服務(wù)器
前言
之前開啟了docker的2375 remote api，接到公司安全部門的要求，需要啟用授權(quán)，翻了下官方文檔
protect the docker daemon socket
啟用tls
在docker服務(wù)器，生成ca私有和公共密鑰
$ openssl genrsa -aes256 -out ca-key.pem 4096generating rsa private key, 4096 bit long modulus............................................................................................................................................................................................ ........ e is 65537 (0x10001)enter pass phrase for ca-key.pem:verifying - enter pass phrase for ca-key.pem:$ openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pementer pass phrase for ca-key.pem:you are about to be asked to enter information that will be incorporatedinto your certificate request.what you are about to enter is what is called a distinguished name or a dn.there are quite a few fields but you can leave some blankfor some fields there will be a default value,if you enter \\\'.\\\', the field will be left blank.-----country name (2 letter code) [au]:state or province name (full name) [some-state]:queenslandlocality name (eg, city) []:brisbaneorganization name (eg, company) [internet widgits pty ltd]:docker incorganizational unit name (eg, section) []:salescommon name (e.g. server fqdn or your name) []:$hostemail address []:sven@home.org.au有了ca后，可以創(chuàng)建一個(gè)服務(wù)器密鑰和證書簽名請(qǐng)求(csr)
$host 是你的服務(wù)器ip
$ openssl genrsa -out server-key.pem 4096generating rsa private key, 4096 bit long modulus..................................................................... ................................................................................................. e is 65537 (0x10001)$ openssl req -subj /cn=$host -sha256 -new -key server-key.pem -out server.csr接著，用ca來(lái)簽署公共密鑰:
$ echo subjectaltname = dns:$host,ip:$host:127.0.0.1 >> extfile.cnf $ echo extendedkeyusage = serverauth >> extfile.cnf生成key：
$ openssl x509 -req -days 365 -sha256 -in server.csr -ca ca.pem -cakey ca-key.pem \\\\ -cacreateserial -out server-cert.pem -extfile extfile.cnfsignature oksubject=/cn=your.host.comgetting ca private keyenter pass phrase for ca-key.pem:創(chuàng)建客戶端密鑰和證書簽名請(qǐng)求:
$ openssl genrsa -out key.pem 4096generating rsa private key, 4096 bit long modulus......................................................... ................ e is 65537 (0x10001)$ openssl req -subj \\\'/cn=client\\\' -new -key key.pem -out client.csr修改extfile.cnf：
echo extendedkeyusage = clientauth > extfile-client.cnf生成簽名私鑰：
$ openssl x509 -req -days 365 -sha256 -in client.csr -ca ca.pem -cakey ca-key.pem \\\\ -cacreateserial -out cert.pem -extfile extfile-client.cnfsignature oksubject=/cn=clientgetting ca private keyenter pass phrase for ca-key.pem:將docker服務(wù)停止，然后修改docker服務(wù)文件
[unit]description=docker application container enginedocumentation=http://docs.docker.io[service]environment=path=/opt/kube/bin:/bin:/sbin:/usr/bin:/usr/sbinexecstart=/opt/kube/bin/dockerd --tlsverify --tlscacert=/root/docker/ca.pem --tlscert=/root/docker/server-cert.pem --tlskey=/root/docker/server-key.pem -h unix:///var/run/docker.sock -h tcp://0.0.0.0:2375execstartpost=/sbin/iptables -i forward -s 0.0.0.0/0 -j acceptexecreload=/bin/kill -s hup $mainpidrestart=on-failurerestartsec=5limitnofile=infinitylimitnproc=infinitylimitcore=infinitydelegate=yeskillmode=process[install]wantedby=multi-user.target然后重啟服務(wù)
systemctl daemon-reloadsystemctl restart docker.service 重啟后查看服務(wù)狀態(tài)：
systemctl status docker.service● docker.service - docker application container engine loaded: loaded (/etc/systemd/system/docker.service; enabled; vendor preset: enabled) active: active (running) since thu 2019-08-08 19:22:26 cst; 1 min ago已經(jīng)生效。
使用證書連接：
復(fù)制ca.pem,cert.pem,key.pem三個(gè)文件到客戶端
docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -h=$host:2375 version連接即可docker-java 啟用tls
項(xiàng)目里使用docker的java客戶端docker-java調(diào)用docker，為了支持tls，在創(chuàng)建客戶端時(shí)，需要增加tls設(shè)置。
首先將ca.pem cert.pem key.pem這三個(gè)文件拷貝到本地，例如e:\\\\\\\\docker\\\\\\\\,
然后defaultdockerclientconfig里wi

如何讓網(wǎng)站的圖片快速加載？
云服務(wù)器秒殺活動(dòng)必看
擁有30萬(wàn)粉絲的“網(wǎng)紅狗”，被科學(xué)家克隆49次，刷新世界紀(jì)錄
以太網(wǎng)幀格式是什么？
上海ecs云服務(wù)器安裝虛擬機(jī)
做SEO優(yōu)化一定要堅(jiān)持做高質(zhì)量?jī)?nèi)容
整機(jī)和云服務(wù)器有什么區(qū)別
43891云服務(wù)器實(shí)惠