docker管理工具之证书的制作与证书的加密

1.证书的制作

##下载registry镜像
lftp 172.25.254.251:/pub/docs/docker> get registry.tar 
##导入镜像
[root@foundation52 kiosk]# docker load -i registry.tar
##
[root@foundation52 kiosk]# docker run -d -p 5000:5000 -v /opt/registry:/var/lib/registry registry:2
Unable to find image 'registry:2' locally
2: Pulling from library/registry
4064ffdc82fe: Pull complete 
c12c92d1c5a2: Pull complete 
4fbc9b6835cc: Pull complete 
765973b0f65f: Pull complete 
3968771a7c3a: Pull complete 
Digest: sha256:51bb55f23ef7e25ac9b8313b139a8dd45baa832943c8ad8f7da2ddad6355b3c8
Status: Downloaded newer image for registry:2
becdda0248cbdf39ab532d5b81f1530d89c485e8fa6fc254c2f2de65b4a03465
[root@foundation52 kiosk]# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                    NAMES
becdda0248cb        registry:2          "/entrypoint.sh /e..."   39 seconds ago      Up 36 seconds       0.0.0.0:5000->5000/tcp   thirsty_bhaskara
[root@foundation35 ~]# docker run -d -p 5000:5000 -v /opt/registry:/var/lib/registry registry:2
[root@foundation35 ~]# docker tag nginx localhost:5000/nginx
## push表示将本地的镜像上传到镜像仓库
[root@foundation35 ~]# docker push localhost:5000/nginx
The push refers to a repository [localhost:5000/nginx]
08d25fa0442e: Pushed 
a8c4aeeaa045: Pushed 
cdb3f9544e4c: Pushed 
latest: digest: sha256:2de9d5fc6585b3f330ff5f2c323d2a4006a49a476729bbc0910b695771526e3f size: 948
[root@foundation35 ~]# docker rmi localhost:5000/nginx
Untagged: localhost:5000/nginx:latest
Untagged: localhost:5000/nginx@sha256:2de9d5fc6585b3f330ff5f2c323d2a4006a49a476729bbc0910b695771526e3f
[root@foundation35 ~]# docker rmi nginx
Untagged: nginx:latest
Untagged: nginx@sha256:d85914d547a6c92faa39ce7058bd7529baacab7e0cd4255442b04577c4d1f424
Deleted: sha256:c82521676580c4850bb8f0d72e47390a50d60c8ffe44d623ce57be521bca9869
Deleted: sha256:2c1f65d17acf8759019a5eb86cc20fb8f8a7e84d2b541b795c1579c4f202a458
Deleted: sha256:8f222b457ca67d7e68c3a8101d6509ab89d1aad6d399bf5b3c93494bbf876407
Deleted: sha256:cdb3f9544e4c61d45da1ea44f7d92386639a052c620d1550376f22f5b46981af
[root@foundation35 ~]# docker pull localhost:5000/nginx
Using default tag: latest
latest: Pulling from nginx
2da35ff30a7d: Pull complete 
831fb1a65ced: Pull complete 
7a63da4e8a19: Pull complete 
Digest: sha256:2de9d5fc6585b3f330ff5f2c323d2a4006a49a476729bbc0910b695771526e3f
Status: Downloaded newer image for localhost:5000/nginx:latest
[root@foundation35 ~]# docker tag localhost:5000/nginx nginx
[root@foundation35 ~]# docker rmi localhost:5000/nginx
Untagged: localhost:5000/nginx:latest
Untagged: localhost:5000/nginx@sha256:2de9d5fc6585b3f330ff5f2c323d2a4006a49a476729bbc0910b695771526e3f
[root@foundation35 ~]# docker images nginx
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
nginx               latest              c82521676580        3 weeks ago         109 MB
[root@foundation52 docker]# docker ps -a
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS                         PORTS                    NAMES
f6c961c0fcad        registry            "/tmp/docker/certs..."   3 minutes ago       Created                                                 unruffled_feynman
becdda0248cb        registry:2          "/entrypoint.sh /e..."   15 minutes ago      Up 15 minutes                  0.0.0.0:5000->5000/tcp   thirsty_bhaskara
##删除5000端口
[root@foundation52 docker]# docker rm -f f6
f6
[root@foundation52 docker]# docker rm -f be
be

##添加解析
[root@foundation52 ~]# vim /etc/hosts
######################
添加: 172.25.254.52 westos.org

