From a694c6a30bdee77956a607aa45ea02c5ab0817a6 Mon Sep 17 00:00:00 2001 From: John McCabe Date: Tue, 31 Jan 2017 05:38:35 +0000 Subject: [PATCH 1/6] tidy image build steps Prior to this commit following the `make`/`make install` steps would fail due to the `pinata-build-sshd.sh` attempting to cd to `/usr/local/share/pinata-ssh-agent` directory before it had been created by `make install`. This commit builds the image in the workspace directory, removes the unused `ssh-build.sh` and tidies the Makefile accordingly. --- Makefile | 5 ----- pinata-build-sshd.sh | 2 -- ssh-build.sh | 5 ----- 3 files changed, 12 deletions(-) delete mode 100755 ssh-build.sh diff --git a/Makefile b/Makefile index 49c0488..07eec7e 100644 --- a/Makefile +++ b/Makefile @@ -7,11 +7,6 @@ BINDIR ?= $(PREFIX)/bin install: @if [ ! -d "$(PREFIX)" ]; then echo Error: need a $(PREFIX) directory; exit 1; fi - @mkdir -p $(PREFIX)/share/pinata-ssh-agent - cp Dockerfile $(PREFIX)/share/pinata-ssh-agent - cp ssh-build.sh $(PREFIX)/share/pinata-ssh-agent/ssh-build - cp ssh-find-agent.sh $(PREFIX)/share/pinata-ssh-agent/ssh-find-agent.sh @mkdir -p $(BINDIR) - cp pinata-build-sshd.sh $(BINDIR)/pinata-build-sshd cp pinata-ssh-forward.sh $(BINDIR)/pinata-ssh-forward cp pinata-ssh-mount.sh $(BINDIR)/pinata-ssh-mount diff --git a/pinata-build-sshd.sh b/pinata-build-sshd.sh index 23e9a85..b1df031 100755 --- a/pinata-build-sshd.sh +++ b/pinata-build-sshd.sh @@ -1,4 +1,2 @@ #!/bin/sh - -cd /usr/local/share/pinata-ssh-agent docker build -t pinata-sshd . diff --git a/ssh-build.sh b/ssh-build.sh deleted file mode 100755 index 4a65084..0000000 --- a/ssh-build.sh +++ /dev/null @@ -1,5 +0,0 @@ -#!/bin/sh - -IMAGE_NAME=pinata-sshd - -docker build -q -t ${IMAGE_NAME} . From 3029d7049a9f6895243c8d761d317822622d1e9f Mon Sep 17 00:00:00 2001 From: Jaeho Shin Date: Tue, 24 Jan 2017 06:42:20 -0800 Subject: [PATCH 2/6] Ensures ssh uses no connection sharing (`-S none`) --- pinata-ssh-forward.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pinata-ssh-forward.sh b/pinata-ssh-forward.sh index 4b236d4..9f9a738 100755 --- a/pinata-ssh-forward.sh +++ b/pinata-ssh-forward.sh @@ -18,7 +18,7 @@ IP=`docker inspect --format '{{(index (index .NetworkSettings.Ports "22/tcp") 0) ssh-keyscan -p ${LOCAL_PORT} ${IP} > ${LOCAL_STATE}/known_hosts 2>/dev/null ssh -f -o "UserKnownHostsFile=${LOCAL_STATE}/known_hosts" \ - -A -p ${LOCAL_PORT} root@${IP} \ + -A -S none -p ${LOCAL_PORT} root@${IP} \ /root/ssh-find-agent.sh echo 'Agent forwarding successfully started.' From 5a81029d352d93f5da3c49a13d576bc2628038b8 Mon Sep 17 00:00:00 2001 From: Jaeho Shin Date: Tue, 24 Jan 2017 06:42:04 -0800 Subject: [PATCH 3/6] Fixes tini path --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 09e82d4..8bf3f66 100644 --- a/Dockerfile +++ b/Dockerfile @@ -8,5 +8,5 @@ RUN mkdir /root/.ssh && \ COPY ssh-find-agent.sh /root/ssh-find-agent.sh EXPOSE 22 VOLUME ["/root/.ssh/authorized_keys"] -ENTRYPOINT ["/usr/bin/tini","--"] +ENTRYPOINT ["/sbin/tini","--"] CMD ["/usr/sbin/sshd","-D"] From a6835b15edef009e9e2718c44dd70c49e41de1e4 Mon Sep 17 00:00:00 2001 From: John McCabe Date: Tue, 31 Jan 2017 05:47:22 +0000 Subject: [PATCH 4/6] Set ownership of authorized_hosts to root Prior to this commit the mapped public key to authorized hosts would inherit the uid/gid from the OSX host, this commit sets the ownership back to root in the container before starting sshd. --- Dockerfile | 3 ++- docker-entrypoint.sh | 4 ++++ 2 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 docker-entrypoint.sh diff --git a/Dockerfile b/Dockerfile index 8bf3f66..0c3d252 100644 --- a/Dockerfile +++ b/Dockerfile @@ -6,7 +6,8 @@ RUN mkdir /root/.ssh && \ chmod 700 /root/.ssh && \ ssh-keygen -A COPY ssh-find-agent.sh /root/ssh-find-agent.sh +COPY docker-entrypoint.sh / EXPOSE 22 VOLUME ["/root/.ssh/authorized_keys"] -ENTRYPOINT ["/sbin/tini","--"] +ENTRYPOINT ["/sbin/tini", "--", "/docker-entrypoint.sh"] CMD ["/usr/sbin/sshd","-D"] diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh new file mode 100644 index 0000000..a55c765 --- /dev/null +++ b/docker-entrypoint.sh @@ -0,0 +1,4 @@ +#!/bin/sh +set -e +chown root:root /root/.ssh/authorized_keys +exec "$@" \ No newline at end of file From 196c441493e70d0528da773735186f3944ad8880 Mon Sep 17 00:00:00 2001 From: John McCabe Date: Tue, 31 Jan 2017 05:50:10 +0000 Subject: [PATCH 5/6] add uninstall recipe to makefile This commit adds an uninstall recipe for the scripts installed to /usr/local/bin. ``` make uninstall ``` --- Makefile | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/Makefile b/Makefile index 07eec7e..4a7164c 100644 --- a/Makefile +++ b/Makefile @@ -10,3 +10,8 @@ install: @mkdir -p $(BINDIR) cp pinata-ssh-forward.sh $(BINDIR)/pinata-ssh-forward cp pinata-ssh-mount.sh $(BINDIR)/pinata-ssh-mount + +uninstall: + @if [ ! -d "$(BINDIR)" ]; then echo Error: $(BINDIR) directory does not exist; exit 1; fi + rm $(BINDIR)/pinata-ssh-forward + rm $(BINDIR)/pinata-ssh-mount \ No newline at end of file From 0036ed2d161e57275c76c2b95a84d5415d6645d7 Mon Sep 17 00:00:00 2001 From: John McCabe Date: Tue, 31 Jan 2017 05:54:01 +0000 Subject: [PATCH 6/6] make docker-entrypoint.sh executable --- docker-entrypoint.sh | 0 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100644 => 100755 docker-entrypoint.sh diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh old mode 100644 new mode 100755