root@debian9: | + | |
| - | </ | + | |
| - | Vérifiez | + | {{ : |
| + | |||
| + | Validez le formulaire et vérifiez | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | Dernièrement, | ||
| < | < | ||
| - | [root@9f36a628c72b | + | root@manager:~/postgres# docker stack ls |
| - | PING 172.25.0.3 (172.25.0.3) 56(84) bytes of data. | + | NAME SERVICES |
| - | 64 bytes from 172.25.0.3: icmp_seq=1 ttl=64 time=0.100 ms | + | postgres |
| - | 64 bytes from 172.25.0.3: icmp_seq=2 ttl=64 time=0.050 ms | + | root@manager:~/postgres# docker stack rm postgres |
| - | 64 bytes from 172.25.0.3: icmp_seq=3 ttl=64 time=0.050 ms | + | Removing service postgres_adminer |
| - | ^C | + | Removing service postgres_db |
| - | --- 172.25.0.3 ping statistics --- | + | Removing network postgres_default |
| - | 3 packets transmitted, | + | |
| - | rtt min/ | + | |
| </ | </ | ||
| - | Les options possibles au niveau | + | =====LAB #2 - Création d'un Utilisateur |
| - | Il est possible d'ajouter une adresse d'un serveur DNS au lancement | + | Au contraire des solutions classiques de gestion de machines virtuelles où l' |
| < | < | ||
| - | [root@9f36a628c72b /]# exit | + | root@manager:~# cat /etc/group | grep docker |
| - | exit | + | docker: |
| - | root@debian9:~# docker | + | root@manager:~# usermod -aG docker |
| - | mongo2 | + | root@manager:~# exit |
| - | root@debian9:~# docker rm resotest | + | déconnexion |
| - | mongo2 | + | trainee@manager:~$ docker |
| - | root@debian9:~# docker run -it --name=resotest --dns 8.8.8.8 centos bash | + | Got permission denied while trying to connect to the Docker daemon socket at unix:/// |
| - | root@735599480b45:/# cat /etc/resolv.conf | + | trainee@manager: |
| - | search home | + | trainee@manager: |
| - | nameserver 8.8.8.8 | + | CONTAINER ID IMAGE |
| - | root@735599480b45:/# | + | d02c6115724c |
| + | trainee@manager:~$ docker rm alpine1 | ||
| + | alpine1 | ||
| + | trainee@manager: | ||
| + | a214e2df0499c97e8da25a6c9ea751ac75344c9bcd7d238f8cb8d5c777510ab9 | ||
| + | trainee@manager: | ||
| + | CONTAINER ID IMAGE | ||
| + | a214e2df0499 | ||
| </ | </ | ||
| - | ou de passer | + | =====LAB #3 - Le Script docker-bench-security.sh===== |
| + | |||
| + | Le **Center for Internet Security (CIS)** est une organisation indépendante à but non-lucratif qui publie des best practices dans de nombreux domaines de l' | ||
| + | |||
| + | Le guide est divisé en plusieurs sections : | ||
| + | |||
| + | * La configuration de l' | ||
| + | * La configuration du daemon Docker, | ||
| + | * Les fichiers de configuration du daemon Docker, | ||
| + | * Les images ainsi que les fichiers servant à la construction des images, | ||
| + | * Le container runtime, | ||
| + | * Les opérations sécuritaires relatives à Docker, | ||
| + | * La configuration de Docker Swarm. | ||
| + | |||
| + | Ce guide est à utiliser avec le script | ||
| + | |||
| + | Clonez le script **docker-bench-security.sh** en utilisant **git** : | ||
| < | < | ||
| - | root@735599480b45:/# | + | trainee@manager:~$ su - |
| - | exit | + | Password: fenestros |
| - | root@debian9:~# docker stop resotest | + | |
| - | mongo2 | + | |
| - | root@debian9: | + | |
| - | mongo2 | + | |
| - | root@debian9: | + | |
| - | root@718e7eab814f:/# cat / | + | |
| - | 127.0.0.1 localhost | + | |
| - | :: | + | |
| - | fe00:: | + | |
| - | ff00:: | + | |
| - | ff02:: | + | |
| - | ff02:: | + | |
| - | 127.0.0.1 mickeymouse | + | |
| - | 172.17.0.2 718e7eab814f | + | |
| - | </ | + | |
| - | ===Liens=== | + | root@manager: |
| + | Cloning in ' | ||
| + | remote: Enumerating objects: 18, done. | ||
| + | remote: Counting objects: 100% (18/18), done. | ||
| + | remote: Compressing objects: 100% (16/16), done. | ||
| + | remote: Total 1921 (delta 5), reused 6 (delta 2), pack-reused 1903 | ||
| + | Receiving objects: 100% (1921/ | ||
| + | Delta resolution: 100% (1339/ | ||
| + | </ | ||
| - | Le mécanisme des liens entre conteneurs est très puissant et permet d' | + | Exécutez maintenant |
| < | < | ||
| - | root@332aa9930f30:/# exit | + | root@manager:~# cd docker-bench-security/ |
| - | exit | + | |
| - | root@debian9:~# docker | + | root@manager:~/ |
| - | 6a315259b2946c3bf2bb69f608cbe910d87edaadedb4f805e7a4dbf6af1eb916 | + | # -------------------------------------------------------------------------------------------- |
| + | # Docker Bench for Security v1.6.0 | ||
| + | # | ||
| + | # Docker, Inc. (c) 2015-2023 | ||
| + | # | ||
| + | # Checks for dozens of common best-practices around deploying Docker containers in production. | ||
| + | # Based on the CIS Docker Benchmark 1.6.0. | ||
| + | # -------------------------------------------------------------------------------------------- | ||
| - | root@debian9: | + | Initializing 2023-12-17T14: |
| - | CONTAINER ID IMAGE | + | |
| - | 6a315259b294 | + | |
| - | 332aa9930f30 | + | |
| - | aaed3bc8e404 | + | |
| - | 9f36a628c72b | + | |
| - | 2169360fcbfd | + | |
| - | ea239635e141 | + | |
| - | 21b0490a93dd | + | |
| - | bdb4bc0f81de | + | |
| - | f5b45072b831 | + | |
| - | 9731a48f126a | + | |
| - | eacd70596e23 | + | |
| - | cffb4456e9c4 | + | |
| - | root@debian9: | ||
| - | [root@6a315259b294 /]# ping centos2 | + | Section A - Check results |
| - | PING alias (172.17.0.4) 56(84) bytes of data. | + | |
| - | 64 bytes from alias (172.17.0.4): | + | |
| - | 64 bytes from alias (172.17.0.4): | + | |
| - | 64 bytes from alias (172.17.0.4): | + | |
| - | 64 bytes from alias (172.17.0.4): | + | |
| - | ^C | + | |
| - | --- alias ping statistics --- | + | |
| - | 4 packets transmitted, | + | |
| - | rtt min/ | + | |
| - | [root@6a315259b294 | + | [INFO] 1 - Host Configuration |
| - | 127.0.0.1 localhost | + | [INFO] 1.1 - Linux Hosts Specific Configuration |
| - | ::1 localhost ip6-localhost ip6-loopback | + | [WARN] 1.1.1 - Ensure a separate partition for containers has been created (Automated) |
| - | fe00::0 ip6-localnet | + | [INFO] 1.1.2 - Ensure only trusted users are allowed to control Docker daemon (Automated) |
| - | ff00::0 ip6-mcastprefix | + | [INFO] |
| - | ff02::1 ip6-allnodes | + | [WARN] 1.1.3 - Ensure auditing is configured for the Docker daemon (Automated) |
| - | ff02::2 ip6-allrouters | + | [WARN] 1.1.4 - Ensure auditing is configured for Docker files and directories -/run/ |
| - | 172.17.0.4 alias aaed3bc8e404 centos2 | + | [WARN] 1.1.5 - Ensure auditing is configured for Docker files and directories - / |
| - | 172.17.0.2 6a315259b294 | + | [WARN] 1.1.6 - Ensure auditing is configured for Docker files and directories - /etc/docker (Automated) |
| + | [WARN] 1.1.7 - Ensure auditing is configured for Docker files and directories - docker.service (Automated) | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [WARN] | ||
| + | [WARN] 1.1.10 | ||
| + | [INFO] 1.1.11 | ||
| + | [INFO] | ||
| + | [WARN] | ||
| + | [INFO] 1.1.13 | ||
| + | [INFO] | ||
| + | [WARN] 1.1.14 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [WARN] 1.1.15 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] 1.1.16 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] | ||
| + | [INFO] 1.1.17 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] | ||
| + | [WARN] 1.1.18 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] 1.2 - General Configuration | ||
| + | [NOTE] 1.2.1 - Ensure the container host has been Hardened (Manual) | ||
| + | [PASS] 1.2.2 - Ensure that the version of Docker is up to date (Manual) | ||
| + | [INFO] | ||
| - | [root@6a315259b294 /]# exit | + | [INFO] 2 - Docker daemon configuration |
| - | exit | + | [NOTE] 2.1 - Run the Docker daemon as a non-root user, if possible (Manual) |
| + | [WARN] 2.2 - Ensure network traffic is restricted between containers on the default bridge (Scored) | ||
| + | [PASS] 2.3 - Ensure the logging level is set to ' | ||
| + | [PASS] 2.4 - Ensure Docker is allowed to make changes to iptables (Scored) | ||
| + | [PASS] 2.5 - Ensure insecure registries are not used (Scored) | ||
| + | [PASS] 2.6 - Ensure aufs storage driver is not used (Scored) | ||
| + | [INFO] 2.7 - Ensure TLS authentication for Docker daemon is configured (Scored) | ||
| + | [INFO] | ||
| + | [INFO] 2.8 - Ensure the default ulimit is configured appropriately (Manual) | ||
| + | [INFO] | ||
| + | [WARN] 2.9 - Enable user namespace support (Scored) | ||
| + | [PASS] 2.10 - Ensure the default cgroup usage has been confirmed (Scored) | ||
| + | [PASS] 2.11 - Ensure base device size is not changed until needed (Scored) | ||
| + | [WARN] 2.12 - Ensure that authorization for Docker client commands is enabled (Scored) | ||
| + | [WARN] 2.13 - Ensure centralized and remote logging is configured (Scored) | ||
| + | [WARN] 2.14 - Ensure containers are restricted from acquiring new privileges (Scored) | ||
| + | [WARN] 2.15 - Ensure live restore is enabled (Scored) | ||
| + | [WARN] 2.16 - Ensure Userland Proxy is Disabled (Scored) | ||
| + | [PASS] 2.17 - Ensure that a daemon-wide custom seccomp profile is applied if appropriate (Manual) | ||
| + | [PASS] 2.18 - Ensure that experimental features are not implemented in production (Scored) | ||
| - | root@debian9:~# docker | + | [INFO] 3 - Docker daemon configuration files |
| - | 172.17.0.2 | + | [PASS] 3.1 - Ensure that the docker.service file ownership is set to root:root (Automated) |
| - | </code> | + | [PASS] 3.2 - Ensure that docker.service file permissions are appropriately set (Automated) |
| + | [PASS] 3.3 - Ensure that docker.socket file ownership is set to root:root (Automated) | ||
| + | [PASS] 3.4 - Ensure that docker.socket file permissions are set to 644 or more restrictive (Automated) | ||
| + | [PASS] 3.5 - Ensure that the /etc/docker directory ownership is set to root:root (Automated) | ||
| + | [PASS] 3.6 - Ensure that /etc/docker directory permissions are set to 755 or more restrictively (Automated) | ||
| + | [INFO] 3.7 - Ensure that registry certificate file ownership is set to root:root (Automated) | ||
| + | [INFO] | ||
| + | [INFO] 3.8 - Ensure that registry certificate file permissions are set to 444 or more restrictively (Automated) | ||
| + | [INFO] | ||
| + | [INFO] 3.9 - Ensure that TLS CA certificate file ownership is set to root:root (Automated) | ||
| + | [INFO] | ||
| + | [INFO] 3.10 - Ensure that TLS CA certificate file permissions are set to 444 or more restrictively (Automated) | ||
| + | [INFO] | ||
| + | [INFO] 3.11 - Ensure that Docker server certificate file ownership is set to root:root (Automated) | ||
| + | [INFO] | ||
| + | [INFO] 3.12 - Ensure that the Docker server certificate file permissions are set to 444 or more restrictively (Automated) | ||
| + | [INFO] | ||
| + | [INFO] 3.13 - Ensure that the Docker server certificate key file ownership is set to root:root (Automated) | ||
| + | [INFO] | ||
| + | [INFO] 3.14 - Ensure that the Docker server certificate key file permissions are set to 400 (Automated) | ||
| + | [INFO] | ||
| + | [PASS] 3.15 - Ensure that the Docker socket file ownership is set to root:docker (Automated) | ||
| + | [PASS] 3.16 - Ensure that the Docker socket file permissions are set to 660 or more restrictively (Automated) | ||
| + | [INFO] 3.17 - Ensure that the daemon.json file ownership is set to root:root (Automated) | ||
| + | [INFO] | ||
| + | [INFO] 3.18 - Ensure that daemon.json file permissions are set to 644 or more restrictive (Automated) | ||
| + | [INFO] | ||
| + | [PASS] 3.19 - Ensure that the /etc/ | ||
| + | [PASS] 3.20 - Ensure that the / | ||
| + | [INFO] 3.21 - Ensure that the / | ||
| + | [INFO] | ||
| + | [INFO] 3.22 - Ensure that the / | ||
| + | [INFO] | ||
| + | [PASS] 3.23 - Ensure that the Containerd socket file ownership is set to root:root (Automated) | ||
| + | [PASS] 3.24 - Ensure that the Containerd socket file permissions are set to 660 or more restrictively (Automated) | ||
| - | Notez cependant qu le lien est unidirectionnel | + | [INFO] 4 - Container Images and Build File |
| + | [INFO] 4.1 - Ensure that a user for the container has been created (Automated) | ||
| + | [INFO] | ||
| + | [NOTE] 4.2 - Ensure that containers use only trusted base images (Manual) | ||
