docker开启远程访问端口,防止非法访问
- 配置证书认证
- 配置防火墙或安全策略
#!/bin/bash # docker.tls.sh # 环境centos 7 ,root # 创建 Docker TLS 证书 ##########配置信息 Port=2376 Node=$(hostname) IP=$(ip add|sed -nr 's#^.*inet (.*)/[1-9].*(ens|eth).*$#\1#gp') PASSWORD="88888888" COUNTRY="CN" STATE="Shanghai" CITY="Shanghai" ORGANIZATION="Elven" ORGANIZATIONAL_UNIT="Dev" COMMON_NAME="$IP" EMAIL="228@elven.vip" ##########生成证书 # Generate CA key openssl genrsa -aes256 -passout "pass:$PASSWORD" -out "ca-key_$Node.pem" 4096 &>/dev/null # Generate CA openssl req -new -x509 -days 730 -key "ca-key_$Node.pem" -sha256 -out "ca_$Node.pem" -passin "pass:$PASSWORD" -subj "/C=$COUNTRY/ST=$STATE/L=$CITY/O=$ORGANIZATION/OU=$ORGANIZATIONAL_UNIT/CN=$COMMON_NAME/emailAddress=$EMAIL" &>/dev/null echo "#Server" # Generate Server key openssl genrsa -out "server-key_$Node.pem" 4096 &>/dev/null # Generate Server Certs. openssl req -subj "/CN=$COMMON_NAME" -sha256 -new -key "server-key_$Node.pem" -out server.csr echo "subjectAltName = IP:$IP,IP:127.0.0.1" >> extfile.cnf echo "extendedKeyUsage = serverAuth" >> extfile.cnf openssl x509 -req -days 730 -sha256 -in server.csr -passin "pass:$PASSWORD" -CA "ca_$Node.pem" -CAkey "ca-key_$Node.pem" -CAcreateserial -out "server-cert_$Node.pem" -extfile extfile.cnf echo "#Client" openssl genrsa -out "client-key_$Node.pem" 4096 &>/dev/null openssl req -subj '/CN=client' -new -key "client-key_$Node.pem" -out client.csr echo extendedKeyUsage = clientAuth >> extfile.cnf openssl x509 -req -days 730 -sha256 -in client.csr -passin "pass:$PASSWORD" -CA "ca_$Node.pem" -CAkey "ca-key_$Node.pem" -CAcreateserial -out "client-cert_$Node.pem" -extfile extfile.cnf chmod 0400 "client-key_$Node.pem" "server-key_$Node.pem" chmod 0444 "ca_$Node.pem" "server-cert_$Node.pem" "client-cert_$Node.pem" ##########docker配置 echo echo "#拷贝证书" #服务端证书 mkdir -p ~/.docker cp -avf "ca_$Node.pem" "server-cert_$Node.pem" "server-key_$Node.pem" ~/.docker #客户端证书文件 cp -avf "client-cert_$Node.pem" "client-key_$Node.pem" ~/.docker/ # 打包客户端证书 tar -zcf docker-tls-client_$Node.tar.gz ca_$Node.pem client-cert_$Node.pem client-key_$Node.pem cp -af docker-tls-client_$Node.tar.gz ~/.docker/ ls -hl $(pwd)/docker-tls* echo echo "#修改docker启动项 /lib/systemd/system/docker.service" SetOPTS=" --tls \ --tlscacert=$HOME/.docker/ca_${Node}.pem \ --tlscert=$HOME/.docker/server-cert_${Node}.pem \ --tlskey=$HOME/.docker/server-key_${Node}.pem \ -H 0.0.0.0:${Port} " sed -i "s#^ExecStart.*#& $SetOPTS #" /lib/systemd/system/docker.service grep '^ExecStart' /lib/systemd/system/docker.service systemctl daemon-reload echo echo "#客户端远程连接" echo "docker -H $IP:${Port} --tlsverify --tlscacert ~/.docker/ca_$Node.pem --tlscert ~/.docker/client-cert_$Node.pem --tlskey ~/.docker/client-key_$Node.pem ps -a" echo "#客户端使用curl连接" echo "curl --cacert ~/.docker/ca_$Node.pem --cert ~/.docker/client-cert_$Node.pem --key ~/.docker/client-key_$Node.pem https://$IP:${Port}/containers/json" #clean rm -f ca*.srl *.pem *.cnf *.csr echo echo -e "\e[1;32m#重启docker生效 systemctl restart docker \e[0m" #