Bamboo server is running on Docker Container (linux) with the Public image.
docker pull atlassian/bamboo-server:latest
It's accessible at http://localhost:8085, but we want to use HTTPS with a self-signed certificate to run our Bamboo Server. Could you please explain the steps for "how to secure Bamboo server running on Docker Container with HTTPS"? I read the Atlassian article, but it does not appear to contain enough information.
We can use Ngnix (if necessary), but I haven't started because I'm not familiar with the configuration.
Despite the fact that I generated the.keystore file on the Docker host and used the environment to map with the container:
{$JAVA_HOME keytool -genkey} or
{openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 365}
docker run -d -v bambooVolumeLatest:/var/atlassian/application-data/bamboo --init -p 54663:54663 -p 8443:8443 -e JVM_MINIMUM_MEMORY=3g -e JVM_MAXIMUM_MEMORY=3g -e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_TOMCAT_SSL_ENABLED=true -e ATL_TOMCAT_SSL_PROTOCOL=TLS -e ATL_TOMCAT_KEYSTORE_FILE=/root/.keystore -e ATL_TOMCAT_KEYSTORE_PASS=changeit atlassian/bamboo
it's throwing an error:
02-Sep-2022 07:59:21.337 SEVERE [main] org.apache.catalina.util.LifecycleBase.handleSubClassException Failed to start component [Connector[HTTP/1.1-8085]]
org.apache.catalina.LifecycleException: Protocol handler start failed
at org.apache.catalina.connector.Connector.startInternal(Connector.java:1077)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
at org.apache.catalina.core.StandardService.startInternal(StandardService.java:449)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
at org.apache.catalina.core.StandardServer.startInternal(StandardServer.java:930)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
at org.apache.catalina.startup.Catalina.start(Catalina.java:772)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:345)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:476)
Caused by: java.lang.IllegalArgumentException: /root/.keystore (Permission denied)
at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:107)
at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:71)
Any help would be much Appricieated.
thsi does the trick for me (docker-compose file)
environment:
- JVM_MINIMUM_MEMORY=4000m
- JVM_MAXIMUM_MEMORY=8000m
- ATL_TOMCAT_PORT=8443
- ATL_TOMCAT_SSL_ENABLED=true
- ATL_TOMCAT_SCHEME=https
- ATL_TOMCAT_SECURE=true
- ATL_TOMCAT_SSL_CERTIFICATE_FILE=/opt/atlassian/bamboo/conf/ssl/xxxxxx.com.crt
- ATL_TOMCAT_SSL_CERTIFICATE_KEY_FILE=/opt/atlassian/bamboo/conf/ssl/xxxxxx.com.key
volumes:
- bamboo:/var/atlassian/application-data/bamboo
- ./ssl:/opt/atlassian/bamboo/conf/ssl
I don't bother with the keystore, on linux systems, be sure the files are owned by 2005:2005 (bamboo user in docker). cert & key can be retrieved with
openssl pkcs12 -in xxxxx.com.pfx -out xxxxx.com.pem -nodes
if you dig around a bit you can also find how to pull it from pem, good luck!
Related
$ docker login -u uploader -p ****** http://10.11.20.186:8082 [14:13:41]
Error: credentials key has https[s]:// prefix
$ docker -v [14:28:20]
podman version 3.4.1-dev
$ cat /etc/os-release [14:28:59]
NAME="CentOS Stream"
VERSION="8"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="8"
PLATFORM_ID="platform:el8"
PRETTY_NAME="CentOS Stream 8"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:8"
HOME_URL="https://centos.org/"
BUG_REPORT_URL="https://bugzilla.redhat.com/"
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux 8"
REDHAT_SUPPORT_PRODUCT_VERSION="CentOS Stream"
sheng#B-Product-U-WEB01 /etc/containers/registries.conf.d
$ cat 003-nexus.conf [14:45:28]
[[registry]]
prefix = "10.11.20.186:8082"
location = "10.11.20.186:8082"
insecure = true
I want to log in to my nexus repository manager.
However, when I attempt to do this I get the error.