| + | [NOTE] 4.3 - Ensure that unnecessary packages are not installed in the container (Manual) | ||
| + | [NOTE] 4.4 - Ensure images are scanned and rebuilt to include security patches (Manual) | ||
| + | [WARN] 4.5 - Ensure Content trust for Docker is Enabled (Automated) | ||
| + | [WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images (Automated) | ||
| + | [WARN] | ||
| + | [WARN] | ||
| + | [WARN] | ||
| + | [WARN] | ||
| + | [PASS] 4.7 - Ensure update instructions are not used alone in the Dockerfile (Manual) | ||
| + | [NOTE] 4.8 - Ensure setuid and setgid permissions are removed (Manual) | ||
| + | [PASS] 4.9 - Ensure that COPY is used instead of ADD in Dockerfiles (Manual) | ||
| + | [NOTE] 4.10 - Ensure secrets are not stored in Dockerfiles (Manual) | ||
| + | [NOTE] 4.11 - Ensure only verified packages are installed (Manual) | ||
| + | [NOTE] 4.12 - Ensure all signed artifacts are validated (Manual) | ||
| - | < | + | [INFO] 5 - Container Runtime |
| - | root@debian9: | + | [INFO] |
| - | [root@aaed3bc8e404 /]# ping centos3 | + | [INFO] 6 - Docker Security Operations |
| - | ping: centos3: Name or service not known | + | [INFO] 6.1 - Ensure that image sprawl is avoided (Manual) |
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] 6.2 - Ensure that container sprawl is avoided (Manual) | ||
| + | [INFO] | ||
| - | [root@aaed3bc8e404 /]# ping 172.17.0.2 | + | [INFO] 7 - Docker Swarm Configuration |
| - | PING 172.17.0.2 | + | [WARN] 7.1 - Ensure swarm mode is not Enabled, if not needed |
| - | 64 bytes from 172.17.0.2: icmp_seq=1 ttl=64 time=0.054 ms | + | [PASS] 7.2 - Ensure that the minimum number of manager nodes have been created in a swarm (Automated) (Swarm mode not enabled) |
| - | 64 bytes from 172.17.0.2: icmp_seq=2 ttl=64 time=0.035 ms | + | [PASS] 7.3 - Ensure that swarm services are bound to a specific host interface (Automated) (Swarm mode not enabled) |
| - | 64 bytes from 172.17.0.2: icmp_seq=3 ttl=64 time=0.051 ms | + | [PASS] 7.4 - Ensure that all Docker swarm overlay networks are encrypted (Automated) |
| - | 64 bytes from 172.17.0.2: icmp_seq=4 ttl=64 time=0.071 ms | + | [PASS] 7.5 - Ensure that Docker' |
| - | ^C | + | [PASS] 7.6 - Ensure that swarm manager is run in auto-lock mode (Automated) (Swarm mode not enabled) |
| - | --- 172.17.0.2 ping statistics | + | [PASS] 7.7 - Ensure that the swarm manager auto-lock key is rotated periodically (Manual) (Swarm mode not enabled) |
| - | 4 packets transmitted, | + | [PASS] 7.8 - Ensure that node certificates are rotated as appropriate (Manual) (Swarm mode not enabled) |
| - | rtt min/ | + | [PASS] 7.9 - Ensure that CA certificates are rotated as appropriate (Manual) (Swarm mode not enabled) |
| + | [PASS] 7.10 - Ensure that management plane traffic is separated from data plane traffic (Manual) (Swarm mode not enabled) | ||
| - | [root@aaed3bc8e404 /]# | ||
| - | </ | ||
| - | Dans le cas ci-dessus, **centos2** peut atteindre **centos3** en utilisant l' | + | Section C - Score |
| - | < | + | [INFO] Checks: 86 |
| - | [root@aaed3bc8e404 /]# exit | + | [INFO] Score: 1 |
| - | exit | + | |
| - | root@debian9:~# docker inspect --format=' | + | |
| - | 172.17.0.4172.25.0.3 | + | |
| </ | </ | ||
| - | ====1.2 - Host==== | + | Ce script sert à automatiser le contrôle des points précédemment cités et produit un rapport contenant des annotations : |
| - | Ce type de réseau est utilisé dans le cas où le réseau ne doit pas être isolé de l'hôte tout en isolant | + | * **[PASS]** : Concerne les points qui n' |
| + | * **[WARN]** : Concerne les points qui **doivent** être modifiés, | ||
| + | * **[INFO]** : Concerne les points qui doivent être passés | ||
| + | * **[NOTE]** : Vous informe d'un **best practice**. | ||
| - | Dans le cas de la machine virtuelle, l' | + | =====LAB #4 - Sécurisation |
| - | < | + | Lors de l' |
| - | root@debian9: | + | |
| - | 2: ens18: < | + | |
| - | link/ether 08: | + | |
| - | inet 10.0.2.60/ | + | |
| - | | + | |
| - | inet6 fe80:: | + | |
| - | | + | |
| - | </ | + | |
| - | Démarrez un conteneur à partir de l' | + | < |
| + | ... | ||
| + | [INFO] 1 - Host Configuration | ||
| + | [INFO] 1.1 - Linux Hosts Specific Configuration | ||
| + | [WARN] 1.1.1 - Ensure a separate partition for containers has been created (Automated) | ||
| + | [INFO] 1.1.2 - Ensure only trusted users are allowed to control Docker daemon (Automated) | ||
| + | [INFO] | ||
| + | [WARN] 1.1.3 - Ensure auditing is configured for the Docker daemon (Automated) | ||
| + | [WARN] 1.1.4 - Ensure auditing is configured for Docker files and directories -/ | ||
| + | [WARN] 1.1.5 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [WARN] 1.1.6 - Ensure auditing is configured for Docker files and directories - /etc/docker (Automated) | ||
| + | [WARN] 1.1.7 - Ensure auditing is configured for Docker files and directories - docker.service (Automated) | ||
| + | [INFO] 1.1.8 - Ensure auditing is configured for Docker files and directories - containerd.sock (Automated) | ||
| + | [INFO] | ||
| + | [WARN] 1.1.9 - Ensure auditing is configured for Docker files and directories - docker.socket (Automated) | ||
| + | [WARN] 1.1.10 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] 1.1.11 - Ensure auditing is configured for Dockerfiles and directories - / | ||
| + | [INFO] | ||
| + | [WARN] 1.1.12 - 1.1.12 Ensure auditing is configured for Dockerfiles and directories - / | ||
| + | [INFO] 1.1.13 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] | ||
| + | [WARN] 1.1.14 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [WARN] 1.1.15 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] 1.1.16 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] | ||
| + | [INFO] 1.1.17 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] | ||
| + | [WARN] 1.1.18 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] 1.2 - General Configuration | ||
| + | [NOTE] 1.2.1 - Ensure the container | ||
| + | [PASS] 1.2.2 - Ensure that the version of Docker is up to date (Manual) | ||
| + | [INFO] | ||
| + | ... | ||
| + | </ | ||
| - | < | + | Les problèmes de sécurité qu'il convient à résoudre sont indiqués par les annotations **[WARN]**. |
| - | root@debian9: | + | |
| - | [root@debian9 /]# ip a | + | |
| - | 1: lo: < | + | |
| - | link/ | + | |
| - | inet 127.0.0.1/8 scope host lo | + | |
| - | | + | |
| - | inet6 ::1/128 scope host | + | |
| - | | + | |
| - | 2: ens18: < | + | |
| - | link/ether 08: | + | |
| - | inet 10.0.2.60/ | + | |
| - | | + | |
| - | inet6 fe80:: | + | |
| - | | + | |
| - | 3: docker0: < | + | |
| - | link/ether 02: | + | |
| - | inet 172.17.0.1/ | + | |
| - | | + | |
| - | inet6 fe80:: | + | |
| - | | + | |
| - | [root@debian9 /]# hostname | + | |
| - | debian9 | + | |
| - | [root@debian9 /]# exit | + | |
| - | </ | + | |
| - | Le but de ce type de réseau est de permettre l' | + | ====[WARN] 1.1.1 - Ensure a separate partition for containers has been created (Automated)==== |
| - | Pour cette raison, dans le cas de l' | + | Par défaut, tous les fichiers de Docker sont stockés |
| - | <WRAP center round important 50%> | + | ====[WARN] 1.1.3 - Ensure auditing is configured for the Docker |
| - | **Important** : Notez que le réseau de type **host** ne fonctionne que sous Linux. Il est donc incompatible avec Docker | + | |
| - | </ | + | |
| - | ====1.3 - None==== | + | < |
| + | [WARN] | ||
| + | [WARN] 1.1.5 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [WARN] 1.1.6 - Ensure auditing is configured for Docker files and directories - /etc/docker (Automated) | ||
| + | [WARN] 1.1.7 - Ensure auditing is configured for Docker files and directories - docker.service (Automated) | ||
| + | [WARN] 1.1.9 - Ensure auditing is configured for Docker files and directories - docker.socket (Automated) | ||
| + | [WARN] 1.1.10 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [WARN] 1.1.12 - Ensure auditing is configured for Dockerfiles and directories - / | ||
| + | [WARN] 1.1.14 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [WARN] 1.1.15 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [WARN] 1.1.18 - Ensure auditing is configured for Docker files and directories | ||
| + | </ | ||
| - | Ce type de réseau est utilisé principalement dans le cas de l' | + | Ces avertissements sont présents parce que **auditd** n'est pas installé et parce qu'il n'y a pas de règles spécifiques au daemon Docker et ses répertoires et fichiers associés. |
| - | Il est donc possible de lancer un conteneur totalement étanche grâce au réseau | + | Editez le fichier |
| < | < | ||
| - | root@718e7eab814f:/# exit | + | root@manager:~/docker-bench-security# vi /etc/apt/sources.list |
| - | exit | + | |
| - | root@debian9: | + | |
| - | mongo2 | + | |
| - | root@debian9: | + | |
| - | mongo2 | + | |
| - | root@debian9: | + | |
| - | root@332aa9930f30: | + | |
| - | </code> | + | |
| - | ====1.4 - Lancer Wordpress dans un container==== | + | root@manager: |
| + | deb http:// | ||
| + | deb-src http:// | ||
| + | deb http:// | ||
| + | deb-src http:// | ||
| + | deb [arch=amd64] https:// | ||
| + | </ | ||
| - | Créez le répertoire ~/wordpress et placez-vous dedans | + | Exécutez la commande **apt-update** |
| < | < | ||
| - | root@debian9:~# mkdir ~/wordpress && cd ~/wordpress | + | root@manager:~/ |
| + | Ign:1 http://archive.debian.org/ | ||
| + | Atteint:2 http:// | ||
| + | Atteint:3 http:// | ||
| + | Réception de:4 https:// | ||
| + | 44,8 ko réceptionnés en 0s (107 ko/s) | ||
| + | Lecture des listes de paquets... Fait | ||
| + | Construction de l' | ||
| + | Lecture des informations d' | ||
| + | 254 packages can be upgraded. Run 'apt list --upgradable' | ||
| </ | </ | ||
| - | Créez un conteneur dénommé | + | Pour installer auditd, utilisez |
| < | < | ||
| - | root@debian9:~/wordpress# | + | root@manager:~/docker-bench-security# apt-get install auditd |
| - | Unable to find image ' | + | |
| - | latest: Pulling from library/ | + | |
| - | f2b6b4884fc8: | + | |
| - | 26d8bdca4f3e: | + | |
| - | 74f09e820cce: | + | |
| - | 5390f1fe4554: | + | |
| - | 3d3f1706a741: | + | |
| - | 2942f66426ea: | + | |
| - | 97ee11d39c75: | + | |
| - | 590c46ef722b: | + | |
| - | 32eb4b9666e5: | + | |
| - | fc883f98a064: | + | |
| - | bb8bee61bc1e: | + | |
| - | Digest: sha256: | + | |
| - | Status: Downloaded newer image for mariadb: | + | |
| - | 67831dacf002bdc21dc79b0e8483f538235d00ddd2e8aae175ef3ebf189ae14d | + | |
| </ | </ | ||
| - | Vérifiez que le conteneur fonctionne | + | Modifiez ensuite |
| < | < | ||
| - | root@debian9:~/wordpress# | + | root@manager:~/docker-bench-security# |
| - | CONTAINER ID IMAGE | + | |
| - | 67831dacf002 | + | root@manager:~/docker-bench-security# |
| + | ## First rule - delete all | ||
| + | -D | ||
| + | |||
| + | ## Increase the buffers to survive stress events. | ||
| + | ## Make this bigger for busy systems | ||
| + | -b 8192 | ||
| + | |||
| + | ## This determine how long to wait in burst of events | ||
| + | --backlog_wait_time 0 | ||
| + | |||
| + | ## Set failure mode to syslog | ||
| + | -f 1 | ||
| + | |||
| + | ##Docker | ||
| + | -w / | ||
| + | -w / | ||
| + | -w /etc/docker -p wa | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| </ | </ | ||
| - | Créez un conteneur appellé | + | <WRAP center round important 50%> |
| + | **Important** : L' | ||
| + | </ | ||
| + | |||
| + | Re-démarrez ensuite auditd | ||
| < | < | ||
| - | root@debian9:~/wordpress# | + | root@manager:~/docker-bench-security# systemctl restart auditd |
| - | Unable to find image ' | + | |
| - | latest: Pulling from library/ | + | |
| - | 2a72cbf407d6: | + | |
| - | 273cd543cb15: | + | |
| - | ec5ac8875de7: | + | |
| - | 9106e19b56c1: | + | |
| - | ee2f70ac7c7d: | + | |
| - | 7257ad6985e8: | + | |
| - | 18f5c2055da2: | + | |
| - | 85293a6fdd80: | + | |
| - | 9e797eeb0c14: | + | |
| - | f16178842884: | + | |
| - | 13899c06d3f8: | + | |
| - | 70c27fe4c3c5: | + | |
| - | d32c8ad2d9d7: | + | |
| - | 07fe445494e6: | + | |
| - | 63b8de7b32fe: | + | |
| - | e4b721952e22: | + | |
| - | d9ede6dd6f74: | + | |
| - | 0af4f74bfd92: | + | |
| - | e4e7c47b969f: | + | |
| - | 69aff47f3112: | + | |
| - | Digest: sha256: | + | |
