diff --git a/CHANGELOG.md b/CHANGELOG.md index 6d2d8d2a..45279898 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog +## 1.1.11 + - Add krb5-kdc-ldap with doc examples #171 + - Fix NFS issue #169 + - Add support of readonly user in custom bootstrap ldif #162 + - Create schemas in a consistent order. #174 + ## 1.1.10 Fix: - Readme #145 #148 diff --git a/Makefile b/Makefile index 354fe540..52d94acd 100644 --- a/Makefile +++ b/Makefile @@ -1,5 +1,5 @@ NAME = osixia/openldap -VERSION = 1.1.10 +VERSION = 1.1.11 .PHONY: build build-nocache test tag-latest push push-latest release git-tag-version diff --git a/README.md b/README.md index 860996a8..475cd754 100644 --- a/README.md +++ b/README.md @@ -4,9 +4,9 @@ ![Docker Stars](https://img.shields.io/docker/stars/osixia/openldap.svg) ![](https://images.microbadger.com/badges/image/osixia/openldap.svg) -Latest release: 1.1.10 - OpenLDAP 2.4.44 - [Changelog](CHANGELOG.md) | [Docker Hub](https://hub.docker.com/r/osixia/openldap/)  +Latest release: 1.1.11 - OpenLDAP 2.4.44 - [Changelog](CHANGELOG.md) | [Docker Hub](https://hub.docker.com/r/osixia/openldap/)  -/!\ Security warning: Databases created with image version up to 1.1.10 creates two admin users with the same password, if you changed admin password after bootstrap you may be concerned by [issue #161](https://github.com/osixia/docker-openldap/issues/161). +/!\ Security warning: Databases created with image version up to 1.1.11 creates two admin users with the same password, if you changed admin password after bootstrap you may be concerned by [issue #161](https://github.com/osixia/docker-openldap/issues/161). **A docker image to run OpenLDAP.** @@ -37,11 +37,12 @@ Latest release: 1.1.10 - OpenLDAP 2.4.44 - [Changelog](CHANGELOG.md) | [Docker - [Link environment file](#link-environment-file) - [Make your own image or extend this image](#make-your-own-image-or-extend-this-image) - [Advanced User Guide](#advanced-user-guide) - - [Extend osixia/openldap:1.1.10 image](#extend-osixiaopenldap1110-image) + - [Extend osixia/openldap:1.1.11 image](#extend-osixiaopenldap1111-image) - [Make your own openldap image](#make-your-own-openldap-image) - [Tests](#tests) - [Kubernetes](#kubernetes) - [Under the hood: osixia/light-baseimage](#under-the-hood-osixialight-baseimage) +- [Security](#security) - [Changelog](#changelog) ## Contributing @@ -55,7 +56,7 @@ If you find this image useful here's how you can help: ## Quick Start Run OpenLDAP docker image: - docker run --name my-openldap-container --detach osixia/openldap:1.1.10 + docker run --name my-openldap-container --detach osixia/openldap:1.1.11 This start a new container with OpenLDAP running inside. Let's make the first search in our LDAP container: @@ -91,7 +92,7 @@ It will create an empty ldap for the company **Example Inc.** and the domain **e By default the admin has the password **admin**. All those default settings can be changed at the docker command line, for example: docker run --env LDAP_ORGANISATION="My Company" --env LDAP_DOMAIN="my-company.com" \ - --env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.1.10 + --env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.1.11 #### Data persistence @@ -125,9 +126,14 @@ Mount `.ldif` in `/container/service/slapd/assets/config/bootstrap/ldif` directo Files containing `changeType:` attributes