Is there away to disable the SHA1 as an option in ssh-keygen for an RSA hostkey?
Trying to use ssh-keygen to create a RSA hostkey without including SHA1
ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key
Per this page: https://man.freebsd.org/cgi/man.cgi?query=ssh-keygen&sektion=1&n=1
This flag may also be used to specify the desired signature type
when signing certificates using an RSA CA key. The available RSA
signature variants are "ssh-rsa" (SHA1 signatures, not recom-
mended), "rsa-sha2-256", and "rsa-sha2-512" (the default).
CentOS Steam 8 with OpenSSH 8 (understood SHA1 is removed in OpenSSH 8.3)
Used the specific -t rsa-sha2-256 and -t rsa-sha2-512 in the ssh-keygen command, but SHA1 is still included.
Updated the sshd_config to point at a key pair generated with the SHA2. removed RSA. restarted sshd. new RSA hostkey is generated on the sshd restart.
Related
When running my asp.net core application locally in my Linux Docker container, the following error occurs:
Unhandled exception. Interop+Crypto+OpenSslCryptographicException: error:0D06B08E:asn1 encoding routines:asn1_d2i_read_bio:not enough data
at Internal.Cryptography.Pal.OpenSslX509CertificateReader.FromBio(SafeBioHandle bio, SafePasswordHandle password)
at Internal.Cryptography.Pal.OpenSslX509CertificateReader.FromFile(String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags)
... when instanciating an X509Certificate2 object in my startup.cs:
services.AddDefaultIdentity<ApplicationUser>(options => options.SignIn.RequireConfirmedAccount = true).AddEntityFrameworkStores<ApplicationDbContext>();
var identityServerBuilder = services.AddIdentityServer().AddApiAuthorization<ApplicationUser, ApplicationDbContext>();
var certificate = new X509Certificate2(#"abc.pfx", "abc"); // This is where the exception is thrown.
identityServerBuilder.AddSigningCredential(certificate);
I need this self-signed certificate to run IdentityServer4.
When debugging in Visual Studio I have no problems and I can perfectly evaluate all of the pfx's properties.
I generated the pfx file on Linux as follows:
openssl genrsa -out rsa.private 1024
openssl req -new -key rsa.private > rsa.csr
openssl x509 -req -in rsa.csr -signkey rsa.private -out rsa.crt
openssl pkcs12 -export -in rsa.crt -inkey rsa.private -out abc.pfx
...and verifying its integrity:
openssl pkcs12 -nokeys -info -nocerts -in abc.pfx
... revealed no problems:
MAC: sha1, Iteration 2048
MAC length: 20, salt length: 8
PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048
Certificate bag
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048
I also used the Microsoft Management Console to generate the pfx, but that results in the same error.
I'm mounting my pfx file executing this Docker run command:
docker run -d=false -p 8080:80 -v abc.pfx:/app/abc.pfx --name mijncont mijncont:dev
My appsettings.json :
"IdentityServer": {
"Clients": {
"TEST.Client": {
"Profile": "IdentityServerSPA"
}
},
"Key": {
"Type": "Store",
"StoreName": "My",
"StoreLocation": "LocalMachine",
"Name": "CN=mijnsubject"
}
When running :
docker exec -it mijncont /bin/bash
... the following prompt appears :
root#3815c63cb5c4:/app#
When executing 'ls -la'
I get this :
drwxr-xr-x 2 root root 4096 Jul 13 16:04 abc.pfx
However when I include this line in my Startup.cs :
Console.WriteLine("Size: "+ new System.IO.FileInfo("abc.pfx").Length);
... .Net throws an exception saying that the file doesn't exist.
I included the directory containing the pfx file in Docker -> Settings -> Resources -> File sharing
Anyone?
The problem lied in the way I mounted my abc.pfx file.
This :
docker run -d=false -p 8080:80 -v abc.pfx:/app/abc.pfx --name mijncont mijncont:dev
...mounts a directory called abc.fpx in the container (holding the abc.pfx file)
If I specify an absolute path :
docker run -d=false -p 8080:80 -v C:\mysolution\abc.pfx:/app/abc.pfx --name mijncont
...only the file is mounted to the 'app' directory which is what I want.
I'm trying to copy an SSL certificate from an Ansible host VM to a Docker host VM,and i keep having the following error
FAILED! => {"changed": false, "msg": "Template source files must be utf-8 encoded"}
the playbook is simple and has only two steps:
- name: Create directory for SSL certificate
file: path=/etc/ssl/certs/pm state=directory
- name: Copy SSL certificate from Ansible host to Docker host
template:
src: inventories/staging/files/pm.jks
dest: /etc/ssl/certs/pm/pm.jks
owner: root
mode: 0755
ignore_errors: true
When i replace pm.jks with an empty file with the same name and extension,the copying works fine,so clearly there's a problem with the format of its content. but i'm not sure how to fix this.
I'm using this command to generate the certif :
keytool -genkey -alias pm -storetype PKCS12 -keyalg RSA -keysize 2048 -keystore pm.p12 -genkey -alias pm -storetype PKCS12 -keyalg RSA -keysize 2048 -keystore pm.p12 -validity 3650
Why not use the file method of Ansible instead the template module? The error is quite clear - you cannot use the template module, because the source file you are referencing is not UTF-8 encoded.