Error: credentials key has https[s]:// prefix
docker login -u uploader -p 1qaz2wsx 10.11.20.186:8082
This should work without a downgrade. Just remove 'https://'.
dnf downgrade podman-docker -y
sheng#B-Product-U-WEB01 /etc/containers/registries.conf.d
$ docker -v [17:27:36]
podman version 3.3.0-dev
sheng#B-Product-U-WEB01 /etc/containers/registries.conf.d
$ docker login -u uploader -p ****** https://10.11.20.186:8082 [17:27:38]
Login Succeeded!
it's work
My Jenkins requires https://, without it, it fails with
java.net.MalformedURLException: no protocol: quay.io
at java.net.URL.<init>(URL.java:611)
at java.net.URL.<init>(URL.java:508)
at java.net.URL.<init>(URL.java:457)
at org.jenkinsci.plugins.docker.commons.credentials.DockerRegistryEndpoint.getEffectiveUrl(DockerRegistryEndpoint.java:145)
at org.jenkinsci.plugins.docker.commons.credentials.DockerRegistryEndpoint.newKeyMaterialFactory(DockerRegistryEndpoint.java:300)
at org.jenkinsci.plugins.docker.workflow.RegistryEndpointStep$Execution2.newKeyMaterialFactory(RegistryEndpointStep.java:95)
at org.jenkinsci.plugins.docker.workflow.AbstractEndpointStepExecution2.doStart(AbstractEndpointStepExecution2.java:52)
at org.jenkinsci.plugins.workflow.steps.GeneralNonBlockingStepExecution.lambda$run$0(GeneralNonBlockingStepExecution.java:77)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:750)
The solution turned out to be a system upgrade to the latest version of the RHEL 8.6 packages through dnf upgrade. Now I have
# docker --version
podman version 4.0.2
which allows me to use the https:// prefix without complaints.
When running my asp.net core application locally in my Linux Docker container, the following error occurs:
Unhandled exception. Interop+Crypto+OpenSslCryptographicException: error:0D06B08E:asn1 encoding routines:asn1_d2i_read_bio:not enough data
at Internal.Cryptography.Pal.OpenSslX509CertificateReader.FromBio(SafeBioHandle bio, SafePasswordHandle password)
at Internal.Cryptography.Pal.OpenSslX509CertificateReader.FromFile(String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags)
... when instanciating an X509Certificate2 object in my startup.cs:
services.AddDefaultIdentity<ApplicationUser>(options => options.SignIn.RequireConfirmedAccount = true).AddEntityFrameworkStores<ApplicationDbContext>();
var identityServerBuilder = services.AddIdentityServer().AddApiAuthorization<ApplicationUser, ApplicationDbContext>();
var certificate = new X509Certificate2(#"abc.pfx", "abc"); // This is where the exception is thrown.
identityServerBuilder.AddSigningCredential(certificate);
I need this self-signed certificate to run IdentityServer4.
When debugging in Visual Studio I have no problems and I can perfectly evaluate all of the pfx's properties.
I generated the pfx file on Linux as follows:
openssl genrsa -out rsa.private 1024
openssl req -new -key rsa.private > rsa.csr
openssl x509 -req -in rsa.csr -signkey rsa.private -out rsa.crt
openssl pkcs12 -export -in rsa.crt -inkey rsa.private -out abc.pfx
...and verifying its integrity:
openssl pkcs12 -nokeys -info -nocerts -in abc.pfx
... revealed no problems:
MAC: sha1, Iteration 2048
MAC length: 20, salt length: 8
PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048
Certificate bag
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048
I also used the Microsoft Management Console to generate the pfx, but that results in the same error.
I'm mounting my pfx file executing this Docker run command:
docker run -d=false -p 8080:80 -v abc.pfx:/app/abc.pfx --name mijncont mijncont:dev
My appsettings.json :
"IdentityServer": {
"Clients": {
"TEST.Client": {
"Profile": "IdentityServerSPA"
}
},
"Key": {
"Type": "Store",
"StoreName": "My",
"StoreLocation": "LocalMachine",
"Name": "CN=mijnsubject"
}
When running :
docker exec -it mijncont /bin/bash
... the following prompt appears :
root#3815c63cb5c4:/app#
When executing 'ls -la'
I get this :
drwxr-xr-x 2 root root 4096 Jul 13 16:04 abc.pfx
However when I include this line in my Startup.cs :
Console.WriteLine("Size: "+ new System.IO.FileInfo("abc.pfx").Length);
... .Net throws an exception saying that the file doesn't exist.
