alexvanin/certificates
1
0
Fork 0
forked from TrueCloudLab/certificates
Code Pull requests Activity

Merge pull request #1223 from smallstep/carl/docker-pwd

Browse source 
Docker: Generate and use independent provisioner and private key passwords
This commit is contained in:
Carl Tashian 2023-01-10 12:34:56 -08:00 committed by GitHub
commit a78ddc7cc5
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 20 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
docker/Dockerfile.step-ca
View file

@ -7,7 +7,6 @@ RUN apk add --no-cache curl git make
RUN make V=1 download
RUN make V=1 bin/step-ca bin/step-awskms-init bin/step-cloudkms-init
FROM smallstep/step-cli:latest
COPY --from=builder /src/bin/step-ca /usr/local/bin/step-ca

26
docker/entrypoint.sh
View file

@ -19,7 +19,7 @@ function init_if_possible () {
fi
done
if [ ${missing_vars} = 1 ]; then
>&2 echo "there is no ca.json config file; please run step ca init, or provide config parameters via DOCKER_STEPCA_INIT_ vars"
>&2 echo "there is no ca.json config file; please run step ca init, or provide config parameters via DOCKER_STEPCA_INIT_ vars"
else
step_ca_init "${@}"
fi
@ -34,17 +34,24 @@ function generate_password () {
# Initialize a CA if not already initialized
function step_ca_init () {
DOCKER_STEPCA_INIT_PROVISIONER_NAME="${DOCKER_STEPCA_INIT_PROVISIONER_NAME:-admin}"
DOCKER_STEPCA_INIT_ADMIN_SUBJECT="${DOCKER_STEPCA_INIT_ADMIN_SUBJECT:-step}"
local -a setup_args=(
--name "${DOCKER_STEPCA_INIT_NAME}"
--dns "${DOCKER_STEPCA_INIT_DNS_NAMES}"
--provisioner "${DOCKER_STEPCA_INIT_PROVISIONER_NAME:-admin}"
--password-file "${STEPPATH}/password"
--dns "${DOCKER_STEPCA_INIT_DNS_NAMES}"
--provisioner "${DOCKER_STEPCA_INIT_PROVISIONER_NAME}"
--password-file "${STEPPATH}/password"
--provisioner-password-file "${STEPPATH}/provisioner_password"
--admin-subject "${DOCKER_STEPCA_INIT_ADMIN_SUBJECT}"
--address ":9000"
)
if [ -n "${DOCKER_STEPCA_INIT_PASSWORD}" ]; then
echo "${DOCKER_STEPCA_INIT_PASSWORD}" > "${STEPPATH}/password"
echo "${DOCKER_STEPCA_INIT_PASSWORD}" > "${STEPPATH}/provisioner_password"
else
generate_password > "${STEPPATH}/password"
generate_password > "${STEPPATH}/provisioner_password"
fi
if [ -n "${DOCKER_STEPCA_INIT_SSH}" ]; then
setup_args=("${setup_args[@]}" --ssh)
@ -56,15 +63,22 @@ function step_ca_init () {
setup_args=("${setup_args[@]}" --remote-management)
fi
step ca init "${setup_args[@]}"
echo ""
if [ -n "${DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT}" ]; then
echo "👉 Your CA administrative username is: ${DOCKER_STEPCA_INIT_ADMIN_SUBJECT}"
fi
echo "👉 Your CA administrative password is: $(< $STEPPATH/provisioner_password )"
echo "🤫 This will only be displayed once."
shred -u $STEPPATH/provisioner_password
mv $STEPPATH/password $PWDPATH
}
if [ -f /usr/sbin/pcscd ]; then
/usr/sbin/pcscd
/usr/sbin/pcscd
fi
if [ ! -f "${STEPPATH}/config/ca.json" ]; then
init_if_possible
init_if_possible
fi
exec "${@}"