If you examine the file you created with the command you posted, you will notice that it is a binary file:
test#toor:~$ file pm.p12
pm.p12: data
test#toor:~$ less pm.p12
"pm.p12" may be a binary file. See it anyway?
Either try using a different Ansible module or try saving the file in a plain text format.
Just because I stumbled over it searching for the same solution.
Here an excerpt from my playbook where I used the builtin copy module
# playbook.yaml
- name: Create path for SSL cert
file: path=/etc/ssl/certs/custom state=directory
- name: Copy SSL cert
ansible.builtin.copy:
src: /path/to/local/my_cert.p12
dest: /etc/ssl/certs/custom/my_cert.p12
owner: root
mode: 0644
Rolling out on a Ubuntu VM.
I am behind a corporate proxy and I'm trying to install Hyperledger Sawtooth on an Ubuntu machine.
Part of that setup is installing rust which is failing.
It uses the following command which is taken from a 'Dockerfile' file as part of the command docker-compose up:
curl --insecure https://sh.rustup.rs -sSf > /usr/bin/rustup-init && chmod +x /usr/bin/rustup-init && rustup-init -y
This gives me an error:
curl: (60) server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
rustup: command failed: downloader https://static.rust-lang.org/rustup/dist/x86_64-unknown-linux-gnu/rustup-init /tmp/tmp.KEMZg5vZRK/rustup-init
Apparently, the command rustup-init -y is failing as I'm behind a corporate proxy and it failed to connect the url https://static.rust-lang.org/rustup/dist/x86_64-unknown-linux-gnu/rustup-init.
Where do I do the modification (add the -k flag) to turn off curl's certificate verification option so that I get an insecure connection and my installation is successful?
I tried modifying the rustup-init.sh file, but it is of no use.
I would like to set up GitLab with https on Synology DS918+.
I am using DOCKER in DSM. I downloaded the latest GitLab Community docker image.
And I used Putty to ssh into the NAS and create keys using openssl.
1) Create a key into cert folder:
mkdir /volume1/docker/gitlab/certs
cd /volume1/docker/gitlab/certs
openssl genrsa -out gitlab.key 2048
openssl req -new -key gitlab.key -out gitlab.csr
openssl x509 -req -days 3650 -in gitlab.csr -signkey gitlab.key -out gitlab.crt
openssl dhparam -out dhparam.pem 2048
chmod 400 gitlab.key
2) I added two additional variables in custom image to set up the environment for HTTPS:
3) In the last part:
I remove port 80 that was first set in the default image.
And add ports 30000/30001 for 22/443 port bindings that were set to auto in the default image:
When I go to browser for https://synologyip.com:30000 GitLab can't be reached.
Any guesses on what have I missed or done wrong?
Thanks!
I don't know about you, but I had to create the cert in the following folder:
/volume1/docker/gitlab/gitlab/certs
Note the repeated gitlab directory
A good well-written tutorial can be found here: Github Tutorial, and with a letsencrypt cert too!
Although i shortened the cert copy part like follows:
cat /usr/syno/etc/certificate/_archive/*/privkey.pem > /volume1/docker/github/github/certs/gitlab.key
cat /usr/syno/etc/certificate/_archive/*/fullchain.pem > /volume1/docker/github/github/certs/gitlab.crt
and continued then with the dhparam.pem
I want to run a private docker registry which is widely available.
So I will be able to push and pull images from other servers.
I'm following this tutorials: doc1 & doc2
I performed 3 steps:
First I've created my certificate and key (as CNAME I filled in my ec2-hostname)
mkdir -p certs && openssl req \
-newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key \
-x509 -days 365 -out certs/domain.crt
Than I've created my docker registry, using this key.
docker run -d -p 5000:5000 --restart=always --name registry \
-v `pwd`/certs:/certs \
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
-e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
registry:2
Than I copied the content of domain.crt to /etc/docker/certs.d/ec2-xx-xx-xx-xx.compute.amazonaws.com:5000/ca.crt
I restarted my docker: sudo service docker restart
When I try to push an image I get the following error:
unable to ping registry endpoint https://ec2-xx-xx-xx-xx.compute.amazonaws.com:5000/v0/
v2 ping attempt failed with error: Get https://ec2-xx-xx-xx-xx.compute.amazonaws.com:5000/v2/: net/http: TLS handshake timeout
v1 ping attempt failed with error: Get https://ec2-xx-xx-xx-xx.compute.amazonaws.com:5000/v1/_ping: net/http: TLS handshake timeout
I really don't know what I'm missing or doing wrong. Can someone please help me. Thanks
I'm not sure if you copy/pasted your pwd directly... but the file path should be /etc/docker/certs.d
You currently have etc/docker/cert.d/registry.ip:5000/domain.crt
The error message says "TLS handshake timeout". This indicates that either no process is listening on port 5000 (check using netstat) or the port is closed from the location where you are trying to push the image (open port in the AWS security group).