I included the directory containing the pfx file in Docker -> Settings -> Resources -> File sharing
Anyone?
The problem lied in the way I mounted my abc.pfx file.
This :
docker run -d=false -p 8080:80 -v abc.pfx:/app/abc.pfx --name mijncont mijncont:dev
...mounts a directory called abc.fpx in the container (holding the abc.pfx file)
If I specify an absolute path :
docker run -d=false -p 8080:80 -v C:\mysolution\abc.pfx:/app/abc.pfx --name mijncont
...only the file is mounted to the 'app' directory which is what I want.
I would like to set up GitLab with https on Synology DS918+.
I am using DOCKER in DSM. I downloaded the latest GitLab Community docker image.
And I used Putty to ssh into the NAS and create keys using openssl.
1) Create a key into cert folder:
mkdir /volume1/docker/gitlab/certs
cd /volume1/docker/gitlab/certs
openssl genrsa -out gitlab.key 2048
openssl req -new -key gitlab.key -out gitlab.csr
openssl x509 -req -days 3650 -in gitlab.csr -signkey gitlab.key -out gitlab.crt
openssl dhparam -out dhparam.pem 2048
chmod 400 gitlab.key
2) I added two additional variables in custom image to set up the environment for HTTPS:
3) In the last part:
I remove port 80 that was first set in the default image.
And add ports 30000/30001 for 22/443 port bindings that were set to auto in the default image:
When I go to browser for https://synologyip.com:30000 GitLab can't be reached.
Any guesses on what have I missed or done wrong?
Thanks!
I don't know about you, but I had to create the cert in the following folder:
/volume1/docker/gitlab/gitlab/certs
Note the repeated gitlab directory
A good well-written tutorial can be found here: Github Tutorial, and with a letsencrypt cert too!
Although i shortened the cert copy part like follows:
cat /usr/syno/etc/certificate/_archive/*/privkey.pem > /volume1/docker/github/github/certs/gitlab.key
cat /usr/syno/etc/certificate/_archive/*/fullchain.pem > /volume1/docker/github/github/certs/gitlab.crt
and continued then with the dhparam.pem
I'm trying to push an image to my docker private repository:
docker pull busybox
docker tag busybox living-registry.com:5000/busybox
docker push living-registry.com:5000/busybox
Docker tells me:
The push refers to a repository [living-registry.com:5000/busybox]
Get https://living-registry.com:5000/v1/_ping: read tcp 195.83.122.16:39714->195.83.122.16:5000: read: connection reset by peer
These commands are being performed on a CoreOS.
In another machine, I've started my registry using this command:
docker run -d -p 5000:5000 --restart=always --name registry \
-v /root/docker-registry/auth:/auth \
-e "REGISTRY_AUTH=htpasswd" \
-e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
-e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
-v /root/docker-registry/certs:/certs \
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/registry.crt \
-e REGISTRY_HTTP_TLS_KEY=/certs/registry.key \
-v /root/docker-registry/data:/var/lib/registry \
registry:2
Everything seems to be right:
# netstat -tupln | grep 5000
tcp6 0 0 :::5000 :::* LISTEN 3160/docker-proxy
# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
27e79f6a504c registry:2 "/bin/registry serve " About an hour ago Restarting (2) 36 minutes ago 0.0.0.0:5000->5000/tcp registry
So, when I'm trying to log in:
[root#jenkins certs]# docker login living-registry.com:5000
Username: xxxx
Password: xxxx
Error response from daemon: Get https://living-registry.com:5000/v1/users/: read tcp 195.83.122.16:39756->195.83.122.16:5000: read: connection reset by peer
Any ideas?
EDIT
I've already added the certificate (ca.crt) in /etc/ssl/certs and in /etc/docker/certs.d/x.x.x.x:5000/.
