dockamole/Readme.md

65 lines
3.7 KiB
Markdown
Raw Normal View History

2019-06-24 19:46:33 +00:00
# Dockamole
2019-06-24 19:49:50 +00:00
Example bridging connections across two distinct Docker networks using [`mole`](https://github.com/davrodpin/mole).
2019-06-24 19:46:33 +00:00
My real use case is something like a remote LDAP server that I don't want to expose to the public internet and some metrics servers only available behind a VPN. This setup will allow me to create a proxy container on a host that will act as a local LDAP or HTTP server.
2019-06-24 21:43:17 +00:00
Eg.
```
+----------+ +----------+ +----------+
| | | | | |
| | | Firewall | | |
| | | | | |
| Local | tunnel +----------+ tunnel | Remote |
| Computer |--------------------------------| SSH |
| | +----------+ | Server |
| | | | | |
| | | Firewall | | |
| | | | | |
+----------+ +----------+ +----------+
|
|
| tunnel
|
|
+----------+
| |
| |
| |
| |
| Remote |
| Service |
| |
| |
| |
+----------+
```
2019-06-24 19:46:33 +00:00
## Running
Requires you to provide your own ssh keys as well as provide the local machine IP address
2019-06-24 21:43:17 +00:00
Dockamole is configured using environment variables:
# Required
MOLE_LOCAL_? indexed local host and port
MOLE_REMOTE_? indexed remote host and port
MOLE_SERVER ssh server to connect to
# Optional
MAX_TUNNELS number of tunnels allowed (default 10)
SSH_KEY path to ssh private key that should be used (default ~/.ssh/id_rsa)
GEN_KNOWN_HOSTS determines if known hosts should be generated on first start (default 1)
## Use in production
2019-08-08 21:35:17 +00:00
This example provides a somewhat restricted sshd server as well. I would advise caution though as this is likely something that will have access to sensitive information.
2019-08-08 21:35:17 +00:00
The server should already be rejecting attempts at a getting a pty, but to be safe you should take precautions from someone logging into your server directly. In my example, I'm using the following as my `authorized_keys` file:
no-pty,no-X11-forwarding,command="/bin/echo do-not-send-commands" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDeG0iBsd5P9ZwDlav7mWaMGiq4SH5XvYGEGoZPgC3PjKgiEpe5lxH9p5lOFicqG7nNBaTwJwDPnJJaIIeHeCcpKF9f5RhTA5rwLkPcVIwZTh2GL7PD/yDmnsB1L8v04yTzjvJxHAi+xx+yN0fcxw2IOJ4k4FC1mNJKNwHZZHvzEyvRbC0GUB1K32dKSDUAWQHKx7xJqgtpkZ0DV78GzBfNUZcucImRwjQTBlJFumTjB5k0xUt0NRDLEkHwUMyiAeXB13tfjZipEHCWPxIrQnuwmV4Lb3VFbh8UqeObsarxG9t+SMoxnrKxQCAntcS0do1VjfiGr6usGVsV56ua8Tyj ifij@C02V7083HV2V
This prevents getting a shell if my key is ever leaked.
2019-08-08 21:35:17 +00:00
Additionally, if you are actually planning on doing this in production, take care when distributing or adding `authorized_keys` or `known_hosts`. By default, this client will auto generate a `known_hosts` file for servers it hasn't connected to before, but it'd be best to validate this yourself.