Différences
Ci-dessous, les différences entre deux révisions de la page.
| Prochaine révision | Révision précédente | ||
| elearning:workbooks:docker3:drf07 [2021/11/21 11:51] – created admin | elearning:workbooks:docker3:drf07 [2024/02/21 16:08] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| - | |||
| ~~PDF: | ~~PDF: | ||
| - | Version : **2021.01** | + | Version : **2024.01** |
| Dernière mise-à-jour : ~~LASTMOD~~ | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| - | ======DOF608 - Gestion | + | ======DOF608 - Validation |
| - | =====Contenu | + | =====Rappel |
| - | * **DOF608 | + | * **DOF600 |
| - | * Contenu du Module | + | * Matériel |
| - | * LAB #1 - Travailler avec les CGroups | + | * Logiciels |
| - | * 1.1 - Présentation des Namespaces | + | * Internet |
| - | * 1.2 - Présentation des CGroups | + | |
| - | * 1.3 - Limitation de la Mémoire | + | |
| - | * 1.4 - Le Paquet cgroup-tools | + | |
| - | * La commande cgcreate | + | |
| - | * La Commande cgexec | + | |
| - | * La Commande cgdelete | + | |
| - | * Le Fichier / | + | |
| - | * LAB #2 - Utilisation des Docker Secrets | + | |
| - | * LAB #3 - Création d'un Utilisateur de Confiance pour Contrôler le Daemon Docker | + | |
| - | * LAB #4 - Le Script docker-bench-security.sh | + | |
| - | * LAB #5 - Sécurisation de la Configuration de l' | + | |
| - | * 5.1 - [WARN] 1.2.1 - Ensure a separate partition for containers has been created | + | |
| - | * 5.2 - [WARN] 1.2.3 - Ensure auditing is configured for the Docker daemon | + | |
| - | * LAB #6 - Sécurisation de la Configuration du daemon Docker | + | |
| - | * 6.1 - [WARN] 2.1 - Ensure network traffic is restricted between containers on the default bridge | + | |
| - | * 6.2 - [WARN] 2.8 - Enable user namespace support | + | |
| - | * 6.3 - [WARN] 2.11 - Ensure that authorization for Docker client commands is enabled | + | |
| - | * 6.4 - [WARN] 2.12 - Ensure centralized and remote logging is configured | + | |
| - | * 6.5 - [WARN] 2.14 - Ensure Userland Proxy is Disabled | + | |
| - | * 6.6 - [WARN] 2.17 - Ensure containers are restricted from acquiring new privileges | + | |
| - | * 6.7 - Le Fichier / | + | |
| - | * LAB #7 - Sécurisation des Images et les Fichiers de Construction | + | |
| - | * 7.1 - [WARN] 4.1 - Ensure a user for the container has been created | + | |
| - | * 7.2 - [WARN] 4.5 - Ensure Content trust for Docker is Enabled | + | |
| - | * 7.3 - [WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images | + | |
| - | * LAB #8 - Sécurisation du Container Runtime | + | |
| - | * 8.1 - [WARN] 5.1 - Ensure AppArmor Profile is Enabled | + | |
| - | * 8.2 - [WARN] 5.2 - Ensure SELinux security options are set, if applicable | + | |
| - | * 8.3 - [WARN] 5.10 - Ensure memory usage for container is limited | + | |
| - | * 8.4 - [WARN] 5.11 - Ensure CPU priority is set appropriately on the container | + | |
| - | * 8.5 - [WARN] 5.12 - Ensure the container' | + | |
| - | * 8.6 - [WARN] 5.14 - Ensure ' | + | |
| - | * 8.7 - [WARN] 5.25 - Ensure the container is restricted from acquiring additional privileges | + | |
| - | * 8.8 - [WARN] 5.26 - Ensure container health is checked at runtime | + | |
| - | * 8.9 - [WARN] 5.28 - Ensure PIDs cgroup limit is used | + | |
| - | * LAB #9 - Sécurisation des Images avec Docker Content Trust | + | |
| - | * 9.1 - DOCKER_CONTENT_TRUST | + | |
| - | * 9.2 - DCT et la commande docker pull | + | |
| - | * L' | + | |
| - | * 9.3 - DCT et la commande docker push | + | |
| - | * 9.4 - DCT et la commande docker build | + | |
| - | * Créer un deuxième Repositry | + | |
| - | * Supprimer une Signature | + | |
| - | * LAB #10 - Sécurisation du Socket du Daemon Docker | + | |
| - | * 10.1 - Création du Certificat de l' | + | |
| - | * 10.2 - Création du Certificat du Serveur Hôte du Daemon Docker | + | |
| - | * 10.3 - Création du Certificat du Client | + | |
| - | * 10.4 - Démarrage du Daemon Docker avec une Invocation Directe | + | |
| - | * 10.5 - Configuration du Client | + | |
| - | =====LAB #1 - Travailler avec les CGroups====== | + | * **DOF601 - La Virtualisation par Isolation** |
| + | * Présentation de la Virtualisation par Isolation | ||
| + | * Historique | ||
| + | * Présentation des Namespaces | ||
| + | * Présentation des CGroups | ||
| + | * LAB #1 - Travailler avec les CGroups | ||
| + | * 1.1 - Limitation de la Mémoire | ||
| + | * 1.2 - Le Paquet cgroup-tools | ||
| + | * La commande cgcreate | ||
| + | * La Commande cgexec | ||
| + | * La Commande cgdelete | ||
| + | * Le Fichier / | ||
| + | * Présentation de Linux Containers | ||
| + | * LAB #2 - Travailler avec LXC | ||
| + | * 2.1 - Installation | ||
| + | * 2.2 - Création d'un Conteneur Simple | ||
| + | * 2.3 - Démarrage d'un Conteneur Simple | ||
| + | * 2.4 - S' | ||
| + | * 2.5 - Commandes LXC de Base | ||
| + | * La Commande lxc-console | ||
| + | * La Commande lxc-stop | ||
| + | * La Commande lxc-execute | ||
| + | * La Commande lxc-info | ||
| + | * La Commande lxc-freeze | ||
| + | * La Commande lxc-unfreeze | ||
| + | * Autres commandes | ||
| + | * 2.6 - Création d'un Conteneur Non-Privilégié | ||
| + | * User Namespaces | ||
| + | * Création d'un Utilisateur Dédié | ||
| + | * Création du Mappage | ||
| + | * Création du Conteneur | ||
| + | * Contrôle du Mappage | ||
| + | * 2.7 - Création d'un Conteneur Éphémère | ||
| + | * La Commande lxc-copy | ||
| + | * 2.8 - Sauvegarde des Conteneurs | ||
| + | * La Commande lxc-snapshot | ||
| - | ====1.1 - Présentation | + | * **DOF602 - Démarrer avec Docker** |
| + | * Présentation de Docker | ||
| + | * LAB #1 - Travailler avec Docker | ||
| + | * 1.1 - Installer docker | ||
| + | * 1.2 - Démarrer un Conteneur | ||
| + | * 1.3 - Consulter la Liste des Conteneurs et Images | ||
| + | * 1.4 - Rechercher une Image dans un Dépôt | ||
| + | * 1.5 - Supprimer un Conteneur d'une Image | ||
| + | * 1.6 - Créer une Image à partir d'un Conteneur Modifié | ||
| + | * 1.7 - Supprimer une Image | ||
| + | * 1.8 - Créer un Conteneur avec un Nom Spécifique | ||
| + | * 1.9 - Exécuter une Commande dans un Conteneur | ||
| + | * 1.10 - Injecter des Variables d' | ||
| + | * 1.11 - Modifier le Nom d' | ||
| + | * 1.12 - Mapper des Ports d'un Conteneur | ||
| + | * 1.13 - Démarrer un Conteneur en mode Détaché | ||
| + | * 1.14 - Accéder aux Services d'un Conteneur de l' | ||
| + | * 1.15 - Arrêter et Démarrer un Conteneur | ||
| + | * 1.16 - Utiliser des Signaux avec un Conteneur | ||
| + | * 1.17 - Forcer la Suppression d'un Conteneur en cours d' | ||
| + | * 1.18 - Utilisation Simple d'un Volume | ||
| + | * 1.19 - Télécharger une image sans créer un conteneur | ||
| + | * 1.20 - S' | ||
| + | * 1.21 - Installer un logiciel dans le conteneur | ||
| + | * 1.22 - Utilisation de la commande docker commit | ||
| + | * 1.23 - Se connecter au serveur du conteneur de l' | ||
| - | Les espaces de noms permettent de regrouper des processus dans un même espace | + | * **DOF603 - Gérer |
| + | * LAB #1 - Re-créer une image officielle docker | ||
| + | * 1.1 - Utilisation | ||
| + | * 1.2 - FROM | ||
| + | * 1.3 - RUN | ||
| + | * 1.4 - ENV | ||
| + | * 1.5 - VOLUME | ||
| + | * 1.6 - COPY | ||
| + | * 1.7 - ENTRYPOINT | ||
| + | * 1.8 - EXPOSE | ||
| + | * 1.9 - CMD | ||
| + | * 1.10 - Autres Commandes | ||
| + | * LAB #2 - Créer | ||
| + | * 2.1 - Création et test du script | ||
| + | * 2.2 - Bonnes Pratiques liées au Cache | ||
| + | * LAB #3 - Installer | ||
| + | * 3.1 - Créer un Registre local, | ||
| + | * 3.2 - Créer un Serveur de Registre Dédié | ||
| + | * Configurer le clone comme Registre Dédié | ||
| + | * Configurer le Client | ||
| - | ====1.2 - Présentation | + | * **DOF604 - Gestion des Volumes, du Réseau et des Ressources** |
| + | * LAB #1 - Gestion des Volumes | ||
| + | * 1.1 - Gestion Automatique par Docker | ||
| + | * 1.2 - Gestion Manuelle d'un Volume | ||
| + | * LAB #2 - Gestion du Réseau | ||
| + | * 2.1 - L' | ||
| + | * Bridge | ||
| + | * Host | ||
| + | * None | ||
| + | * Liens | ||
| + | * 2.2 - Lancer Wordpress dans un container | ||
| + | * 2.3 - Gestion d'une Architecture de Microservices | ||
| + | * LAB #3 - Superviser les Conteneurs | ||
| + | * 3.1 - Les Journaux | ||
| + | * 3.2 - Les Processus | ||
| + | * 3.3 - L' | ||
| + | * LAB #4 - Gestion | ||
| + | * 4.1 - Limiter la Mémoire | ||
| - | Les Groupes de Contrôles (Control Groups) aussi appelés **CGroups**, sont une nouvelle façon de contrôler | + | |
| + | * LAB #1 - Docker Compose | ||
| + | * 1.1 - Installation | ||
| + | * 1.2 - Utiliser docker-compose | ||
| + | * LAB #2 - Docker Machine | ||
| + | * 2.1 - Présentation | ||
| + | * 2.2 - Création | ||
| + | * 2.3 - Lister les VM Docker | ||
| + | * 2.4 - Obtenir | ||
| + | * 2.5 - Se connecter à une VM Docker | ||
| + | * LAB #3 - Docker Swarm | ||
| + | * 3.1 - Présentation | ||
| + | * 3.2 - Initialiser Docker Swarm | ||
| + | * 3.3 - Le Statut Leader | ||
| + | * 3.4 - Rejoindre | ||
| + | * 3.5 - Consulter les Informations | ||
| + | * 3.6 - Démarrer un Service | ||
| + | * 3.7 - Augmentation | ||
| + | * 3.8 - Consulter le Statut d'un Nœud | ||
| + | * 3.9 - Haute Disponibilité | ||
| + | * 3.10 - Supprimer un Service | ||
| + | * 3.11 - Sauvegarder Docker Swarm | ||
| + | * 3.12 - Restaurer Docker Swarm | ||
| - | Les CGroups sont organisés de manière hiérarchique, | + | * **DOF606 - Gestion |
| + | * L'Approche Réseau Docker | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | * 1.4 - DNS container discovery | ||
| + | * 1.5 - Création d'un Réseau overlay Personnalisé | ||
| + | * LAB #2 - Gestion | ||
| + | * 2.1 - Mise en Place avec Docker Swarm avec des réseaux Overlay | ||
| - | Ces hiérarchies multiples et séparés sont necéssaires parce que chaque hiérarchie est attaché à un ou plusieurs sous-système(s) aussi appelés | + | * **DOF607 |
| + | * LAB #1 - Utilisation | ||
| + | | ||
| + | | ||
| + | * LAB #4 - Sécurisation | ||
| + | | ||
| + | | ||
| + | * LAB #5 - Sécurisation de la Configuration du daemon Docker | ||
| + | * 5.1 - [WARN] 2.1 - Ensure network traffic is restricted between containers on the default bridge | ||
| + | * 5.2 - [WARN] 2.8 - Enable user namespace support | ||
| + | * 5.3 - [WARN] 2.11 - Ensure that authorization for Docker client commands is enabled | ||
| + | * 5.4 - [WARN] 2.12 - Ensure centralized and remote logging is configured | ||
| + | * 5.5 - [WARN] 2.14 - Ensure Userland Proxy is Disabled | ||
| + | * 5.6 - [WARN] 2.17 - Ensure containers are restricted from acquiring new privileges | ||
| + | * 5.7 - Le Fichier / | ||
| + | * LAB #6 - Sécurisation | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | * 7.1 - [WARN] 5.1 - Ensure AppArmor Profile is Enabled | ||
| + | * 7.2 - [WARN] 5.2 - Ensure SELinux security options are set, if applicable | ||
| + | * 7.3 - [WARN] 5.10 - Ensure memory usage for container is limited | ||
| + | * 7.4 - [WARN] 5.11 - Ensure CPU priority is set appropriately on the container | ||
| + | * 7.5 - [WARN] 5.12 - Ensure the container' | ||
| + | * 7.6 - [WARN] 5.14 - Ensure ' | ||
| + | * 7.7 - [WARN] 5.25 - Ensure the container is restricted from acquiring additional privileges | ||