| - | Status: Downloaded newer image for wordpress: | + | |
| - | 9eb2f7fbfbd25307ed2f463c7eb3bef40bfa556174e68750bb76b8d032546129 | + | |
| </ | </ | ||
| - | Vérifiez | + | Vérifiez |
| < | < | ||
| - | root@debian9:~/wordpress# docker | + | root@manager:~/docker-bench-security# cat / |
| - | CONTAINER ID IMAGE | + | ## This file is automatically generated from / |
| - | 9eb2f7fbfbd2 | + | -D |
| - | 67831dacf002 | + | -b 8192 |
| + | -f 1 | ||
| + | --backlog_wait_time 0 | ||
| + | -w /usr/bin/docker | ||
| + | -w / | ||
| + | -w /etc/docker -p wa | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w /usr/ | ||
| + | -w /usr/bin/docker-runc -p wa | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w /usr/ | ||
| + | -w / | ||
| </ | </ | ||
| - | Vérifiez que le Wordpress fonctionne | + | <WRAP center round important 50%> |
| + | **Important** - Pour plus d' | ||
| + | </ | ||
| + | |||
| + | Ré-exécutez | ||
| < | < | ||
| - | root@debian9:~/wordpress# lynx --dump http://10.0.2.60 | + | root@manager:~/docker-bench-security# ./docker-bench-security.sh |
| - | | + | ... |
| - | Select a default | + | [PASS] 1.1.4 - Ensure auditing is configured for Docker files and directories |
| + | [PASS] 1.1.5 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [PASS] 1.1.6 - Ensure auditing is configured for Docker files and directories - /etc/docker (Automated) | ||
| + | [PASS] 1.1.7 - Ensure auditing is configured for Docker files and directories - docker.service (Automated) | ||
| + | [PASS] 1.1.9 - Ensure auditing is configured for Docker files and directories - docker.socket (Automated) | ||
| + | [PASS] 1.1.10 - Ensure auditing is configured for Docker files and directories - /etc/default/docker (Automated) | ||
| + | [PASS] 1.1.12 - Ensure auditing is configured for Dockerfiles and directories - / | ||
| + | [PASS] 1.1.14 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [PASS] 1.1.15 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [PASS] 1.1.18 - Ensure auditing is configured for Docker files and directories - / | ||
| + | ... | ||
| + | </ | ||
| - | | + | =====LAB #5 - Sécurisation de la Configuration du daemon Docker===== |
| - | References | + | Exécutez de nouveau le script **docker-bench-security.sh**. Vous devez obtenir un résultat similaire à ceci en ce qui concerne la sécurité de la configuration du daemon Docker : |
| - | 1. https:// | + | < |
| + | ... | ||
| + | [INFO] 2 - Docker daemon configuration | ||
| + | [NOTE] 2.1 - Run the Docker daemon as a non-root user, if possible (Manual) | ||
| + | [WARN] 2.2 - Ensure network traffic is restricted between containers on the default bridge (Scored) | ||
| + | [PASS] 2.3 - Ensure the logging level is set to ' | ||
| + | [PASS] 2.4 - Ensure Docker is allowed to make changes to iptables (Scored) | ||
| + | [PASS] 2.5 - Ensure insecure registries are not used (Scored) | ||
| + | [PASS] 2.6 - Ensure aufs storage driver is not used (Scored) | ||
| + | [INFO] 2.7 - Ensure TLS authentication for Docker daemon is configured (Scored) | ||
| + | [INFO] | ||
| + | [INFO] 2.8 - Ensure the default ulimit is configured appropriately (Manual) | ||
| + | [INFO] | ||
| + | [WARN] 2.9 - Enable user namespace support (Scored) | ||
| + | [PASS] 2.10 - Ensure the default cgroup usage has been confirmed (Scored) | ||
| + | [PASS] 2.11 - Ensure base device size is not changed until needed (Scored) | ||
| + | [WARN] 2.12 - Ensure that authorization for Docker client commands is enabled (Scored) | ||
| + | [WARN] 2.13 - Ensure centralized and remote logging is configured (Scored) | ||
| + | [WARN] 2.14 - Ensure containers are restricted from acquiring new privileges (Scored) | ||
| + | [WARN] 2.15 - Ensure live restore is enabled (Scored) | ||
| + | [WARN] 2.16 - Ensure Userland Proxy is Disabled (Scored) | ||
| + | [PASS] 2.17 - Ensure that a daemon-wide custom seccomp profile is applied if appropriate (Manual) | ||
| + | [PASS] 2.18 - Ensure that experimental features are not implemented in production (Scored) | ||
| + | ... | ||
| + | </file> | ||
| - | root@debian9: | + | Les problèmes de sécurité qu'il convient à résoudre sont indiqués par les annotations **[WARN]**. |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | + | ||
| - | root@debian9: | + | |
| - | [1]WordPress | + | |
| - | | + | |
| - | | + | ====[WARN] 2.2 - Ensure network traffic is restricted between containers on the default bridge (Scored)==== |
| - | References | + | Par défaut Docker permet un trafic réseau sans restrictions entre des conteneurs sur le même hôte. Il est cependant possible de modifier la configuration par défaut. Pour empêcher ceci, il faut fixer la valeur de **icc** à **false**. De cette façon, docker crée des conteneurs qui peuvent communiquer entre eux **uniquement** s'il existe un lien. |
| - | | + | Pour plus d' |
| - | </code> | + | |
| - | ====1.5 - Gestion d'une Architecture de Microservices==== | + | ====[WARN] 2.9 - Enable user namespace support (Scored)==== |
| - | Vous allez mettre en place une application simple sous forme de microservices, développé | + | Cet avertissement nous indique que l' |
| - | {{ :elearning: | + | Pour plus d' |
| - | Dans cette application le conteneur **voting-app** permet de voter pour des **chats** ou des **chiens**. Cette application tourne sous Python et fournit une interface HTML : | + | ====[WARN] 2.12 - Ensure that authorization for Docker client commands is enabled (Scored)==== |
| - | {{ : | + | Par défaut, Docker permet un accès sans restrictions aux daemon Docker. Il est possible de restreindre l' |
| - | Lors de la vote, le résultat de celle-ci est stocké dans **Redis** dans une base de données en mémoire. Le résultat est ensuite passé au conteneur **Worker** qui tourne sous .NET et qui met à jour la base de données persistante dans le conteneur **db** qui tourne sous PostgreSQL. | + | Pour plus d' |
| - | L' | + | ====[WARN] 2.13 - Ensure centralized and remote logging is configured (Scored)==== |
| - | {{ : | + | Cet avertissement indique que la configuration de rsyslog ne permet pas l' |
| - | Cette application peut être mise en place sous docker avec les commandes suivantes | + | Pour plus d' |
| - | < | + | ====[WARN] 2.14 - Ensure containers are restricted from acquiring new privileges (Scored)==== |
| - | docker run -d --name=redis redis | + | |
| - | docker run -d --name=db -e POSTGRES_PASSWORD=postgres -e POSTGRES_USER=postgres postgres:9.4 | + | |
| - | docker run -d --name=vote -p 5000:80 --link redis:redis dockersamples/ | + | |
| - | docker run -d --name=result -p 5001:80 --link db:db dockersamples/ | + | |
| - | docker run -d --name=worker --link db:db --link redis:redis dockersamples/ | + | |
| - | </ | + | |
| - | Cette solution utilise | + | Par défaut |
| - | Ouvrez le navigateur web **Firefox** ou **Chrome** dans **votre** machine et saisissez l'URL selon le tableau ci-dessous : | + | Pour plus d' |
| - | ^ ID ^ URL ( Notez http: et non https: | + | ====[WARN] 2.15 - Ensure live restore is enabled |
| - | | Trainee10 | http:// | + | |
| - | | Trainee11 | http:// | + | |
| - | | Trainee12 | http:// | + | |
| - | | Trainee13 | http:// | + | |
| - | | Trainee14 | http:// | + | |
| - | | Trainee15 | http:// | + | |
| - | | Trainee16 | http:// | + | |
| - | | Trainee17 | http:// | + | |
| - | | Trainee18 | http:// | + | |
| - | | Trainee19 | http:// | + | |
| - | | Trainee20 | http:// | + | |
| - | | Trainee21 | http:// | + | |
| - | | Trainee22 | http:// | + | |
| - | | Trainee23 | http:// | + | |
| - | | Trainee24 | http:// | + | |
| - | | Trainee25 | http:// | + | |
| - | | Trainee26 | http:// | + | |
| - | | Trainee27 | http:// | + | |
| - | | Trainee28 | http:// | + | |
| - | | Trainee29 | http:// | + | |
| - | Dans la boîte | + | L' |
| - | Cliquez sur la connexion **TraineeXX_VNC** et testez ensuite votre application en utilisant le navigateur web de la machine virtuelle. | + | ====[WARN] 2.16 - Ensure Userland Proxy is Disabled (Scored)==== |
| - | =====LAB #2 - Gestion du Réseau overlay===== | + | Il existe deux méthodes pour qu'un conteneur puisse router vers l' |
| - | En plus des réseaux | + | |
| + | | ||
| - | Comme son nom indique, un réseau overlay | + | Il est préférable d' |
| - | + | ||
| - | Le trafic lié à la gestion des services swarm est crypté par défaut avec l’algorithme AES en mode GCM. Afin de crypter le trafic des données liées aux applications il est possible d' | + | |
| - | <WRAP center round important 60%> | + | Pour plus d' |
| - | **ATTENTION** : Le cryptage des données liées aux applications n'est pas compatible avec Windows(tm). Lors de la connexion du nœud Windows(tm) à un réseau overlay crypté, aucune erreur ne sera rapportée. Par contre le nœud sera incapable de communiquer. | + | |
| - | </WRAP> | + | |
| - | Commencez par re-créer un swarm en utilisant les machines virtuelles | + | ====5.1 |
| + | |||
| + | Créez le fichier | ||
| < | < | ||
| - | trainee@traineeXX: | + | root@manager: |
| - | ... | + | |
| - | root@manager: | + | |
| - | Node left the swarm. | + | |
| - | root@manager: | + | |
| - | Swarm initialized: | + | |
| - | To add a worker to this swarm, run the following command: | + | root@manager: |
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | </ | ||
| - | docker swarm join --token SWMTKN-1-23d7n1fkkk9rvlhty106q9390bfpf9daljjguq3s807le6c5qs-e0s1yqsajvmi7s8t9l9mw48ao 10.0.2.62:2377 | + | Re-démarrez le service Docker |
| - | To add a manager to this swarm, run ' | + | < |
| - | root@manager: | + | root@manager: |
| - | trainee@manager: | + | |
| </ | </ | ||
| - | ou | + | Vérifiez la présence de l' |
| < | < | ||
| - | trainee@traineeXX:~$ ssh -l trainee 10.0.2.42 | + | root@manager:~/docker-bench-security# |
| + | uid=116(dockremap) gid=121(dockremap) groupes=121(dockremap) | ||
| + | </ | ||
| + | |||
| + | Ré-exécutez le script **Docker Benchmark Security** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| ... | ... | ||
| - | root@manager: | + | [PASS] 2.2 - Ensure network traffic is restricted between containers on the default bridge (Scored) |
| - | Node left the swarm. | + | [PASS] 2.3 - Ensure |
| - | root@manager: | + | [PASS] 2.4 - Ensure Docker is allowed to make changes to iptables (Scored) |
| - | Swarm initialized: | + | [PASS] 2.5 - Ensure insecure registries are not used (Scored) |
| + | [PASS] 2.6 - Ensure aufs storage driver is not used (Scored) | ||
| + | [PASS] 2.9 - Enable user namespace support (Scored) | ||
| + | [PASS] 2.10 - Ensure the default cgroup usage has been confirmed (Scored) | ||
| + | [PASS] 2.11 - Ensure base device size is not changed until needed (Scored) | ||
| + | [PASS] 2.13 - Ensure centralized and remote logging is configured (Scored) | ||
| + | [PASS] | ||
| + | [PASS] 2.15 - Ensure live restore is enabled | ||
| + | [PASS] 2.16 - Ensure Userland Proxy is Disabled (Scored) | ||
| + | [PASS] 2.17 - Ensure that a daemon-wide custom seccomp profile is applied if appropriate (Manual) | ||
| + | [PASS] 2.18 - Ensure that experimental features are not implemented in production (Scored) | ||
| + | ... | ||
| + | </ | ||
| - | To add a worker to this swarm, run the following command: | + | Pour plus d' |
| - | docker swarm join --token SWMTKN-1-23d7n1fkkk9rvlhty106q9390bfpf9daljjguq3s807le6c5qs-e0s1yqsajvmi7s8t9l9mw48ao 10.0.2.42: | + | =====LAB #6 - Sécurisation des Images et les Fichiers de Construction===== |
| - | To add a manager | + | Créez le conteneur mysql : |
| - | root@manager: | + | |
| - | trainee@manager: | + | < |
| + | root@manager: | ||
| + | Lecture des listes de paquets... Fait | ||
| + | Construction de l'arbre des dépendances | ||
| + | Lecture des informations d' | ||
| + | Le paquet suivant a été installé automatiquement et n'est plus nécessaire : | ||
| + | libsasl2-modules | ||
| + | Veuillez utiliser « apt autoremove » pour le supprimer. | ||
| + | Les paquets suivants seront mis à jour : | ||
| + | | ||
| + | 1 mis à jour, 0 nouvellement installés, 0 à enlever et 252 non mis à jour. | ||
| + | Il est nécessaire de prendre 22,7 Mo dans les archives. | ||
| + | Après cette opération, 497 ko d'espace disque supplémentaires seront utilisés. | ||
