前言:为了防止链路劫持、会话劫持等问题导致Docker通信时被中间人攻击,c/s两端应该通过加密方式通讯
一、部署
- 一台做服务端tls。一台做客户端client
1.环境部署
[root@promote ~]# hostnamectl set-hostname master
[root@promote ~]# su
[root@master ~]# vim /etc/hosts
127.0.0.1 master
[root@promote ~]# hostnamectl set-hostname client
[root@promote ~]# su
[root@client ~]# vim /etc/hosts
192.168。170.151 master
2.部署tls
[root@master ~]# mkdir /tls
[root@master ~]# cd /tls/
- 创建ca密钥
[root@master tls]# openssl genrsa -aes256 -out ca-key.pem 4096
Generating RSA private key, 4096 bit long modulus
.............................................................................................................................................................++
.........................................++
e is 65537 (0x10001)
Enter pass phrase for ca-key.pem: //密码输入123123
Verifying - Enter pass phrase for ca-key.pem:
//aes256 对称加密形式,256位 输出的形式为pem(证书)
[root@master tls]# ls
ca-key.pem
- 创建ca证书
[root@master tls]# openssl req -new -x509 -days 1000 -key ca-key.pem -sha256 -subj "/CN=*" -out ca.pem
Enter pass phrase for ca-key.pem: //自己建的密码123123
[root@master tls]# ls
ca-key.pem ca.pem
//有效期1000天 密钥文件指向ca.key.pem 用的哈希算法 subj项目名称 输出证书名
- 创建服务器私钥
[root@master tls]# openssl genrsa -out server-key.pem 4096
Generating RSA private key, 4096 bit long modulus
...............................................................++
.........................................................................................................................................................++
e is 65537 (0x10001)
[root@master tls]# ls
ca-key.pem ca.pem server-key.pem
//genrea 非对称
- 签名私钥
[root@master tls]# openssl req -subj "/CN=*" -sha256 -new -key server-key.pem -out server.csr
[root@master tls]# ls
ca-key.pem ca.pem server.csr server-key.pem
//用server-key.epm创建 签名私钥为 server.csr
- 使用ca证书与私钥证书签名
[root@master tls]# openssl x509 -req -days 1000 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem
Signature ok
subject=/CN=* //项目注册名称
Getting CA Private Key
Enter pass phrase for ca-key.pem:
[root@master tls]# ls
ca-key.pem ca.pem ca.srl server-cert.pem server.csr server-key.pem
- 生成客户端密钥
[root@master tls]# openssl genrsa -out key.pem 4096
Generating RSA private key, 4096 bit long modulus
......................++
.................++
e is 65537 (0x10001)
[root@master tls]# ls
ca-key.pem ca.pem ca.srl key.pem server-cert.pem server.csr server-key.pem
- 签名客户端
[root@master tls]# openssl req -subj "/CN=client" -new -key key.pem -out client.csr
[root@master tls]# ls
ca-key.pem ca.pem ca.srl client.csr key.pem server-cert.pem server.csr server-key.pem
//生成一个客户端的密钥
- 创建配置文件
[root@master tls]# echo extendedKeyUsage=clientAuth > extfile.cnf
//拓展性密钥使用的是客户端验证
- 签名证书,输入123123,需要(签名客户端,ca证书,ca密钥)
[root@master tls]# openssl x509 -req -days 1000 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem -extfile extfile.cnf
Signature ok
subject=/CN=client
Getting CA Private Key
Enter pass phrase for ca-key.pem:
[root@master tls]# ls
ca-key.pem ca.srl client.csr key.pem server.csr
ca.pem cert.pem extfile.cnf server-cert.pem server-key.pem
- 删除多余文件
[root@master tls]# rm -rf ca.srl client.csr extfile.cnf server.csr
[root@master tls]# ls
ca-key.pem ca.pem cert.pem key.pem server-cert.pem server-key.pem
//中途签名的不需要,剩下证书
- 配置docker
[root@master tls]# vim /lib/systemd/system/docker.service
14 ExecStart=/usr/bin/dockerd --tlsverify --tlscacert=/tls/ca.pem --tlscert=/tls/server-cert.pem --tlskey=/tls/server-key.pem -H tcp://0.0.0.0:2376 -H unix:///var/run/docker.sock
[root@master tls]# systemctl daemon-reload
[root@master tls]# systemctl restart docker
[root@master tls]# netstat -ntap | grep dockerd //端口已开启
tcp6 0 0 :::2376 :::* LISTEN 55590/dockerd
[root@master tls]# dockerd --tls //可以使用dockerd命令
INFO[2020-04-26T21:38:10.644555951+08:00] Starting up
failed to start daemon: pid file found, ensure docker is not running or delete /var/run/docker.pid
3.client操作
- 将三个证书文件复制到client主机
[root@master tls]# scp ca.pem root@192.168.170.152:/etc/docker/
root@192.168.170.152's password:
ca.pem 100% 1765 1.0MB/s 00:00
[root@master tls]# scp cert.pem root@192.168.170.152:/etc/docker/
root@192.168.170.152's password:
cert.pem 100% 1696 983.8KB/s 00:00
[root@master tls]# scp key.pem root@192.168.170.152:/etc/docker/
root@192.168.170.152's password:
key.pem 100% 3243 1.5MB/s 00:00
[root@client ~]# cd /etc/docker
[root@client docker]# ls
ca.pem cert.pem daemon.json key.json key.pem
4.验证
- 为了验证,先关闭master的防火墙
[root@master tls]# systemctl stop firewalld.service
[root@master tls]# setenforce 0
setenforce: SELinux is disabled
- 在客户端验证
[root@client docker]# docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H tcp://master:2376 version
Client: Docker Engine - Community
Version: 19.03.8
API version: 1.40
Go version: go1.12.17
Git commit: afacb8b
Built: Wed Mar 11 01:27:04 2020
OS/Arch: linux/amd64
Experimental: false
Server: Docker Engine - Community
Engine:
Version: 19.03.8
API version: 1.40 (minimum version 1.12)
Go version: go1.12.17
Git commit: afacb8b
Built: Wed Mar 11 01:25:42 2020
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: 1.2.13
GitCommit: 7ad184331fa3e55e52b890ea95e65ba581ae3429
runc:
Version: 1.0.0-rc10
GitCommit: dc9208a3303feef5b3839f4323d9beb36df0a9dd
docker-init:
Version: 0.18.0
GitCommit: fec3683
//出现了版本信息,说明两者之间的通信已经被建立tls加密通讯
//比如查看镜像信息
[root@client docker]# docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H tcp://master:2376 images
REPOSITORY TAG IMAGE ID CREATED SIZE
//这里没有创建镜像
- 同样,在本地也能查看
[root@master tls]# docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H tcp://master:2376 version
Client: Docker Engine - Community
Version: 19.03.8
API version: 1.40
Go version: go1.12.17
Git commit: afacb8b
Built: Wed Mar 11 01:27:04 2020
OS/Arch: linux/amd64
Experimental: false
Server: Docker Engine - Community
Engine:
Version: 19.03.8
API version: 1.40 (minimum version 1.12)
Go version: go1.12.17
Git commit: afacb8b
Built: Wed Mar 11 01:25:42 2020
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: 1.2.13
GitCommit: 7ad184331fa3e55e52b890ea95e65ba581ae3429
runc:
Version: 1.0.0-rc10
GitCommit: dc9208a3303feef5b3839f4323d9beb36df0a9dd
docker-init:
Version: 0.18.0
GitCommit: fec3683
总结
- 在生产环境,为了确保容器的安全,比如用k8s组群集,做编排,都是用加密通讯