Docker开启并配置远程安全访问_docker开启远程访问

最新推荐文章于 2024-08-01 15:55:46 发布

m0_60635176

最新推荐文章于 2024-08-01 15:55:46 发布

阅读量1.2k

点赞数 17

分类专栏： 2024年程序员学习文章标签： docker 安全容器

本文链接：https://blog.csdn.net/m0_60635176/article/details/137474345

版权

2024年程序员学习专栏收录该内容

255 篇文章 1 订阅

订阅专栏

2，在Docker主机上通过命令生成CA私钥和公钥

执行命令：openssl genrsa -aes256 -out ca-key.pem 4096

[root@VM-12-4-centos ca_key]# openssl genrsa -aes256 -out ca-key.pem 4096
Generating RSA private key, 4096 bit long modulus
…++
…++
e is 65537 (0x10001)
Enter pass phrase for ca-key.pem:
Verifying - Enter pass phrase for ca-key.pem:
Verify failure
User interface error
139698349328272:error:0906906F:PEM routines:PEM_ASN1_write_bio:read key:pem_lib.c:385:
[root@VM-12-4-centos ca_key]# openssl genrsa -aes256 -out ca-key.pem 4096
Generating RSA private key, 4096 bit long modulus
…++
…++
e is 65537 (0x10001)
Enter pass phrase for ca-key.pem:
Verifying - Enter pass phrase for ca-key.pem:

这里需要输入密码并确认，只要两次输入一致就行，否则会像重置密码数据两次新密码一样报验证错误。需要注意的是：Linux上并不会显示输入的密码信息，因此要格外注意别输错了。

如果成功，该文件下就有了pem证书文件生成：

[root@VM-12-4-centos ca_key]# ll
total 4
-rw-r–r-- 1 root root 3326 Apr 10 10:29 ca-key.pem

3，补全CA信息

执行命令：openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem根据要求依次输入访问密码、国家、省、市、组织名称、单位名称、随便一个名字、邮箱等，需要这些信息作为证书申请。

[root@VM-12-4-centos ca_key]# openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem
Enter pass phrase for ca-key.pem:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.

Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HUBei
Locality Name (eg, city) [Default City]:WuHan
Organization Name (eg, company) [Default Company Ltd]:ZC
Organizational Unit Name (eg, section) []:QA
Common Name (eg, your name or your server’s hostname) []:192.168.98.128（ip地址）
Email Address []:8888888888@qq.com

现在我们有了CA，就可以创建服务器密钥和证书签名请求（CSR）。

Tips：确保“Common Name”与用于连接Docker的主机名匹配，否则后续远程连接会失败！

4，生成service-key.pem

执行命令：openssl genrsa -out server-key.pem 4096

[root@VM-12-4-centos ca_key]# openssl genrsa -out server-key.pem 4096
Generating RSA private key, 4096 bit long modulus
…++
…++
e is 65537 (0x10001)
[root@VM-12-4-centos ca_key]# ll
total 12
-rw-r–r-- 1 root root 3326 Apr 10 10:29 ca-key.pem
-rw-r–r-- 1 root root 2082 Apr 10 10:56 ca.pem
-rw-r–r-- 1 root root 3247 Apr 10 11:45 server-key.pem