| + | Réception de:1 https:// | ||
| + | 22,7 Mo réceptionnés en 0s (26,0 Mo/s) | ||
| + | Lecture des fichiers de modifications (« changelog »)... Terminé | ||
| + | (Lecture de la base de données... 112865 fichiers et répertoires déjà installés.) | ||
| + | Préparation du dépaquetage de .../ | ||
| + | Dépaquetage de docker-ce (5: | ||
| + | Paramétrage de docker-ce (5: | ||
| + | Traitement des actions différées (« triggers ») pour systemd (232-25+deb9u14) ... | ||
| + | |||
| + | root@manager: | ||
| + | Unable to find image ' | ||
| + | latest: Pulling from library/ | ||
| + | e9f2695d7e5b: | ||
| + | 80c6055edb33: | ||
| + | c646ab461d8b: | ||
| + | 012006c6a591: | ||
| + | 929d5fa34b95: | ||
| + | 17e0243877fa: | ||
| + | 1850b459cd2f: | ||
| + | 8dceaed53baf: | ||
| + | 197b834ea1cd: | ||
| + | 8df78c25b227: | ||
| + | Digest: sha256: | ||
| + | Status: Downloaded newer image for mysql: | ||
| + | e503dd98f88992ae6ed5ec4dcaa2e18982ade8ec74966869515a120763418f74 | ||
| + | |||
| + | root@manager:~/ | ||
| + | CONTAINER ID IMAGE | ||
| + | e503dd98f889 | ||
| </ | </ | ||
| - | Connectez-vous au **worker1** : | + | Exécutez de nouveau le script |
| < | < | ||
| - | trainee@traineeXX:~$ ssh -l trainee 10.0.2.63 | + | root@manager:~/docker-bench-security# |
| + | ... | ||
| + | [INFO] 4 - Container Images and Build File | ||
| + | [WARN] 4.1 - Ensure that a user for the container has been created (Automated) | ||
| + | [WARN] | ||
| + | [NOTE] 4.2 - Ensure that containers use only trusted base images (Manual) | ||
| + | [NOTE] 4.3 - Ensure that unnecessary packages are not installed in the container (Manual) | ||
| + | [NOTE] 4.4 - Ensure images are scanned and rebuilt to include security patches (Manual) | ||
| + | [WARN] 4.5 - Ensure Content trust for Docker is Enabled (Automated) | ||
| + | [WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images (Automated) | ||
| + | [WARN] | ||
| + | [PASS] 4.7 - Ensure update instructions are not used alone in the Dockerfile (Manual) | ||
| + | [NOTE] 4.8 - Ensure setuid and setgid permissions are removed (Manual) | ||
| + | [PASS] 4.9 - Ensure that COPY is used instead of ADD in Dockerfiles (Manual) | ||
| + | [NOTE] 4.10 - Ensure secrets are not stored in Dockerfiles (Manual) | ||
| + | [NOTE] 4.11 - Ensure only verified packages are installed (Manual) | ||
| + | [NOTE] 4.12 - Ensure all signed artifacts are validated (Manual) | ||
| ... | ... | ||
| - | root@worker1: | ||
| - | Node left the swarm. | ||
| - | root@worker1: | ||
| - | This node joined a swarm as a worker. | ||
| - | root@worker1: | ||
| - | trainee@worker1: | ||
| </ | </ | ||
| - | ou | + | ====[WARN] 4.1 - Ensure that a user for the container has been created (Automated)==== |
| + | |||
| + | Les processus dans le conteneur **mysql** tourne sous l'UID de root. Ceci est l' | ||
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | ====[WARN] 4.5 - Ensure Content trust for Docker is Enabled (Automated)==== | ||
| + | |||
| + | Cette ligne indique que le support de Content trust n'a pas été activé. Content trust permet de s' | ||
| + | |||
| + | Pour activer le Content trust, il faut positionner la valeur de la variable **DOCKER_CONTENT_TRUST** à **1** : | ||
| < | < | ||
| - | trainee@traineeXX: | + | root@manager:~/docker-bench-security# echo " |
| - | ... | + | DOCKER_CONTENT_TRUST=1 |
| - | root@worker1:~# docker swarm leave | + | |
| - | Node left the swarm. | + | root@manager:~/ |
| - | root@worker1: | + | |
| - | This node joined | + | |
| - | root@worker1:~# exit | + | |
| - | trainee@worker1:~# exit | + | |
| </ | </ | ||
| - | Connectez-vous au **worker2** : | + | Re-démarrez la machine virtuelle |
| < | < | ||
| - | trainee@traineeXX:~$ ssh -l trainee | + | root@manager:~/docker-bench-security# |
| - | ... | + | Connection to 10.0.2.62 closed by remote host. |
| - | root@worker2:~# docker swarm leave | + | Connection to 10.0.2.62 closed. |
| - | Node left the swarm. | + | |
| - | root@worker2:~# docker swarm join --token SWMTKN-1-23d7n1fkkk9rvlhty106q9390bfpf9daljjguq3s807le6c5qs-e0s1yqsajvmi7s8t9l9mw48ao | + | root@debian11:~# ssh -l trainee 10.0.2.62 |
| - | This node joined a swarm as a worker. | + | trainee@10.0.2.62' |
| - | root@worker2:~# exit | + | Linux manager.i2tch.loc 4.9.0-8-amd64 #1 SMP Debian 4.9.130-2 (2018-10-27) x86_64 |
| - | trainee@worker2:~# exit | + | |
| + | The programs included with the Debian GNU/Linux system are free software; | ||
| + | the exact distribution terms for each program are described in the | ||
| + | individual files in / | ||
| + | |||
| + | Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent | ||
| + | permitted by applicable law. | ||
| + | Last login: Sun Dec 17 18:39:07 2023 from 10.0.2.46 | ||
| + | |||
| + | trainee@manager:~$ su - | ||
| + | Mot de passe : fenestros | ||
| + | |||
| + | root@manager:~# cd docker-bench-security/ | ||
| + | |||
| + | root@manager:~/ | ||
| + | |||
| + | root@manager: | ||
| + | mysql | ||
| </ | </ | ||
| - | ou : | + | Exécutez de nouveau le script et notez le contenu de la section 4 : |
| < | < | ||
| - | trainee@traineeXX:~$ ssh -l trainee 10.0.2.44 | + | root@manager:~/docker-bench-security# |
| + | ... | ||
| + | [INFO] 4 - Container Images and Build File | ||
| + | [WARN] 4.1 - Ensure that a user for the container has been created (Automated) | ||
| + | [WARN] | ||
| + | [NOTE] 4.2 - Ensure that containers use only trusted base images (Manual) | ||
| + | [NOTE] 4.3 - Ensure that unnecessary packages are not installed in the container (Manual) | ||
| + | [NOTE] 4.4 - Ensure images are scanned and rebuilt to include security patches (Manual) | ||
| + | [PASS] 4.5 - Ensure Content trust for Docker is Enabled (Automated) | ||
| + | [WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images (Automated) | ||
| + | [WARN] | ||
| + | [PASS] 4.7 - Ensure update instructions are not used alone in the Dockerfile (Manual) | ||
| + | [NOTE] 4.8 - Ensure setuid and setgid permissions are removed (Manual) | ||
| + | [PASS] 4.9 - Ensure that COPY is used instead of ADD in Dockerfiles (Manual) | ||
| + | [NOTE] 4.10 - Ensure secrets are not stored in Dockerfiles (Manual) | ||
| + | [NOTE] 4.11 - Ensure only verified packages are installed (Manual) | ||
| + | [NOTE] 4.12 - Ensure all signed artifacts are validated (Manual) | ||
| ... | ... | ||
| - | root@worker2: | ||
| - | Node left the swarm. | ||
| - | root@worker2: | ||
| - | This node joined a swarm as a worker. | ||
| - | root@worker2: | ||
| - | trainee@worker2: | ||
| </ | </ | ||
| - | Vérifiez | + | Pour plus d' |
| + | |||
| + | ====[WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images==== | ||
| + | |||
| + | Quand une image est construite il est possible d'y mettre un **HEALTHCHECK** dont le statut peut être vérifié par Docker afin de relancer le conteneur si nécessaire. | ||
| + | |||
| + | Pour mettre en place un HEALTHCHECK, | ||
| + | |||
| + | < | ||
| + | HEALTHCHECK --interval=20s --timeout=3s CMD curl -f http:// | ||
| + | </ | ||
| + | |||
| + | Ce test permet de vérifier que le conteneur peut atteindre l'URL indiqué tous les 20 secondes et produit une erreur au bout de 3 secondes. | ||
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | =====LAB #7 - Sécurisation du Container Runtime===== | ||
| + | |||
| + | Exécutez de nouveau le script **docker-bench-security.sh**, | ||
| < | < | ||
| - | trainee@traineeXX:~$ ssh -l trainee 10.0.2.62 | + | root@manager:~/docker-bench-security# |
| + | ... | ||
| + | [INFO] 5 - Container Runtime | ||
| + | [WARN] 5.1 - Ensure that, if applicable, an AppArmor Profile is enabled (Automated) | ||
| + | [WARN] | ||
| + | [WARN] 5.2 - Ensure that, if applicable, SELinux security options are set (Automated) | ||
| + | [WARN] | ||
| + | [PASS] 5.3 - Ensure that Linux kernel capabilities are restricted within containers (Automated) | ||
| + | [PASS] 5.4 - Ensure that privileged containers are not used (Automated) | ||
| + | [PASS] 5.5 - Ensure sensitive host system directories are not mounted on containers (Automated) | ||
| + | [PASS] 5.6 - Ensure sshd is not run within containers (Automated) | ||
| + | [PASS] 5.7 - Ensure privileged ports are not mapped within containers (Automated) | ||
| + | [PASS] 5.8 - Ensure that only needed ports are open on the container (Manual) | ||
| + | [PASS] 5.9 - Ensure that the host's network namespace is not shared (Automated) | ||
| + | [WARN] 5.10 - Ensure that the memory usage for containers is limited (Automated) | ||
| + | [WARN] | ||
| + | [WARN] 5.11 - Ensure that CPU priority is set appropriately on containers (Automated) | ||
| + | [WARN] | ||
| + | [WARN] 5.12 - Ensure that the container' | ||
| + | [WARN] | ||
| + | [PASS] 5.13 - Ensure that incoming container traffic is bound to a specific host interface (Automated) | ||
| + | [WARN] 5.14 - Ensure that the ' | ||
| + | [WARN] | ||
| + | [PASS] 5.15 - Ensure that the host's process namespace is not shared (Automated) | ||
| + | [PASS] 5.16 - Ensure that the host's IPC namespace is not shared (Automated) | ||
| + | [PASS] 5.17 - Ensure that host devices are not directly exposed to containers (Manual) | ||
| + | [INFO] 5.18 - Ensure that the default ulimit is overwritten at runtime if needed (Manual) | ||
| + | [INFO] | ||
| + | [PASS] 5.19 - Ensure mount propagation mode is not set to shared (Automated) | ||
| + | [PASS] 5.20 - Ensure that the host's UTS namespace is not shared (Automated) | ||
| + | [PASS] 5.21 - Ensure the default seccomp profile is not Disabled (Automated) | ||
| + | [NOTE] 5.22 - Ensure that docker exec commands are not used with the privileged option (Automated) | ||
| + | [NOTE] 5.23 - Ensure that docker exec commands are not used with the user=root option (Manual) | ||
| + | [PASS] 5.24 - Ensure that cgroup usage is confirmed (Automated) | ||
| + | [PASS] 5.25 - Ensure that the container is restricted from acquiring additional privileges (Automated) | ||
| + | [WARN] 5.26 - Ensure that container health is checked at runtime (Automated) | ||
| + | [WARN] | ||
| + | [INFO] 5.27 - Ensure that Docker commands always make use of the latest version of their image (Manual) | ||
| + | [WARN] 5.28 - Ensure that the PIDs cgroup limit is used (Automated) | ||
| + | [WARN] | ||
| + | [INFO] 5.29 - Ensure that Docker' | ||
| + | [INFO] | ||
| + | [PASS] 5.30 - Ensure that the host's user namespaces are not shared (Automated) | ||
| + | [PASS] 5.31 - Ensure that the Docker socket is not mounted inside any containers (Automated) | ||
| ... | ... | ||
| - | root@manager: | ||
| - | ID HOSTNAME | ||
| - | b85hxlixbr1mh1txd1hrfe4us * | ||
| - | 4sui75vvdhmet4qvt0zbvzlzl | ||
| - | lbjtg5o9kw3x6xg7frm07jfuw | ||
| - | root@manager: | ||
| - | ID HOSTNAME | ||
| - | b85hxlixbr1mh1txd1hrfe4us * | ||
| - | root@manager: | ||
| - | ID HOSTNAME | ||
| - | 4sui75vvdhmet4qvt0zbvzlzl | ||
| - | lbjtg5o9kw3x6xg7frm07jfuw | ||
| </ | </ | ||
| - | ou : | + | Les problèmes de sécurité qu'il convient à résoudre sont indiqués par les annotations **[WARN]**. |
| + | |||
| + | ====[WARN] 5.1 - Ensure that, if applicable, an AppArmor Profile is enabled (Automated)==== | ||
| + | |||
| + | Cet avertissement est présent parce que le conteneur n' | ||
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | ====[WARN] 5.2 - Ensure that, if applicable, SELinux security options are set (Automated)==== | ||
| + | |||
| + | Cet avertissement est présent parce que le conteneur n' | ||
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | ====[WARN] 5.10 - Ensure that the memory usage for containers is limited (Automated)==== | ||
| + | |||
| + | Cet avertissement est du au fait que les conteneurs ont automatiquement accès à la totalité de la RAM de l' | ||
| < | < | ||
| - | trainee@traineeXX:~$ ssh -l trainee 10.0.2.42 | + | root@manager:~# docker run -d -p 8081:80 nginx |
| - | ... | + | b04b2a6f0dd93da21a8b7640afc319406e42868a141f90936dbcf52ab5bffb0d |
| - | root@manager: | + | root@manager: |
| - | ID | + | CONTAINER |
| - | b85hxlixbr1mh1txd1hrfe4us * | + | b04b2a6f0dd9 |
| - | 4sui75vvdhmet4qvt0zbvzlzl | + | ^C |
| - | lbjtg5o9kw3x6xg7frm07jfuw | + | |
