Skip to content
This repository was archived by the owner on Jul 2, 2024. It is now read-only.

Commit 3fcc789

Browse files
jdeathejdeathe
authored
Merge pull request #706 from jdeathe/centos-7-develop
Release changes for 2.5.0
2 parents 76517ed + 1b3fb4f commit 3fcc789

30 files changed

+3287
-2037
lines changed

‎CHANGELOG.md

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,40 @@
44

55
Summary of release changes for Version 2 - CentOS-7
66

7+
### 2.5.0 - 2019-01-28
8+
9+
- Updates `openssl` package to 1.0.2k-16.el7.
10+
- Updates `sudo` package to 1.8.23-3.el7.
11+
- Updates `yum-plugin-versionlock` package to 1.1.31-50.el7.
12+
- Updates supervisor to 3.3.5.
13+
- Updates validation for `SSH_USER_ID` to allow values in the system ID range.
14+
- Updates and restructures Dockerfile to reduce number of layers in image.
15+
- Updates container naming conventions for `scmi` making the node element optional.
16+
- Updates container naming conventions and readability of `Makefile`.
17+
- Updates `docker logs` output example in README document.
18+
- Updates README instructions following review.
19+
- Updates default HEALTHCHECK interval to 1 second from 0.5.
20+
- Replaces awk with native bash regex when testing sudo user's have `NOPASSWD:ALL`.
21+
- Fixes bootstrap errors regarding readonly `PASSWORD_LENGTH`.
22+
- Fixes issue with redacted password when using `SSH_PASSWORD_AUTHENTICATION` in combination with `SSH_USER_FORCE_SFTP`.
23+
- Fixes issue with unexpected published port in run templates when `DOCKER_PORT_MAP_TCP_22` is set to an empty string or 0.
24+
- Fixes missing `SSH_TIMEZONE` from Makefile's install run template.
25+
- Fixes validation of `SSH_TIMEZONE` values - set to defaults with warning and abort on error.
26+
- Adds `SSH_USER_PRIVATE_KEY` to allow configuration of an RSA private key for `SSH_USER`.
27+
- Adds placeholder replacement of `RELEASE_VERSION` docker argument to systemd service unit template.
28+
- Adds error messages to healthcheck script and includes supervisord check.
29+
- Adds a short sleep after bootstrap Details to work-around missing output on CI service's host.
30+
- Adds port incrementation to Makefile's run template for container names with an instance suffix.
31+
- Adds consideration for event lag into test cases for unhealthy health_status events.
32+
- Adds feature to allow configuration of "root" `SSH_USER`.
33+
- Adds validation of `SSH_SUDO` values.
34+
- Removes use of `/etc/services-config` paths.
35+
- Removes fleet `--manager` option in the `scmi` installer.
36+
- Removes X-Fleet section from etcd register template unit-file.
37+
- Removes the unused group element from the default container name.
38+
- Removes the node element from the default container name.
39+
- Removes undocumented `SSH_ROOT_PASSWORD` from bootstrap process.
40+
741
### 2.4.1 - 2018-11-10
842

943
- Adds feature to set system time zone via `SSH_TIMEZONE`.

‎Dockerfile

Lines changed: 47 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
1-
# =============================================================================
2-
# jdeathe/centos-ssh
3-
#
4-
# CentOS-7 7.5.1804 x86_64 - SCL/EPEL/IUS Repos. / Supervisor / OpenSSH.
5-
#
6-
# =============================================================================
71
FROM centos:7.5.1804
82

