{"id":988,"date":"2024-04-26T14:10:00","date_gmt":"2024-04-26T06:10:00","guid":{"rendered":"https:\/\/www.dd-home.top\/?p=988"},"modified":"2024-04-26T14:10:00","modified_gmt":"2024-04-26T06:10:00","slug":"ubuntu-%e4%b8%8bdocker%e5%bc%80%e5%90%afssl","status":"publish","type":"post","link":"https:\/\/www.dd-home.top\/?p=988","title":{"rendered":"Ubuntu \u4e0bdocker\u5f00\u542fssl"},"content":{"rendered":"<p><!--more--><\/p>\n<p>\u6587\u4ef6\u4fdd\u5b58\u6210.sh \u53ef\u4ee5\u5728ubuntu\u4e2d\u901a\u8fc7bash xxx.sh\u6267\u884c\u3002<\/p>\n<pre class=\"md-fences md-end-block ty-contain-cm modeLoaded\" lang=\"shell\" spellcheck=\"false\"><span role=\"presentation\"><span class=\"cm-meta\">#!\/bin\/sh<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-def\">ip<\/span><span class=\"cm-operator\">=xx.xx.xx.xx<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-def\">password<\/span><span class=\"cm-operator\">=<\/span>Aa654321 \u00a0<span class=\"cm-comment\"># 3\u4e2a\u5b57\u8282\u4ee5\u4e0a\uff0c\u4e0d\u7136\u751f\u6210\u6587\u4ef6\u6570\u4e0d\u5bf9<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-def\">dir<\/span><span class=\"cm-operator\">=<\/span>\/etc\/docker\/tls <span class=\"cm-comment\"># \u8bc1\u4e66\u751f\u6210\u4f4d\u7f6e<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-def\">validity_period<\/span><span class=\"cm-operator\">=<\/span><span class=\"cm-number\">3650<\/span> \u00a0 \u00a0<span class=\"cm-comment\"># \u8bc1\u4e66\u6709\u6548\u671f10\u5e74<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-def\">COUNTRY<\/span><span class=\"cm-operator\">=<\/span><span class=\"cm-string\">\"CN\"<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-def\">STATE<\/span><span class=\"cm-operator\">=<\/span><span class=\"cm-string\">\"\"<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-def\">CITY<\/span><span class=\"cm-operator\">=<\/span><span class=\"cm-string\">\"\"<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-def\">ORGANIZATION<\/span><span class=\"cm-operator\">=<\/span><span class=\"cm-string\">\"\"<\/span><\/span>\r\n \r\n<span role=\"presentation\"><span class=\"cm-comment\"># \u5c06\u6b64shell\u811a\u672c\u5728\u5b89\u88c5docker\u7684\u673a\u5668\u4e0a\u6267\u884c\uff0c\u4f5c\u7528\u662f\u751f\u6210docker\u8fdc\u7a0b\u8fde\u63a5\u52a0\u5bc6\u8bc1\u4e66<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-keyword\">if<\/span> [ ! <span class=\"cm-attribute\">-d<\/span> <span class=\"cm-string\">\"<\/span><span class=\"cm-def\">$dir<\/span><span class=\"cm-string\">\"<\/span> ]; <span class=\"cm-keyword\">then<\/span><\/span>\r\n<span role=\"presentation\"> \u00a0<span class=\"cm-builtin\">echo<\/span> <span class=\"cm-string\">\"\"<\/span><\/span>\r\n<span role=\"presentation\"> \u00a0<span class=\"cm-builtin\">echo<\/span> <span class=\"cm-string\">\"<\/span><span class=\"cm-def\">$dir<\/span><span class=\"cm-string\"> , not dir , will create\"<\/span><\/span>\r\n<span role=\"presentation\"> \u00a0<span class=\"cm-builtin\">echo<\/span> <span class=\"cm-string\">\"\"<\/span><\/span>\r\n<span role=\"presentation\"> \u00a0<span class=\"cm-builtin\">mkdir<\/span> <span class=\"cm-attribute\">-p<\/span> <span class=\"cm-def\">$dir<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-keyword\">else<\/span><\/span>\r\n<span role=\"presentation\"> \u00a0<span class=\"cm-builtin\">echo<\/span> <span class=\"cm-string\">\"\"<\/span><\/span>\r\n<span role=\"presentation\"> \u00a0<span class=\"cm-builtin\">echo<\/span> <span class=\"cm-string\">\"<\/span><span class=\"cm-def\">$dir<\/span><span class=\"cm-string\"> , dir exist , will delete and create\"<\/span><\/span>\r\n<span role=\"presentation\"> \u00a0<span class=\"cm-builtin\">echo<\/span> <span class=\"cm-string\">\"\"<\/span><\/span>\r\n<span role=\"presentation\"> \u00a0<span class=\"cm-builtin\">rm<\/span> <span class=\"cm-attribute\">-rf<\/span> <span class=\"cm-def\">$dir<\/span><\/span>\r\n<span role=\"presentation\"> \u00a0<span class=\"cm-builtin\">mkdir<\/span> <span class=\"cm-attribute\">-p<\/span> <span