| - | root@manager: | + | |
| - | ID HOSTNAME | + | |
| - | b85hxlixbr1mh1txd1hrfe4us * | + | |
| - | root@manager: | + | |
| - | ID HOSTNAME | + | |
| - | 4sui75vvdhmet4qvt0zbvzlzl | + | |
| - | lbjtg5o9kw3x6xg7frm07jfuw | + | |
| </ | </ | ||
| - | Vérifiez la présence du réseau overlay **ingress** ainsi que le réseau ponté **docker_gwbridge** | + | Supprimez |
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | NETWORK ID NAME DRIVER | + | Unable to find image ' |
| - | 4edb7186dcc9 | + | sha256: |
| - | d4c9b0c9437a | + | 1f7ce2fa46ab: |
| - | f3cb3bc3c581 | + | 9b16c94bb686: |
| - | r8htcvc8oxmz | + | 9a59d19f9c5b: |
| - | de563e30d473 | + | 9ea27b074f71: |
| + | c6edf33e2524: | ||
| + | 84b1ff10387b: | ||
| + | 517357831967: | ||
| + | Digest: sha256: | ||
| + | Status: Downloaded newer image for nginx@sha256: | ||
| + | Tagging nginx@sha256: | ||
| + | e14d5112c2feb71e6f37252bcf99d03603d6b7a3e200bff0d55611a0e9a25e2b | ||
| + | |||
| + | root@manager: | ||
| + | CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O PIDS | ||
| + | e14d5112c2fe | ||
| + | e503dd98f889 | ||
| + | ^C | ||
| </ | </ | ||
| - | <WRAP center round info 60%> | + | Supprimez |
| - | **Info** : Le réseau **docker_gwbridge** relie le réseau **ingress** à l' | + | |
| - | </ | + | |
| - | <WRAP center round tip 60%> | + | <code> |
| - | **Best Practice** | + | root@manager:~/ |
| - | </WRAP> | + | CONTAINER ID IMAGE |
| + | e14d5112c2fe | ||
| + | e503dd98f889 | ||
| - | ====2.2 | + | root@manager: |
| + | e14 | ||
| - | A partir du Manager, créez un réseau de type overlay appelé **nginx-net** : | + | root@manager: |
| + | 38e91e096c83f7cbe78089617a4d70110bd273f53339f8fed8df2503d3cd65ca | ||
| - | < | + | root@manager: |
| - | root@manager: | + | CONTAINER |
| - | j57jhtug4kjxp22ai1y664lqr | + | 38e91e096c83 |
| - | root@manager: | + | e503dd98f889 |
| - | NETWORK | + | ^C |
| - | dde514eea83f | + | |
| - | d4c9b0c9437a | + | |
| - | f3cb3bc3c581 | + | |
| - | r8htcvc8oxmz | + | |
| - | j57jhtug4kjx | + | |
| - | de563e30d473 | + | |
| </ | </ | ||
| - | ====2.2 - Création | + | Pour plus d'informations, |
| - | Créez un service nginx qui utilise le réseau **nginx-net** : | + | ====[WARN] 5.11 - Ensure that CPU priority is set appropriately on containers (Automated)==== |
| - | < | + | Cet avertissement est du au fait que les conteneurs ont automatiquement accès à tous les CPU de l' |
| - | root@manager: | + | |
| - | fpydgix3e1rc1qum72gvwcb7f | + | |
| - | overall progress: 5 out of 5 tasks | + | |
| - | 1/5: running | + | |
| - | 2/5: running | + | |
| - | 3/5: running | + | |
| - | 4/5: running | + | |
| - | 5/5: running | + | |
| - | verify: Service converged | + | |
| - | </ | + | |
| - | <WRAP center round info 60%> | + | La valeur de cpu-shares est relative à la valeur par défaut de **1024**. Un valeur |
| - | **Info** : Le service publie le port 80 qui est visible | + | |
| - | </WRAP> | + | Pour plus d' |
| - | Vérifiez que le service fonctionne avant de poursuivre | + | ====[WARN] 5.12 - Ensure that the container' |
| + | |||
| + | Afin de minimiser | ||
| + | |||
| + | Créez le fichier **write_a_file** dans le conteneur **mysql** | ||
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | ID NAME MODE REPLICAS | + | |
| - | fpydgix3e1rc | + | |
| </ | </ | ||
| - | Consultez maintenant | + | La Commande **docker container diff** indique |
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | [ | + | C /run |
| - | { | + | C /run/mysqld |
| - | " | + | A / |
| - | " | + | A / |
| - | " | + | A / |
| - | }, | + | A / |
| - | " | + | A /run/mysqld/ |
| - | " | + | A /write_a_file |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | }, | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | } | + | |
| - | ], | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | } | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | }, | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ], | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | } | + | |
| - | } | + | |
| - | ] | + | |
| </ | </ | ||
| - | <WRAP center round important | + | <WRAP center round important |
| - | **Important** : Notez ici les informations concernant les ports et les Endpoints utilisés par le service. | + | **Important** : Notez que la sortie indique |
| </ | </ | ||
| - | ====2.3 - Déplacer | + | Arrêtez et supprimez |
| - | Consultez le réseau overlay **nginx-net** sur les trois nœuds | + | < |
| + | root@manager:~/ | ||
| + | mysql | ||
| - | < | + | root@manager: |
| - | root@manager: | + | mysql |
| - | [ | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | }, | + | |
| - | " | + | |
| - | "com.docker.network.driver.overlay.vxlanid_list": | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | } | + | |
| - | ] | + | |
| </ | </ | ||
| + | |||
| + | Lancez un conteneur mysql en lecture seule : | ||
| < | < | ||
| - | root@worker1:~# docker | + | root@manager:~/ |
| - | [ | + | 711ab28bdfb41220c84246c1658bcde398681a78291bbbe7d3bbfd9bc317d41b |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | "lb-nginx-net": { | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | } | + | |
| - | ] | + | |
| </ | </ | ||
| + | |||
| + | Créez le fichier **write_a_file** dans le conteneur **mysql** : | ||
| < | < | ||
| - | root@worker2:~# docker | + | root@manager:~/docker-bench-security# docker container exec mysql touch /write_a_file |
| - | [ | + | touch: cannot touch '/write_a_file' |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | } | + | |
| - | ] | + | |
| </ | </ | ||
| - | <WRAP center round important | + | <WRAP center round important |
| - | **Important** : Notez que le réseau | + | **Important** : Notez l' |
| </ | </ | ||
| - | Créez maintenant un deuxième réseau de type overlay, appelé | + | Exécutez la commande |
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | aez5huut9hd472qmldzf2tsud | + | root@manager: |
| </ | </ | ||
| - | Déplacez | + | <WRAP center round important 50%> |
| + | **Important** : Notez que la commande ne retourne aucune sortie. En effet le conteneur étant en lecture seule, aucun changement ne peut intervenir. | ||
| + | </ | ||
| + | |||
| + | ====[WARN] 5.14 - Ensure that the ' | ||
| + | |||
| + | Cet avertissement concerne la politique de re-démarrage du conteneur. La politique | ||
| + | |||
| + | # docker container run -d --name mysql --read-only --restart on-failure: | ||
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | ====[WARN] 5.26 - Ensure that container health is checked at runtime (Automated)==== | ||
| + | |||
| + | Voir l' | ||
| + | |||
| + | ====[WARN] 5.28 - Ensure that the PIDs cgroup limit is used (Automated)==== | ||
| + | |||
| + | Sans l' | ||
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | my-nginx | + | |
| - | overall progress: 5 out of 5 tasks | + | |
| - | 1/5: running | + | |
| - | 2/5: running | + | |
| - | 3/5: running | + | |
| - | 4/5: running | + | |
| - | 5/5: running | + | |
| - | verify: Service converged | + | |
| </ | </ | ||
| - | Vérifiez que le service fonctionne avant de poursuivre | + | L' |
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | ID NAME MODE REPLICAS | + | Unable to find image ' |
| - | fpydgix3e1rc | + | sha256: |
| + | a48641193673: | ||
| + | Digest: sha256: | ||
| + | Status: Downloaded newer image for ubuntu@sha256: | ||
| + | Tagging ubuntu@sha256: | ||
| + | environment: fork: retry: Resource temporarily unavailable | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | ^P^Q | ||
| </ | </ | ||
| - | Vérifiez qu'aucun conteneur se trouve dans le réseau | + | Pour plus d'informations, |
| + | |||
| + | Supprimez maintenant tous les conteneurs déjà créées | ||
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | [ | + | db5ae43c3e55 |
| - | { | + | f3b2528fbac0 |
| - | " | + | 711ab28bdfb4 |
| - | " | + | |
| - | " | + | root@manager:~/docker-bench-security# |
| - | " | + | CONTAINER ID IMAGE |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | "com.docker.network.driver.overlay.vxlanid_list": | + | |
| - | | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| </ | </ | ||
| - | Vérifiez maintenant que les conteneurs se trouvent dans le réseau **nginx-net-2** : | + | Re-créez le conteneur mysql en intégrant les points vus ci-dessus |
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | [ | + | f49d1ffdeae2e83435e8cc3a2e03fb2e0b33e5609d266e5a3403ff8859e5d122 |
| - | { | + | |
| - | " | + | root@manager:~/docker-bench-security# |
| - | " | + | CONTAINER ID IMAGE |
| - | " | + | f49d1ffdeae2 |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | "lb-nginx-net-2": { | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | | + | |
| - | "Options": | + | |
| - | "com.docker.network.driver.overlay.vxlanid_list": " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | } | + | |
| - | ] | + | |
| </ | </ | ||
| - | Supprimez maintenant | + | Exécutez de nouveau |
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | my-nginx | + | ... |
| - | root@manager: | + | [PASS] 5.2 - Ensure that, if applicable, SELinux security options are set (Automated) |
| - | nginx-net | + | [PASS] 5.10 - Ensure that the memory usage for containers is limited (Automated) |
| - | nginx-net-2 | + | [PASS] 5.11 - Ensure that CPU priority is set appropriately on containers (Automated) |
| + | [PASS] 5.12 - Ensure that the container' | ||
| + | [PASS] 5.14 - Ensure that the ' | ||
| + | [PASS] 5.28 - Ensure that the PIDs cgroup limit is used (Automated) | ||
| + | ... | ||
| </ | </ | ||
| - | ====2.4 - DNS container discovery==== | + | =====LAB #8 - Sécurisation des Images avec Docker Content Trust===== |
| - | Le daemon | + | **Docker |
| - | Pour que le **DNS container discovery** fonctionne, les ports suivants doivent | + | DCT est utilisé par le **Docker Hub Registry** mais peut aussi être mis en place dans des Registry privés, notamment grâce à la mise en place du **[[https:// |
| - | | + | DCT est basé sur l' |
| - | | + | |
| - | * 7946/udp | + | |
| - | | + | |
| - | Créez maintenant le réseau de type overlay | + | Pour plus d' |
| - | < | + | ====8.1 |
| - | root@manager: | + | |
| - | hrs25w4l951kkickhj6262mjg | + | |
| - | </ | + | |
| - | <WRAP center round important 60%> | + | Pour utiliser |
| - | **Important** : Notez que le **NETWORK-ID** ici est **hrs25w4l951kkickhj6262mjg**. | + | |
| - | </ | + | |
| - | + | ||
| - | Sur le Manager, démarrez un conteneur interactif appelé **alpine1** et qui se connecte au réseau **test-net** : | + | |
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | Unable to find image ' | + | 1 |
| - | latest: Pulling from library/ | + | |
| - | 89d9c30c1d48: | + | |
| - | Digest: sha256: | + | |
| - | Status: Downloaded newer image for alpine: | + | |
| - | / # | + | |
| </ | </ | ||
| - | Listez les réseaux disponibles sur **Worker1** | + | Dans le cas contraire, il faut fixer la valeur de la variable à 1 : |
| < | < | ||
| - | root@worker1:~# docker network ls | + | root@manager:~# export DOCKER_CONTENT_TRUST=1 |
| - | NETWORK ID NAME DRIVER | + | root@manager: |
| - | 3fe43b514f9d | + | 1 |
| - | ee22b3e623ca | + | |
| - | f3cb3bc3c581 | + | |
| - | r8htcvc8oxmz | + | |
| - | de563e30d473 | + | |
| </ | </ | ||
| - | <WRAP center round important 60%> | + | ====8.2 - DCT et la commande docker pull==== |
| - | **Important** : Notez que le réseau **test-net** n'a pas été créé. | + | |
| - | </ | + | |
| - | Démarrez maintenant | + | Afin d' |
| < | < | ||
| - | root@worker1:~# docker | + | root@manager:~# docker |
| - | Unable | + | Login with your Docker ID to push and pull images from Docker Hub. If you don't have a Docker ID, head over to https:// |
| - | latest: Pulling from library/alpine | + | Username: < |
| - | 89d9c30c1d48: Pull complete | + | Password: < |
| - | Digest: sha256: | + | WARNING! Your password will be stored unencrypted in / |
| - | Status: Downloaded newer image for alpine: | + | Configure a credential helper to remove this warning. See |
| - | 5734e84cd460cdd33ce90970d98a96837a0305832a86fc4d86be38aecf51b23b | + | https:// |
| + | |||
| + | Login Succeeded | ||
| </ | </ | ||
| - | Saisissez la commande | + | Pour constater l' |
