Docker安全之TLS加密通信解析與配置驗證

時間 2020-05-01

標籤 docker 安全 tls 加密通信解析配置驗證欄目 Docker 简体版

原文原文鏈接

Docker安全之TLS加密通信解析與配置驗證

TLS的基本概念

TLS（Transport Layer Security，安全傳輸層)，TLS是創建在傳輸層TCP協議之上的協議，服務於應用層，它的前身是SSL（Secure Socket Layer，安全套接字層），它實現了將應用層的報文進行加密後再交由TCP進行傳輸的功能。linux

TLS協議具有三大特性：保密性（數據都是加密傳輸，預防第三方嗅探）、數據完整性（基於MAC校驗機制）、雙向認證支持（避免身份被冒充）nginx

在docker中，創建TLS加密是爲了防止鏈路劫持、會話劫持等問題致使 Docker 通訊時被中間人***，c/s 兩端應該經過加密方式通信。算法

圖解TLS創建過程

TLS的C/S創建鏈接的過程圖解（完整的即雙向驗證過程）docker

大致上是發送hello包，客戶端發送認證和請求認證，對應的迴應認證，其後進行對應的協商驗證，生成信息，最後兩邊開始準備加密通訊，雙方使用客戶端密鑰經過對稱加密算法對通訊內容加密後進行雙向通訊，隨着通信結束，任意一方斷開ssl鏈接的信息便可。shell

部署配置過程

所需基本環境

兩臺服務器，一臺爲server端一臺爲client端，都部署安裝了docker-cejson

配置過程

一、準備工做：服務器節點上vim

#建立工做目錄文件夾
[root@localhost ~]# mkdir /tls
[root@localhost ~]# cd /tls/
#設置主機名
[root@localhost tls]# hostnamectl set-hostname server
[root@localhost tls]# su
[root@server tls]# vim /etc/hosts
127.0.0.1   server
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
#進行測試
[root@server tls]# ping server
PING server (127.0.0.1) 56(84) bytes of data.
64 bytes from server (127.0.0.1): icmp_seq=1 ttl=64 time=0.033 ms
64 bytes from server (127.0.0.1): icmp_seq=2 ttl=64 time=0.029 ms
64 bytes from server (127.0.0.1): icmp_seq=3 ttl=64 time=0.031 ms
64 bytes from server (127.0.0.1): icmp_seq=4 ttl=64 time=0.084 ms
^C
--- server ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3012ms
rtt min/avg/max/mdev = 0.029/0.044/0.084/0.023 ms

二、建立ca祕鑰證書和ca證書安全

#建立ca祕鑰證書
[root@server tls]# openssl genrsa -aes256 -out ca-key.pem 4096
Generating RSA private key, 4096 bit long modulus
...........................................................................++
.................................++
e is 65537 (0x10001)
#下面須要進行，本身設置密碼
Enter pass phrase for ca-key.pem:
Verifying - Enter pass phrase for ca-key.pem:

#建立ca證書
[root@server tls]# openssl req -new -x509 -days 1000 -key ca-key.pem -sha256 -subj "/CN=*" -out ca.pem
#下面須要進行交互輸入你剛剛設置的密碼便可
Enter pass phrase for ca-key.pem:

三、服務器私鑰證書和生成簽名私鑰服務器

#建立服務器私鑰證書
[root@server tls]# openssl genrsa -out server-key.pem 4096
Generating RSA private key, 4096 bit long modulus
...........................................++
...........................................................................................++
e is 65537 (0x10001)

#利用上面建立的ca證書與服務器私鑰生成簽名私鑰
[root@server tls]# openssl req -subj "/CN=*" -sha256 -new -key server-key.pem -out server.csr#使用上面建立的ca證書與私鑰簽名

#查看對應的證書
[root@server tls]# ls
ca-key.pem  ca.pem  server.csr  server-key.pem

#進行簽名
[root@server tls]# openssl x509 -req -days 1000 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem
Signature ok
subject=/CN=*
Getting CA Private Key
#輸入密碼
Enter pass phrase for ca-key.pem:
[root@server tls]# ls
ca-key.pem  ca.pem  ca.srl  server-cert.pem  server.csr  server-key.pem

四、生成客戶端密鑰和進行客戶端簽名dom

#生成客戶端密鑰
[root@server tls]# openssl genrsa -out key.pem 4096
Generating RSA private key, 4096 bit long modulus
.........................................................................................................++
...............................................++
e is 65537 (0x10001)
#進行客戶端簽名
[root@server tls]# openssl req -subj "/CN=client" -new -key key.pem -out client.csr