will be loaded with `ldapmodify`. -The startup script provide some substitution in bootstrap ldif files: -`{{LDAP_BASE_DN }}` and `{{ LDAP_BACKEND }}` values are supported. Other `{{ * }}` -substitution are left as is. +The startup script provides some substitutions in bootstrap ldif files. Following substitutions are supported: + +- `{{ LDAP_BASE_DN }}` +- `{{ LDAP_BACKEND }}` +- `{{ LDAP_READONLY_USER_USERNAME }}` +- `{{ LDAP_READONLY_USER_PASSWORD_ENCRYPTED }}` + +Other `{{ * }}` substitutions are left unchanged. Since startup script modifies `ldif` files, you **must** add `--copy-service` argument to entrypoint if you don't want to overwrite them. @@ -136,12 +142,12 @@ argument to entrypoint if you don't want to overwrite them. # single file example: docker run \ --volume ./bootstrap.ldif:/container/service/slapd/assets/config/bootstrap/ldif/50-bootstrap.ldif \ - osixia/openldap:1.1.10 --copy-service + osixia/openldap:1.1.11 --copy-service #directory example: docker run \ --volume ./lidf:/container/service/slapd/assets/config/bootstrap/ldif/custom \ - osixia/openldap:1.1.10 --copy-service + osixia/openldap:1.1.11 --copy-service ### Use an existing ldap database @@ -152,7 +158,7 @@ simply mount this directories as a volume to `/var/lib/ldap` and `/etc/ldap/slap docker run --volume /data/slapd/database:/var/lib/ldap \ --volume /data/slapd/config:/etc/ldap/slapd.d \ - --detach osixia/openldap:1.1.10 + --detach osixia/openldap:1.1.11 You can also use data volume containers. Please refer to: > [https://docs.docker.com/engine/tutorials/dockervolumes/](https://docs.docker.com/engine/tutorials/dockervolumes/) @@ -172,7 +178,7 @@ If you are looking for a simple solution to administrate your ldap server you ca #### Use auto-generated certificate By default, TLS is already configured and enabled, certificate is created using container hostname (it can be set by docker run --hostname option eg: ldap.example.org). - docker run --hostname ldap.my-company.com --detach osixia/openldap:1.1.10 + docker run --hostname ldap.my-company.com --detach osixia/openldap:1.1.11 #### Use your own certificate @@ -182,24 +188,24 @@ You can set your custom certificate at run time, by mounting a directory contain --env LDAP_TLS_CRT_FILENAME=my-ldap.crt \ --env LDAP_TLS_KEY_FILENAME=my-ldap.key \ --env LDAP_TLS_CA_CRT_FILENAME=the-ca.crt \ - --detach osixia/openldap:1.1.10 + --detach osixia/openldap:1.1.11 Other solutions are available please refer to the [Advanced User Guide](#advanced-user-guide) #### Disable TLS Add --env LDAP_TLS=false to the run command: - docker run --env LDAP_TLS=false --detach osixia/openldap:1.1.10 + docker run --env LDAP_TLS=false --detach osixia/openldap:1.1.11 ### Multi master replication Quick example, with the default config. #Create the first ldap server, save the container id in LDAP_CID and get its IP: - LDAP_CID=$(docker run --hostname ldap.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.1.10) + LDAP_CID=$(docker run --hostname ldap.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.1.11) LDAP_IP=$(docker inspect -f "{{ .NetworkSettings.IPAddress }}" $LDAP_CID) #Create the second ldap server, save the container id in LDAP2_CID and get its IP: - LDAP2_CID=$(docker run --hostname ldap2.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.1.10) + LDAP2_CID=$(docker run --hostname ldap2.