| < | < | ||
| - | root@worker1:~# docker | + | root@manager:~# docker |
| - | NETWORK ID NAME DRIVER | + | Error: remote trust data does not exist for docker.io/ |
| - | 3fe43b514f9d | + | |
| - | ee22b3e623ca | + | |
| - | f3cb3bc3c581 | + | |
| - | r8htcvc8oxmz | + | |
| - | de563e30d473 | + | |
| - | hrs25w4l951k | + | |
| </ | </ | ||
| - | <WRAP center round important | + | <WRAP center round important |
| - | **Important** : Notez que le réseau | + | **Important** : Notez l' |
| </ | </ | ||
| - | Listez | + | Par contre, toutes |
| < | < | ||
| - | root@worker2:~# docker | + | root@manager:~# docker |
| - | NETWORK ID NAME DRIVER | + | Using default tag: latest |
| - | ff7308310f60 | + | Pull (1 of 1): centos: |
| - | 0ce1d8369c29 | + | sha256: |
| - | f3cb3bc3c581 | + | 729ec3a6ada3: |
| - | r8htcvc8oxmz | + | Digest: sha256: |
| - | de563e30d473 | + | Status: Downloaded newer image for centos@sha256: |
| + | Tagging centos@sha256: | ||
| + | docker.io/ | ||
| </ | </ | ||
| - | <WRAP center round important 60%> | + | Cette image est maintenant présente sur **manager.i2tch.loc** : |
| - | **Important** : Notez que le réseau **test-net** n'a pas été créé. | + | |
| - | </ | + | |
| - | + | ||
| - | Attachez vous au conteneur **alpine2** sur **Worker1** et essayez de contacter le conteneur **alpine1** : | + | |
| < | < | ||
| - | root@worker1:~# docker | + | root@manager:~# docker |
| - | CONTAINER | + | REPOSITORY |
| - | ce9097b864dc | + | ubuntu |
| - | root@worker1: | + | nginx |
| - | / # ping -c 2 alpine1 | + | alpine |
| - | PING alpine1 (10.0.2.2): 56 data bytes | + | mysql |
| - | 64 bytes from 10.0.2.2: seq=0 ttl=64 time=1.874 ms | + | centos |
| - | 64 bytes from 10.0.2.2: seq=1 ttl=64 time=1.669 ms | + | </ |
| - | --- alpine1 ping statistics --- | + | ===L' |
| - | 2 packets transmitted, | + | |
| - | round-trip min/ | + | |
| - | / # | + | |
| - | </ | + | |
| - | Retournez dans la VM **Manager** et essayez | + | Il est aussi possible d' |
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | / # ping -c 2 alpine2 | + | unsigned: Pulling from i2tch/docker |
| - | PING alpine2 (10.0.0.4): 56 data bytes | + | 10d70a43a9f9: Pull complete |
| - | 64 bytes from 10.0.0.4: seq=0 ttl=64 time=0.666 ms | + | 4f4fb700ef54: Pull complete |
| - | 64 bytes from 10.0.0.4: seq=1 ttl=64 time=1.239 ms | + | 8951e3a91277: Pull complete |
| + | d1814ff35b8b: | ||
| + | ff2a2bbf6141: | ||
| + | b7205da5c3c9: | ||
| + | 458ea241cc75: | ||
| + | 74d1c0702786: | ||
| + | c66f3692932d: | ||
| + | 9224bd1b9757: | ||
| + | Digest: sha256: | ||
| + | Status: Downloaded newer image for i2tch/ | ||
| + | docker.io/ | ||
| - | --- alpine2 ping statistics --- | + | root@manager: |
| - | 2 packets transmitted, | + | REPOSITORY |
| - | round-trip min/avg/max = 0.666/0.952/1.239 ms | + | ubuntu |
| - | / # | + | nginx |
| + | alpine | ||
| + | mysql | ||
| + | centos | ||
| + | i2tch/docker | ||
| + | |||
| + | root@manager: | ||
| + | Untagged: i2tch/docker: | ||
| + | Untagged: i2tch/docker@sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| </ | </ | ||
| - | Créez ensuite le conteneur | + | ====8.3 - DCT et la commande docker push==== |
| + | |||
| + | Pour envoyer l' | ||
| < | < | ||
| - | root@worker2:~# docker | + | root@manager:~# docker image tag alpine: |
| - | Unable to find image 'alpine: | + | </code> |
| - | latest: Pulling from library/alpine | + | |
| - | c9b1b535fdd9: Pull complete | + | |
| - | Digest: sha256: | + | |
| - | Status: Downloaded newer image for alpine:latest | + | |
| - | / # ping -c 2 alpine1 | + | |
| - | PING alpine1 (10.0.2.2): 56 data bytes | + | |
| - | 64 bytes from 10.0.2.2: seq=0 ttl=64 time=0.642 ms | + | |
| - | 64 bytes from 10.0.2.2: seq=1 ttl=64 time=1.684 ms | + | |
| - | --- alpine1 ping statistics --- | + | L' |
| - | 2 packets transmitted, | + | |
| - | round-trip min/avg/max = 0.642/1.163/1.684 ms | + | < |
| - | / # exit | + | root@manager: |
| + | REPOSITORY | ||
| + | ubuntu | ||
| + | nginx latest | ||
| + | < | ||
| + | alpine | ||
| + | mysql latest | ||
| + | centos | ||
| </ | </ | ||
| - | Arrêtez maintenant | + | Lors du push vers le registry privé, il faut créer des passphrases pour **deux** clefs : |
| + | |||
| + | | ||
| + | * la **repository** key aussi connue sous le nom **tagging** key (ID 168c754), utilisée pour signer l' | ||
| < | < | ||
| - | root@worker1:~# docker | + | root@manager:~# docker |
| - | alpine2 | + | The push refers to repository [docker.io/< |
| + | 77cae8ab23bf: | ||
| + | alpine: digest: sha256: | ||
| + | Signing and pushing trust metadata | ||
| + | You are about to create a new root signing key passphrase. This passphrase | ||
| + | will be used to protect the most sensitive key in your signing system. Please | ||
| + | choose a long, complex passphrase and be careful to keep the password and the | ||
| + | key file itself secure and backed up. It is highly recommended that you use a | ||
| + | password manager to generate the passphrase and keep it safe. There will be no | ||
| + | way to recover this key. You can find the key in your config directory. | ||
| + | Enter passphrase for new root key with ID 192fc7e: fenestros | ||
| + | Repeat passphrase for new root key with ID 192fc7e: fenestros | ||
| + | Enter passphrase for new repository key with ID 168c754: fenestros | ||
| + | Repeat passphrase for new repository key with ID 168c754: fenestros | ||
| + | Finished initializing " | ||
| + | Successfully signed docker.io/< | ||
| </ | </ | ||
| - | Saisissez la commande | + | Les clefs sont stockées dans le répertoire |
| < | < | ||
| - | root@worker1:~# docker | + | root@manager:~# ls -l ~/.docker/trust |
| - | NETWORK ID NAME DRIVER | + | total 8 |
| - | 3bb80f391804 | + | drwx------ 2 root root 4096 nov. 10 14:49 private |
| - | ee22b3e623ca | + | drwx------ 3 root root 4096 nov. 8 13:48 tuf |
| - | f3cb3bc3c581 | + | |
| - | r8htcvc8oxmz | + | root@manager: |
| - | de563e30d473 | + | total 8 |
| + | -rw------- 1 root root 447 nov. 10 14:49 168c754ea8f36ce7fbcbe2299b6d91fc0f4d594c9ed9b86916687b618d8438ac.key | ||
| + | -rw------- 1 root root 416 nov. 10 14:49 192fc7ed9543ad4bceec58886ab1d605b7433c35f7462d7343d0780d8fddf1db.key | ||
| + | root@manager: | ||
| + | -----BEGIN ENCRYPTED PRIVATE KEY----- | ||
| + | gun: docker.io/ | ||
| + | role: targets | ||
| + | |||
| + | MIHuMEkGCSqGSIb3DQEFDTA8MBsGCSqGSIb3DQEFDDAOBAhm7HwR0y8FFAICCAAw | ||
| + | HQYJYIZIAWUDBAEqBBC729tU73wKHFQSbmZ1EVZaBIGgmGiFSs4lM5tElSGukl1B | ||
| + | HrELT9aFooFgW7oSXNLM8aFfF/ | ||
| + | 3m40g3MywHilW4rUcjoHVTTUXABGXUQ3f7h+nI15CXcZ11qRLyWbf2uywE9yYH9O | ||
| + | M7GLUcE+pTENJKfZAhRGBEL+LgXNfGI1aAVqaEbBDcDnKKf4Uj1Xu4oLJ7je8+nT | ||
| + | dg== | ||
| + | -----END ENCRYPTED PRIVATE KEY----- | ||
| + | |||
| + | root@manager: | ||
| + | -----BEGIN ENCRYPTED PRIVATE KEY----- | ||
| + | role: root | ||
| + | |||
| + | MIHuMEkGCSqGSIb3DQEFDTA8MBsGCSqGSIb3DQEFDDAOBAiAtCzEar3AhgICCAAw | ||
| + | HQYJYIZIAWUDBAEqBBAO7hHWVoqOo6xcETQQDXRdBIGgPUoLzTz07Ajx8K3D8+Vv | ||
| + | 2NUiflMYhH/ | ||
| + | V2BwSlXp7t1Cnqp/ | ||
| + | KREO8uEq3v7HcSBBqFm0+TU+92d7hVuDApPaj0lZYP+3f7H6AjUOqu6hUoK8Ck/ | ||
| + | Ig== | ||
| + | -----END ENCRYPTED PRIVATE KEY----- | ||
| </ | </ | ||
| - | <WRAP center round important 60%> | + | ====8.4 - DCT et la commande docker build==== |
| - | **Important** : Notez que le réseau **test-net** a été supprimé. | + | |
| - | </ | + | |
| - | Supprimez le conteneur **alpine2**: | + | L' |
| < | < | ||
| - | root@worker1:~# docker | + | root@manager:~# mkdir nottrusted |
| - | alpine2 | + | |
| + | root@manager: | ||
| + | |||
| + | root@manager: | ||
| + | |||
| + | root@manager: | ||
| + | FROM docker/ | ||
| + | RUN echo | ||
| </ | </ | ||
| - | Arrêtez le conteneur | + | Lors du build de l' |
| < | < | ||
| - | / # exit | + | root@manager: |
| - | root@manager: | + | Sending build context to Docker daemon |
| - | alpine1 | + | |
| - | root@manager:~# docker network ls | + | error during connect: Post http:// |
| - | NETWORK ID NAME DRIVER | + | |
| - | a604e7db6f95 | + | |
| - | d4c9b0c9437a | + | |
| - | f3cb3bc3c581 | + | |
| - | jxu667wzmj2u | + | |
| - | de563e30d473 | + | |
| - | 518l09lcjhsp | + | |
| - | root@manager:~# docker | + | |
| - | test-net | + | |
| </ | </ | ||
| - | ====2.5 - Création d'un Réseau overlay Personnalisé==== | + | L'utilisation |
| - | + | ||
| - | Il est possible | + | |
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | WARNING! Before removing the routing-mesh network, make sure all the nodes in your swarm run the same docker | + | Sending build context to Docker daemon |
| - | Are you sure you want to continue? [y/N] y | + | Step 1/2 : FROM docker/ |
| - | ingress | + | latest: Pulling from docker/ |
| + | Image docker.io/ | ||
| + | aac0c133338d: | ||
| + | a3ed95caeb02: | ||
| + | Digest: sha256: | ||
| + | Status: Downloaded newer image for docker/ | ||
| + | | ||
| + | Step 2/2 : RUN echo | ||
| + | | ||
| + | |||
| + | Removing intermediate container 694e79d3cd88 | ||
| + | | ||
| + | Successfully built 686e85ee76b8 | ||
| + | Successfully tagged < | ||
| </ | </ | ||
| - | Créez ensuite votre réseau personnalisé | + | Lors du push de l' |
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | 44ozn3vtg23zkksrvloxuulcl | + | The push refers to repository [docker.io/< |
| - | root@manager:~# docker | + | 5f70bf18a086: |
| - | NETWORK ID NAME DRIVER | + | c22f7bc058a9: Mounted from docker/ |
| - | 24be8a0f0ef5 | + | nottrusted: digest: sha256: |
| - | d4c9b0c9437a | + | Signing and pushing trust metadata |
| - | f3cb3bc3c581 | + | Enter passphrase for repository key with ID 168c754: fenestros |
| - | 44ozn3vtg23z | + | Successfully signed docker.io/< |
| - | de563e30d473 | + | |
| </ | </ | ||
| - | Créez | + | <WRAP center round important 50%> |
| + | **Important** : Notez l' | ||
| + | </ | ||
| + | |||
| + | ===Créer un deuxième Repositry=== | ||
| + | |||
| + | Par contre en modifiant | ||
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | gp1iozmbi25dx3skn00m6suoz | + | |
| - | overall progress: 5 out of 5 tasks | + | |
| - | 1/5: running | + | |
| - | 2/5: running | + | |
| - | 3/5: running | + | |
| - | 4/5: running | + | |
| - | 5/5: running | + | |
| - | verify: Service converged | + | |
| - | root@manager: | + | root@manager: |
| - | ID | + | REPOSITORY |
| - | gp1iozmbi25d | + | < |
| + | < | ||
| + | ubuntu | ||
| + | nginx latest | ||
| + | < | ||
| + | alpine | ||
| + | mysql latest | ||
| + | centos | ||
| + | docker/ | ||
| - | root@manager: | + | root@manager: |
| - | ID NAME IMAGE | + | The push refers to repository [docker.io/< |
| - | upmbwmtr76cm | + | 5f70bf18a086: Mounted from < |
| - | qz6p1li7zmef | + | c22f7bc058a9: Mounted from < |
| - | me50mkhd11yk | + | latest: digest: sha256: |
| - | sctjud70ihkl | + | Signing and pushing trust metadata |
| - | kql9qx3phb73 | + | Enter passphrase for root key with ID 192fc7e: fenestros |
| + | Enter passphrase for new repository key with ID 7b13d02: fenestros | ||
| + | Repeat passphrase for new repository key with ID 7b13d02: fenestros | ||
| + | Finished initializing " | ||
| + | Successfully signed docker.io/< | ||
| </ | </ | ||
| - | Consultez les informations concernant | + | <WRAP center round important 50%> |
| + | **Important** : Notez la création d'une deuxième repositry key (ID 7b13d02 au lieu de ID 168c754) lors du push de l' | ||
| + | </ | ||
| + | |||
| + | La présence de cette deuxième repositry key (**7b13d02d74264624fb201e7ae13ae694286b9f761aa86adddefd0408c7234a58.key**) peut être constatée dans le répertoire | ||
| < | < | ||
| - | root@manager: | + | root@manager: |
| + | total 12 | ||
| + | -rw------- 1 root root 447 nov. 10 14:49 168c754ea8f36ce7fbcbe2299b6d91fc0f4d594c9ed9b86916687b618d8438ac.key | ||
| + | -rw------- 1 root root 416 nov. 10 14:49 192fc7ed9543ad4bceec58886ab1d605b7433c35f7462d7343d0780d8fddf1db.key | ||
| + | -rw------- 1 root root 451 nov. 10 17:37 7b13d02d74264624fb201e7ae13ae694286b9f761aa86adddefd0408c7234a58.key | ||
| + | </ | ||
| + | |||
| + | En inspectant les clefs des images créées, l' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| [ | [ | ||