class=\"cm-def\">$dir<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-keyword\">fi<\/span><\/span>\r\n \r\n<span role=\"presentation\"><span class=\"cm-builtin\">cd<\/span> <span class=\"cm-def\">$dir<\/span> || <span class=\"cm-keyword\">exit<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-comment\"># \u521b\u5efa\u6839\u8bc1\u4e66RSA\u79c1\u94a5<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-builtin\">openssl<\/span> genrsa <span class=\"cm-attribute\">-aes256<\/span> <span class=\"cm-attribute\">-passout<\/span> pass:<span class=\"cm-string\">\"<\/span><span class=\"cm-def\">$password<\/span><span class=\"cm-string\">\"<\/span> <span class=\"cm-attribute\">-out<\/span> ca-key.pem <span class=\"cm-number\">4096<\/span><\/span>\r\n<span role=\"presentation\">\u200b<\/span>\r\n<span role=\"presentation\"><span class=\"cm-comment\"># \u521b\u5efaCA\u8bc1\u4e66<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-builtin\">openssl<\/span> req <span class=\"cm-attribute\">-new<\/span> <span class=\"cm-attribute\">-x509<\/span> <span class=\"cm-attribute\">-days<\/span> <span class=\"cm-def\">$validity_period<\/span> <span class=\"cm-attribute\">-key<\/span> ca-key.pem <span class=\"cm-attribute\">-passin<\/span> pass:<span class=\"cm-string\">\"<\/span><span class=\"cm-def\">$password<\/span><span class=\"cm-string\">\"<\/span> <span class=\"cm-attribute\">-sha256<\/span> <span class=\"cm-attribute\">-out<\/span> ca.pem <span class=\"cm-attribute\">-subj<\/span> <span class=\"cm-string\">\"\/C=<\/span><span class=\"cm-def\">$COUNTRY<\/span><span class=\"cm-string\">\/ST=<\/span><span class=\"cm-def\">$STATE<\/span><span class=\"cm-string\">\/L=<\/span><span class=\"cm-def\">$CITY<\/span><span class=\"cm-string\">\/O=<\/span><span class=\"cm-def\">$ORGANIZATION<\/span><span class=\"cm-string\">\/CN=<\/span><span class=\"cm-def\">$ip<\/span><span class=\"cm-string\">\"<\/span><\/span>\r\n<span role=\"presentation\">\u200b<\/span>\r\n<span role=\"presentation\"><span class=\"cm-comment\"># \u521b\u5efa\u670d\u52a1\u7aef\u79c1\u94a5<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-builtin\">openssl<\/span> genrsa <span class=\"cm-attribute\">-out<\/span> server-key.pem <span class=\"cm-number\">4096<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-comment\"># \u521b\u5efa\u670d\u52a1\u7aef\u7b7e\u540d\u8bf7\u6c42\u8bc1\u4e66\u6587\u4ef6<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-builtin\">openssl<\/span> req <span class=\"cm-attribute\">-subj<\/span> <span class=\"cm-string\">\"\/CN=<\/span><span class=\"cm-def\">$ip<\/span><span class=\"cm-string\">\"<\/span> <span class=\"cm-attribute\">-sha256<\/span> <span class=\"cm-attribute\">-new<\/span> <span class=\"cm-attribute\">-key<\/span> server-key.pem <span class=\"cm-attribute\">-out<\/span> server.csr<\/span>\r\n \r\n<span role=\"presentation\"><span class=\"cm-builtin\">echo<\/span> subjectAltName <span class=\"cm-operator\">=<\/span> IP:<span class=\"cm-def\">$ip<\/span>,IP:0.0.0.0 &gt;&gt;extfile.cnf<\/span>\r\n<span role=\"presentation\"><span class=\"cm-builtin\">echo<\/span> extendedKeyUsage <span class=\"cm-operator\">=<\/span> serverAuth &gt;&gt;extfile.cnf<\/span>\r\n<span role=\"presentation\">\u200b<\/span>\r\n<span role=\"presentation\"><span class=\"cm-comment\"># \u521b\u5efa\u7b7e\u540d\u751f\u6548\u7684\u670d\u52a1\u7aef\u8bc1\u4e66\u6587\u4ef6<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-builtin\">openssl<\/span> x509 <span class=\"cm-attribute\">-req<\/span> <span class=\"cm-attribute\">-days<\/span> <span class=\"cm-def\">$validity_period<\/span> <span class=\"cm-attribute\">-sha256<\/span> <span class=\"cm-attribute\">-in<\/span> server.csr <span class=\"cm-attribute\">-CA<\/span> ca.pem <span class=\"cm-attribute\">-CAkey<\/span> ca-key.pem <span class=\"cm-attribute\">-passin<\/span> <span class=\"cm-string\">\"pass:<\/span><span class=\"cm-def\">$password<\/span><span class=\"cm-string\">\"<\/span> <span class=\"cm-attribute\">-CAcreateserial<\/span> <span