| + | * 7.8 - [WARN] 5.26 - Ensure container health is checked at runtime | ||
| + | * 7.9 - [WARN] 5.28 - Ensure PIDs cgroup limit is used | ||
| + | * LAB #8 - Sécurisation des Images avec Docker Content Trust | ||
| + | * 8.1 - DOCKER_CONTENT_TRUST | ||
| + | * 8.2 - DCT et la commande docker pull | ||
| + | * L' | ||
| + | * 8.3 - DCT et la commande docker push | ||
| + | * 8.4 - DCT et la commande docker build | ||
| + | * Créer un deuxième Repositry | ||
| + | * Supprimer une Signature | ||
| + | * LAB #9 - Sécurisation du Socket du Daemon Docker | ||
| + | * 9.1 - Création du Certificat de l' | ||
| + | * 9.2 - Création du Certificat du Serveur Hôte du Daemon Docker | ||
| + | * 9.3 - Création du Certificat du Client | ||
| + | * 9.4 - Démarrage du Daemon Docker avec une Invocation Directe | ||
| + | * 9.5 - Configuration du Client | ||
| - | * **blkio** - utilisé pour établir des limites sur l' | + | * **DOF608 |
| - | * **cpu** | + | * Rappel du Programme |
| - | | + | |
| - | * **cpuset** - utilisé pour assigner des CPU individuels sur un système multicœur et des nœuds de mémoire à des tâches dans un groupe de contrôle, | + | |
| - | * **devices** - utilisé pour autoriser ou pour refuser l' | + | |
| - | * **freezer** - utilisé pour suspendre ou pour réactiver les tâches dans un groupe de contrôle, | + | |
| - | * **memory** - utilisé pour établir les limites d' | + | |
| - | * **net_cls** - utilisé pour repérer les paquets réseau avec un identifiant de classe (classid) afin de permettre au contrôleur de trafic Linux, **tc**, d' | + | |
| - | * **perf_event** - utilisé pour permettre le monitoring des CGroups avec l' | + | |
| - | * **hugetlb** - utilisé pour limiter des ressources sur des pages de mémoire virtuelle de grande taille. | + | |
| - | Les hiérarchies ont des points | + | =====Évaluation |
| - | < | + | Afin de valider votre formation, veuillez compléter |
| - | trainee@debian9: | + | |
| - | Mot de passe : fenestros | + | |
| - | root@debian9: | + | |
| - | total 0 | + | |
| - | dr-xr-xr-x 2 root root 0 mai 26 08:52 blkio | + | |
| - | lrwxrwxrwx 1 root root 11 mai 26 08:52 cpu -> cpu, | + | |
| - | lrwxrwxrwx 1 root root 11 mai 26 08:52 cpuacct -> cpu, | + | |
| - | dr-xr-xr-x 2 root root 0 mai 26 08:52 cpu, | + | |
| - | dr-xr-xr-x 2 root root 0 mai 26 08:52 cpuset | + | |
| - | dr-xr-xr-x 5 root root 0 mai 26 08:52 devices | + | |
| - | dr-xr-xr-x 2 root root 0 mai 26 08:52 freezer | + | |
| - | dr-xr-xr-x 2 root root 0 mai 26 08:52 memory | + | |
| - | lrwxrwxrwx 1 root root 16 mai 26 08:52 net_cls -> net_cls, | + | |
| - | dr-xr-xr-x 2 root root 0 mai 26 08:52 net_cls, | + | |
| - | lrwxrwxrwx 1 root root 16 mai 26 08:52 net_prio -> net_cls, | + | |
| - | dr-xr-xr-x 2 root root 0 mai 26 08:52 perf_event | + | |
| - | dr-xr-xr-x 5 root root 0 mai 26 08:52 pids | + | |
| - | dr-xr-xr-x 5 root root 0 mai 26 08:52 systemd | + | |
| - | </ | + | |
| - | **Systemd** organise les processus dans chaque CGroup. Par exemple tous les processus démarrés par le serveur Apache se trouveront dans le même CGroup, y compris les scripts CGI. Ceci implique que la gestion des ressources en utilisant des hiérarchies est couplé avec l' | ||
| - | |||
| - | En haut de l' | ||
| - | |||
| - | * le **system.slice** - l' | ||
| - | * le **user.slice** - l' | ||
| - | * le **machine.slice** - l' | ||
| - | |||
| - | En dessous des tranches peuvent se trouver : | ||
| - | |||
| - | * des **scopes** - des processus crées par **fork**, | ||
| - | * des **services** - des processus créés par une **Unité**. | ||
| - | |||
| - | Les slices peuvent être visualisés avec la commande suivante : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | UNIT | ||
| - | -.slice | ||
| - | system-getty.slice loaded active active system-getty.slice | ||
| - | system.slice | ||
| - | user-1000.slice | ||
| - | user-112.slice | ||
| - | user.slice | ||
| - | |||
| - | LOAD = Reflects whether the unit definition was properly loaded. | ||
| - | ACTIVE = The high-level unit activation state, i.e. generalization of SUB. | ||
| - | SUB = The low-level unit activation state, values depend on unit type. | ||
| - | |||
| - | 6 loaded units listed. Pass --all to see loaded but inactive units, too. | ||
| - | To show all installed unit files use ' | ||
| - | </ | ||
| - | |||
| - | L' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | Control group /: | ||
| - | -.slice | ||
| - | ├─user.slice | ||
| - | │ ├─user-112.slice | ||
| - | │ │ ├─user@112.service | ||
| - | │ │ │ ├─dbus.service | ||
| - | │ │ │ │ └─539 / | ||
| - | │ │ │ ├─init.scope | ||
| - | │ │ │ │ ├─527 / | ||
| - | │ │ │ │ └─528 (sd-pam) | ||
| - | │ │ │ └─gvfs-daemon.service | ||
| - | │ │ │ | ||
| - | │ │ └─session-c1.scope | ||
| - | │ │ | ||
| - | │ │ | ||
| - | │ │ | ||
| - | │ │ | ||
| - | │ │ | ||
| - | │ └─user-1000.slice | ||
| - | │ | ||
| - | │ │ ├─668 sshd: trainee [priv] | ||
| - | │ │ ├─679 sshd: trainee@pts/ | ||
| - | │ │ ├─680 -bash | ||
| - | │ │ ├─689 su - | ||
| - | │ │ ├─690 -su | ||
| - | │ │ ├─708 systemd-cgls | ||
| - | │ │ └─709 systemd-cgls | ||
| - | │ | ||
| - | │ | ||
| - | │ | ||
| - | │ | ||
| - | ├─init.scope | ||
| - | │ └─1 /sbin/init | ||
| - | └─system.slice | ||
| - | ├─lightdm.service | ||
| - | │ ├─410 / | ||
| - | │ ├─425 / | ||
| - | │ └─588 lightdm --session-child 14 21 | ||
| - | ├─anacron.service | ||
| - | lines 1-39 | ||
| - | </ | ||
| - | |||
| - | En utilisant Systemd, plusieurs ressources peuvent être limitées : | ||
| - | |||
| - | * **CPUShares** - par défaut 1024, | ||
| - | * **MemoryLimit** - limite exprimée en Mo ou en Go. Pas de valeur par défaut, | ||
| - | * **BlockIOWeight** - valeur entre 10 et 1000. Pas de valeur par défaut, | ||
| - | * **StartupCPUShares** - comme CPUShares mais uniquement appliqué pendant le démarrage, | ||
| - | * **StartupBlockIOWeight** - comme BlockIOWeight mais uniquement appliqué pendant le démarrage, | ||
| - | * **CPUQuota** - utilisé pour limiter le temps CPU, même quand le système ne fait rien. | ||
| - | |||
| - | <WRAP center round important> | ||
| - | **Important** : Consultez le manuel systemd.resource-control(5) pour voir les paramètres CGroup qui peuvent être passés à systemctl. | ||
| - | </ | ||
| - | |||
| - | ====1.3 - Limitation de la Mémoire==== | ||
| - | |||
| - | Pour travailler avec les CGroups dans Debian 9, il convient d' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | </ | ||
| - | |||
| - | Commencez ensuite par créer le script **hello-world.sh** qui servira à générer un processus pour travailler avec les CGroups : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | #!/bin/bash | ||
| - | while [ 1 ]; do | ||
| - | echo "hello world" | ||
| - | sleep 60 | ||
| - | done | ||
| - | </ | ||
| - | |||
| - | Rendez le script exécutable et testez-le : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | hello world | ||
| - | hello world | ||
| - | ^C | ||
| - | </ | ||
| - | |||
| - | Créez maintenant un CGroup dans le sous-système **memory** appelé **helloworld** : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | </ | ||
| - | |||
| - | Par défaut, ce CGroup héritera de l' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | 39997440 | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important> | ||
| - | **Important** - Notez que les 40 000 000 demandés sont devenus 39 997 440 ce qui correspond à un nombre entier de pages mémoire du noyau de 4Ko. ( 39 997 440 / 4096 = 9 765 ). | ||
| - | </ | ||
| - | |||
| - | Lancez maintenant le script **helloworld.sh** : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | [1] 1012 | ||
| - | root@debian9: | ||
| - | |||
| - | root@debian9: | ||
| - | root 1012 0.0 0.1 11172 2868 pts/0 S 10:24 0:00 /bin/bash ./ | ||
| - | root 1015 0.0 0.0 12784 968 pts/0 S+ | ||
| - | </ | ||
| - | |||
| - | Notez l' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | CGROUP | ||
| - | 6: | ||
| - | </ | ||
| - | |||
| - | Insérer le PID de notre script dans le CGroup **helloworld** : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | </ | ||
| - | |||
| - | Notez maintenant l' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | CGROUP | ||
| - | 6: | ||
| - | </ | ||
| - | |||
| - | Constatez ensuite l' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | 319488 | ||
| - | </ | ||
| - | |||
| - | Tuez le script **hello-world.sh** : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | root 1038 0.0 0.0 12784 936 pts/0 S+ | ||
| - | [1]+ Complété | ||
| - | </ | ||
| - | |||
| - | Créez un second CGroup beaucoup plus restrictif : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | 4096 | ||
| - | </ | ||
| - | |||
| - | Relancez le script **hello-world.sh** et insérez-le dans le nouveau CGroup : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | [1] 1042 | ||
| - | root@debian9: | ||
| - | |||
| - | root@debian9: | ||
| - | </ | ||
| - | |||
| - | Attendez la prochaine sortie de **hello world** sur le canal standard puis constatez que le script s' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | |||
| - | [1]+ Processus arrêté | ||
| - | </ | ||
| - | |||
| - | Consultez en suite la fin du fichier **/ | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | Jul 28 10:39:26 debian9 kernel: [ 1501.775169] | ||
| - | Jul 28 10:39:26 debian9 kernel: [ 1501.775171] | ||
| - | Jul 28 10:39:26 debian9 kernel: [ 1501.775175] | ||
| - | Jul 28 10:39:26 debian9 kernel: [ 1501.775176] Task in / | ||
| - | Jul 28 10:39:26 debian9 kernel: [ 1501.775180] memory: usage 4kB, limit 4kB, failcnt 17 | ||
| - | Jul 28 10:39:26 debian9 kernel: [ 1501.775180] memory+swap: | ||
| - | Jul 28 10:39:26 debian9 kernel: [ 1501.775181] kmem: usage 0kB, limit 9007199254740988kB, | ||
| - | Jul 28 10:39:26 debian9 kernel: [ 1501.775181] Memory cgroup stats for / | ||
| - | Jul 28 10:39:26 debian9 kernel: [ 1501.775188] [ pid ] | ||
| - | Jul 28 10:39:26 debian9 kernel: [ 1501.775219] [ 1042] | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important> | ||
| - | **Important** - Notez la trace **Task in / | ||
| - | </ | ||
| - | |||
| - | ====1.4 - Le Paquet cgroup-tools==== | ||
| - | |||
| - | Le paquet **cgroup-tools** installe des commandes dites //de facilité// dont : | ||
| - | |||
| - | ===La commande cgcreate=== | ||
| - | |||
| - | Cette commande permet la création d'un CGroup : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | total 0 | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 11:09 cgroup.clone_children | ||
| - | --w--w--w- 1 root root 0 juil. 28 11:09 cgroup.event_control | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 11:09 cgroup.procs | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 11:09 memory.failcnt | ||
| - | --w------- 1 root root 0 juil. 28 11:09 memory.force_empty | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 11:09 memory.kmem.failcnt | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 11:09 memory.kmem.limit_in_bytes | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 11:09 memory.kmem.max_usage_in_bytes | ||