| { | { | ||
| - | "ID": "gp1iozmbi25dx3skn00m6suoz", | + | "Name": "< |
| - | " | + | "SignedTags": |
| - | | + | { |
| - | }, | + | "SignedTag": "alpine", |
| - | "CreatedAt": | + | "Digest": "e4355b66995c96b4b468159fc5c7e3540fcef961189ca13fee877798649f531a", |
| - | " | + | "Signers": |
| - | " | + | "Repo Admin" |
| - | | + | |
| - | " | + | } |
| - | " | + | ], |
| - | "ContainerSpec": | + | "Signers": |
| - | | + | "AdministrativeKeys": |
| - | " | + | { |
| - | " | + | "Name": "Root", |
| - | " | + | "Keys": |
| - | " | + | { |
| - | }, | + | "ID": "d4074334a4ff5a9a43ebd1320ad77c2df88c990ec812f90eb045c603c01ab698" |
| - | "Resources": | + | } |
| - | | + | |
| - | " | + | |
| - | }, | + | |
| - | "RestartPolicy": | + | |
| - | "Condition": " | + | |
| - | " | + | |
| - | " | + | |
| - | | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | | + | |
| - | { | + | |
| - | " | + | |
| - | }, | + | |
| - | { | + | |
| - | | + | |
| - | "OS": | + | |
| - | }, | + | |
| - | | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | }, | + | |
| - | "ForceUpdate": | + | |
| - | | + | |
| - | }, | + | |
| - | " | + | |
| - | "Replicated": | + | |
| - | | + | |
| - | } | + | |
| - | }, | + | |
| - | " | + | |
| - | "Parallelism": | + | |
| - | | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | | + | |
| - | " | + | |
| - | | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| }, | }, | ||
| - | | + | { |
| - | "Mode": "vip", | + | "Name": "Repository", |
| - | "Ports": [ | + | "Keys": [ |
| { | { | ||
| - | "Protocol": "tcp", | + | "ID": "168c754ea8f36ce7fbcbe2299b6d91fc0f4d594c9ed9b86916687b618d8438ac" |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| } | } | ||
| ] | ] | ||
| } | } | ||
| - | }, | + | |
| - | "Endpoint": { | + | |
| - | "Spec": { | + | ] |
| - | "Mode": "vip", | + | root@manager: |
| - | "Ports": [ | + | [ |
| + | { | ||
| + | " | ||
| + | "SignedTags": | ||
| + | | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | "Repo Admin" | ||
| + | ] | ||
| + | | ||
| + | ], | ||
| + | | ||
| + | " | ||
| + | | ||
| + | "Name": "Root", | ||
| + | "Keys": [ | ||
| { | { | ||
| - | "Protocol": "tcp", | + | "ID": "d4074334a4ff5a9a43ebd1320ad77c2df88c990ec812f90eb045c603c01ab698" |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| } | } | ||
| ] | ] | ||
| }, | }, | ||
| - | | + | |
| - | | + | "Name": "Repository", |
| - | | + | "Keys": [ |
| - | " | + | { |
| - | " | + | "ID": "168c754ea8f36ce7fbcbe2299b6d91fc0f4d594c9ed9b86916687b618d8438ac" |
| - | " | + | |
| - | | + | |
| - | ], | + | |
| - | | + | |
| - | { | + | |
| - | "NetworkID": "44ozn3vtg23zkksrvloxuulcl", | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| } | } | ||
| ] | ] | ||
| </ | </ | ||
| - | Vérifiez maintenant que les conteneurs se trouvent dans le réseau | + | <WRAP center round important 50%> |
| + | **Important** : Notez que les clefs utilisées sont les mêmes pour les deux images. | ||
| + | </ | ||
| < | < | ||
| - | root@manager: | + | root@manager: |
| [ | [ | ||
| { | { | ||
| - | " | + | " |
| - | " | + | "SignedTags": [ |
| - | "Created": | + | { |
| - | " | + | "SignedTag": "latest", |
| - | " | + | "Digest": "1183c62a5d31e202b5f5f528e9e7cdc36140aa3212c938e1d471c6b3b59f01bc", |
| - | " | + | "Signers": |
| - | " | + | "Repo Admin" |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | "Name": "my-nginx.3.me50mkhd11ykwz7aj07znloh1", | + | |
| - | "EndpointID": "41531d43496f4723cb62cad1d57c5a088faebe79c430d04a1765022e31d8ae17", | + | |
| - | "MacAddress": | + | |
| - | "IPv4Address": " | + | |
| - | | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| } | } | ||
| - | | + | |
| - | "Options": | + | "Signers": |
| - | " | + | "AdministrativeKeys": [ |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | "Peers": [ | + | |
| { | { | ||
| - | " | + | " |
| - | "IP": "10.0.2.62" | + | "Keys": |
| + | { | ||
| + | | ||
| + | } | ||
| + | ] | ||
| }, | }, | ||
| { | { | ||
| - | " | + | " |
| - | "IP": "10.0.2.64" | + | "Keys": |
| + | { | ||
| + | | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | ] | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** : Notez que les clefs utilisées sont différentes. | ||
| + | </ | ||
| + | |||
| + | ===Supprimer une Signature=== | ||
| + | |||
| + | Dernièrement il est possible de supprimer la signature d'une image avec la commande **docker trust revoke** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | Enter passphrase for repository key with ID 168c754: | ||
| + | Successfully deleted signature for < | ||
| + | root@manager: | ||
| + | [ | ||
| + | { | ||
| + | | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| }, | }, | ||
| { | { | ||
| - | " | + | " |
| - | "IP": "10.0.2.63" | + | "Keys": |
| + | { | ||
| + | | ||
| + | } | ||
| + | ] | ||
| } | } | ||
| ] | ] | ||
| Ligne 1881: | Ligne 1720: | ||
| </ | </ | ||
| - | Supprimez maintenant | + | <WRAP center round important 50%> |
| + | **Important** : Il existe un autre mécanisme de signatures cryptographiques qui permet de certifier | ||
| + | </ | ||
| + | |||
| + | =====LAB #9 - Sécurisation du Socket du Daemon Docker===== | ||
| + | |||
| + | Par défaut le daemon Docker peut être contacté en utilisant un socket Unix local ce qui implique qu'il faut une connexion SSH vers l' | ||
| + | |||
| + | Pour pouvoir contacter de daemon Docker via le réseau d'une manière sécurisée il faut installer, configurer et activer le support TLS grâce aux options **tlsverify** et **tlscacert**. | ||
| + | |||
| + | La configuration implique que : | ||
| + | |||
| + | * pour le daemon Docker, seules les connections en provenance de clients authentifiés par un certificat signé par l' | ||
| + | * pour le client, il ne peut que connecter aux serveurs ayant un certificat signé par le CA du serveur. | ||
| + | |||
| + | La mise en place nécessite **openssl** : | ||
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | my-nginx | + | / |
| </ | </ | ||
| - | =====LAB #3 - Gestion d'une Architecture | + | ====9.1 - Création du Certificat de l'Autorité |
| - | Vous allez mettre en place une application simple, appelé | + | Commencez par créer |
| - | {{ :elearning:workbooks: | + | < |
| + | root@manager:~# openssl genrsa -aes256 -out ca-key.pem 4096 | ||
| + | Generating RSA private key, 4096 bit long modulus | ||
| + | ......................................................................................................................++++ | ||
| + | ...............................................................................................................................................................++++ | ||
| + | e is 65537 (0x010001) | ||
| + | Enter pass phrase for ca-key.pem:fenestros | ||
| + | Verifying - Enter pass phrase for ca-key.pem: | ||
| + | </ | ||
| - | Dans cette application | + | Ensuite, créez |
| - | {{ :elearning:workbooks:debian:6:avance:kubernetes15.png? | + | < |
| + | root@manager:~# openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem | ||
| + | Enter pass phrase for ca-key.pem:fenestros | ||
| + | You are about to be asked to enter information that will be incorporated | ||
| + | into your certificate request. | ||
| + | What you are about to enter is what is called a Distinguished Name or a DN. | ||
| + | There are quite a few fields but you can leave some blank | ||
| + | For some fields there will be a default value, | ||
| + | If you enter ' | ||
| + | ----- | ||
| + | Country Name (2 letter code) [AU]:GB | ||
| + | State or Province Name (full name) [Some-State]:SURREY | ||
| + | Locality Name (eg, city) []:ADDLESTONE | ||
| + | Organization Name (eg, company) [Internet Widgits Pty Ltd]:I2TCH LIMITED | ||
| + | Organizational Unit Name (eg, section) []: | ||
| + | Common Name (e.g. server FQDN or YOUR name) []: | ||
| + | Email Address []: | ||
| + | </ | ||
| - | Lors de la vote, le résultat de celle-ci est stocké dans **Redis** dans une base de données en mémoire. Le résultat est ensuite passé au conteneur **Worker** qui tourne sous .NET et qui met à jour la base de données persistante dans le conteneur **db** qui tourne sous PostgreSQL. | + | ====9.2 |
| - | L' | + | Les clefs du CA ayant été créées, créez une clef **server-key.pem** pour le serveur hôte du daemon Docker |
| - | {{ :elearning: | + | < |
| + | root@manager:~# openssl genrsa -out server-key.pem 4096 | ||
| + | Generating RSA private key, 4096 bit long modulus | ||
| + | .................................................................................................................................++++ | ||
| + | ...........................++++ | ||
| + | e is 65537 (0x010001) | ||
| + | </ | ||
| - | ====3.1 - Mise en Place avec Docker Swarm avec des réseaux Overlay==== | + | Créez ensuite un **[[https:// |
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | manager.i2tch.loc | ||
| + | root@manager: | ||
| + | </ | ||
| - | Cette application | + | Une connexion TLS peut être effectuée |
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | ID | + | |
| - | b85hxlixbr1mh1txd1hrfe4us * | + | |
| - | 4sui75vvdhmet4qvt0zbvzlzl | + | |
| - | lbjtg5o9kw3x6xg7frm07jfuw | + | |
| </ | </ | ||
| - | Téléchargez maintenant le fichier | + | Fixez l' |
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | % Total % Received % Xferd Average Speed | + | |
| - | | + | |
| - | 100 1707 100 1707 0 | + | |
| </ | </ | ||
| - | Consultez le fichier | + | Vérifiez que votre fichier |
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | version: " | + | subjectAltName = DNS:manager.i2tch.loc, |
| - | services: | + | extendedKeyUsage = serverAuth |
| + | </ | ||
| - | redis: | + | Signez maintenant le CSR du serveur **server.csr** avec la clef privée du CA **ca-key.pem** afin de produire le certificat du serveur **server-cert.pem** : |
| - | image: redis: | + | |
| - | networks: | + | |
| - | | + | |
| - | deploy: | + | |
| - | replicas: 1 | + | |
| - | update_config: | + | |
| - | parallelism: | + | |
| - | delay: 10s | + | |
| - | restart_policy: | + | |
| - | condition: on-failure | + | |
| - | db: | + | |
| - | image: postgres:9.4 | + | |
| - | environment: | + | |
| - | POSTGRES_USER: | + | |
| - | POSTGRES_PASSWORD: | + | |
| - | volumes: | + | |
| - | | + | |
| - | networks: | + | |
| - | - backend | + | |
| - | deploy: | + | |
| - | placement: | + | |
| - | constraints: | + | |
| - | vote: | + | |
| - | image: dockersamples/ | + | |
| - | ports: | + | |
| - | - 5000:80 | + | |
| - | networks: | + | |
| - | - frontend | + | |
| - | depends_on: | + | |
| - | - redis | + | |
| - | deploy: | + | |
| - | replicas: 2 | + | |
| - | update_config: | + | |
| - | parallelism: | + | |
| - | restart_policy: | + | |
| - | condition: on-failure | + | |
| - | result: | + | |
| - | image: dockersamples/ | + | |
| - | ports: | + | |
| - | - 5001:80 | + | |
| - | networks: | + | |
| - | - backend | + | |
| - | depends_on: | + | |
| - | - db | + | |
| - | deploy: | + | |
| - | replicas: 1 | + | |
| - | update_config: | + | |
| - | parallelism: | + | |
| - | delay: 10s | + | |
| - | restart_policy: | + | |
| - | condition: on-failure | + | |
| - | worker: | + | < |
| - | image: dockersamples/ | + | root@manager:~# openssl x509 -req -days 365 -sha256 -in server.csr |
| - | networks: | + | Signature ok |
| - | | + | subject=CN = manager.i2tch.loc |
| - | | + | Getting CA Private Key |
| - | depends_on: | + | Enter pass phrase for ca-key.pem:fenestros |
| - | | + | </ |
| - | | + | |
| - | | + | |
| - | mode: replicated | + | |
| - | replicas: 1 | + | |
| - | labels: [APP=VOTING] | + | |
| - | | + | |
| - | | + | |
| - | delay: 10s | + | |
| - | | + | |
| - | window: 120s | + | |
| - | placement: | + | |
| - | constraints: | + | |
| - | visualizer: | + | ====9.3 - Création du Certificat du Client==== |
| - | image: dockersamples/ | + | |
| - | ports: | + | |
| - | - " | + | |
| - | stop_grace_period: | + | |
| - | volumes: | + | |
| - | - "/ | + | |
| - | deploy: | + | |
| - | placement: | + | |
| - | constraints: | + | |
| - | networks: | + | Créez ensuite la clef privée **key.pem** du client qui se connectera au daemon à partir du réseau |