From this CoreOS instance, I'm trying to perform that:
$ docker login https://x.x.x.x:5000
Username: xxx
Password:
Email: xxx#mail.com
And it tells me:
Error response from daemon: invalid registry endpoint https://x.x.x.x:5000/v0/: unable to ping registry endpoint https://x.x.x.x:5000/v0/
v2 ping attempt failed with error: Get https://x.x.x.x:5000/v2/: EOF
v1 ping attempt failed with error: Get https://x.x.x.x:5000/v1/_ping: EOF. If this private registry supports only HTTP or HTTPS with an unknown CA certificate, please add --insecure-registry x.x.x.x:5000 to the daemon's arguments. In the case of HTTPS, if you have access to the registry's CA certificate, no need for the flag; simply place the CA certificate at /etc/docker/certs.d/x.x.x.x:5000/ca.crt
I've also tried to get the connection directly with openssl:
openssl s_client -connect x.x.x.x:5000
The output is:
CONNECTED(00000003)
140180300502672:error:140790E5:SSL routines:ssl23_write:ssl handshake failure:s23_lib.c:177:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 308 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : 0000
Session-ID:
Session-ID-ctx:
Master-Key:
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1467812448
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
For self-signed certificates, the crt must be copied into
/etc/docker/cert.d/hostname:port/ca.crt
cf : https://docs.docker.com/engine/security/certificates/
I create certificates :
openssl req -x509 -nodes -days 3650d -newkey rsa:2048 -keyout /root/docker-registry/certs/registry.key -out /root/docker-registry/certs/registry.crt -days 3650d
cp /root/docker-registry/certs/registry.crt /etc/docker/cert.d/x.x.x.x:5000/ca.crt
I want to run a private docker registry which is widely available.
So I will be able to push and pull images from other servers.
I'm following this tutorials: doc1 & doc2
I performed 3 steps:
First I've created my certificate and key (as CNAME I filled in my ec2-hostname)
mkdir -p certs && openssl req \
-newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key \
-x509 -days 365 -out certs/domain.crt
Than I've created my docker registry, using this key.
docker run -d -p 5000:5000 --restart=always --name registry \
-v `pwd`/certs:/certs \
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
-e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
registry:2
Than I copied the content of domain.crt to /etc/docker/certs.d/ec2-xx-xx-xx-xx.compute.amazonaws.com:5000/ca.crt
I restarted my docker: sudo service docker restart
When I try to push an image I get the following error:
unable to ping registry endpoint https://ec2-xx-xx-xx-xx.compute.amazonaws.com:5000/v0/
v2 ping attempt failed with error: Get https://ec2-xx-xx-xx-xx.compute.amazonaws.com:5000/v2/: net/http: TLS handshake timeout
v1 ping attempt failed with error: Get https://ec2-xx-xx-xx-xx.compute.amazonaws.com:5000/v1/_ping: net/http: TLS handshake timeout
I really don't know what I'm missing or doing wrong. Can someone please help me. Thanks
I'm not sure if you copy/pasted your pwd directly... but the file path should be /etc/docker/certs.d
You currently have etc/docker/cert.d/registry.ip:5000/domain.crt
The error message says "TLS handshake timeout". This indicates that either no process is listening on port 5000 (check using netstat) or the port is closed from the location where you are trying to push the image (open port in the AWS security group).
From what I've seen docker login is way more sensitive to properly crafted self-signed certs than browsers are + there's an interesting gotcha I'll point out at the very bottom, so read the whole thing.
According to this site:
https://jamielinux.com/docs/openssl-certificate-authority/create-the-root-pair.html
Bash# openssl x509 -noout -text -in ca.crt
X509v3 Basic Constraints: critical
CA:TRUE
^You should see something like this is you provisioned your certs right.