| - | -r--r--r-- 1 root root 0 juil. 28 11:09 memory.kmem.slabinfo | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 11:09 memory.kmem.tcp.failcnt | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 11:09 memory.kmem.tcp.limit_in_bytes | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 11:09 memory.kmem.tcp.max_usage_in_bytes | ||
| - | -r--r--r-- 1 root root 0 juil. 28 11:09 memory.kmem.tcp.usage_in_bytes | ||
| - | -r--r--r-- 1 root root 0 juil. 28 11:09 memory.kmem.usage_in_bytes | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 11:09 memory.limit_in_bytes | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 11:09 memory.max_usage_in_bytes | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 11:09 memory.move_charge_at_immigrate | ||
| - | -r--r--r-- 1 root root 0 juil. 28 11:09 memory.numa_stat | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 11:09 memory.oom_control | ||
| - | ---------- 1 root root 0 juil. 28 11:09 memory.pressure_level | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 11:09 memory.soft_limit_in_bytes | ||
| - | -r--r--r-- 1 root root 0 juil. 28 11:09 memory.stat | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 11:09 memory.swappiness | ||
| - | -r--r--r-- 1 root root 0 juil. 28 11:09 memory.usage_in_bytes | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 11:09 memory.use_hierarchy | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 11:09 notify_on_release | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 11:09 tasks | ||
| - | </ | ||
| - | |||
| - | Il n' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | </ | ||
| - | |||
| - | ===La Commande cgexec=== | ||
| - | |||
| - | Cette commande permet d' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | [2] 1860 | ||
| - | root@debian9: | ||
| - | |||
| - | root@debian9: | ||
| - | </ | ||
| - | |||
| - | === La Commande cgdelete=== | ||
| - | |||
| - | Une fois le script terminé, cette commande permet de supprimer le cgroup : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | root 1073 0.0 0.1 11172 2868 pts/0 S 11:18 0:00 /bin/bash ./ | ||
| - | root 1076 0.0 0.0 528 4 pts/0 R+ | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | root 1078 0.0 0.0 12784 920 pts/0 S+ | ||
| - | [1]+ Complété | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | ls: impossible d' | ||
| - | </ | ||
| - | |||
| - | ===Le Fichier / | ||
| - | |||
| - | Afin de les rendre persistants, | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | group helloworld2 { | ||
| - | cpu { | ||
| - | cpu.shares = 100; | ||
| - | } | ||
| - | memory { | ||
| - | memory.limit_in_bytes = 40000; | ||
| - | } | ||
| - | } | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important> | ||
| - | **Important** - Notez la création de **deux** limitations, | ||
| - | </ | ||
| - | |||
| - | Créez donc les deux CGroups concernés : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | total 0 | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:47 cgroup.clone_children | ||
| - | --w--w--w- 1 root root 0 juil. 28 12:47 cgroup.event_control | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:47 cgroup.procs | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:47 memory.failcnt | ||
| - | --w------- 1 root root 0 juil. 28 12:47 memory.force_empty | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:47 memory.kmem.failcnt | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:47 memory.kmem.limit_in_bytes | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:47 memory.kmem.max_usage_in_bytes | ||
| - | -r--r--r-- 1 root root 0 juil. 28 12:47 memory.kmem.slabinfo | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:47 memory.kmem.tcp.failcnt | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:47 memory.kmem.tcp.limit_in_bytes | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:47 memory.kmem.tcp.max_usage_in_bytes | ||
| - | -r--r--r-- 1 root root 0 juil. 28 12:47 memory.kmem.tcp.usage_in_bytes | ||
| - | -r--r--r-- 1 root root 0 juil. 28 12:47 memory.kmem.usage_in_bytes | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:47 memory.limit_in_bytes | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:47 memory.max_usage_in_bytes | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:47 memory.move_charge_at_immigrate | ||
| - | -r--r--r-- 1 root root 0 juil. 28 12:47 memory.numa_stat | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:47 memory.oom_control | ||
| - | ---------- 1 root root 0 juil. 28 12:47 memory.pressure_level | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:47 memory.soft_limit_in_bytes | ||
| - | -r--r--r-- 1 root root 0 juil. 28 12:47 memory.stat | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:47 memory.swappiness | ||
| - | -r--r--r-- 1 root root 0 juil. 28 12:47 memory.usage_in_bytes | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:47 memory.use_hierarchy | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:47 notify_on_release | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:47 tasks | ||
| - | </ | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | total 0 | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:48 cgroup.clone_children | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:48 cgroup.procs | ||
| - | -r--r--r-- 1 root root 0 juil. 28 12:48 cpuacct.stat | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:48 cpuacct.usage | ||
| - | -r--r--r-- 1 root root 0 juil. 28 12:48 cpuacct.usage_all | ||
| - | -r--r--r-- 1 root root 0 juil. 28 12:48 cpuacct.usage_percpu | ||
| - | -r--r--r-- 1 root root 0 juil. 28 12:48 cpuacct.usage_percpu_sys | ||
| - | -r--r--r-- 1 root root 0 juil. 28 12:48 cpuacct.usage_percpu_user | ||
| - | -r--r--r-- 1 root root 0 juil. 28 12:48 cpuacct.usage_sys | ||
| - | -r--r--r-- 1 root root 0 juil. 28 12:48 cpuacct.usage_user | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:48 cpu.cfs_period_us | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:48 cpu.cfs_quota_us | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:48 cpu.shares | ||
| - | -r--r--r-- 1 root root 0 juil. 28 12:48 cpu.stat | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:48 notify_on_release | ||
| - | -rw-r--r-- 1 root root 0 juil. 28 12:48 tasks | ||
| - | </ | ||
| - | |||
| - | Appliquez le contenu du fichier **/ | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | 36864 | ||
| - | root@debian9: | ||
| - | 100 | ||
| - | </ | ||
| - | |||
| - | =====LAB #2 - Utilisation des Docker Secrets===== | ||
| - | |||
| - | Les secrets Docker sont une façon sécurisée de stocker des informations sensibles telles les noms d' | ||
| - | |||
| - | Considérez l' | ||
| - | |||
| - | < | ||
| - | version: ' | ||
| - | |||
| - | services: | ||
| - | |||
| - | db: | ||
| - | image: postgres | ||
| - | environment: | ||
| - | POSTGRES_USER: | ||
| - | POSTGRES_PASSWORD: | ||
| - | POSTGRES_DB: | ||
| - | |||
| - | adminer: | ||
| - | image: adminer | ||
| - | ports: | ||
| - | - 8080:8080 | ||
| - | </ | ||
| - | |||
| - | On peut constater dans ce fichier la présence des informations sensibles en non-sécurisées : | ||
| - | |||
| - | * POSTGRES_USER | ||
| - | * POSTGRES_PASSWORD | ||
| - | * POSTGRES_DB | ||
| - | |||
| - | Afin de sécuriser ces informations, | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | </ | ||
| - | |||
| - | Créez ensuite un Docker Secret appelé **pg_user** : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | root@manager: | ||
| - | lpk8eq80qvfiqw7z1686fmj5t | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : Notez l' | ||
| - | </ | ||
| - | |||
| - | Pour visualiser la liste des secrets, utilisez la commande docker secrets **ls** : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | ID NAME DRIVER | ||
| - | lpk8eq80qvfiqw7z1686fmj5t | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : Notez que la colonne **DRIVER** est vide. Ceci indique que le gestion des secrets est accomplie par Docker lui-même au lieu d' | ||
| - | </ | ||
| - | |||
| - | Créez maintenant les secrets **pg_password** et **pg_database** : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | h9tsfbfwz6o0sd35roklwpopi | ||
| - | root@manager: | ||
| - | 5lx4zydpfocwgpdto0yy1jod9 | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : Notez qu'un secret Docker est immuable. | ||
| - | </ | ||
| - | |||
| - | Vérifiez la prise en compte de vos commandes : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | ID NAME DRIVER | ||
| - | 5lx4zydpfocwgpdto0yy1jod9 | ||
| - | h9tsfbfwz6o0sd35roklwpopi | ||
| - | lpk8eq80qvfiqw7z1686fmj5t | ||
| - | </ | ||
| - | |||
| - | Pour obtenir de l' | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | [ | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | }, | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | } | ||
| - | } | ||
| - | ] | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : On peut constater dans la sortie de cette commande la valeur **CreatedAt** qui correspond à la date de création du secret ainsi que **UpdatedAt** qui correspond à la date de modification du secret. | ||
| - | </ | ||
| - | |||
| - | L' | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | ID: 5lx4zydpfocwgpdto0yy1jod9 | ||
| - | Name: pg_database | ||
| - | Driver: | ||
| - | Created at: 2021-04-15 03: | ||
| - | Updated at: 2021-04-15 03: | ||
| - | </ | ||
| - | |||
| - | Créez maintenant le fichier compose **postgres-secrets.yaml** : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | root@manager: | ||
| - | version: ' | ||
| - | |||
| - | services: | ||
| - | |||
| - | db: | ||
| - | image: postgres | ||
| - | restart: always | ||
| - | environment: | ||
| - | POSTGRES_USER_FILE: | ||
| - | POSTGRES_PASSWORD_FILE: | ||
| - | POSTGRES_DB_FILE: | ||
| - | secrets: | ||
| - | - pg_password | ||
| - | - pg_user | ||
| - | - pg_database | ||
| - | |||
| - | adminer: | ||
| - | image: adminer | ||
| - | ports: | ||
| - | - 8080:8080 | ||
| - | |||
| - | secrets: | ||
| - | pg_user: | ||
| - | external: true | ||
| - | pg_password: | ||
| - | external: true | ||
| - | pg_database: | ||
| - | external: true | ||
| - | </ | ||
| - | |||
| - | Notez que dans ce fichier les trois variables **POSTGRES_USER**, | ||
| - | |||
| - | Deuxièmement la section suivantes spécifie les noms des secrets à utiliser avec le service : | ||
| - | |||
| - | < | ||
| - | secrets: | ||
| - | - pg_password | ||
| - | - pg_user | ||
| - | - pg_database | ||
| - | </ | ||
| - | |||
| - | La dernière section spécifie que les secrets sont **externes** : | ||
| - | |||
| - | < | ||
| - | secrets: | ||
| - | pg_user: | ||
| - | external: true | ||
| - | pg_password: | ||
| - | external: true | ||
| - | pg_database: | ||
| - | external: true | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : Le terme **externe** indique que les secrets ne seront pas stockés dans l' | ||
| - | </ | ||
| - | |||
| - | Déployez maintenant le service en utilisant la commande **docker stack** : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | Ignoring unsupported options: restart | ||
| - | |||
| - | Creating network postgres_default | ||
| - | Creating service postgres_db | ||
| - | Creating service postgres_adminer | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : Notez a présence de l' | ||
| - | </ | ||
| - | |||
