Add multiple programs

5 files changed, 188 insertions, 0 deletions

diff --git a/ssh-bastion/Dockerfile b/ssh-bastion/Dockerfile
new file mode 100644
index 0000000..05dade3
--- /dev/null
+++ b/ssh-bastion/Dockerfile
@@ -0,0 +1,22 @@
+FROM ubuntu:14.04
+MAINTAINER Michael Crute <mike@crute.us>
+
+RUN export DEBIAN_FRONTEND=noninteractive && \
+    apt-get update && \
+    apt-get install -y openssh-server libpam-google-authenticator && \
+    mkdir /var/run/sshd && \
+    chmod 700 /var/run/sshd
+
+ADD etc/sshd_config /etc/ssh/sshd_config
+ADD etc/sshd-pam /etc/pam.d/sshd
+ADD entrypoint.sh /entrypoint.sh
+
+RUN \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* && \
+    rm -rf /tmp/*
+
+EXPOSE 4321
+VOLUME "/srv/ssh"
+ENTRYPOINT [ "/entrypoint.sh" ]
+CMD [ "/usr/sbin/sshd", "-D", "-e" ]
diff --git a/ssh-bastion/Makefile b/ssh-bastion/Makefile
new file mode 100644
index 0000000..9090c53
--- /dev/null
+++ b/ssh-bastion/Makefile
@@ -0,0 +1,8 @@
+all:
+        docker build -t ssh-bastion .
+
+run:
+        docker run -d \
+                -p 4321:4321 \
+                -v /srv/ssh-bastion:/srv/ssh \
+                ssh-bastion
diff --git a/ssh-bastion/entrypoint.sh b/ssh-bastion/entrypoint.sh
new file mode 100755
index 0000000..aa8a8e6
--- /dev/null
+++ b/ssh-bastion/entrypoint.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+
+cd /srv/ssh/users
+
+for user in *; do
+    if getent passwd $user 2>&1>/dev/null; then
+        echo "User $user already exists"
+        continue
+    fi
+
+    uid=$(cat /srv/ssh/users/$user/uid)
+    if [[ -z "$uid" ]]; then
+        echo "No UID for $user"
+        exit 1
+    fi
+
+    useradd -MN -s /usr/sbin/nologin -u $uid $user
+done
+
+exec "$@"
diff --git a/ssh-bastion/etc/sshd-pam b/ssh-bastion/etc/sshd-pam
new file mode 100644
index 0000000..a62ba2b
--- /dev/null
+++ b/ssh-bastion/etc/sshd-pam
@@ -0,0 +1,60 @@
+# PAM configuration for the Secure Shell service
+
+# Standard Un*x authentication.
+# Exclude common auth and prefer google authenticator only
+#@include common-auth
+auth    [success=1 default=ignore] pam_google_authenticator.so secret=/srv/ssh/users/${USER}/totp user=root
+auth    requisite                       pam_deny.so
+auth    required                        pam_permit.so
+auth    optional                        pam_cap.so 
+
+# Disallow non-root logins when /etc/nologin exists.
+account    required     pam_nologin.so
+
+# Uncomment and edit /etc/security/access.conf if you need to set complex
+# access limits that are hard to express in sshd_config.
+# account  required     pam_access.so
+
+# Standard Un*x authorization.
+@include common-account
+
+# SELinux needs to be the first session rule.  This ensures that any
+# lingering context has been cleared.  Without this it is possible that a
+# module could execute code in the wrong domain.
+session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so close
+
+# Set the loginuid process attribute.
+session    required     pam_loginuid.so
+
+# Create a new session keyring.
+session    optional     pam_keyinit.so force revoke
+
+# Standard Un*x session setup and teardown.
+@include common-session
+
+# Print the message of the day upon successful login.
+# This includes a dynamically generated part from /run/motd.dynamic
+# and a static (admin-editable) part from /etc/motd.
+session    optional     pam_motd.so  motd=/run/motd.dynamic noupdate
+session    optional     pam_motd.so # [1]
+
+# Print the status of the user's mailbox upon successful login.
+session    optional     pam_mail.so standard noenv # [1]
+
+# Set up user limits from /etc/security/limits.conf.
+session    required     pam_limits.so
+
+# Read environment variables from /etc/environment and
+# /etc/security/pam_env.conf.
+session    required     pam_env.so # [1]
+# In Debian 4.0 (etch), locale-related environment variables were moved to
+# /etc/default/locale, so read that as well.
+session    required     pam_env.so user_readenv=1 envfile=/etc/default/locale
+
+# SELinux needs to intervene at login time to ensure that the process starts
+# in the proper default security context.  Only sessions which are intended
+# to run in the user's context should be run after this.
+session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so open
+
+# Standard Un*x password updating.
+@include common-password
diff --git a/ssh-bastion/etc/sshd_config b/ssh-bastion/etc/sshd_config
new file mode 100644
index 0000000..dd65731
--- /dev/null
+++ b/ssh-bastion/etc/sshd_config
@@ -0,0 +1,78 @@
+# vim:set ft=sshdconfig
+
+HostKey /srv/ssh/hostkeys/rsa_key
+HostKey /srv/ssh/hostkeys/ecdsa_key
+HostKey /srv/ssh/hostkeys/ed25519_key
+
+# By default SSH attempts to chdir to the logged-in user's home directory.  The
+# vast majority of users won't have a home directory on the machine, so
+# suppress the warning with a chroot.
+ChrootDirectory /
+
+Protocol 2
+
+# Bind a port above 1024 so we can run ssh as an unpriviledged user
+Port 4321
+
+PermitTTY no
+#ForceCommand /bin/false
+
+SyslogFacility AUTH
+LogLevel INFO
+PrintLastLog yes
+
+PidFile /var/run/sshd.pid
+
+StrictModes yes
+
+AuthorizedKeysFile /srv/ssh/users/%u/ssh
+
+PubkeyAuthentication yes
+HostbasedAuthentication no
+IgnoreRhosts yes
+PasswordAuthentication no
+PermitEmptyPasswords no
+RhostsRSAAuthentication no
+
+UsePAM yes
+UseLogin no
+PermitRootLogin no
+ChallengeResponseAuthentication yes
+AuthenticationMethods publickey,keyboard-interactive:pam
+
+# Use an unprivileged child process to accept connections and
+# authenticate the user before spinning up another process as
+# the user.
+UsePrivilegeSeparation yes
+
+# This turns off reverse lookups of the originating host which hang sshd
+# on DNS timeouts when DNS is down.  This also breaks "from=" lines in
+# authorizd_keys files which must be converted to dotted quad ip addrs.
+UseDNS no
+
+# By default SSH doesn't accept any environment variables from the client.  But
+# we use this specific variable to pass robot user authentication tokens into
+# the system.
+AcceptEnv LANG LC_*
+
+# Disconnect after this period of time if the user hasn't provided
+# a correct password.
+LoginGraceTime 120
+
+# After 66 seconds of inactivity, request a keep-alive from the
+# client.  If they don't respond after ten requests, kill the
+# connection.
+ClientAliveInterval 66
+ClientAliveCountMax 10
+
+# Allow up to 100 simultaneous unauthenticated connections.  Any
+# connections beyond that limit will be dropped.
+MaxStartups 100
+
+# The maxiumum number of sessions which can be served on one
+# multi-plexing connection. ssh does not fail gracefully when this
+# number is exceeded, so we keep it high.
+MaxSessions 100
+
+X11Forwarding no
+PrintMotd no