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.1.11) LDAP2_IP=$(docker inspect -f "{{ .NetworkSettings.IPAddress }}" $LDAP2_CID) #Add the pair "ip hostname" to /etc/hosts on each containers, @@ -235,7 +241,7 @@ You may have some problems with mounted files on some systems. The startup scrip To fix that run the container with `--copy-service` argument : - docker run [your options] osixia/openldap:1.1.10 --copy-service + docker run [your options] osixia/openldap:1.1.11 --copy-service ### Debug @@ -244,11 +250,11 @@ Available levels are: `none`, `error`, `warning`, `info`, `debug` and `trace`. Example command to run the container in `debug` mode: - docker run --detach osixia/openldap:1.1.10 --loglevel debug + docker run --detach osixia/openldap:1.1.11 --loglevel debug See all command line options: - docker run osixia/openldap:1.1.10 --help + docker run osixia/openldap:1.1.11 --help ## Environment Variables @@ -313,7 +319,7 @@ Replication options: If you want to set this variable at docker run command add the tag `#PYTHON2BASH:` and convert the yaml in python: - docker run --env LDAP_REPLICATION_HOSTS="#PYTHON2BASH:['ldap://ldap.example.org','ldap://ldap2.example.org']" --detach osixia/openldap:1.1.10 + docker run --env LDAP_REPLICATION_HOSTS="#PYTHON2BASH:['ldap://ldap.example.org','ldap://ldap2.example.org']" --detach osixia/openldap:1.1.11 To convert yaml to python online: http://yaml-online-parser.appspot.com/ @@ -333,7 +339,7 @@ Other environment variables: Environment variables can be set by adding the --env argument in the command line, for example: docker run --env LDAP_ORGANISATION="My company" --env LDAP_DOMAIN="my-company.com" \ - --env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.1.10 + --env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.1.11 Be aware that environment variable added in command line will be available at any time in the container. In this example if someone manage to open a terminal in this container @@ -344,14 +350,14 @@ he will be able to read the admin password in clear text from environment variab For example if your environment files **my-env.yaml** and **my-env.startup.yaml** are in /data/ldap/environment docker run --volume /data/ldap/environment:/container/environment/01-custom \ - --detach osixia/openldap:1.1.10 + --detach osixia/openldap:1.1.11 Take care to link your environment files folder to `/container/environment/XX-somedir` (with XX < 99 so they will be processed before default environment files) and not directly to `/container/environment` because this directory contains predefined baseimage environment files to fix container environment (INITRD, LANG, LANGUAGE and LC_CTYPE). Note: the container will try to delete the **\*.startup.yaml** file after the end of startup files so the file will also be deleted on the docker host. To prevent that : use --volume /data/ldap/environment:/container/environment/01-custom**:ro** or set all variables in **\*.yaml** file and don't use **\*.startup.yaml**: docker run --volume /data/ldap/environment/my-env.yaml:/container/environment/01-custom/env.yaml \ - --detach osixia/openldap:1.1.10 + --detach osixia/openldap:1.1.11 #### Make your own image or extend this image @@ -359,13 +365,13 @@ This is the best solution if you have a private registry. Please refer to the [A ## Advanced User