class=\"cm-attribute\">-out<\/span> server-cert.pem <span class=\"cm-attribute\">-extfile<\/span> extfile.cnf<\/span>\r\n<span role=\"presentation\">\u200b<\/span>\r\n<span role=\"presentation\"><span class=\"cm-comment\"># --------------------------------------------------------------------------------<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-comment\"># --------------------------------------------------------------------------------<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-comment\"># --------------------------------------------------------------------------------<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-comment\"># --------------------------------------------------------------------------------<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-comment\"># \u521b\u5efa\u5ba2\u6237\u7aef\u79c1\u94a5<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-builtin\">openssl<\/span> genrsa <span class=\"cm-attribute\">-out<\/span> key.pem <span class=\"cm-number\">4096<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-comment\"># \u521b\u5efa\u5ba2\u6237\u7aef\u7b7e\u540d\u8bf7\u6c42\u8bc1\u4e66\u6587\u4ef6<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-builtin\">openssl<\/span> req <span class=\"cm-attribute\">-subj<\/span> <span class=\"cm-string\">'\/CN=client'<\/span> <span class=\"cm-attribute\">-sha256<\/span> <span class=\"cm-attribute\">-new<\/span> <span class=\"cm-attribute\">-key<\/span> key.pem <span class=\"cm-attribute\">-out<\/span> client.csr<\/span>\r\n \r\n<span role=\"presentation\"><span class=\"cm-builtin\">echo<\/span> extendedKeyUsage <span class=\"cm-operator\">=<\/span> clientAuth &gt;extfile-client.cnf<\/span>\r\n<span role=\"presentation\">\u200b<\/span>\r\n<span role=\"presentation\"><span class=\"cm-comment\"># \u521b\u5efa\u7b7e\u540d\u751f\u6548\u7684\u5ba2\u6237\u7aef\u8bc1\u4e66\u6587\u4ef6<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-builtin\">openssl<\/span> x509 <span class=\"cm-attribute\">-req<\/span> <span class=\"cm-attribute\">-days<\/span> <span class=\"cm-def\">$validity_period<\/span> <span class=\"cm-attribute\">-sha256<\/span> <span class=\"cm-attribute\">-in<\/span> client.csr <span class=\"cm-attribute\">-CA<\/span> ca.pem <span class=\"cm-attribute\">-CAkey<\/span> ca-key.pem <span class=\"cm-attribute\">-passin<\/span> <span class=\"cm-string\">\"pass:<\/span><span class=\"cm-def\">$password<\/span><span class=\"cm-string\">\"<\/span> <span class=\"cm-attribute\">-CAcreateserial<\/span> <span class=\"cm-attribute\">-out<\/span> cert.pem <span class=\"cm-attribute\">-extfile<\/span> extfile-client.cnf<\/span>\r\n<span role=\"presentation\"><span class=\"cm-comment\"># \u5220\u9664\u591a\u4f59\u6587\u4ef6<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-builtin\">rm<\/span> <span class=\"cm-attribute\">-f<\/span> <span class=\"cm-attribute\">-v<\/span> client.csr server.csr extfile.cnf extfile-client.cnf<\/span>\r\n \r\n<span role=\"presentation\"><span class=\"cm-builtin\">chmod<\/span> <span class=\"cm-attribute\">-v<\/span> <span class=\"cm-number\">0400<\/span> ca-key.pem key.pem server-key.pem<\/span>\r\n \r\n<span role=\"presentation\"><span class=\"cm-builtin\">chmod<\/span> <span class=\"cm-attribute\">-v<\/span> <span class=\"cm-number\">0444<\/span> ca.pem server-cert.pem cert.pem<\/span>\r\n<span role=\"presentation\">\u200b<\/span>\r\n<span role=\"presentation\">\u200b<\/span>\r\n<span role=\"presentation\"><span class=\"cm-comment\">########## \u914d\u7f6e Docker \u5b88\u62a4\u8fdb\u7a0b ##########<\/span><\/span>\r\n<span role=\"presentation\">\u200b<\/span>\r\n<span role=\"presentation\"><span class=\"cm-builtin\">echo<\/span> <span class=\"cm-string\">\"Configuring Docker daemon...