[root@foundation52 ~]# ping westos.org
PING westos.org172.25.52.250 (172.25.52.250) 56(84) bytes of data.
64 bytes from westos.org172.25.52.250 (172.25.52.250): icmp_seq=1 ttl=64 time=0.038 ms
64 bytes from westos.org172.25.52.250 (172.25.52.250): icmp_seq=2 ttl=64 time=0.082 ms
^Z
[1]+  Stopped                 ping westos.org
[root@foundation52 ~]# cd /tmp/docker/
[root@foundation52 docker]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key -x509 -days 365 -out certs/domain.crt
Generating a 4096 bit RSA private key
...........................++
............................................................................................................................++
writing new private key to 'certs/domain.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:shaanxi
Locality Name (eg, city) [Default City]:xi'an
Organization Name (eg, company) [Default Company Ltd]:westos
Organizational Unit Name (eg, section) []:linux
Common Name (eg, your name or your server's hostname) []:westos.org
Email Address []:root@westos.org
[root@foundation52 docker]# mkdir certs
[root@foundation52 docker]# cd certs/
[root@foundation52 certs]# ll
total 8
-rw-r--r-- 1 root root 2098 Aug 22 16:39 domain.crt
-rw-r--r-- 1 root root 3272 Aug 22 16:39 domain.key
[root@foundation52 certs]# cd ..
[root@foundation52 docker]# docker run -d \
> --restart=always \
> --name registry \
> -v `pwd`/certs:/certs \
> -e REGISTRY_HTTP_ADDR=0.0.0.0:443 \
> -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
> -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
> -p 443:443 \
> registry:2
d5e1dec99b8d950538f8a04f63bb3219015d1d08daa94e7287cbd60274901a21
[root@foundation52 docker]# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                            NAMES
d5e1dec99b8d        registry:2          "/entrypoint.sh /e..."   11 seconds ago      Up 10 seconds       0.0.0.0:443->443/tcp, 5000/tcp   registry
[root@foundation52 docker]# netstat -antlp |grep :443
tcp6       0      0 :::443                  :::*                    LISTEN      13765/docker-proxy  
[root@foundation52 docker]#  cd /opt/registry/
[root@foundation52 registry]# ls
[root@foundation52 registry]#  iptables -t nat -nL
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DOCKER     all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DOCKER     all  --  0.0.0.0/0           !127.0.0.0/8          ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  172.17.0.0/16        0.0.0.0/0           
RETURN     all  --  192.168.122.0/24     224.0.0.0/24        
RETURN     all  --  192.168.122.0/24     255.255.255.255     
MASQUERADE  tcp  --  192.168.122.0/24    !192.168.122.0/24     masq ports: 1024-65535
MASQUERADE  udp  --  192.168.122.0/24    !192.168.122.0/24     masq ports: 1024-65535
MASQUERADE  all  --  192.168.122.0/24    !192.168.122.0/24    
MASQUERADE  tcp  --  172.17.0.2           172.17.0.2           tcp dpt:443

Chain DOCKER (2 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:443 to:172.17.0.2:443
[root@foundation52 registry]# cd /etc/docker
[root@foundation52 docker]# ls
daemon.json  key.json
[root@foundation52 docker]# mkdir certs.d
[root@foundation52 docker]# cd certs.d/
[root@foundation52 certs.d]# mkdir westos.org
[root@foundation52 certs.d]#  cd westos.org
[root@foundation52 westos.org]# cp /tmp/docker/certs/domain.crt ./ca.crt
[root@foundation52 westos.org]# ls
ca.crt
[root@foundation52 westos.org]# docker tag nginx westos.org/rhel7
[root@foundation52 westos.org]# docker push westos.org/rhel7
The push refers to a repository [westos.org/rhel7]
08d25fa0442e: Pushed 
a8c4aeeaa045: Pushed 
cdb3f9544e4c: Pushed 
latest: digest: sha256:2de9d5fc6585b3f330ff5f2c323d2a4006a49a476729bbc0910b695771526e3f size: 948

2.证书的加密

[root@foundation52 kiosk]# cd /tmp/docker/
[root@foundation52 docker]# mkdir auth
[root@foundation52 docker]# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                            NAMES
[root@foundation52 docker]# docker volume ls
DRIVER              VOLUME NAME
local               017f3f8d7cae7b732ef372eef90c4d3a6f65701e581a5704e837f9bed51af355
local               27ec2bb38d509f1aada158c0051ab50acd2dc40880a0763296d79f6a2065b74e
.............
[root@foundation52 docker]# docker volume rm `docker volume ls -q`
017f3f8d7cae7b732ef372eef90c4d3a6f65701e581a5704e837f9bed51af355
27ec2bb38d509f1aada158c0051ab50acd2dc40880a0763296d79f6a2065b74e
.............
[root@foundation52 docker]# docker volume ls
DRIVER              VOLUME NAME

##
[root@foundation52 docker]# docker run --entrypoint htpasswd registry:2 -Bbn haha westos > auth/htpasswd
[root@foundation52 docker]# cat auth/htpasswd
haha:$2y$05$iAk4eCp8ntMaWIfSwxvqeej4VrsRrieI3yiAC.fJ7zznp81PVlaQu
## >>表示追加
[root@foundation52 docker]# docker run --entrypoint htpasswd registry:2 -Bbn admin admin >> auth/htpasswd
[root@foundation52 docker]# cat auth/htpasswd
haha:$2y$05$iAk4eCp8ntMaWIfSwxvqeej4VrsRrieI3yiAC.fJ7zznp81PVlaQu
admin:$2y$05$xuQmKgjMheEbpPr45AdSYO9TpxsPWy0VSs/UIBIYDZ.0Qy0ysQu/O