From what I've seen docker login is way more sensitive to properly crafted self-signed certs than browsers are + there's an interesting gotcha I'll point out at the very bottom, so read the whole thing.
According to this site:
https://jamielinux.com/docs/openssl-certificate-authority/create-the-root-pair.html
Bash# openssl x509 -noout -text -in ca.crt
X509v3 Basic Constraints: critical
CA:TRUE
^You should see something like this is you provisioned your certs right.
While following random how-to guides on the net I was able to generate ca.crt and website.crt
When I ran the above command I didn't see that output, but I noticed:
If I imported the cert as trusted in Mac or Win my browser would be happy and say yeap valid cert, but docker login on RHEL7 would complain with messages like)
x509: certificate signed by unknown authority
I tried following directions related to using: /etc/docker/certs.d/mydockerrepo.lan:5000/ca.crt
on https://docs.docker.com/engine/security/certificates/
It got me a better error message (which caused me to find the above site in the first place)
x509: certificate signed by unknown authority (possibly because of
"x509: invalid signature: parent certificate cannot sign this kind of
certificate" while trying to verify candidate authority certificate
After 2 days of messing around I figured it out:
When I was taught programming I was taught the concept of a short self-contained example, so going to try doing that here for ansible, leveraging the openssl built-in modules, I'm running latest ansible 2.9, but this should work for ansible 2.5++ in theory:
Short Self Contained Example:
#Name this file generatecertificates.playbook.yml
#Run using Bash# ansible-playbook generatecertificates.playbook.yml
#
#What to Expect:
#Run Self Contained Stand Alone Ansible Playbook --Get-->
# currentworkingdir/certs/
# ca.crt
# ca.key
# mydockerrepo.private.crt
# mydockerrepo.private.key
#
#PreReq Ansible 2.5++
#PreReq Bash# pip3 install cryptograph >= 1.6 or PyOpenSSL > 0.15 (if using selfsigned provider)
---
- hosts: localhost
connection: local
gather_facts: no
vars:
- caencryptionpassword: "myrootcaencryptionpassword"
- dockerepodns: "mydockerrepo.private"
- rootcaname: "My Root CA"
tasks:
- name: get current working directory
shell: pwd
register: pathvar
- debug: var=pathvar.stdout
- name: Make sub directory
file:
path: "{{pathvar.stdout}}/certs"
state: directory
register: certsoutputdir
- debug: var=certsoutputdir.path
- name: "Generate Root CA's Encrypted Private Key"
openssl_privatekey:
size: 4096
path: "{{certsoutputdir.path}}/ca.key"
cipher: auto
passphrase: "{{caencryptionpassword}}"
- name: "Generate Root CA's Self Signed Certificate Signing Request"
openssl_csr:
path: "{{certsoutputdir.path}}/ca.csr"
privatekey_path: "{{certsoutputdir.path}}/ca.key"
privatekey_passphrase: "{{caencryptionpassword}}"
common_name: "{{rootcaname}}"
basic_constraints_critical: yes
basic_constraints: ['CA:TRUE']
- name: "Generate Root CA's Self Signed Certificate"
openssl_certificate:
path: "{{certsoutputdir.path}}/ca.crt"
csr_path: "{{certsoutputdir.path}}/ca.csr"
provider: selfsigned
selfsigned_not_after: "+3650d" #Note: Mac won't trust by default due to https://support.apple.com/en-us/HT210176, but you can explitly trust to make it work.
privatekey_path: "{{certsoutputdir.path}}/ca.key"
privatekey_passphrase: "{{caencryptionpassword}}"
register: cert
- debug: var=cert
- name: "Generate Docker Repo's Private Key"
openssl_privatekey:
size: 4096
path: "{{certsoutputdir.path}}/{{dockerepodns}}.key"
- name: "Generate Docker Repo's Certificate Signing Request"
openssl_csr:
path: "{{certsoutputdir.path}}/{{dockerepodns}}.csr"
privatekey_path: "{{certsoutputdir.path}}/{{dockerepodns}}.key"
common_name: "{{dockerepodns}}"
subject_alt_name: 'DNS:{{dockerepodns}},DNS:localhost,IP:127.0.0.1'
- name: "Generate Docker Repo's Cert, signed by Root CA"
openssl_certificate:
path: "{{certsoutputdir.path}}/{{dockerepodns}}.crt"
csr_path: "{{certsoutputdir.path}}/{{dockerepodns}}.csr"
provider: ownca
ownca_not_after: "+365d" #Cert valid 1 year
ownca_path: "{{certsoutputdir.path}}/ca.crt"
ownca_privatekey_path: "{{certsoutputdir.path}}/ca.key"
ownca_privatekey_passphrase: "{{caencryptionpassword}}"
register: cert
- debug: var=cert
Interesting Gotcha/Final Step:
RHEL7Bash# sudo cp ca.crt /etc/pki/ca-trust/source/anchors/ca.crt
RHEL7Bash# sudo update-ca-trust
RHEL7Bash# sudo systemctl restart docker
The gotcha is that you have to restart docker, for docker login to recognize updates to CA's newly added to the system.