robertdebock / docker-centos-openssh Goto Github PK

View Code? Open in Web Editor NEW

15.0 3.0 16.0 105 KB

A CentOS 7 container that runs openssh server

License: Apache License 2.0

Shell 74.61% Dockerfile 25.39%

docker-centos-openssh docker centos openssh bats ssh-key

docker-centos-openssh's Introduction

docker-centos-openssh

A CentOS container that runs openssh server.

You can use this container to quickly startup a "machine" and test things, or it can be used as an SSH server, maybe a stepstone.

This container will generate new keys (host and user) at startup if none are loaded by attaching a volume.

Running the container.

It's quite easy to start a container:

docker run -P robertdebock/docker-centos-openssh

For Podman, please use:

podman run --cap-add AUDIT_WRITE -P robertdebock/docker-centos-openssh

(The --cap-add AUDIT_WRITE is added to overcome an issue.)

A private key will be displayed, copy-pasts-save it, set the permissions to 0600.

Find out what port Docker has connected to the container:

docker port docker-centos-openssh

And connect to the container:

ssh -p ${port} -i ${savedkey} root@${ip}

The ${ip} depends on where the container is running.

Using your own private key

Simply save your key in a folder like "dot-ssh" and map the volumes:

docker run -P -v $(pwd)/./ssh:/root/.ssh/ robertdebock/docker-centos-openssh

Using with docker-compose

You may setup a testlab, for example for Ansible or Rundeck, using Docker-compose, like so:

version: '3'
services:
  server:
    image: robertdebock/docker-centos-openssh
    volumes:
      - /path/to/dot-ssh:/root/.ssh/
    links:
      - client1
      - client2
      - client3
    ports:
      - "2222:22"
  client1:
    image: robertdebock/docker-centos-openssh
    volumes:
      - /path/to/dot-ssh:/root/.ssh/
  client2:
    image: robertdebock/docker-centos-openssh
    volumes:
      - /path/to/dot-ssh:/root/.ssh/
  client3:
    image: robertdebock/docker-centos-openssh
    volumes:
      - /path/to/dot-ssh:/root/.ssh/

Technologies used to build and test

Travis CI is used to build, run and test the image.
Docker Hub is used to deploy the image to.

Building on Travis CI and publishing to Docker Hub happens in parallel. On Travis CI, few project are used:

Bats for testing.
Docker Lint for finding weird errors.

A bit weird about this setup is that when the build fails, an image is still published.

docker-centos-openssh's People

Contributors

Stargazers

Watchers

Forkers

gmolto yonghuster setyadhiputrad venkateswarlu245a strattond hua0129 leggendario12 ziyanakthar gabrywu jsvini aankittcoolest 13uttam danielhanold feishengfei jniltinho jijiechen

docker-centos-openssh's Issues

MAINTAINER is depricated

https://github.com/docker/cli/blob/master/docs/deprecated.md#maintainer-in-dockerfile

lastest image doesnt'work

with lastest image 20211212 pulled,the ssh connect is closed even when we connect by docker host got

[root@dockerhost tmp]# ssh [email protected] -i key.key
Connection closed by 8.8.8.8 port 22

small modify to your * start.sh *

/usr/sbin/sshd -D

/usr/sbin/sshd -D -E /var/log/sshd.log

to view log output showed:

[root@node log]# tail -F sshd.log
Server listening on 0.0.0.0 port 22.
Server listening on :: port 22.
Connection reset by 123.333.333.555 port 1206 [preauth]
linux_audit_write_entry failed: Operation not permitted
linux_audit_write_entry failed: Operation not permitted
linux_audit_write_entry failed: Operation not permitted

Two builds are done; in Travis and on Dockers Hub.

The CI is a bit weird now; at a commit:

Travis starts to build and test.
Docker start to build and publish.

This means a commit that makes Travis fail, still published an image on hub.docker.com.

Travis is now used purely for testing, it may make more sense to let Travis push to Docker Hub on a successful build.

Is "epel-release" really required?

I only see openssh packages and don't understand why epel-release is installed.

When (bind) mounting a host volume, permissions can be incorrect.

I'm trying to mount a host volume:

docker run -P  $(pwd):/root/.ssh/ robertdebock/docker-centos-openssh
open /root/.ssh/id_rsa failed: Permission denied.
Generating public/private rsa key pair.
Saving the key failed: /root/.ssh/id_rsa.
/start.sh: line 10: /root/.ssh/id_rsa.pub: Permission denied
/usr/bin/cp: cannot stat '/root/.ssh/id_rsa.pub': No such file or directory
chown: cannot read directory '/root/.ssh': Permission denied
/usr/bin/cat: /root/.ssh/id_rsa: No such file or directory

Please save the printed private RSA key and login using:
"ssh -i ${savedkey} root@${ipaddress}"

This is because a host-mount passes on the uid/gid:

docker run -P -v $(pwd):/root/.ssh/ robertdebock/docker-centos-openssh ls -lda /root/.ssh
drwxrwxr-x. 2 1000 1000 4096 Sep  6 18:08 /root/.ssh

I suggest to make a (initially failing) test for this, change the Dockerfile (CMD) to check & fix permissions where possible.

Functional tests are missing

No tests are done, include some functional tests like:

See if a user can login.

DSA is used, RSA seems not possible.

CTRL+C does not terminate the container.

It's quite annoying to open another terminal and kill the running container. Entering CTRL+C would be much easier.