Guide -### Extend osixia/openldap:1.1.10 image +### Extend osixia/openldap:1.1.11 image If you need to add your custom TLS certificate, bootstrap config or environment files the easiest way is to extends this image. Dockerfile example: - FROM osixia/openldap:1.1.10 + FROM osixia/openldap:1.1.11 MAINTAINER Your Name ADD bootstrap /container/service/slapd/assets/config/bootstrap @@ -435,6 +441,11 @@ It uses the following features: To fully understand how this image works take a look at: https://github.com/osixia/docker-light-baseimage +## Security +If you discover a security vulnerability within this docker image, please send an email to the Osixia! team at security@osixia.net. For minor vulnerabilities feel free to add an issue here on github. + +Please include as many details as possible. + ## Changelog Please refer to: [CHANGELOG.md](CHANGELOG.md) diff --git a/example/docker-compose.yml b/example/docker-compose.yml index f1406b00..95c7c059 100644 --- a/example/docker-compose.yml +++ b/example/docker-compose.yml @@ -1,7 +1,7 @@ version: '2' services: openldap: - image: osixia/openldap:1.1.10 + image: osixia/openldap:1.1.11 container_name: openldap environment: LDAP_LOG_LEVEL: "256" diff --git a/example/extend-osixia-openldap/Dockerfile b/example/extend-osixia-openldap/Dockerfile index 291756ba..55b8d0f9 100644 --- a/example/extend-osixia-openldap/Dockerfile +++ b/example/extend-osixia-openldap/Dockerfile @@ -1,4 +1,4 @@ -FROM osixia/openldap:1.1.10 +FROM osixia/openldap:1.1.11 MAINTAINER Your Name ADD bootstrap /container/service/slapd/assets/config/bootstrap diff --git a/example/kubernetes/simple/ldap-deployment.yaml b/example/kubernetes/simple/ldap-deployment.yaml index 8c1a3651..ffed1d31 100644 --- a/example/kubernetes/simple/ldap-deployment.yaml +++ b/example/kubernetes/simple/ldap-deployment.yaml @@ -13,7 +13,7 @@ spec: spec: containers: - name: ldap - image: osixia/openldap:1.1.10 + image: osixia/openldap:1.1.11 volumeMounts: - name: ldap-data mountPath: /var/lib/ldap diff --git a/example/kubernetes/using-secrets/ldap-deployment.yaml b/example/kubernetes/using-secrets/ldap-deployment.yaml index f14c7109..97283d50 100644 --- a/example/kubernetes/using-secrets/ldap-deployment.yaml +++ b/example/kubernetes/using-secrets/ldap-deployment.yaml @@ -13,7 +13,7 @@ spec: spec: containers: - name: ldap - image: osixia/openldap:1.1.10 + image: osixia/openldap:1.1.11 args: ["--copy-service"] volumeMounts: - name: ldap-data diff --git a/image/Dockerfile b/image/Dockerfile index 92b24254..627a6aaa 100644 --- a/image/Dockerfile +++ b/image/Dockerfile @@ -14,7 +14,7 @@ RUN if [ -z "${LDAP_OPENLDAP_GID}" ]; then groupadd -r openldap; else groupadd - # Install OpenLDAP, ldap-utils and ssl-tools from baseimage and clean apt-get files # sources: https://github.com/osixia/docker-light-baseimage/blob/stable/image/tool/add-service-available #  https://github.com/osixia/docker-light-baseimage/blob/stable/image/service-available/:ssl-tools/download.sh -RUN apt-get -y update \ +RUN echo "path-include /usr/share/doc/krb5*" >> /etc/dpkg/dpkg.cfg.d/docker && apt-get -y update \ && /container/tool/add-service-available :ssl-tools \ && LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \ ldap-utils \ @@ -26,6 +26,7 @@ RUN apt-get -y update \ libsasl2-modules-sql \ openssl \ slapd \ + krb5-kdc-ldap \ && apt-get