3+
ARG RELEASE_VERSION="2.5.0"
4+
95
# -----------------------------------------------------------------------------
10-
# Base Install + Import the RPM GPG keys for Repositories
6+
# - Import the RPM GPG keys for repositories
7+
# - Base install of required packages
8+
# - Install supervisord (used to run more than a single process)
9+
# - Install supervisor-stdout to allow output of services started by
10+
# supervisord to be easily inspected with "docker logs".
1111
# -----------------------------------------------------------------------------
1212
RUN rpm --rebuilddb \
1313
&& rpm --import \
@@ -25,10 +25,10 @@ RUN rpm --rebuilddb \
2525
https://centos7.iuscommunity.org/ius-release.rpm \
2626
openssh-clients-7.4p1-16.el7 \
2727
openssh-server-7.4p1-16.el7 \
28-
openssl-1.0.2k-12.el7 \
28+
openssl-1.0.2k-16.el7 \
2929
python-setuptools-0.9.8-7.el7 \
30-
sudo-1.8.19p2-14.el7_5 \
31-
yum-plugin-versionlock-1.1.31-46.el7_5 \
30+
sudo-1.8.23-3.el7 \
31+
yum-plugin-versionlock-1.1.31-50.el7 \
3232
&& yum versionlock add \
3333
openssh \
3434
openssh-server \
@@ -37,50 +37,17 @@ RUN rpm --rebuilddb \
3737
sudo \
3838
yum-plugin-versionlock \
3939
&& yum clean all \
40+
&& easy_install \
41+
'supervisor == 3.3.5' \
42+
'supervisor-stdout == 0.1.1' \
43+
&& mkdir -p \
44+
/var/log/supervisor/ \
4045
&& rm -rf /etc/ld.so.cache \
4146
&& rm -rf /sbin/sln \
4247
&& rm -rf /usr/{{lib,share}/locale,share/{man,doc,info,cracklib,i18n},{lib,lib64}/gconv,bin/localedef,sbin/build-locale-archive} \
4348
&& rm -rf /{root,tmp,var/cache/{ldconfig,yum}}/* \
4449
&& > /etc/sysconfig/i18n
4550

46-
# -----------------------------------------------------------------------------
47-
# Install supervisord (required to run more than a single process in a container)
48-
# Note: EPEL package lacks /usr/bin/pidproxy
49-
# We require supervisor-stdout to allow output of services started by
50-
# supervisord to be easily inspected with "docker logs".
51-
# -----------------------------------------------------------------------------
52-
RUN easy_install \
53-
'supervisor == 3.3.4' \
54-
'supervisor-stdout == 0.1.1' \
55-
&& mkdir -p \
56-
/var/log/supervisor/
57-
58-
# -----------------------------------------------------------------------------
59-
# UTC Timezone & Networking
60-
# -----------------------------------------------------------------------------
61-
RUN ln -sf \
62-
/usr/share/zoneinfo/UTC \
63-
/etc/localtime \
64-
&& echo "NETWORKING=yes" > /etc/sysconfig/network
65-
66-
# -----------------------------------------------------------------------------
67-
# Configure SSH for non-root public key authentication
68-
# -----------------------------------------------------------------------------
69-
RUN sed -i \
70-
-e 's~^PasswordAuthentication yes~PasswordAuthentication no~g' \
71-
-e 's~^#PermitRootLogin yes~PermitRootLogin no~g' \
72-
-e 's~^#UseDNS yes~UseDNS no~g' \
73-
-e 's~^\(.*\)/usr/libexec/openssh/sftp-server$~\1internal-sftp~g' \
74-
/etc/ssh/sshd_config
75-
76-
# -----------------------------------------------------------------------------
77-
# Enable the wheel sudoers group
78-
# -----------------------------------------------------------------------------
79-
RUN sed -i \
80-
-e 's~^# %wheel\tALL=(ALL)\tALL~%wheel\tALL=(ALL) ALL~g' \
81-
-e 's~\(.*\) requiretty$~#\1requiretty~' \
82-
/etc/sudoers
83-
8451
# -----------------------------------------------------------------------------
8552
# Copy files into place
8653
# -----------------------------------------------------------------------------
@@ -90,40 +57,38 @@ ADD src/usr/sbin \
9057
/usr/sbin/
9158
ADD src/opt/scmi \
9259
/opt/scmi/
93-
ADD src/etc/systemd/system \
94-
/etc/systemd/system/
95-
ADD src/etc/services-config/ssh/authorized_keys \
96-
src/etc/services-config/ssh/sshd-bootstrap.conf \
97-
src/etc/services-config/ssh/sshd-bootstrap.env \
98-
/etc/services-config/ssh/
99-
ADD src/etc/services-config/supervisor/supervisord.conf \
100-
/etc/services-config/supervisor/
101-
ADD src/etc/services-config/supervisor/supervisord.d \
102-
/etc/services-config/supervisor/supervisord.d/
60+
ADD src/etc \
61+
/etc/
10362