| - | Connectez-vous maintenant à Apache Guacamole et ouvrez un navigateur web dans la machine virtuelle. Naviguez ensuite à l' | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | Validez le formulaire et vérifiez que les secrets ont été pris en compte : | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | Dernièrement, | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | NAME SERVICES | ||
| - | postgres | ||
| - | root@manager: | ||
| - | Removing service postgres_adminer | ||
| - | Removing service postgres_db | ||
| - | Removing network postgres_default | ||
| - | </ | ||
| - | |||
| - | =====LAB #3 - Création d'un Utilisateur de Confiance pour Contrôler le Daemon Docker===== | ||
| - | |||
| - | Au contraire des solutions classiques de gestion de machines virtuelles où l' | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | docker: | ||
| - | root@manager: | ||
| - | root@manager: | ||
| - | déconnexion | ||
| - | trainee@manager: | ||
| - | Got permission denied while trying to connect to the Docker daemon socket at unix:/// | ||
| - | trainee@manager: | ||
| - | trainee@manager: | ||
| - | CONTAINER ID IMAGE | ||
| - | d02c6115724c | ||
| - | trainee@manager: | ||
| - | alpine1 | ||
| - | trainee@manager: | ||
| - | a214e2df0499c97e8da25a6c9ea751ac75344c9bcd7d238f8cb8d5c777510ab9 | ||
| - | trainee@manager: | ||
| - | CONTAINER ID IMAGE | ||
| - | a214e2df0499 | ||
| - | </ | ||
| - | |||
| - | =====LAB #4 - Le Script docker-bench-security.sh===== | ||
| - | |||
| - | Le **Center for Internet Security (CIS)** est une organisation indépendante à but non-lucratif qui publie des best practices dans de nombreux domaines de l' | ||
| - | |||
| - | Le guide est divisé en plusieurs sections : | ||
| - | |||
| - | * La configuration de l' | ||
| - | * La configuration du daemon Docker, | ||
| - | * Les fichiers de configuration du daemon Docker, | ||
| - | * Les images ainsi que les fichiers servant à la construction des images, | ||
| - | * Le container runtime, | ||
| - | * Les opérations sécuritaires relatives à Docker, | ||
| - | * La configuration de Docker Swarm. | ||
| - | |||
| - | Ce guide est à utiliser avec le script **Docker Benchmark Security**. | ||
| - | |||
| - | Clonez le script **docker-bench-security.sh** en utilisant **git** : | ||
| - | |||
| - | < | ||
| - | trainee@manager: | ||
| - | Mot de passe : fenestros | ||
| - | root@manager: | ||
| - | Clonage dans ' | ||
| - | remote: Enumerating objects: 18, done. | ||
| - | remote: Counting objects: 100% (18/18), done. | ||
| - | remote: Compressing objects: 100% (16/16), done. | ||
| - | remote: Total 1921 (delta 5), reused 6 (delta 2), pack-reused 1903 | ||
| - | Réception d' | ||
| - | Résolution des deltas: 100% (1339/ | ||
| - | </ | ||
| - | |||
| - | Exécutez maintenant le script **Docker Benchmark Security** : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | root@manager: | ||
| - | # ------------------------------------------------------------------------------ | ||
| - | # Docker Bench for Security v1.3.5 | ||
| - | # | ||
| - | # Docker, Inc. (c) 2015- | ||
| - | # | ||
| - | # Checks for dozens of common best-practices around deploying Docker containers in production. | ||
| - | # Inspired by the CIS Docker Benchmark v1.2.0. | ||
| - | # ------------------------------------------------------------------------------ | ||
| - | |||
| - | Initializing vendredi 8 novembre 2019, 12:12:03 (UTC+0100) | ||
| - | |||
| - | |||
| - | [INFO] 1 - Host Configuration | ||
| - | |||
| - | [INFO] 1.1 - General Configuration | ||
| - | [NOTE] 1.1.1 - Ensure the container host has been Hardened | ||
| - | [INFO] 1.1.2 - Ensure Docker is up to date | ||
| - | [INFO] | ||
| - | [INFO] | ||
| - | |||
| - | [INFO] 1.2 - Linux Hosts Specific Configuration | ||
| - | [WARN] 1.2.1 - Ensure a separate partition for containers has been created | ||
| - | ... | ||
| - | </ | ||
| - | |||
| - | Ce script sert à automatiser le contrôle des points précédemment cités et produit un rapport contenant des annotations : | ||
| - | |||
| - | * **[PASS]** : Concerne les points qui n'ont pas besoin d' | ||
| - | * **[WARN]** : Concerne les points qui **doivent** être modifiés, | ||
| - | * **[INFO]** : Concerne les points qui doivent être passés en revue selon les besoins de votre configuration, | ||
| - | * **[NOTE]** : Vous informe d'un **best practice**. | ||
| - | |||
| - | =====LAB #5 - Sécurisation de la Configuration de l' | ||
| - | |||
| - | Lors de l' | ||
| - | |||
| - | < | ||
| - | ... | ||
| - | [INFO] 1 - Host Configuration | ||
| - | |||
| - | [INFO] 1.1 - General Configuration | ||
| - | [NOTE] 1.1.1 - Ensure the container host has been Hardened | ||
| - | [INFO] 1.1.2 - Ensure Docker is up to date | ||
| - | [INFO] | ||
| - | [INFO] | ||
| - | |||
| - | [INFO] 1.2 - Linux Hosts Specific Configuration | ||
| - | [WARN] 1.2.1 - Ensure a separate partition for containers has been created | ||
| - | [INFO] 1.2.2 - Ensure only trusted users are allowed to control Docker daemon | ||
| - | [INFO] | ||
| - | [WARN] 1.2.3 - Ensure auditing is configured for the Docker daemon | ||
| - | [WARN] 1.2.4 - Ensure auditing is configured for Docker files and directories - / | ||
| - | [WARN] 1.2.5 - Ensure auditing is configured for Docker files and directories - /etc/docker | ||
| - | [WARN] 1.2.6 - Ensure auditing is configured for Docker files and directories - docker.service | ||
| - | [WARN] 1.2.7 - Ensure auditing is configured for Docker files and directories - docker.socket | ||
| - | [WARN] 1.2.8 - Ensure auditing is configured for Docker files and directories - / | ||
| - | [INFO] 1.2.9 - Ensure auditing is configured for Docker files and directories - / | ||
| - | [INFO] | ||
| - | [INFO] 1.2.10 | ||
| - | [INFO] | ||
| - | [WARN] 1.2.11 | ||
| - | [INFO] 1.2.12 | ||
| - | [INFO] | ||
| - | ... | ||
| - | </ | ||
| - | |||
| - | Les problèmes de sécurité qu'il convient à résoudre sont indiqués par les annotations **[WARN]**. | ||
| - | |||
| - | ====5.1 - [WARN] 1.2.1 - Ensure a separate partition for containers has been created==== | ||
| - | |||
| - | Par défaut, tous les fichiers de Docker sont stockés dans le répertoire **/ | ||
| - | |||
| - | ====5.2 - [WARN] 1.2.3 - Ensure auditing is configured for the Docker daemon==== | ||
| - | |||
| - | < | ||
| - | [WARN] 1.2.4 - Ensure auditing is configured for Docker files and directories - / | ||
| - | [WARN] 1.2.5 - Ensure auditing is configured for Docker files and directories - /etc/docker | ||
| - | [WARN] 1.2.6 - Ensure auditing is configured for Docker files and directories - docker.service | ||
| - | [WARN] 1.2.7 - Ensure auditing is configured for Docker files and directories - docker.socket | ||
| - | [WARN] 1.2.8 - Ensure auditing is configured for Docker files and directories - / | ||
| - | [WARN] 1.2.11 | ||
| - | </ | ||
| - | |||
| - | Ces avertissements sont présents parce que **auditd** n'est pas installé et parce qu'il n'y a pas de règles spécifiques au daemon Docker et ses répertoires et fichiers associés. | ||
| - | |||
| - | Pour installer auditd, utilisez **apt-get** : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | </ | ||
| - | |||
| - | Modifiez ensuite le fichier **/ | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | root@manager: | ||
| - | ## First rule - delete all | ||
| - | -D | ||
| - | |||
| - | ## Increase the buffers to survive stress events. | ||
| - | ## Make this bigger for busy systems | ||
| - | -b 8192 | ||
| - | |||
| - | ## This determine how long to wait in burst of events | ||
| - | --backlog_wait_time 0 | ||
| - | |||
| - | ## Set failure mode to syslog | ||
| - | -f 1 | ||
| - | |||
| - | ##Docker | ||
| - | -w / | ||
| - | -w / | ||
| - | -w /etc/docker -p wa | ||
| - | -w / | ||
| - | -w / | ||
| - | -w / | ||
| - | -w / | ||
| - | -w / | ||
| - | -w / | ||
| - | -w / | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : L' | ||
| - | </ | ||
| - | |||
| - | Re-démarrez ensuite auditd : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | </ | ||
| - | |||
| - | Vérifiez ensuite la prise en charge des règles : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | ## This file is automatically generated from / | ||
| - | -D | ||
| - | -b 8192 | ||
| - | -f 1 | ||
| - | --backlog_wait_time 0 | ||
| - | -w / | ||
| - | -w / | ||
| - | -w /etc/docker -p wa | ||
| - | -w / | ||
| - | -w / | ||
| - | -w / | ||
| - | -w / | ||
| - | -w / | ||
| - | -w / | ||
| - | -w / | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** - Pour plus d' | ||
| - | </ | ||
| - | |||
| - | Ré-exécutez le script **Docker Benchmark Security** : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | ... | ||
| - | [PASS] 1.2.4 - Ensure auditing is configured for Docker files and directories - / | ||
| - | [PASS] 1.2.5 - Ensure auditing is configured for Docker files and directories - /etc/docker | ||
| - | [PASS] 1.2.6 - Ensure auditing is configured for Docker files and directories - docker.service | ||
| - | [PASS] 1.2.7 - Ensure auditing is configured for Docker files and directories - docker.socket | ||
| - | [PASS] 1.2.8 - Ensure auditing is configured for Docker files and directories - / | ||
| - | ... | ||
| - | [PASS] 1.2.11 | ||
| - | ... | ||
| - | </ | ||
| - | |||
| - | =====LAB #6 - Sécurisation de la Configuration du daemon Docker===== | ||
| - | |||
| - | Exécutez de nouveau le script **docker-bench-security.sh**. Vous devez obtenir un résultat similaire à ceci en ce qui concerne la sécurité de la configuration du daemon Docker : | ||
| - | |||
| - | < | ||
| - | ... | ||
| - | [INFO] 2 - Docker daemon configuration | ||
| - | [WARN] 2.1 - Ensure network traffic is restricted between containers on the default bridge | ||
| - | [PASS] 2.2 - Ensure the logging level is set to ' | ||
| - | [PASS] 2.3 - Ensure Docker is allowed to make changes to iptables | ||
| - | [PASS] 2.4 - Ensure insecure registries are not used | ||
| - | [PASS] 2.5 - Ensure aufs storage driver is not used | ||
| - | [INFO] 2.6 - Ensure TLS authentication for Docker daemon is configured | ||
| - | [INFO] | ||
| - | [INFO] 2.7 - Ensure the default ulimit is configured appropriately | ||
| - | [INFO] | ||
| - | [WARN] 2.8 - Enable user namespace support | ||
| - | [PASS] 2.9 - Ensure the default cgroup usage has been confirmed | ||
| - | [PASS] 2.10 - Ensure base device size is not changed until needed | ||
| - | [WARN] 2.11 - Ensure that authorization for Docker client commands is enabled | ||
| - | [WARN] 2.12 - Ensure centralized and remote logging is configured | ||
| - | [PASS] 2.13 - Ensure live restore is Enabled (Incompatible with swarm mode) | ||
| - | [WARN] 2.14 - Ensure Userland Proxy is Disabled | ||
| - | [PASS] 2.15 - Ensure that a daemon-wide custom seccomp profile is applied if appropriate | ||
| - | [PASS] 2.16 - Ensure that experimental features are not implemented in production | ||
| - | [WARN] 2.17 - Ensure containers are restricted from acquiring new privileges | ||
| - | ... | ||
| - | </ | ||
| - | |||
| - | Les problèmes de sécurité qu'il convient à résoudre sont indiqués par les annotations **[WARN]**. | ||
| - | |||