clean \ && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* diff --git a/image/service/slapd/assets/config/bootstrap/ldif/custom/README.md b/image/service/slapd/assets/config/bootstrap/ldif/custom/README.md index d47a1d5d..d4688134 100644 --- a/image/service/slapd/assets/config/bootstrap/ldif/custom/README.md +++ b/image/service/slapd/assets/config/bootstrap/ldif/custom/README.md @@ -1,9 +1,14 @@ Add your custom ldif files here if you don't want to overwrite image default boostrap ldif. at run time you can also mount a data volume with your ldif files to /container/service/slapd/assets/config/bootstrap/ldif/custom -The startup script provide some substitution in bootstrap ldif files: -`{{LDAP_BASE_DN }}` and `{{ LDAP_BACKEND }}` values are supported. -Other `{{ * }}` substitution are left as is. +The startup script provides some substitutions in bootstrap ldif files. Following substitutions are supported: + +- `{{ LDAP_BASE_DN }}` +- `{{ LDAP_BACKEND }}` +- `{{ LDAP_READONLY_USER_USERNAME }}` +- `{{ LDAP_READONLY_USER_PASSWORD_ENCRYPTED }}` + +Other `{{ * }}` substitutions are left unchanged. Since startup script modifies `ldif` files, you **must** add `--copy-service` argument to entrypoint if you don't want to overwrite them. diff --git a/image/service/slapd/startup.sh b/image/service/slapd/startup.sh index 0d2c4928..0100b757 100755 --- a/image/service/slapd/startup.sh +++ b/image/service/slapd/startup.sh @@ -64,8 +64,13 @@ if [ ! -e "$FIRST_START_DONE" ]; then function ldap_add_or_modify (){ local LDIF_FILE=$1 + log-helper debug "Processing file ${LDIF_FILE}" sed -i "s|{{ LDAP_BASE_DN }}|${LDAP_BASE_DN}|g" $LDIF_FILE sed -i "s|{{ LDAP_BACKEND }}|${LDAP_BACKEND}|g" $LDIF_FILE + if [ "${LDAP_READONLY_USER,,}" == "true" ]; then + sed -i "s|{{ LDAP_READONLY_USER_USERNAME }}|${LDAP_READONLY_USER_USERNAME}|g" $LDIF_FILE + sed -i "s|{{ LDAP_READONLY_USER_PASSWORD_ENCRYPTED }}|${LDAP_READONLY_USER_PASSWORD_ENCRYPTED}|g" $LDIF_FILE + fi if grep -iq changetype $LDIF_FILE ; then ldapmodify -Y EXTERNAL -Q -H ldapi:/// -f $LDIF_FILE 2>&1 | log-helper debug || ldapmodify -h localhost -p 389 -D cn=admin,$LDAP_BASE_DN -w $LDAP_ADMIN_PASSWORD -f $LDIF_FILE 2>&1 | log-helper debug else @@ -82,7 +87,8 @@ if [ ! -e "$FIRST_START_DONE" ]; then # database and config directory are empty # setup bootstrap config - Part 1 # - if [ -z "$(ls -A -I lost+found /var/lib/ldap)" ] && [ -z "$(ls -A -I lost+found /etc/ldap/slapd.d)" ]; then + if [ -z "$(ls -A -I lost+found -I .rmtab -I .gitignore /var/lib/ldap)" ] && \ + [ -z "$(ls -A -I lost+found -I .rmtab -I .gitignore /etc/ldap/slapd.d)" ]; then BOOTSTRAP=true log-helper info "Database and config directory are empty..." @@ -127,14 +133,14 @@ EOF # # Error: the database directory (/var/lib/ldap) is empty but not the config directory (/etc/ldap/slapd.d) # - elif [ -z "$(ls -A -I lost+found /var/lib/ldap)" ] && [ ! -z "$(ls -A -I lost+found /etc/ldap/slapd.d)" ]; then + elif [ -z "$(ls -A -I lost+found -I .rmtab /var/lib/ldap)" ] && [ ! -z "$(ls -A -I lost+found -I .rmtab /etc/ldap/slapd.d)" ]; then log-helper error "Error: the database directory (/var/lib/ldap) is empty but not the config directory (/etc/ldap/slapd.d)" exit 1 # # Error: the config directory (/etc/ldap/slapd.d) is empty but not the database directory (/var/lib/ldap) # - elif [ ! -z "$(ls -A -I