104-
RUN mkdir -p \
105-
/etc/supervisord.d/ \
106-
&& cp -pf \
107-
/etc/ssh/sshd_config \
108-
/etc/services-config/ssh/ \
109-
&& ln -sf \
110-
/etc/services-config/ssh/sshd_config \
63+
# -----------------------------------------------------------------------------
64+
# Provisioning
65+
# - UTC Timezone
66+
# - Networking
67+
# - Configure SSH defaults for non-root public key authentication
68+
# - Enable the wheel sudoers group
69+
# - Replace placeholders with values in systemd service unit template
70+
# - Set permissions
71+
# -----------------------------------------------------------------------------
72+
RUN ln -sf \
73+
/usr/share/zoneinfo/UTC \
74+
/etc/localtime \
75+
&& echo "NETWORKING=yes" \
76+
> /etc/sysconfig/network \
77+
&& sed -i \
78+
-e 's~^PasswordAuthentication yes~PasswordAuthentication no~g' \
79+
-e 's~^#PermitRootLogin yes~PermitRootLogin no~g' \
80+
-e 's~^#UseDNS yes~UseDNS no~g' \
81+
-e 's~^\(.*\)/usr/libexec/openssh/sftp-server$~\1internal-sftp~g' \
11182
/etc/ssh/sshd_config \
112-
&& ln -sf \
113-
/etc/services-config/ssh/sshd-bootstrap.conf \
114-
/etc/sshd-bootstrap.conf \
115-
&& ln -sf \
116-
/etc/services-config/ssh/sshd-bootstrap.env \
117-
/etc/sshd-bootstrap.env \
118-
&& ln -sf \
119-
/etc/services-config/supervisor/supervisord.conf \
120-
/etc/supervisord.conf \
121-
&& ln -sf \
122-
/etc/services-config/supervisor/supervisord.d/sshd-wrapper.conf \
123-
/etc/supervisord.d/sshd-wrapper.conf \
124-
&& ln -sf \
125-
/etc/services-config/supervisor/supervisord.d/sshd-bootstrap.conf \
126-
/etc/supervisord.d/sshd-bootstrap.conf \
83+
&& sed -i \
84+
-e 's~^# %wheel\tALL=(ALL)\tALL~%wheel\tALL=(ALL) ALL~g' \
85+
-e 's~\(.*\) requiretty$~#\1requiretty~' \
86+
/etc/sudoers \
87+
&& sed -i \
88+
-e "s~{{RELEASE_VERSION}}~${RELEASE_VERSION}~g" \
89+
/etc/systemd/system/centos-ssh@.service \
90+
&& chmod 644 \
91+
/etc/{sshd-bootstrap.{conf,env},supervisord.conf,supervisord.d/sshd-{bootstrap,wrapper}.conf} \
12792
&& chmod 700 \
12893
/usr/{bin/healthcheck,sbin/{scmi,sshd-{bootstrap,wrapper}}}
12994

@@ -146,12 +111,12 @@ ENV SSH_AUTHORIZED_KEYS="" \
146111
SSH_USER_ID="500:500" \
147112
SSH_USER_PASSWORD="" \
148113
SSH_USER_PASSWORD_HASHED="false" \
114+
SSH_USER_PRIVATE_KEY="" \
149115
SSH_USER_SHELL="/bin/bash"
150116

151117
# -----------------------------------------------------------------------------
152118
# Set image metadata
153119
# -----------------------------------------------------------------------------
154-
ARG RELEASE_VERSION="2.4.1"
155120
LABEL \
156121
maintainer="James Deathe <james.deathe@gmail.com>" \
157122
install="docker run \
@@ -183,7 +148,7 @@ jdeathe/centos-ssh:${RELEASE_VERSION} \
183148
org.deathe.description="CentOS-7 7.5.1804 x86_64 - SCL, EPEL and IUS Repositories / Supervisor / OpenSSH."
184149

185150
HEALTHCHECK \
186-
--interval=0.5s \
151+
--interval=1s \
187152
--timeout=1s \
188153
--retries=5 \
189154
CMD ["/usr/bin/healthcheck"]

0 commit comments

Comments
 (0)