五、建立配置文件來加強密鑰

#加強密鑰文件建立
[root@server tls]# echo extendedKeyUsage=clientAuth > extfile.cnf
#簽名證書
[root@server tls]# openssl x509 -req -days 1000 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem -extfile extfile.cnf
Signature ok
subject=/CN=client
Getting CA Private Key
Enter pass phrase for ca-key.pem:

六、移除多餘文件以及設置docker服務

[root@server tls]# rm -rf ca.srl client.csr extfile.cnf server.csr

[root@server tls]# vim /lib/systemd/system/docker.service
將低14行（準啓動方式設置）進行修改後保存退出
14 ExecStart=/usr/bin/dockerd --tlsverify --tlscacert=/tls/ca.pem --tlscert=/tls/server-cert.pem --tlskey=/tls/server-ke    y.pem -H tcp://0.0.0.0:2376 -H unix:///var/run/docker.sock

七、重載服務和重啓docker

[root@server tls]# systemctl daemon-reload
[root@server tls]# systemctl restart docker.service

八、將/tls/ca.pem /tls/cert.pem /tls/key.pem 三個文件複製到客戶端主機

[root@server tls]# ls
ca-key.pem  ca.pem  cert.pem  key.pem  server-cert.pem  server-key.pem
[root@server tls]# scp ca.pem cert.pem key.pem root@192.168.0.136:/etc/docker
root@192.168.0.136's password: 
ca.pem                                                                                 100% 1765   894.4KB/s   00:00    
cert.pem                                                                               100% 1696     1.7MB/s   00:00    
key.pem                                                                                100% 3243     2.6MB/s   00:00

client端設置

一、查看遠程複製過來的三個文件是否存在

[root@localhost ~]# ls /etc/docker/
ca.pem  cert.pem  daemon.json  key.json  key.pem

二、環境安裝和設置主機名稱以及hosts文件

[root@localhost ~]# systemctl status docker.service 
● docker.service - Docker Application Container Engine
   Loaded: loaded (/usr/lib/systemd/system/docker.service; disabled; vendor preset: disabled)
   Active: active (running) since 四 2020-04-30 09:31:18 CST; 3min 20s ago
     Docs: https://docs.docker.com

[root@localhost ~]# hostnamectl set-hostname client
[root@localhost ~]# su
[root@client ~]# vim /etc/hosts
[root@client ~]# cat /etc/hosts
192.168.0.135 server
[root@client ~]# ping server
PING server (192.168.0.135) 56(84) bytes of data.
64 bytes from server (192.168.0.135): icmp_seq=1 ttl=64 time=0.444 ms
64 bytes from server (192.168.0.135): icmp_seq=2 ttl=64 time=0.345 ms
64 bytes from server (192.168.0.135): icmp_seq=3 ttl=64 time=1.09 ms
^C
--- server ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 0.345/0.628/1.096/0.333 ms

三、進入/etc/docker目錄查看server端的docker版本進行驗證

[root@client docker]# docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H tcp://server:2376 version
Client: Docker Engine - Community
 Version:           19.03.8
 API version:       1.40
 Go version:        go1.12.17
 Git commit:        afacb8b
 Built:             Wed Mar 11 01:27:04 2020
 OS/Arch:           linux/amd64
 Experimental:      false
#上面是客戶端，下面是服務器端
Server: Docker Engine - Community
 Engine:
  Version:          19.03.8
  API version:      1.40 (minimum version 1.12)
  Go version:       go1.12.17
  Git commit:       afacb8b
  Built:            Wed Mar 11 01:25:42 2020
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.2.13
  GitCommit:        7ad184331fa3e55e52b890ea95e65ba581ae3429
 runc:
  Version:          1.0.0-rc10
  GitCommit:        dc9208a3303feef5b3839f4323d9beb36df0a9dd
 docker-init:
  Version:          0.18.0
  GitCommit:        fec3683

以上docker容器的TLS加密通訊及配置完了，下面進行一個簡單的測試

最終測試

在server端拉取一個鏡像在client端查看

#拉取一個nginx鏡像
[root@server tls]# docker pull nginx
Using default tag: latest
latest: Pulling from library/nginx
54fec2fa59d0: Pull complete 
4ede6f09aefe: Pull complete 
f9dc69acb465: Pull complete 
Digest: sha256:86ae264c3f4acb99b2dee4d0098c40cb8c46dcf9e1148f05d3a51c4df6758c12
Status: Downloaded newer image for nginx:latest
docker.io/library/nginx:latest
[root@server tls]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED                  SIZE
nginx               latest              602e111c06b6        Less than a second ago   127MB

#在客戶端查看鏡像
[root@client docker]# docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H tcp://server:2376 images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
nginx               latest              602e111c06b6        6 days ago          127MB

測試無誤（看鏡像ID便可），謝謝閱讀！