| - | ====6.1 - [WARN] 2.1 - Ensure network traffic is restricted between containers on the default bridge==== | ||
| - | |||
| - | Par défaut Docker permet un trafic réseau sans restrictions entre des conteneurs sur le même hôte. Il est cependant possible de modifier la configuration par défaut. Pour empêcher ceci, il faut fixer la valeur de **icc** à **false**. De cette façon, docker crée des conteneurs qui peuvent communiquer entre eux **uniquement** s'il existe un lien. | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====6.2 - [WARN] 2.8 - Enable user namespace support==== | ||
| - | |||
| - | Cet avertissement nous indique que l' | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====6.3 - [WARN] 2.11 - Ensure that authorization for Docker client commands is enabled==== | ||
| - | |||
| - | Par défaut, Docker permet un accès sans restrictions aux daemon Docker. Il est possible de restreindre l' | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====6.4 - [WARN] 2.12 - Ensure centralized and remote logging is configured==== | ||
| - | |||
| - | Cet avertissement indique que la configuration de rsyslog ne permet pas l' | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====6.5 - [WARN] 2.14 - Ensure Userland Proxy is Disabled==== | ||
| - | |||
| - | Il existe deux méthodes pour qu'un conteneur puisse router vers l' | ||
| - | |||
| - | * le mode **Hairpin NAT**, | ||
| - | * **Userland Proxy**. | ||
| - | |||
| - | Il est préférable d' | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====6.6 - [WARN] 2.17 - Ensure containers are restricted from acquiring new privileges==== | ||
| - | |||
| - | Par défaut un conteneur peut obtenir une escalade de privilèges en utilisant les binaires setuid ou setgid. Pour interdire ceci il faut fixer la valeur de **no-new-privileges** à **true**. | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====6.7 - Le Fichier / | ||
| - | |||
| - | Créez le fichier **/ | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | root@manager: | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | } | ||
| - | </ | ||
| - | |||
| - | Notez ici que **live-restore** est fixé à **true**. Ceci permet aux conteneurs de continuer à fonctionner même quand le daemon Docker ne fonctionne pas. Ceci est utile pendant la mise-à-jour de Docker. | ||
| - | |||
| - | Re-démarrez le service Docker : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | </ | ||
| - | |||
| - | Vérifiez la présence de l' | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | uid=116(dockremap) gid=121(dockremap) groupes=121(dockremap) | ||
| - | </ | ||
| - | |||
| - | Ré-exécutez le script **Docker Benchmark Security** : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | root@manager: | ||
| - | ... | ||
| - | [PASS] 2.1 - Ensure network traffic is restricted between containers on the default bridge | ||
| - | ... | ||
| - | [PASS] 2.8 - Enable user namespace support | ||
| - | ... | ||
| - | [WARN] 2.11 - Ensure that authorization for Docker client commands is enabled | ||
| - | [PASS] 2.12 - Ensure centralized and remote logging is configured | ||
| - | ... | ||
| - | [PASS] 2.14 - Ensure Userland Proxy is Disabled | ||
| - | ... | ||
| - | [PASS] 2.17 - Ensure containers are restricted from acquiring new privileges | ||
| - | ... | ||
| - | </ | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | =====LAB #7 - Sécurisation des Images et les Fichiers de Construction===== | ||
| - | |||
| - | Créez le conteneur mysql : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | Unable to find image ' | ||
| - | latest: Pulling from library/ | ||
| - | 80369df48736: | ||
| - | e8f52315cb10: | ||
| - | cf2189b391fc: | ||
| - | cc98f645c682: | ||
| - | 27a27ac83f74: | ||
| - | fa1f04453414: | ||
| - | d45bf7d22d33: | ||
| - | 3dbac26e409c: | ||
| - | 9017140fb8c1: | ||
| - | b76dda2673ae: | ||
| - | bea9eb46d12a: | ||
| - | e1f050a38d0f: | ||
| - | Digest: sha256: | ||
| - | Status: Downloaded newer image for mysql: | ||
| - | 54606c03c52c5e3ec0328029d69b869d4b285fb433015576dedc8b8dd4ad0494 | ||
| - | root@manager: | ||
| - | CONTAINER ID IMAGE | ||
| - | 54606c03c52c | ||
| - | </ | ||
| - | |||
| - | Exécutez de nouveau le script **docker-bench-security.sh**. Vous devez obtenir un résultat similaire à ceci en ce qui concerne la sécurité des images et les fichiers de leur construction : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | ... | ||
| - | [INFO] 4 - Container Images and Build File | ||
| - | [WARN] 4.1 - Ensure a user for the container has been created | ||
| - | [WARN] | ||
| - | [NOTE] 4.2 - Ensure that containers use only trusted base images | ||
| - | [NOTE] 4.3 - Ensure that unnecessary packages are not installed in the container | ||
| - | [NOTE] 4.4 - Ensure images are scanned and rebuilt to include security patches | ||
| - | [WARN] 4.5 - Ensure Content trust for Docker is Enabled | ||
| - | [WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images | ||
| - | [WARN] | ||
| - | [WARN] | ||
| - | [INFO] 4.7 - Ensure update instructions are not use alone in the Dockerfile | ||
| - | [INFO] | ||
| - | [NOTE] 4.8 - Ensure setuid and setgid permissions are removed | ||
| - | [PASS] 4.9 - Ensure that COPY is used instead of ADD in Dockerfiles | ||
| - | [NOTE] 4.10 - Ensure secrets are not stored in Dockerfiles | ||
| - | [NOTE] 4.11 - Ensure only verified packages are installed | ||
| - | ... | ||
| - | </ | ||
| - | |||
| - | ====7.1 - [WARN] 4.1 - Ensure a user for the container has been created==== | ||
| - | |||
| - | Les processus dans le conteneur **mysql** tourne sous l'UID de root. Ceci est l' | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====7.2 - [WARN] 4.5 - Ensure Content trust for Docker is Enabled==== | ||
| - | |||
| - | Cette ligne indique que le support de Content trust n'a pas été activé. Content trust permet de s' | ||
| - | |||
| - | Pour activer le Content trust, il faut positionner la valeur de la variable **DOCKER_CONTENT_TRUST** à **1** : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | DOCKER_CONTENT_TRUST=1 | ||
| - | root@manager: | ||
| - | </ | ||
| - | |||
| - | Re-démarrez la machine virtuelle **Manager** et démarrez le conteneur **mysql** : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | mysql | ||
| - | root@manager: | ||
| - | CONTAINER ID IMAGE | ||
| - | 54606c03c52c | ||
| - | </ | ||
| - | |||
| - | Exécutez de nouveau le script et notez le contenu de la section 4 : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | ... | ||
| - | [INFO] 4 - Container Images and Build File | ||
| - | [WARN] 4.1 - Ensure a user for the container has been created | ||
| - | [WARN] | ||
| - | [NOTE] 4.2 - Ensure that containers use only trusted base images | ||
| - | [NOTE] 4.3 - Ensure that unnecessary packages are not installed in the container | ||
| - | [NOTE] 4.4 - Ensure images are scanned and rebuilt to include security patches | ||
| - | [PASS] 4.5 - Ensure Content trust for Docker is Enabled | ||
| - | [WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images | ||
| - | [WARN] | ||
| - | [WARN] | ||
| - | [INFO] 4.7 - Ensure update instructions are not use alone in the Dockerfile | ||
| - | [INFO] | ||
| - | [NOTE] 4.8 - Ensure setuid and setgid permissions are removed | ||
| - | [PASS] 4.9 - Ensure that COPY is used instead of ADD in Dockerfiles | ||
| - | [NOTE] 4.10 - Ensure secrets are not stored in Dockerfiles | ||
| - | [NOTE] 4.11 - Ensure only verified packages are installed | ||
| - | ... | ||
| - | </ | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====7.3 - [WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images==== | ||
| - | |||
| - | Quand une image est construite il est possible d'y mettre un **HEALTHCHECK** dont le statut peut être vérifié par Docker afin de relancer le conteneur si nécessaire. | ||
| - | |||
| - | Pour mettre en place un HEALTHCHECK, | ||
| - | |||
| - | < | ||
| - | HEALTHCHECK --interval=20s --timeout=3s CMD curl -f http:// | ||
| - | </ | ||
| - | |||
| - | Ce test permet de vérifier que le conteneur peut atteindre l'URL indiqué tous les 20 secondes et produit une erreur au bout de 3 secondes. | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | =====LAB #8 - Sécurisation du Container Runtime===== | ||
| - | |||
| - | Exécutez de nouveau le script **docker-bench-security.sh**, | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | ... | ||
| - | [INFO] 5 - Container Runtime | ||
| - | [WARN] 5.1 - Ensure that, if applicable, an AppArmor Profile is enabled | ||
| - | [WARN] | ||
| - | [WARN] 5.2 - Ensure that, if applicable, SELinux security options are set | ||
| - | [WARN] | ||
| - | [PASS] 5.3 - Ensure Linux Kernel Capabilities are restricted within containers | ||
| - | [PASS] 5.4 - Ensure that privileged containers are not used | ||
| - | [PASS] 5.5 - Ensure sensitive host system directories are not mounted on containers | ||
| - | [PASS] 5.6 - Ensure sshd is not run within containers | ||
| - | [PASS] 5.7 - Ensure privileged ports are not mapped within containers | ||
| - | [NOTE] 5.8 - Ensure that only needed ports are open on the container | ||
| - | [PASS] 5.9 - Ensure the host's network namespace is not shared | ||
| - | [WARN] 5.10 - Ensure that the memory usage for containers is limited | ||
| - | [WARN] | ||
| - | [WARN] 5.11 - Ensure CPU priority is set appropriately on the container | ||
| - | [WARN] | ||
| - | [WARN] 5.12 - Ensure that the container' | ||
| - | [WARN] | ||
| - | [PASS] 5.13 - Ensure that incoming container traffic is bound to a specific host interface | ||
| - | [WARN] 5.14 - Ensure that the ' | ||
| - | [WARN] | ||
| - | [PASS] 5.15 - Ensure the host's process namespace is not shared | ||
| - | [PASS] 5.16 - Ensure the host's IPC namespace is not shared | ||
| - | [PASS] 5.17 - Ensure that host devices are not directly exposed to containers | ||
| - | [INFO] 5.18 - Ensure that the default ulimit is overwritten at runtime if needed | ||
| - | [INFO] | ||
| - | [PASS] 5.19 - Ensure mount propagation mode is not set to shared | ||
| - | [PASS] 5.20 - Ensure the host's UTS namespace is not shared | ||
| - | [PASS] 5.21 - Ensure the default seccomp profile is not Disabled | ||
| - | [NOTE] 5.22 - Ensure docker exec commands are not used with privileged option | ||
| - | [NOTE] 5.23 - Ensure that docker exec commands are not used with the user=root option | ||
| - | [PASS] 5.24 - Ensure that cgroup usage is confirmed | ||
| - | [WARN] 5.25 - Ensure that the container is restricted from acquiring additional privileges | ||
| - | [WARN] | ||
| - | [WARN] 5.26 - Ensure that container health is checked at runtime | ||
| - | [WARN] | ||
| - | [INFO] 5.27 - Ensure that Docker commands always make use of the latest version of their image | ||
| - | [WARN] 5.28 - Ensure that the PIDs cgroup limit is used | ||
| - | [WARN] | ||
| - | [INFO] 5.29 - Ensure that Docker' | ||
| - | [INFO] | ||
| - | [PASS] 5.30 - Ensure that the host's user namespaces are not shared | ||
| - | [PASS] 5.31 - Ensure that the Docker socket is not mounted inside any containers | ||
| - | ... | ||
| - | </ | ||
| - | |||
| - | Les problèmes de sécurité qu'il convient à résoudre sont indiqués par les annotations **[WARN]**. | ||