While following random how-to guides on the net I was able to generate ca.crt and website.crt
When I ran the above command I didn't see that output, but I noticed:
If I imported the cert as trusted in Mac or Win my browser would be happy and say yeap valid cert, but docker login on RHEL7 would complain with messages like)
x509: certificate signed by unknown authority
I tried following directions related to using: /etc/docker/certs.d/mydockerrepo.lan:5000/ca.crt
on https://docs.docker.com/engine/security/certificates/
It got me a better error message (which caused me to find the above site in the first place)
x509: certificate signed by unknown authority (possibly because of
"x509: invalid signature: parent certificate cannot sign this kind of
certificate" while trying to verify candidate authority certificate
After 2 days of messing around I figured it out:
When I was taught programming I was taught the concept of a short self-contained example, so going to try doing that here for ansible, leveraging the openssl built-in modules, I'm running latest ansible 2.9, but this should work for ansible 2.5++ in theory:
Short Self Contained Example:
#Name this file generatecertificates.playbook.yml
#Run using Bash# ansible-playbook generatecertificates.playbook.yml
#
#What to Expect:
#Run Self Contained Stand Alone Ansible Playbook --Get-->
# currentworkingdir/certs/
# ca.crt
# ca.key
# mydockerrepo.private.crt
# mydockerrepo.private.key
#
#PreReq Ansible 2.5++
#PreReq Bash# pip3 install cryptograph >= 1.6 or PyOpenSSL > 0.15 (if using selfsigned provider)
---
- hosts: localhost
connection: local
gather_facts: no
vars:
- caencryptionpassword: "myrootcaencryptionpassword"
- dockerepodns: "mydockerrepo.private"
- rootcaname: "My Root CA"
tasks:
- name: get current working directory
shell: pwd
register: pathvar
- debug: var=pathvar.stdout
- name: Make sub directory
file:
path: "{{pathvar.stdout}}/certs"
state: directory
register: certsoutputdir
- debug: var=certsoutputdir.path
- name: "Generate Root CA's Encrypted Private Key"
openssl_privatekey:
size: 4096
path: "{{certsoutputdir.path}}/ca.key"
cipher: auto
passphrase: "{{caencryptionpassword}}"
- name: "Generate Root CA's Self Signed Certificate Signing Request"
openssl_csr:
path: "{{certsoutputdir.path}}/ca.csr"
privatekey_path: "{{certsoutputdir.path}}/ca.key"
privatekey_passphrase: "{{caencryptionpassword}}"
common_name: "{{rootcaname}}"
basic_constraints_critical: yes
basic_constraints: ['CA:TRUE']
- name: "Generate Root CA's Self Signed Certificate"
openssl_certificate:
path: "{{certsoutputdir.path}}/ca.crt"
csr_path: "{{certsoutputdir.path}}/ca.csr"
provider: selfsigned
selfsigned_not_after: "+3650d" #Note: Mac won't trust by default due to https://support.apple.com/en-us/HT210176, but you can explitly trust to make it work.
privatekey_path: "{{certsoutputdir.path}}/ca.key"
privatekey_passphrase: "{{caencryptionpassword}}"
register: cert
- debug: var=cert
- name: "Generate Docker Repo's Private Key"
openssl_privatekey:
size: 4096
path: "{{certsoutputdir.path}}/{{dockerepodns}}.key"
- name: "Generate Docker Repo's Certificate Signing Request"
openssl_csr:
path: "{{certsoutputdir.path}}/{{dockerepodns}}.csr"
privatekey_path: "{{certsoutputdir.path}}/{{dockerepodns}}.key"
common_name: "{{dockerepodns}}"
subject_alt_name: 'DNS:{{dockerepodns}},DNS:localhost,IP:127.0.0.1'
- name: "Generate Docker Repo's Cert, signed by Root CA"
openssl_certificate:
path: "{{certsoutputdir.path}}/{{dockerepodns}}.crt"
csr_path: "{{certsoutputdir.path}}/{{dockerepodns}}.csr"
provider: ownca
ownca_not_after: "+365d" #Cert valid 1 year
ownca_path: "{{certsoutputdir.path}}/ca.crt"
ownca_privatekey_path: "{{certsoutputdir.path}}/ca.key"
ownca_privatekey_passphrase: "{{caencryptionpassword}}"
register: cert
- debug: var=cert
Interesting Gotcha/Final Step:
RHEL7Bash# sudo cp ca.crt /etc/pki/ca-trust/source/anchors/ca.crt
RHEL7Bash# sudo update-ca-trust
RHEL7Bash# sudo systemctl restart docker
The gotcha is that you have to restart docker, for docker login to recognize updates to CA's newly added to the system.