\"<\/span><\/span>\r\n<span role=\"presentation\">\u200b<\/span>\r\n<span role=\"presentation\"><span class=\"cm-comment\"># \u5907\u4efd Docker \u914d\u7f6e\u6587\u4ef6<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-def\">DOCKER_SERVICE_FILE<\/span><span class=\"cm-operator\">=<\/span><span class=\"cm-string\">\"\/usr\/lib\/systemd\/system\/docker.service\"<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-def\">DOCKER_SERVICE_BACKUP<\/span><span class=\"cm-operator\">=<\/span><span class=\"cm-string\">\"\/usr\/lib\/systemd\/system\/docker.service.bak\"<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-builtin\">cp<\/span> <span class=\"cm-string\">\"<\/span><span class=\"cm-def\">$DOCKER_SERVICE_FILE<\/span><span class=\"cm-string\">\"<\/span> <span class=\"cm-string\">\"<\/span><span class=\"cm-def\">$DOCKER_SERVICE_BACKUP<\/span><span class=\"cm-string\">\"<\/span><\/span>\r\n<span role=\"presentation\">\u200b<\/span>\r\n<span role=\"presentation\"><span class=\"cm-comment\"># \u66f4\u65b0 Docker \u914d\u7f6e\u6587\u4ef6<\/span><\/span>\r\n<span role=\"presentation\"><span class=\"cm-def\">DOCKER_TLS_OPTS<\/span><span class=\"cm-operator\">=<\/span><span class=\"cm-string\">\"-H fd:\/\/ -H tcp:\/\/0.0.0.0:2375 --tlsverify --tlscacert=<\/span><span class=\"cm-def\">$dir<\/span><span class=\"cm-string\">\/ca.pem --tlscert=<\/span><span class=\"cm-def\">$dir<\/span><span class=\"cm-string\">\/server-cert.pem --tlskey=<\/span><span class=\"cm-def\">$dir<\/span><span class=\"cm-string\">\/server-key.pem --containerd=\/run\/containerd\/containerd.sock\"<\/span><\/span>\r\n<span role=\"presentation\">\u200b<\/span>\r\n<span role=\"presentation\">\u200b<\/span>\r\n<span role=\"presentation\"><span class=\"cm-builtin\">sed<\/span> <span class=\"cm-attribute\">-i<\/span> <span class=\"cm-string\">\"s|^ExecStart=.*|ExecStart=\/usr\/bin\/dockerd <\/span><span class=\"cm-def\">$DOCKER_TLS_OPTS<\/span><span class=\"cm-string\">|\"<\/span> <span class=\"cm-string\">\"<\/span><span class=\"cm-def\">$DOCKER_SERVICE_FILE<\/span><span class=\"cm-string\">\"<\/span><\/span>\r\n<span role=\"presentation\">\u200b<\/span>\r\n<span role=\"presentation\"><span class=\"cm-comment\"># \u91cd\u65b0\u52a0\u8f7d systemd \u914d\u7f6e<\/span><\/span>\r\n<span role=\"presentation\">systemctl daemon-reload<\/span>\r\n<span role=\"presentation\">\u200b<\/span>\r\n<span role=\"presentation\"><span class=\"cm-comment\">########## \u5b8c\u6210 ##########<\/span><\/span>\r\n<span role=\"presentation\">\u200b<\/span>\r\n<span role=\"presentation\"><span class=\"cm-builtin\">echo<\/span> <span class=\"cm-string\">\"Docker TLS certificates and configuration have been generated successfully.\"<\/span><\/span>\r\n<span role=\"presentation\">\u200b<\/span>\r\n<span role=\"presentation\"><span class=\"cm-comment\">########## \u91cd\u542fDocker ##########<\/span><\/span>\r\n<span role=\"presentation\">\u200b<\/span>\r\n<span role=\"presentation\"><span class=\"cm-builtin\">sudo<\/span> systemctl <span class=\"cm-builtin\">restart<\/span> docker<\/span>\r\n<span role=\"presentation\">\u200b<\/span>\r\n<span role=\"presentation\"><span class=\"cm-builtin\">sudo<\/span> ufw allow <span class=\"cm-number\">2375<\/span><\/span><\/pre>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-988","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.dd-home.top\/index.php?rest_route=\/wp\/v2\/posts\/988","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dd-home.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dd-home.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dd-home.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dd-home.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=988"}],"version-history":[{"count":1,"href":"https:\/\/www.dd-home.top\/index.php?rest_route=\/wp\/v2\/posts\/988\/revisions"}],"predecessor-version":[{"id":989,"href":"https:\/\/www.dd-home.top\/index.php?rest_route=\/wp\/v2\/posts\/988\/revisions\/989"}],"wp:attachment":[{"href":"https:\/\/www.dd-home.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=988"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dd-home.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=988"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dd-home.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=988"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}