| - | |||
| - | ====8.1 - [WARN] 5.1 - Ensure AppArmor Profile is Enabled==== | ||
| - | |||
| - | Cet avertissement est présent parce que le conteneur n' | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====8.2 - [WARN] 5.2 - Ensure SELinux security options are set, if applicable==== | ||
| - | |||
| - | Cet avertissement est présent parce que le conteneur n' | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====8.3 - [WARN] 5.10 - Ensure memory usage for container is limited==== | ||
| - | |||
| - | Cet avertissement est du au fait que les conteneurs ont automatiquement accès à la totalité de la RAM de l' | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | b04b2a6f0dd93da21a8b7640afc319406e42868a141f90936dbcf52ab5bffb0d | ||
| - | root@manager: | ||
| - | CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O PIDS | ||
| - | b04b2a6f0dd9 | ||
| - | ^C | ||
| - | </ | ||
| - | |||
| - | Supprimez le conteneur et re-créez le avec une limite de mémoire : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | CONTAINER ID IMAGE | ||
| - | b04b2a6f0dd9 | ||
| - | 5b31fe1e13bc | ||
| - | 7788c67c3b69 | ||
| - | root@manager: | ||
| - | b0 | ||
| - | root@manager: | ||
| - | 095472e5096a57277230ff94822d9bd0ad479ad26a33cbf83ec381cdb02910e1 | ||
| - | root@manager: | ||
| - | CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O PIDS | ||
| - | 095472e5096a | ||
| - | ^C | ||
| - | </ | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====8.4 - [WARN] 5.11 - Ensure CPU priority is set appropriately on the container==== | ||
| - | |||
| - | Cet avertissement est du au fait que les conteneurs ont automatiquement accès à tous les CPU de l' | ||
| - | |||
| - | La valeur de cpu-shares est relative à la valeur par défaut de **1024**. Un valeur de 512 permet au conteneur d' | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====8.5 - [WARN] 5.12 - Ensure the container' | ||
| - | |||
| - | Afin de minimiser le risque de compromettre un conteneur par la présence de code malicieux, il est conseillé de démarrer les conteneurs en lecture seule, sauf pour les volumes qui nécessitent un accès en écriture/ | ||
| - | |||
| - | Créez le fichier **write_a_file** dans le conteneur **mysql** : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | </ | ||
| - | |||
| - | La Commande **docker container diff** indique les différences apportées au conteneur par rapport à l' | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | A / | ||
| - | C /run | ||
| - | C /run/mysqld | ||
| - | A / | ||
| - | A / | ||
| - | A / | ||
| - | A / | ||
| - | A / | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : Notez que la sortie indique les changements apportés au conteneur. | ||
| - | </ | ||
| - | |||
| - | Arrêtez et supprimez le conteneur : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | mysql | ||
| - | root@manager: | ||
| - | mysql | ||
| - | </ | ||
| - | |||
| - | Lancez un conteneur mysql en lecture seule : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | 7788c67c3b692515f63f4659a8f40af397bfbde97485e2e40c500c16b158045b | ||
| - | root@manager: | ||
| - | CONTAINER ID IMAGE | ||
| - | 7788c67c3b69 | ||
| - | </ | ||
| - | |||
| - | Créez le fichier **write_a_file** dans le conteneur **mysql** : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | touch: cannot touch '/ | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : Notez l' | ||
| - | </ | ||
| - | |||
| - | Exécutez la commande **docker container diff** : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | root@manager: | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : Notez que la commande ne retourne aucune sortie. En effet le conteneur étant en lecture seule, aucun changement ne peut intervenir. | ||
| - | </ | ||
| - | |||
| - | ====8.6 - [WARN] 5.14 - Ensure ' | ||
| - | |||
| - | Cet avertissement concerne la politique de re-démarrage du conteneur. La politique **on-failure[: | ||
| - | |||
| - | # docker container run -d --name mysql --read-only --restart on-failure: | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====8.7 - [WARN] 5.25 - Ensure the container is restricted from acquiring additional privileges==== | ||
| - | |||
| - | Pour complémenter la configuration précédemment mise en place, il convient de lancer le conteneur en utilisant l' | ||
| - | |||
| - | # docker container run -d --name mysql --read-only --restart on-failure: | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====8.8 - [WARN] 5.26 - Ensure container health is checked at runtime==== | ||
| - | |||
| - | Voir l' | ||
| - | |||
| - | ====8.9 - [WARN] 5.28 - Ensure PIDs cgroup limit is used==== | ||
| - | |||
| - | Sans l' | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | </ | ||
| - | |||
| - | L' | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | CONTAINER ID IMAGE | ||
| - | 05b11e44e595 | ||
| - | ... | ||
| - | root@manager: | ||
| - | 05 | ||
| - | root@manager: | ||
| - | environment: | ||
| - | environment: | ||
| - | environment: | ||
| - | environment: | ||
| - | environment: | ||
| - | environment: | ||
| - | ^C | ||
| - | </ | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | Supprimez maintenant tous les conteneurs déjà créées : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | CONTAINER ID IMAGE | ||
| - | 095472e5096a | ||
| - | 5b31fe1e13bc | ||
| - | 7788c67c3b69 | ||
| - | root@manager: | ||
| - | 095 | ||
| - | root@manager: | ||
| - | 5b31fe1e13bc | ||
| - | 7788c67c3b69 | ||
| - | 095472e5096a | ||
| - | root@manager: | ||
| - | CONTAINER ID IMAGE | ||
| - | </ | ||
| - | |||
| - | Re-créez le conteneur mysql en intégrant les points vus ci-dessus : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | root@manager: | ||
| - | df54974ebc11fe357f6e8e9b0f8499aee2658af435e32a45058a1e49fcd3dc24 | ||
| - | root@manager: | ||
| - | CONTAINER ID IMAGE | ||
| - | df54974ebc11 | ||
| - | </ | ||
| - | |||
| - | Exécutez de nouveau le script **docker-bench-security.sh**, | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | ... | ||
| - | [INFO] 5 - Container Runtime | ||
| - | [WARN] 5.1 - Ensure that, if applicable, an AppArmor Profile is enabled | ||
| - | [WARN] | ||
| - | [PASS] 5.2 - Ensure that, if applicable, SELinux security options are set | ||
| - | [PASS] 5.3 - Ensure Linux Kernel Capabilities are restricted within containers | ||
| - | [PASS] 5.4 - Ensure that privileged containers are not used | ||
| - | [PASS] 5.5 - Ensure sensitive host system directories are not mounted on containers | ||
| - | [PASS] 5.6 - Ensure sshd is not run within containers | ||
| - | [PASS] 5.7 - Ensure privileged ports are not mapped within containers | ||
| - | [NOTE] 5.8 - Ensure that only needed ports are open on the container | ||
| - | [PASS] 5.9 - Ensure the host's network namespace is not shared | ||
| - | [PASS] 5.10 - Ensure that the memory usage for containers is limited | ||
| - | [PASS] 5.11 - Ensure CPU priority is set appropriately on the container | ||
| - | [PASS] 5.12 - Ensure that the container' | ||
| - | [PASS] 5.13 - Ensure that incoming container traffic is bound to a specific host interface | ||
| - | [PASS] 5.14 - Ensure that the ' | ||
| - | [PASS] 5.15 - Ensure the host's process namespace is not shared | ||
| - | [PASS] 5.16 - Ensure the host's IPC namespace is not shared | ||
| - | [PASS] 5.17 - Ensure that host devices are not directly exposed to containers | ||
| - | [INFO] 5.18 - Ensure that the default ulimit is overwritten at runtime if needed | ||
| - | [INFO] | ||
| - | [PASS] 5.19 - Ensure mount propagation mode is not set to shared | ||
| - | [PASS] 5.20 - Ensure the host's UTS namespace is not shared | ||
| - | [PASS] 5.21 - Ensure the default seccomp profile is not Disabled | ||
| - | [NOTE] 5.22 - Ensure docker exec commands are not used with privileged option | ||
| - | [NOTE] 5.23 - Ensure that docker exec commands are not used with the user=root option | ||
| - | [PASS] 5.24 - Ensure that cgroup usage is confirmed | ||
| - | [PASS] 5.25 - Ensure that the container is restricted from acquiring additional privileges | ||
| - | [WARN] 5.26 - Ensure that container health is checked at runtime | ||
| - | [WARN] | ||
| - | [INFO] 5.27 - Ensure that Docker commands always make use of the latest version of their image | ||
| - | [PASS] 5.28 - Ensure that the PIDs cgroup limit is used | ||
| - | [INFO] 5.29 - Ensure that Docker' | ||
| - | [INFO] | ||
| - | [PASS] 5.30 - Ensure that the host's user namespaces are not shared | ||
| - | [PASS] 5.31 - Ensure that the Docker socket is not mounted inside any containers | ||
| - | ... | ||
| - | </ | ||
| - | |||
| - | =====LAB #9 - Sécurisation des Images avec Docker Content Trust===== | ||
| - | |||
| - | **Docker Content Trust (DCT)** a été introduit avec Docker Engine 1.8 et Docker CS Engine 1.9.0. DCT permet la vérification de l' | ||
| - | |||
| - | DCT est utilisé par le **Docker Hub Registry** mais peut aussi être mis en place dans des Registry privés, notamment grâce à la mise en place du **[[https:// | ||
| - | |||
| - | DCT est basé sur l' | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====9.1 - DOCKER_CONTENT_TRUST==== | ||
| - | |||
| - | Pour utiliser **Docker Content Trust (DCT)**, il convient de vérifier que la valeur de la variable **DOCKER_CONTENT_TRUST** est **1** : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | 1 | ||
| - | </ | ||
| - | |||
| - | Dans le cas contraire, il faut fixer la valeur de la variable à 1 : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | root@manager: | ||
| - | 1 | ||
| - | </ | ||
| - | |||
| - | ====9.2 - DCT et la commande docker pull==== | ||
| - | |||
| - | Afin d' | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | Login with your Docker ID to push and pull images from Docker Hub. If you don't have a Docker ID, head over to https:// | ||
| - | Username: < | ||
| - | Password: < | ||
| - | WARNING! Your password will be stored unencrypted in / | ||
| - | Configure a credential helper to remove this warning. See | ||
| - | https:// | ||
| - | |||
| - | Login Succeeded | ||
| - | </ | ||
| - | |||
| - | Pour constater l' | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | Error: remote trust data does not exist for docker.io/ | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : Notez l' | ||
| - | </ | ||
| - | |||
| - | Par contre, toutes les images de type **official** sont signées : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | Using default tag: latest | ||
| - | Pull (1 of 1): centos: | ||
| - | sha256: | ||
| - | 729ec3a6ada3: | ||
| - | Digest: sha256: | ||
| - | Status: Downloaded newer image for centos@sha256: | ||
| - | Tagging centos@sha256: | ||
| - | docker.io/ | ||
| - | </ | ||
| - | |||
| - | Cette image est maintenant présente sur **manager.i2tch.loc** : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | REPOSITORY | ||
| - | ubuntu | ||
| - | nginx | ||
| - | alpine | ||
| - | mysql | ||
| - | centos | ||
| - | </ | ||
| - | |||
| - | ===L' | ||
| - | |||
| - | Il est aussi possible d' | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | unsigned: Pulling from i2tch/ | ||
