diff --git a/Dockerfile b/Dockerfile index 8daf0c1..803eefb 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,18 +1,18 @@ FROM php:7.0-apache -COPY www/ /opt/ldap_user_manager -COPY entrypoint /usr/local/bin/entrypoint - RUN apt-get update && apt-get install -y --no-install-recommends libldb-dev libldap2-dev && rm -rf /var/lib/apt/lists/* && ln -s /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/libldap.so \ && ln -s /usr/lib/x86_64-linux-gnu/liblber.so /usr/lib/liblber.so RUN docker-php-source extract && docker-php-ext-install -j$(nproc) ldap && docker-php-source delete -RUN chmod a+x /usr/local/bin/entrypoint RUN a2enmod rewrite ssl RUN a2dissite 000-default default-ssl EXPOSE 80 EXPOSE 443 +COPY www/ /opt/ldap_user_manager +COPY entrypoint /usr/local/bin/entrypoint +RUN chmod a+x /usr/local/bin/entrypoint + CMD ["apache2-foreground"] ENTRYPOINT ["/usr/local/bin/entrypoint"] diff --git a/README.md b/README.md index 18f365d..e6f8ee9 100644 --- a/README.md +++ b/README.md @@ -47,7 +47,7 @@ docker run \ -e "SERVER_HOSTNAME=lum.example.com" \ -e "LDAP_URI=ldap://ldap.example.com" \ -e "LDAP_BASE_DN=dc=example,dc=com" \ - -e "LDAP_STARTTLS=TRUE" \ + -e "LDAP_REQUIRE_STARTTLS=TRUE" \ -e "LDAP_ADMINS_GROUP=admins" \ -e "LDAP_ADMIN_BIND_DN=cn=admin,dc=example,dc=com" \ -e "LDAP_ADMIN_BIND_PWD=secret"\ @@ -78,6 +78,7 @@ Optional: ---- * `SERVER_HOSTNAME` (default: *example.com*): The hostname that this interface will be served from. +* `NO_HTTPS` (default: *FALSE*): If you set this to *TRUE* then the server will run in HTTP mode, without any encryption. This is insecure and should only be used for testing. * `LDAP_USER_OU` (default: *people*): The name of the OU used to store user accounts (without the base DN appended). @@ -85,8 +86,6 @@ Optional: * `LDAP_GROUP_MEMBERSHIP_ATTRIBUTE` (default: *uniqueMember*): The attribute used when adding a user to a group. * `LDAP_GROUP_MEMBERSHIP_USES_UID`(default: *FALSE*): If *TRUE* then the entry for a member of a group will be just the username. Otherwise it's the member's full DN. -* `LDAP_ACCOUNT_ATTRIBUTE` (default: *uid*): The attribute used to identify account usernames. - * `LDAP_REQUIRE_STARTTLS` (default: *TRUE*): If *TRUE* then a TLS connection is required for this interface to work. If set to *FALSE* then the interface will work without STARTTLS, but a warning will be displayed on the page. * `LDAP_TLS_CACERT` (no default): If you need to use a specific CA certificate for TLS connections to the LDAP server (when `LDAP_REQUIRE_STARTTLS` is set) then assign the contents of the CA certificate to this variable. e.g. `-e LDAP_TLS_CERT=$(/etc/apache2/sites-enabled/lum.conf - mkdir -p $ssl_dir - confout="${ssl_dir}/conf" - keyout="${ssl_dir}/server.key" - certout="${ssl_dir}/server.crt" - cakey="${ssl_dir}/ca.key" - cacert="${ssl_dir}/ca.crt" - serialfile="${ssl_dir}/serial" + - echo "Generating CA key" - openssl genrsa -out $cakey 2048 - if [ $? -ne 0 ]; then exit 1 ; fi + ServerName $SERVER_HOSTNAME + DocumentRoot /opt/ldap_user_manager - echo "Generating CA certificate" - openssl req \ - -x509 \ - -new \ - -nodes \ - -subj "/C=GB/ST=GB/L=GB/O=CA/OU=CA/CN=Wheelybird" \ - -key $cakey \ - -sha256 \ - -days 7300 \ - -out $cacert - if [ $? -ne 0 ]; then exit 1 ; fi + DirectoryIndex index.php index.html - echo "Generating openssl configuration" + + Require all granted + - cat <$confout + +EoHTTPC + + +else + + ######################## + #If there aren't any SSL certs then create a CA and then CA-signed certificate + + if [ ! -f "${ssl_dir}/server.key" ] && [ ! -f "${ssl_dir}/server.crt" ]; then + + mkdir -p $ssl_dir + confout="${ssl_dir}/conf" + keyout="${ssl_dir}/server.key" + certout="${ssl_dir}/server.crt" + cakey="${ssl_dir}/ca.key" + cacert="${ssl_dir}/ca.crt" + serialfile="${ssl_dir}/serial" + + echo "Generating CA key" + openssl genrsa -out $cakey 2048 + if [ $? -ne 0 ]; then exit 1 ; fi + + echo "Generating CA certificate" + openssl req \ + -x509 \ + -new \ + -nodes \ + -subj "/C=GB/ST=GB/L=GB/O=CA/OU=CA/CN=Wheelybird" \ + -key $cakey \ + -sha256 \ + -days 7300 \ + -out $cacert + if [ $? -ne 0 ]; then exit 1 ; fi + + echo "Generating openssl configuration" + + cat <$confout subjectAltName = DNS:${SERVER_HOSTNAME},IP:127.0.0.1 extendedKeyUsage = serverAuth EoCertConf - echo "Generating server key..." - openssl genrsa -out $keyout 2048 - if [ $? -ne 0 ]; then exit 1 ; fi + echo "Generating server key..." + openssl genrsa -out $keyout 2048 + if [ $? -ne 0 ]; then exit 1 ; fi - echo "Generating server signing request..." - openssl req \ - -subj "/CN=${SERVER_HOSTNAME}" \ - -sha256 \ - -new \ - -key $keyout \ - -out /tmp/server.csr - if [ $? -ne 0 ]; then exit 1 ; fi + echo "Generating server signing request..." + openssl req \ + -subj "/CN=${SERVER_HOSTNAME}" \ + -sha256 \ + -new \ + -key $keyout \ + -out /tmp/server.csr + if [ $? -ne 0 ]; then exit 1 ; fi - echo "Generating server cert..." - openssl x509 \ - -req \ - -days 7300 \ - -sha256 \ - -in /tmp/server.csr \ - -CA $cacert \ - -CAkey $cakey \ - -CAcreateserial \ - -CAserial $serialfile \ - -out $certout \ - -extfile $confout - if [ $? -ne 0 ]; then exit 1 ; fi + echo "Generating server cert..." + openssl x509 \ + -req \ + -days 7300 \ + -sha256 \ + -in /tmp/server.csr \ + -CA $cacert \ + -CAkey $cakey \ + -CAcreateserial \ + -CAserial $serialfile \ + -out $certout \ + -extfile $confout + if [ $? -ne 0 ]; then exit 1 ; fi -fi + fi -######################## -#Create Apache config + ######################## + #Create Apache config + if [ -f "/opt/tls/chain.pem" ]; then $ssl_chain="SSLCertificateChainFile /opt/tls/chain.pem"; fi -if [ -f "/opt/tls/chain.pem" ]; then $ssl_chain="SSLCertificateChainFile /opt/tls/chain.pem"; fi - -cat </etc/apache2/sites-enabled/lum.conf + cat </etc/apache2/sites-enabled/lum.conf Listen 443 @@ -114,11 +133,10 @@ Listen 443 SSLCertificateKeyFile /opt/ssl/server.key $ssl_chain - php_value include_path "/opt/ldap_user_manager/includes" - -EoC +EoHTTPSC +fi ######################## #Run Apache diff --git a/www/account_manager/groups.php b/www/account_manager/groups.php index 3d4671f..158c903 100644 --- a/www/account_manager/groups.php +++ b/www/account_manager/groups.php @@ -1,8 +1,10 @@