| - | frontend: | + | |
| - | backend: | + | |
| - | volumes: | + | < |
| - | | + | root@manager:~# openssl genrsa -out key.pem 4096 |
| + | Generating RSA private key, 4096 bit long modulus | ||
| + | ...................................................................................................................................++++ | ||
| + | ...............++++ | ||
| + | e is 65537 (0x010001) | ||
| </ | </ | ||
| - | Dans ce fichier on peut constater 6 services, **redis**, **db**, **vote**, **result**, **worker** et **visualizer**. Les 5 premiers services forment ensemble | + | Modifiez |
| - | Dans un premier temps, regardez la clef **deploy** du service **worker** | + | < |
| + | root@manager:~# vi / | ||
| + | root@manager: | ||
| + | 127.0.0.1 localhost | ||
| + | 10.0.2.46 debian11.i2tch.loc debian11 | ||
| + | 10.0.2.45 myregistry.i2tch.loc | ||
| + | 10.0.2.62 manager.i2tch.loc manager | ||
| + | 10.0.2.63 worker1.i2tch.loc worker1 | ||
| + | 10.0.2.64 worker2.i2tch.loc worker2 | ||
| - | < | + | # The following lines are desirable for IPv6 capable hosts |
| - | ... | + | ::1 localhost ip6-localhost ip6-loopback |
| - | | + | ff02::1 ip6-allnodes |
| - | mode: replicated | + | ff02::2 ip6-allrouters |
| - | replicas: 1 | + | </code> |
| - | | + | |
| - | restart_policy: | + | |
| - | condition: on-failure | + | |
| - | delay: 10s | + | |
| - | max_attempts: 3 | + | |
| - | window: 120s | + | |
| - | placement: | + | |
| - | constraints: | + | |
| - | ... | + | |
| - | </file> | + | |
| - | La clef **deploy** permet de spécifier des options lors du déploiement du service | + | Créez ensuite le CSR du client |
| - | * **mode** | + | < |
| - | * **replicas** - spécifie le nombre de replicas | + | root@manager: |
| - | * **restart_policy** spécifie ce qui se passe en cas d'arrêt du service. Dans le cas ci-dessus, docker va essayer de re-démarrer le service **3** fois (**max_attempts**) à des intervalles de **10** secondes (**delay**) en attendant chaque fois **120** secondes (**window**) pour constater si le service s'est effectivement re-démarré, | + | </ |
| - | * **placement** - spécifie où le service doit être démarré. | + | |
| - | Déployez maintenant le stack : | + | Fixez l' |
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | Creating network app_backend | + | |
| - | Creating network app_default | + | |
| - | Creating network app_frontend | + | |
| - | Creating service app_worker | + | |
| - | Creating service app_visualizer | + | |
| - | Creating service app_redis | + | |
| - | Creating service app_db | + | |
| - | Creating service app_vote | + | |
| - | Creating service app_result | + | |
| </ | </ | ||
| - | <WRAP center round important 60%> | + | Signez le CSR du client |
| - | **Important** - Notez que chaque réseau et chaque service a comme préfixe le nom de l' | + | |
| - | </ | + | |
| - | Consultez maintenant l' | + | < |
| + | root@manager: | ||
| + | Signature ok | ||
| + | subject=CN = myregistry.i2tch.loc | ||
| + | Getting CA Private Key | ||
| + | Enter pass phrase for ca-key.pem: | ||
| + | </ | ||
| + | |||
| + | Vérifiez la présence des fichiers générés | ||
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | NAME SERVICES | + | total 60 |
| - | app | + | -rw------- 1 root root 3326 nov. 11 10:53 ca-key.pem |
| + | -rw-r--r-- 1 root root 2163 nov. 11 10:57 ca.pem | ||
| + | -rw-r--r-- 1 root root 17 nov. 11 11:15 ca.srl | ||
| + | -rw-r--r-- 1 root root 1907 nov. 11 11:15 cert.pem | ||
| + | -rw-r--r-- 1 root root 1594 nov. 11 11:12 client.csr | ||
| + | drwxr-xr-x 5 root root 4096 nov. 8 12:58 docker-bench-security | ||
| + | -rw-r--r-- 1 root root 1707 nov. 8 12:35 docker-stack.yml | ||
| + | -rw-r--r-- 1 root root 30 nov. 11 11:13 extfile-client.cnf | ||
| + | -rw-r--r-- 1 root root 95 nov. 11 11:06 extfile.cnf | ||
| + | -rw------- 1 root root 3243 nov. 11 11:10 key.pem | ||
| + | drwxr-xr-x 2 root root 4096 nov. 10 17:21 nottrusted | ||
| + | -rw-r--r-- 1 root root 1964 nov. 11 11:08 server-cert.pem | ||
| + | -rw-r--r-- 1 root root 1594 nov. 11 11:01 server.csr | ||
| + | -rw------- 1 root root 3243 nov. 11 10:59 server-key.pem | ||
| + | -rw-r--r-- 1 root root 882 oct. 27 15:46 stats | ||
| </ | </ | ||
| - | Consultez ensuite l' | + | Supprimez les fichiers ayant déjà été utilisés, à savoir les deux CSR et les deux fichiers |
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | ID NAME MODE REPLICAS | + | ' |
| - | d0i4ac4fshw0 | + | ' |
| - | funp5kboyip1 | + | ' |
| - | dpdkc49oj671 | + | ' |
| - | vrkahv38v5mn | + | |
| - | t4u16cpdrx21 | + | |
| - | so40eljbcviy | + | |
| </ | </ | ||
| - | <WRAP center round important 60%> | + | Modifiez les permissions des clefs privées |
| - | **Important** | + | |
| - | </ | + | |
| - | Retournez à la fenêtre d' | + | < |
| + | root@manager: | ||
| + | le mode de 'ca-key.pem' a été modifié de 0600 (rw-------) en 0400 (r--------) | ||
| + | le mode de 'key.pem' a été modifié de 0600 (rw-------) en 0400 (r--------) | ||
| + | le mode de ' | ||
| + | </code> | ||
| - | {{ :elearning: | + | Ainsi que les permissions des certificats |
| - | Comme vous pouvez constater, conformément au fichier **docker-stack.yml**, les trois conteneurs **db**, **worker** et **visualizer** ont été démarrés sur le nœud manager. | + | < |
| + | root@manager: | ||
| + | le mode de ' | ||
| + | le mode de ' | ||
| + | le mode de ' | ||
| + | </ | ||
| - | Retournez à votre connexion SSH et consultez l' | + | Arrêtez |
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | NETWORK ID NAME | + | mysql |
| - | sw489bb290zb | + | root@manager: |
| - | smuxoglyudpo | + | mysql |
| - | lfizui95od90 | + | |
| - | 24be8a0f0ef5 | + | |
| - | d4c9b0c9437a | + | |
| - | f3cb3bc3c581 | + | |
| - | x7l4mk4ldb75 | + | |
| - | de563e30d473 | + | |
| </ | </ | ||
| - | <WRAP center round important 60%> | + | ====9.4 - Démarrage du Daemon Docker avec une Invocation Directe==== |
| - | **Important** : Notez que les trois réseaux créés sont de type **overlay**. | + | |
| - | </ | + | Arrêtez et désactivez le service Docker : |
| < | < | ||
| - | root@worker1:~# docker | + | root@manager:~# systemctl stop docker |
| - | NETWORK ID NAME DRIVER | + | Warning: Stopping docker.service, |
| - | qhysvpoolsw0 | + | |
| - | f9a69d02de3b | + | root@manager: |
| - | ee22b3e623ca | + | Synchronizing state of docker.service with SysV service script with / |
| - | f3cb3bc3c581 | + | Executing: / |
| - | x7l4mk4ldb75 | + | |
| - | de563e30d473 | + | |
| </ | </ | ||
| - | <WRAP center round important 60%> | + | Lancez un invocation directe de **dockerd** afin que le daemon n' |
| - | **Important** : Notez que seul le réseau **app_frontend** a été créé dans **worker1**. | + | |
| - | </ | + | |
| < | < | ||
| - | root@worker2:~# docker network ls | + | root@manager:~# dockerd --tlsverify --tlscacert=ca.pem --tlscert=server-cert.pem --tlskey=server-key.pem -H=0.0.0.0: |
| - | NETWORK | + | [1] 1868 |
| - | s4gbgi4isp1i | + | root@manager: |
| - | qhysvpoolsw0 | + | INFO[2019-11-11T12: |
| - | 0e6c118bf3fd | + | INFO[2019-11-11T12: |
| - | 0ce1d8369c29 | + | INFO[2019-11-11T12: |
| - | f3cb3bc3c581 | + | INFO[2019-11-11T12: |
| - | x7l4mk4ldb75 | + | INFO[2019-11-11T12: |
| - | de563e30d473 | + | INFO[2019-11-11T12: |
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | WARN[2019-11-11T12: | ||
| + | WARN[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | [Entrée] | ||
| + | root@manager: | ||
| </ | </ | ||
| - | <WRAP center round important 60%> | + | Vérifiez |
| - | **Important** : Notez que les deux réseaux **app_frontend** et **app_backend** ont été créés dans **worker2**. | + | |
| - | </ | + | |
| - | Consultez les informations concernant | + | < |
| + | root@manager: | ||
| + | root 1868 0.2 4.0 421876 82236 pts/0 Sl | ||
| + | root 1995 0.0 0.0 12780 964 pts/0 S+ | ||
| + | </ | ||
| + | |||
| + | Installez | ||
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | [ | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | } | + | |
| - | ] | + | |
| </ | </ | ||
| - | <WRAP center round important 60%> | + | Vérifiez |
| - | **Important** : Notez que le réseau est **10.0.3.0/24** et la passerelle **10.0.3.1**. | + | |
| - | </ | + | |
| - | Consultez les informations concernant | + | < |
| + | root@manager: | ||
| + | tcp6 | ||
| + | </ | ||
| + | |||
| + | ====9.5 - Configuration du Client==== | ||
| + | |||
| + | Transférez ensuite le certificat du CA ainsi que le certificat et la clef privée du client vers la VM **10.0.2.45** : | ||
| < | < | ||
| - | root@manager: | + | root@manager: |
| - | [ | + | The authenticity of host '10.0.2.45 (10.0.2.45)' can't be established. |
| - | { | + | ECDSA key fingerprint is SHA256:sEfHBv9azmK60cjqF/ |
| - | " | + | Are you sure you want to continue connecting (yes/no)? yes |
| - | " | + | Warning: Permanently added '10.0.2.45' (ECDSA) to the list of known hosts. |
| - | " | + | trainee@10.0.2.45's password: trainee |
| - | " | + | ca.pem 100% 2163 917.8KB/s 00:00 |
| - | " | + | key.pem 100% 3243 3.0MB/s 00:00 |
| - | " | + | cert.pem 100% 1907 921.7KB/s 00:00 |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | }, | + | |
| - | " | + | |
| - | "com.docker.network.driver.overlay.vxlanid_list" | + | |
| - | }, | + | |
| - | " | + | |
| - | "com.docker.stack.namespace" | + | |
| - | }, | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | } | + | |
| - | ] | + | |
| </ | </ | ||
| - | <WRAP center round important 60%> | + | Lancez la commande |
| - | **Important** : Notez que le réseau est **10.0.2.0/ | + | |
| - | </ | + | |
| - | Consultez les informations concernant | + | < |
| + | trainee@myregistry: | ||
| + | Client: Docker Engine - Community | ||
| + | | ||
| + | API version: | ||
| + | Go version: | ||
| + | Git commit: | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Server: Docker Engine - Community | ||
| + | | ||
| + | Version: | ||
| + | API version: | ||
| + | Go version: | ||
| + | Git commit: | ||
| + | Built: | ||
| + | OS/ | ||
| + | Experimental: | ||
| + | | ||
| + | Version: | ||
| + | GitCommit: | ||
| + | | ||
| + | Version: | ||
| + | GitCommit: | ||
| + | | ||
| + | Version: | ||
| + | GitCommit: | ||
| + | </ | ||
| + | |||
| + | Afin de faciliter l' | ||
| < | < | ||
| - | root@manager:~# docker inspect app_default | + | trainee@myregistry:~$ mkdir -pv ~/.docker |
| - | [ | + | mkdir: création du répertoire '/home/ |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | }, | + | |
| - | " | + | |
| - | "com.docker.network.driver.overlay.vxlanid_list": | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | } | + | |
| - | ] | + | |
| </ | </ | ||
| - | <WRAP center round important 60%> | + | Copiez ensuite les fichiers |
| - | **Important** : Notez que le réseau est **10.0.1.0/24** et la passerelle **10.0.1.1**. | + | |
| - | </ | + | |
| - | Schématiquement, la mise en place de l'application dans le Swarm est ainsi : | + | < |
| + | trainee@myregistry: | ||
| + | 'ca.pem' | ||
| + | ' | ||
| + | ' | ||
| + | </ | ||
| - | {{ :elearning: | + | Créez les deux variables **DOCKER_HOST** et **DOCKER_TLS_VERIFY** |
| - | Dernièrement, | + | < |
| + | trainee@myregistry: | ||
| + | </ | ||
| + | |||
| + | Maintenant la connexion est sécurisée par défaut | ||
| < | < | ||
| - | root@manager:~# docker | + | trainee@myregistry:~$ docker |
| - | NAME SERVICES | + | REPOSITORY |
| - | app | + | i2tch/docker |
| - | root@manager: | + | i2tch/ |
| - | Removing service app_db | + | ubuntu |
| - | Removing service app_redis | + | nginx |
| - | Removing service app_result | + | alpine |
| - | Removing service app_visualizer | + | i2tch/docker |
| - | Removing service app_vote | + | mysql |
| - | Removing service app_worker | + | centos |
| - | Removing network app_frontend | + | docker/ |
| - | Removing network app_backend | + | |
| - | Removing network app_default | + | |
| - | root@manager: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | d02c6115724c | + | |
| </ | </ | ||
| ----- | ----- | ||
| - | < | + | |
| - | <div align=" | + | Copyright © 2024 Hugh Norris. |
| - | Copyright © 2021 Hugh NORRIS | + | |
| - | </ | + | |
| - | </ | + | |