| - | 10d70a43a9f9: | ||
| - | 4f4fb700ef54: | ||
| - | 8951e3a91277: | ||
| - | d1814ff35b8b: | ||
| - | ff2a2bbf6141: | ||
| - | b7205da5c3c9: | ||
| - | 458ea241cc75: | ||
| - | 74d1c0702786: | ||
| - | c66f3692932d: | ||
| - | 9224bd1b9757: | ||
| - | Digest: sha256: | ||
| - | Status: Downloaded newer image for i2tch/ | ||
| - | docker.io/ | ||
| - | |||
| - | root@manager: | ||
| - | REPOSITORY | ||
| - | ubuntu | ||
| - | nginx | ||
| - | alpine | ||
| - | mysql | ||
| - | centos | ||
| - | i2tch/ | ||
| - | |||
| - | root@manager: | ||
| - | Untagged: i2tch/ | ||
| - | Untagged: i2tch/ | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | </ | ||
| - | |||
| - | ====9.3 - DCT et la commande docker push==== | ||
| - | |||
| - | Pour envoyer l' | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | </ | ||
| - | |||
| - | L' | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | REPOSITORY | ||
| - | ubuntu | ||
| - | nginx latest | ||
| - | < | ||
| - | alpine | ||
| - | mysql latest | ||
| - | centos | ||
| - | </ | ||
| - | |||
| - | Lors du push vers le registry privé, il faut créer des passphrases pour **deux** clefs : | ||
| - | |||
| - | * la **root** key aussi connue sous le nom **offline** key (ID 192fc7e), qui est uniquement demandée la **première** fois après la mise en place de DCT lors de la création d'un **repositry**, | ||
| - | * la **repository** key aussi connue sous le nom **tagging** key (ID 168c754), utilisée pour signer l' | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | The push refers to repository [docker.io/< | ||
| - | 77cae8ab23bf: | ||
| - | alpine: digest: sha256: | ||
| - | Signing and pushing trust metadata | ||
| - | You are about to create a new root signing key passphrase. This passphrase | ||
| - | will be used to protect the most sensitive key in your signing system. Please | ||
| - | choose a long, complex passphrase and be careful to keep the password and the | ||
| - | key file itself secure and backed up. It is highly recommended that you use a | ||
| - | password manager to generate the passphrase and keep it safe. There will be no | ||
| - | way to recover this key. You can find the key in your config directory. | ||
| - | Enter passphrase for new root key with ID 192fc7e: fenestros | ||
| - | Repeat passphrase for new root key with ID 192fc7e: fenestros | ||
| - | Enter passphrase for new repository key with ID 168c754: fenestros | ||
| - | Repeat passphrase for new repository key with ID 168c754: fenestros | ||
| - | Finished initializing " | ||
| - | Successfully signed docker.io/< | ||
| - | </ | ||
| - | |||
| - | Les clefs sont stockées dans le répertoire **~/ | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | total 8 | ||
| - | drwx------ 2 root root 4096 nov. 10 14:49 private | ||
| - | drwx------ 3 root root 4096 nov. 8 13:48 tuf | ||
| - | |||
| - | root@manager: | ||
| - | total 8 | ||
| - | -rw------- 1 root root 447 nov. 10 14:49 168c754ea8f36ce7fbcbe2299b6d91fc0f4d594c9ed9b86916687b618d8438ac.key | ||
| - | -rw------- 1 root root 416 nov. 10 14:49 192fc7ed9543ad4bceec58886ab1d605b7433c35f7462d7343d0780d8fddf1db.key | ||
| - | root@manager: | ||
| - | -----BEGIN ENCRYPTED PRIVATE KEY----- | ||
| - | gun: docker.io/ | ||
| - | role: targets | ||
| - | |||
| - | MIHuMEkGCSqGSIb3DQEFDTA8MBsGCSqGSIb3DQEFDDAOBAhm7HwR0y8FFAICCAAw | ||
| - | HQYJYIZIAWUDBAEqBBC729tU73wKHFQSbmZ1EVZaBIGgmGiFSs4lM5tElSGukl1B | ||
| - | HrELT9aFooFgW7oSXNLM8aFfF/ | ||
| - | 3m40g3MywHilW4rUcjoHVTTUXABGXUQ3f7h+nI15CXcZ11qRLyWbf2uywE9yYH9O | ||
| - | M7GLUcE+pTENJKfZAhRGBEL+LgXNfGI1aAVqaEbBDcDnKKf4Uj1Xu4oLJ7je8+nT | ||
| - | dg== | ||
| - | -----END ENCRYPTED PRIVATE KEY----- | ||
| - | |||
| - | root@manager: | ||
| - | -----BEGIN ENCRYPTED PRIVATE KEY----- | ||
| - | role: root | ||
| - | |||
| - | MIHuMEkGCSqGSIb3DQEFDTA8MBsGCSqGSIb3DQEFDDAOBAiAtCzEar3AhgICCAAw | ||
| - | HQYJYIZIAWUDBAEqBBAO7hHWVoqOo6xcETQQDXRdBIGgPUoLzTz07Ajx8K3D8+Vv | ||
| - | 2NUiflMYhH/ | ||
| - | V2BwSlXp7t1Cnqp/ | ||
| - | KREO8uEq3v7HcSBBqFm0+TU+92d7hVuDApPaj0lZYP+3f7H6AjUOqu6hUoK8Ck/ | ||
| - | Ig== | ||
| - | -----END ENCRYPTED PRIVATE KEY----- | ||
| - | </ | ||
| - | |||
| - | ====9.4 - DCT et la commande docker build==== | ||
| - | |||
| - | L' | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | root@manager: | ||
| - | root@manager: | ||
| - | root@manager: | ||
| - | FROM docker/ | ||
| - | RUN echo | ||
| - | </ | ||
| - | |||
| - | Lors du build de l' | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | Sending build context to Docker daemon | ||
| - | |||
| - | error during connect: Post http:// | ||
| - | </ | ||
| - | |||
| - | L' | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | Sending build context to Docker daemon | ||
| - | Step 1/2 : FROM docker/ | ||
| - | latest: Pulling from docker/ | ||
| - | Image docker.io/ | ||
| - | aac0c133338d: | ||
| - | a3ed95caeb02: | ||
| - | Digest: sha256: | ||
| - | Status: Downloaded newer image for docker/ | ||
| - | | ||
| - | Step 2/2 : RUN echo | ||
| - | | ||
| - | |||
| - | Removing intermediate container 694e79d3cd88 | ||
| - | | ||
| - | Successfully built 686e85ee76b8 | ||
| - | Successfully tagged < | ||
| - | </ | ||
| - | |||
| - | Lors du push de l' | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | The push refers to repository [docker.io/< | ||
| - | 5f70bf18a086: | ||
| - | c22f7bc058a9: | ||
| - | nottrusted: digest: sha256: | ||
| - | Signing and pushing trust metadata | ||
| - | Enter passphrase for repository key with ID 168c754: fenestros | ||
| - | Successfully signed docker.io/< | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : Notez l' | ||
| - | </ | ||
| - | |||
| - | ===Créer un deuxième Repositry=== | ||
| - | |||
| - | Par contre en modifiant le tag de l' | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | root@manager: | ||
| - | REPOSITORY | ||
| - | < | ||
| - | < | ||
| - | ubuntu | ||
| - | nginx latest | ||
| - | < | ||
| - | alpine | ||
| - | mysql latest | ||
| - | centos | ||
| - | docker/ | ||
| - | |||
| - | root@manager: | ||
| - | The push refers to repository [docker.io/< | ||
| - | 5f70bf18a086: | ||
| - | c22f7bc058a9: | ||
| - | latest: digest: sha256: | ||
| - | Signing and pushing trust metadata | ||
| - | Enter passphrase for root key with ID 192fc7e: fenestros | ||
| - | Enter passphrase for new repository key with ID 7b13d02: fenestros | ||
| - | Repeat passphrase for new repository key with ID 7b13d02: fenestros | ||
| - | Finished initializing " | ||
| - | Successfully signed docker.io/< | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : Notez la création d'une deuxième repositry key (ID 7b13d02 au lieu de ID 168c754) lors du push de l' | ||
| - | </ | ||
| - | |||
| - | La présence de cette deuxième repositry key (**7b13d02d74264624fb201e7ae13ae694286b9f761aa86adddefd0408c7234a58.key**) peut être constatée dans le répertoire **~/ | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | total 12 | ||
| - | -rw------- 1 root root 447 nov. 10 14:49 168c754ea8f36ce7fbcbe2299b6d91fc0f4d594c9ed9b86916687b618d8438ac.key | ||
| - | -rw------- 1 root root 416 nov. 10 14:49 192fc7ed9543ad4bceec58886ab1d605b7433c35f7462d7343d0780d8fddf1db.key | ||
| - | -rw------- 1 root root 451 nov. 10 17:37 7b13d02d74264624fb201e7ae13ae694286b9f761aa86adddefd0408c7234a58.key | ||
| - | </ | ||
| - | |||
| - | En inspectant les clefs des images créées, l' | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | [ | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | "Repo Admin" | ||
| - | ] | ||
| - | } | ||
| - | ], | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | } | ||
| - | ] | ||
| - | }, | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | } | ||
| - | ] | ||
| - | } | ||
| - | ] | ||
| - | } | ||
| - | ] | ||
| - | root@manager: | ||
| - | [ | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | "Repo Admin" | ||
| - | ] | ||
| - | } | ||
| - | ], | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | } | ||
| - | ] | ||
| - | }, | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | } | ||
| - | ] | ||
| - | } | ||
| - | ] | ||
| - | } | ||
| - | ] | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : Notez que les clefs utilisées sont les mêmes pour les deux images. | ||
| - | </ | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | [ | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | "Repo Admin" | ||
| - | ] | ||
| - | } | ||
| - | ], | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | } | ||
| - | ] | ||
| - | }, | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | } | ||
| - | ] | ||
| - | } | ||
| - | ] | ||
| - | } | ||
| - | ] | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : Notez que les clefs utilisées sont différentes. | ||
| - | </ | ||
| - | |||
| - | ===Supprimer une Signature=== | ||
| - | |||
| - | Dernièrement il est possible de supprimer la signature d'une image avec la commande **docker trust revoke** : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | Enter passphrase for repository key with ID 168c754: | ||
| - | Successfully deleted signature for < | ||
| - | root@manager: | ||
| - | [ | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | } | ||
| - | ] | ||
| - | }, | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | } | ||
| - | ] | ||
| - | } | ||
| - | ] | ||
| - | } | ||
| - | ] | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important> | ||
| - | **Important** : Il existe un autre mécanisme de signatures cryptographiques qui permet de certifier le contenu des images mises à disposition sur une Registry. Appelé **Notary**, ce système a été développé par la communauté Docker et intègre une partie de la spécification de **[[https:// | ||
| - | </ | ||
| - | |||
| - | =====LAB #10 - Sécurisation du Socket du Daemon Docker===== | ||
| - | |||
| - | Par défaut le daemon Docker peut être contacté en utilisant un socket Unix local ce qui implique qu'il faut une connexion SSH vers l' | ||
| - | |||
| - | Pour pouvoir contacter de daemon Docker via le réseau d'une manière sécurisée il faut installer, configurer et activer le support TLS grâce aux options **tlsverify** et **tlscacert**. | ||
| - | |||
| - | La configuration implique que : | ||
| - | |||
| - | * pour le daemon Docker, seules les connections en provenance de clients authentifiés par un certificat signé par l' | ||
| - | * pour le client, il ne peut que connecter aux serveurs ayant un certificat signé par le CA du serveur. | ||
| - | |||
| - | La mise en place nécessite **openssl** : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | / | ||
| - | </ | ||
| - | |||
| - | ====10.1 - Création du Certificat de l' | ||
| - | |||
| - | Commencez par créer une clef privée **ca-key.pem** pour le CA : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | Generating RSA private key, 4096 bit long modulus | ||
| - | ......................................................................................................................++++ | ||
| - | ...............................................................................................................................................................++++ | ||