lost+found /var/lib/ldap)" ] && [ -z "$(ls -A -I lost+found /etc/ldap/slapd.d)" ]; then + elif [ ! -z "$(ls -A -I lost+found -I .rmtab /var/lib/ldap)" ] && [ -z "$(ls -A -I lost+found -I .rmtab /etc/ldap/slapd.d)" ]; then log-helper error "Error: the config directory (/etc/ldap/slapd.d) is empty but not the database directory (/var/lib/ldap)" exit 1 fi @@ -214,7 +220,7 @@ EOF ${CONTAINER_SERVICE_DIR}/slapd/assets/schema-to-ldif.sh "$SCHEMAS" # add converted schemas - for f in $(find ${CONTAINER_SERVICE_DIR}/slapd/assets/config/bootstrap/schema -name \*.ldif -type f); do + for f in $(find ${CONTAINER_SERVICE_DIR}/slapd/assets/config/bootstrap/schema -name \*.ldif -type f|sort); do log-helper debug "Processing file ${f}" # add schema if not already exists SCHEMA=$(basename "${f}" .ldif) @@ -241,34 +247,21 @@ EOF ldap_add_or_modify "$f" done - log-helper info "Add custom bootstrap ldif..." - for f in $(find ${CONTAINER_SERVICE_DIR}/slapd/assets/config/bootstrap/ldif/custom -type f -name \*.ldif | sort); do - log-helper debug "Processing file ${f}" - ldap_add_or_modify "$f" - done - # read only user if [ "${LDAP_READONLY_USER,,}" == "true" ]; then - log-helper info "Add read only user..." LDAP_READONLY_USER_PASSWORD_ENCRYPTED=$(slappasswd -s $LDAP_READONLY_USER_PASSWORD) - sed -i "s|{{ LDAP_READONLY_USER_USERNAME }}|${LDAP_READONLY_USER_USERNAME}|g" ${CONTAINER_SERVICE_DIR}/slapd/assets/config/bootstrap/ldif/readonly-user/readonly-user.ldif - sed -i "s|{{ LDAP_READONLY_USER_PASSWORD_ENCRYPTED }}|${LDAP_READONLY_USER_PASSWORD_ENCRYPTED}|g" ${CONTAINER_SERVICE_DIR}/slapd/assets/config/bootstrap/ldif/readonly-user/readonly-user.ldif - sed -i "s|{{ LDAP_BASE_DN }}|${LDAP_BASE_DN}|g" ${CONTAINER_SERVICE_DIR}/slapd/assets/config/bootstrap/ldif/readonly-user/readonly-user.ldif - sed -i "s|{{ LDAP_READONLY_USER_USERNAME }}|${LDAP_READONLY_USER_USERNAME}|g" ${CONTAINER_SERVICE_DIR}/slapd/assets/config/bootstrap/ldif/readonly-user/readonly-user-acl.ldif - sed -i "s|{{ LDAP_BASE_DN }}|${LDAP_BASE_DN}|g" ${CONTAINER_SERVICE_DIR}/slapd/assets/config/bootstrap/ldif/readonly-user/readonly-user-acl.ldif - - sed -i "s|{{ LDAP_BACKEND }}|${LDAP_BACKEND}|g" ${CONTAINER_SERVICE_DIR}/slapd/assets/config/bootstrap/ldif/readonly-user/readonly-user-acl.ldif - - log-helper debug "Processing file ${CONTAINER_SERVICE_DIR}/slapd/assets/config/bootstrap/ldif/readonly-user/readonly-user.ldif" - ldapmodify -h localhost -p 389 -D cn=admin,$LDAP_BASE_DN -w $LDAP_ADMIN_PASSWORD -f ${CONTAINER_SERVICE_DIR}/slapd/assets/config/bootstrap/ldif/readonly-user/readonly-user.ldif 2>&1 | log-helper debug + ldap_add_or_modify "${CONTAINER_SERVICE_DIR}/slapd/assets/config/bootstrap/ldif/readonly-user/readonly-user.ldif" + ldap_add_or_modify "${CONTAINER_SERVICE_DIR}/slapd/assets/config/bootstrap/ldif/readonly-user/readonly-user-acl.ldif" + fi - log-helper debug "Processing file ${CONTAINER_SERVICE_DIR}/slapd/assets/config/bootstrap/ldif/readonly-user/readonly-user-acl.ldif" - ldapmodify -Y EXTERNAL -Q -H ldapi:/// -f ${CONTAINER_SERVICE_DIR}/slapd/assets/config/bootstrap/ldif/readonly-user/readonly-user-acl.ldif 2>&1 | log-helper debug + log-helper info "Add custom bootstrap ldif..." + for f in $(find ${CONTAINER_SERVICE_DIR}/slapd/assets/config/bootstrap/ldif/custom -type f -name \*.ldif | sort); do + ldap_add_or_modify "$f" + done - fi fi #