[root@foundation52 docker]# docker ps 
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
[root@foundation52 docker]# docker ps -a
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS                      PORTS               NAMES
cad9935c58b7        registry:2          "htpasswd -Bbn adm..."   24 seconds ago      Exited (0) 22 seconds ago                       elated_davinci
a76411db42c5        registry:2          "htpasswd -Bbn hah..."   47 seconds ago      Exited (0) 43 seconds ago                       youthful_keller

##更改用户密码 第一次必须加 -cm
[root@foundation52 docker]# htpasswd -cm htpaswd haha
New password: 
Re-type new password: 
Adding password for user haha
[root@foundation52 docker]# cat htpaswd
haha:$apr1$I0l6qswB$fW6C2EEzw28FbzS/oD6h80
##此后便可直接加 -m
[root@foundation52 docker]# htpasswd -m htpaswd admin
New password: 
Re-type new password: 
Adding password for user admin
[root@foundation52 docker]# cat htpaswd
haha:$apr1$I0l6qswB$fW6C2EEzw28FbzS/oD6h80
admin:$apr1$PRHSaDPG$e9j5Fn2n6OI/EhPf11KLI1
[root@foundation52 docker]# rm -f htpaswd 
[root@foundation52 docker]# docker container prune
WARNING! This will remove all stopped containers.
Are you sure you want to continue? [y/N] y
Deleted Containers:
e5775c9bb2389069749f0248462aa04b3473a3f189c1472f9be7e7e1f7c4a271
500f2ce33b774f048dd7f144016f6d033b3e09865410ca5a56478daa3bdcdc08

Total reclaimed space: 0 B
[root@foundation52 docker]# docker run -d \
> --restart=always \
> -v `pwd`/certs:/certs \
> -e REGISTRY_HTTP_ADDR=0.0.0.0:443 \
> -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
> -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
> -v `pwd`/auth:/auth -e "REGISTRY_AUTH=htpasswd" \
> -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
> -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
> -p 443:443 \
> registry:2
eb27ad6bf246581518ddeb463b22a958352f867c320f29131532d8305873110e
[root@foundation52 docker]# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                            NAMES
99ee302d848c        registry:2          "/entrypoint.sh /e..."   11 seconds ago      Up 9 seconds        0.0.0.0:443->443/tcp, 5000/tcp   flamboyant_boyd
##用户登陆
[root@foundation52 docker]# docker login -u haha -p westos westos.org
Login Succeeded
[root@foundation52 docker]# ping westos.org
PING westos.org (172.25.254.52) 56(84) bytes of data.
64 bytes from westos.org (172.25.254.52): icmp_seq=1 ttl=64 time=0.039 ms
^Z
[1]+  Stopped                 ping westos.org
##因为做了证书加密 所以只有用户登陆了之后才能push
[root@foundation52 docker]# docker push westos.org/rhel7
The push refers to a repository [westos.org/rhel7]
08d25fa0442e: Pushed 
a8c4aeeaa045: Pushed 
cdb3f9544e4c: Pushed 
latest: digest: sha256:2de9d5fc6585b3f330ff5f2c323d2a4006a49a476729bbc0910b695771526e3f size: 948

[root@foundation52 docker]# cd 
[root@foundation52 ~]# cd .docker/
[root@foundation52 .docker]# ls
config.json
[root@foundation52 .docker]# cat config.json 
{
    "auths": {
        "westos.org": {
            "auth": "aGFoYTp3ZXN0b3M="
        }
    }
}
[root@foundation52 .docker]# netstat -antlp | grep :443
tcp6       0      0 :::443                  :::*                    LISTEN      4964/docker-proxy   
[root@foundation52 .docker]# cat config.json 
{
    "auths": {
        "westos.org": {
            "auth": "aGFoYTp3ZXN0b3M="
        }
    }
[root@foundation52 .docker]# cd 
[root@foundation52 ~]# rm -rf .docker/
##将nginx镜像标示为westos.org/nginx 即为更改镜像名称
[root@foundation52 ~]# docker tag nginx westos.org/nginx
##上传镜像
[root@foundation52 ~]# docker push westos.org/nginx
The push refers to a repository [westos.org/nginx]
08d25fa0442e: Pushed 
a8c4aeeaa045: Pushed 
cdb3f9544e4c: Pushed 
latest: digest: sha256:2de9d5fc6585b3f330ff5f2c323d2a4006a49a476729bbc0910b695771526e3f size: 948

你可能感兴趣的:(docker管理工具之证书的制作与证书的加密)