| - | e is 65537 (0x010001) | ||
| - | Enter pass phrase for ca-key.pem: | ||
| - | Verifying - Enter pass phrase for ca-key.pem: | ||
| - | </ | ||
| - | |||
| - | Ensuite, créez le certificat **ca.pem** du CA : | ||
| - | |||
| - | < | ||
| - | root@manager: | ||
| - | Enter pass phrase for ca-key.pem: | ||
| - | You are about to be asked to enter information that will be incorporated | ||
| - | into your certificate request. | ||
| - | What you are about to enter is what is called a Distinguished Name or a DN. | ||
| - | There are quite a few fields but you can leave some blank | ||
| - | For some fields there will be a default value, | ||
| - | If you enter ' | ||
| ----- | ----- | ||
| - | Country Name (2 letter code) [AU]:GB | ||
| - | State or Province Name (full name) [Some-State]: | ||
| - | Locality Name (eg, city) []: | ||
| - | Organization Name (eg, company) [Internet Widgits Pty Ltd]:I2TCH LIMITED | ||
| - | Organizational Unit Name (eg, section) []:TRAINING | ||
| - | Common Name (e.g. server FQDN or YOUR name) []: | ||
| - | Email Address []: | ||
| - | </ | ||
| - | ====10.2 | + | Copyright © 2024 Hugh Norris |
| - | + | ||
| - | Les clefs du CA ayant été créées, créez une clef **server-key.pem** pour le serveur hôte du daemon Docker : | + | |
| - | + | ||
| - | < | + | |
| - | root@manager: | + | |
| - | Generating RSA private key, 4096 bit long modulus | + | |
| - | .................................................................................................................................++++ | + | |
| - | ...........................++++ | + | |
| - | e is 65537 (0x010001) | + | |
| - | </ | + | |
| - | + | ||
| - | Créez ensuite un **[[https:// | + | |
| - | + | ||
| - | < | + | |
| - | root@manager: | + | |
| - | manager.i2tch.loc | + | |
| - | root@manager: | + | |
| - | </ | + | |
| - | + | ||
| - | Une connexion TLS peut être effectuée en utilisant un FQDN ou une adresse IP. Pour cette raison, créez le fichier **extfile.cnf** : | + | |
| - | + | ||
| - | < | + | |
| - | root@manager: | + | |
| - | </ | + | |
| - | + | ||
| - | Fixez l' | + | |
| - | + | ||
| - | < | + | |
| - | root@manager: | + | |
| - | </ | + | |
| - | + | ||
| - | Vérifiez que votre fichier a été correctement créé : | + | |
| - | + | ||
| - | < | + | |
| - | root@manager: | + | |
| - | subjectAltName = DNS: | + | |
| - | extendedKeyUsage = serverAuth | + | |
| - | </ | + | |
| - | + | ||
| - | Signez maintenant le CSR du serveur **server.csr** avec la clef privée du CA **ca-key.pem** afin de produire le certificat du serveur **server-cert.pem** : | + | |
| - | + | ||
| - | < | + | |
| - | root@manager: | + | |
| - | Signature ok | + | |
| - | subject=CN = manager.i2tch.loc | + | |
| - | Getting CA Private Key | + | |
| - | Enter pass phrase for ca-key.pem: | + | |
| - | </ | + | |
| - | + | ||
| - | ====10.3 - Création du Certificat du Client==== | + | |
| - | + | ||
| - | Créez ensuite la clef privée **key.pem** du client qui se connectera au daemon à partir du réseau : | + | |
| - | + | ||
| - | < | + | |
| - | root@manager: | + | |
| - | Generating RSA private key, 4096 bit long modulus | + | |
| - | ...................................................................................................................................++++ | + | |
| - | ...............++++ | + | |
| - | e is 65537 (0x010001) | + | |
| - | </ | + | |
| - | + | ||
| - | Modifiez l' | + | |
| - | + | ||
| - | < | + | |
| - | root@manager: | + | |
| - | root@manager: | + | |
| - | 127.0.0.1 localhost | + | |
| - | 10.0.2.60 debian9.i2tch.loc debian9 | + | |
| - | 10.0.2.61 myregistry.i2tch.loc | + | |
| - | 10.0.2.62 manager.i2tch.loc manager | + | |
| - | 10.0.2.63 worker1.i2tch.loc worker1 | + | |
| - | 10.0.2.64 worker2.i2tch.loc worker2 | + | |
| - | + | ||
| - | # The following lines are desirable for IPv6 capable hosts | + | |
| - | ::1 | + | |
| - | ff02::1 ip6-allnodes | + | |
| - | ff02::2 ip6-allrouters | + | |
| - | </ | + | |
| - | + | ||
| - | Créez ensuite le CSR du client **client.csr** : | + | |
| - | + | ||
| - | < | + | |
| - | root@manager: | + | |
| - | </ | + | |
| - | + | ||
| - | Fixez l' | + | |
| - | + | ||
| - | < | + | |
| - | root@manager: | + | |
| - | </ | + | |
| - | + | ||
| - | Signez le CSR du client **client.csr** avec la clef privée du CA **ca-key.pem** afin de créer le certificat du client **cert.pem** : | + | |
| - | + | ||
| - | < | + | |
| - | root@manager: | + | |
| - | Signature ok | + | |
| - | subject=CN = myregistry.i2tch.loc | + | |
| - | Getting CA Private Key | + | |
| - | Enter pass phrase for ca-key.pem: | + | |
| - | </ | + | |
| - | + | ||
| - | Vérifiez la présence des fichiers générés : | + | |
| - | + | ||
| - | < | + | |
| - | root@manager: | + | |
| - | total 60 | + | |
| - | -rw------- 1 root root 3326 nov. 11 10:53 ca-key.pem | + | |
| - | -rw-r--r-- 1 root root 2163 nov. 11 10:57 ca.pem | + | |
| - | -rw-r--r-- 1 root root 17 nov. 11 11:15 ca.srl | + | |
| - | -rw-r--r-- 1 root root 1907 nov. 11 11:15 cert.pem | + | |
| - | -rw-r--r-- 1 root root 1594 nov. 11 11:12 client.csr | + | |
| - | drwxr-xr-x 5 root root 4096 nov. 8 12:58 docker-bench-security | + | |
| - | -rw-r--r-- 1 root root 1707 nov. 8 12:35 docker-stack.yml | + | |
| - | -rw-r--r-- 1 root root 30 nov. 11 11:13 extfile-client.cnf | + | |
| - | -rw-r--r-- 1 root root 95 nov. 11 11:06 extfile.cnf | + | |
| - | -rw------- 1 root root 3243 nov. 11 11:10 key.pem | + | |
| - | drwxr-xr-x 2 root root 4096 nov. 10 17:21 nottrusted | + | |
| - | -rw-r--r-- 1 root root 1964 nov. 11 11:08 server-cert.pem | + | |
| - | -rw-r--r-- 1 root root 1594 nov. 11 11:01 server.csr | + | |
| - | -rw------- 1 root root 3243 nov. 11 10:59 server-key.pem | + | |
| - | -rw-r--r-- 1 root root 882 oct. 27 15:46 stats | + | |
| - | </ | + | |
| - | + | ||
| - | Supprimez les fichiers ayant déjà été utilisés, à savoir les deux CSR et les deux fichiers des extensions : | + | |
| - | + | ||
| - | < | + | |
| - | root@manager: | + | |
| - | ' | + | |
| - | ' | + | |
| - | ' | + | |
| - | ' | + | |
| - | </ | + | |
| - | + | ||
| - | Modifiez les permissions des clefs privées : | + | |
| - | + | ||
| - | < | + | |
| - | root@manager: | + | |
| - | le mode de ' | + | |
| - | le mode de 'key.pem' a été modifié de 0600 (rw-------) en 0400 (r--------) | + | |
| - | le mode de ' | + | |
| - | </ | + | |
| - | + | ||
| - | Ainsi que les permissions des certificats : | + | |
| - | + | ||
| - | < | + | |
| - | root@manager: | + | |
| - | le mode de ' | + | |
| - | le mode de ' | + | |
| - | le mode de ' | + | |
| - | </ | + | |
| - | + | ||
| - | Arrêtez et supprimez le conteneur **mysql** : | + | |
| - | + | ||
| - | < | + | |
| - | root@manager: | + | |
| - | mysql | + | |
| - | root@manager: | + | |
| - | mysql | + | |
| - | </ | + | |
| - | + | ||
| - | ====10.4 - Démarrage du Daemon Docker avec une Invocation Directe==== | + | |
| - | + | ||
| - | Arrêtez et désactivez le service Docker : | + | |
| - | + | ||
| - | < | + | |
| - | root@manager: | + | |
| - | Warning: Stopping docker.service, | + | |
| - | docker.socket | + | |
| - | root@manager: | + | |
| - | Synchronizing state of docker.service with SysV service script with / | + | |
| - | Executing: / | + | |
| - | </ | + | |
| - | + | ||
| - | Lancez un invocation directe de **dockerd** afin que le daemon n' | + | |
| - | + | ||
| - | < | + | |
| - | root@manager: | + | |
| - | [1] 1868 | + | |
| - | root@manager: | + | |
| - | INFO[2019-11-11T12: | + | |
| - | INFO[2019-11-11T12: | + | |
| - | INFO[2019-11-11T12: | + | |
| - | INFO[2019-11-11T12: | + | |
| - | INFO[2019-11-11T12: | + | |
| - | INFO[2019-11-11T12: | + | |
| - | INFO[2019-11-11T12: | + | |
| - | INFO[2019-11-11T12: | + | |
| - | INFO[2019-11-11T12: | + | |
| - | INFO[2019-11-11T12: | + | |
| - | INFO[2019-11-11T12: | + | |
| - | WARN[2019-11-11T12: | + | |
| - | WARN[2019-11-11T12: | + | |
| - | INFO[2019-11-11T12: | + | |
| - | INFO[2019-11-11T12: | + | |
| - | INFO[2019-11-11T12: | + | |
| - | INFO[2019-11-11T12: | + | |
| - | INFO[2019-11-11T12: | + | |
| - | INFO[2019-11-11T12: | + | |
| - | [Entrée] | + | |
| - | root@manager: | + | |
| - | </ | + | |
| - | + | ||
| - | Vérifiez que le processus tourne : | + | |
| - | + | ||
| - | < | + | |
| - | root@manager: | + | |
| - | root 1868 0.2 4.0 421876 82236 pts/0 Sl | + | |
| - | root 1995 0.0 0.0 12780 964 pts/0 S+ | + | |
| - | </ | + | |
| - | + | ||
| - | Installez le paquet **net-tools** qui contient le binaire **netstat** : | + | |
| - | + | ||
| - | < | + | |
| - | root@manager: | + | |
| - | </ | + | |
| - | + | ||
| - | Vérifiez que le port **2376** est à l' | + | |
| - | + | ||
| - | < | + | |
| - | root@manager: | + | |
| - | tcp6 | + | |
| - | </ | + | |
| - | + | ||
| - | ====10.5 - Configuration du Client==== | + | |
| - | + | ||
| - | Transférez ensuite le certificat du CA ainsi que le certificat et la clef privée du client vers la VM **debian91** : | + | |
| - | + | ||
| - | < | + | |
| - | root@manager: | + | |
| - | The authenticity of host ' | + | |
| - | ECDSA key fingerprint is SHA256: | + | |
| - | Are you sure you want to continue connecting (yes/no)? yes | + | |
| - | Warning: Permanently added ' | + | |
| - | trainee@10.0.2.61' | + | |
| - | ca.pem | + | |
| - | key.pem | + | |
| - | cert.pem | + | |
| - | </ | + | |
| - | + | ||
| - | Lancez la commande **docker version** sur la VM **debian91** : | + | |
| - | + | ||
| - | < | + | |
| - | trainee@myregistry: | + | |
| - | Client: Docker Engine - Community | + | |
| - | | + | |
| - | API version: | + | |
| - | Go version: | + | |
| - | Git commit: | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | Server: Docker Engine - Community | + | |
| - | | + | |
| - | Version: | + | |
| - | API version: | + | |
| - | Go version: | + | |
| - | Git commit: | + | |
| - | Built: | + | |
| - | OS/ | + | |
| - | Experimental: | + | |
| - | | + | |
| - | Version: | + | |
| - | GitCommit: | + | |
| - | | + | |
| - | Version: | + | |
| - | GitCommit: | + | |
| - | | + | |
| - | Version: | + | |
| - | GitCommit: | + | |
| - | </ | + | |
| - | + | ||
| - | Afin de faciliter l' | + | |
| - | + | ||
| - | < | + | |
| - | trainee@myregistry: | + | |
| - | mkdir: création du répertoire '/ | + | |
| - | </ | + | |
| - | + | ||
| - | Copiez ensuite les fichiers *.pem dans le répertoire **~/ | + | |
| - | + | ||
| - | < | + | |
| - | trainee@myregistry: | + | |
| - | ' | + | |
| - | ' | + | |
| - | ' | + | |
| - | </ | + | |
| - | + | ||
| - | Créez les deux variables **DOCKER_HOST** et **DOCKER_TLS_VERIFY** : | + | |
| - | + | ||
| - | < | + | |
| - | trainee@myregistry: | + | |
| - | </ | + | |
| - | + | ||
| - | Maintenant la connection est sécurisée par défaut : | + | |
| - | + | ||
| - | < | + | |
| - | trainee@myregistry: | + | |
| - | REPOSITORY | + | |
| - | i2tch/ | + | |
| - | i2tch/ | + | |
| - | ubuntu | + | |
| - | nginx | + | |
| - | alpine | + | |
| - | i2tch/ | + | |
| - | mysql | + | |
| - | centos | + | |
| - | docker/ | + | |
| - | </ | + | |
| - | + | ||
| - | ----- | + | |
| - | < | + | |
| - | <div align=" | + | |
| - | Copyright © 2021 Hugh NORRIS | + | |
| - | </ | + | |
| - | </ | + | |
