Docker/Pods/Wifi - Revision history

Admin: Replacing charlesreid1.com:3000 with git.charlesreid1.com

2019-10-09T03:22:48Z

Replacing charlesreid1.com:3000 with git.charlesreid1.com

← Older revision		Revision as of 03:22, 9 October 2019
Line 36:		Line 36:
	===Get Files===		===Get Files===

	Get the Dockerfile from the git.charlesreid1.com repo: https://charlesreid1.com~~:3000~~/docker/d-stunnel		Get the Dockerfile from the git.charlesreid1.com repo: https://git.charlesreid1.com/docker/d-stunnel

	<pre>		<pre>
	$ mkdir ~/docker		$ mkdir ~/docker
	$ cd ~/docker		$ cd ~/docker
	$ git clone https://charlesreid1.com~~:3000~~/docker/d-stunnel		$ git clone https://git.charlesreid1.com/docker/d-stunnel
	$ cd d-stunnel		$ cd d-stunnel
	</pre>		</pre>
Line 57:		Line 57:
	Option 2 is to use a self-signed certificate. See [[RaspberryPi/SSH Stunnel]] for details and use the <code>generate_ss_cert.sh</code> script in the d-stunnel repository.		Option 2 is to use a self-signed certificate. See [[RaspberryPi/SSH Stunnel]] for details and use the <code>generate_ss_cert.sh</code> script in the d-stunnel repository.

	Link to d-stunnel repository: https://charlesreid1.com~~:3000~~/docker/d-stunnel		Link to d-stunnel repository: https://git.charlesreid1.com/docker/d-stunnel

	===Configure Client===		===Configure Client===

	Next, configure your client stunnel using stunnel.conf. On a Mac, this will go in <code>/usr/local/etc/stunnel/stunnel.conf</code>. On Ubuntu/Linux, it will go in <code>/etc/stunnel/stunnel.conf</code>. The client machine's configuration should map ports matching whatever you're trying to do. There are some examples in the docker/d-stunnel repository on git.charlesreid1.com: https://charlesreid1.com~~:3000~~/docker/d-stunnel		Next, configure your client stunnel using stunnel.conf. On a Mac, this will go in <code>/usr/local/etc/stunnel/stunnel.conf</code>. On Ubuntu/Linux, it will go in <code>/etc/stunnel/stunnel.conf</code>. The client machine's configuration should map ports matching whatever you're trying to do. There are some examples in the docker/d-stunnel repository on git.charlesreid1.com: https://git.charlesreid1.com/docker/d-stunnel

	These pages have sample client configuration files:		These pages have sample client configuration files:
Line 71:		Line 71:
	====Configure Raspberry Pi Client====		====Configure Raspberry Pi Client====

	Stunnel client config files for Raspberry Pi: https://charlesreid1.com~~:3000~~/rpi/p-stunnel		Stunnel client config files for Raspberry Pi: https://git.charlesreid1.com/rpi/p-stunnel

	===Configure Server===		===Configure Server===
Line 83:		Line 83:
	* [[Stunnel/HTTP]]		* [[Stunnel/HTTP]]

	This is the configuration file that will be copied into the Docker container and used with its stunnel instance. It is recommended you check out https://charlesreid1.com~~:3000~~/docker/d-stunnel and put it into the d-stunnel/ directory.		This is the configuration file that will be copied into the Docker container and used with its stunnel instance. It is recommended you check out https://git.charlesreid1.com/docker/d-stunnel and put it into the d-stunnel/ directory.

	===TLDR===		===TLDR===

Admin at 10:41, 16 August 2017

2017-08-16T10:41:21Z

← Older revision		Revision as of 10:41, 16 August 2017
Line 1:		Line 1:
	=Wifi ~~Boat~~ Overview=		=Wifi Pod Overview=

	==Services==		==Services==

	UGR wifi ~~boat~~ ships the following services in Docker containers:		UGR wifi pod ships the following services in Docker containers:
	* stunnel server		* stunnel server
	* web server (hello world, report, file management)		* web server (hello world, report, file management)
Line 13:		Line 13:

	Please make a note:		Please make a note:
	* The UGR wifi ~~boat~~ does not receive or process raw packet data. The Raspberry Pi device will extract network data, either by using a tool that extracts relevant information or by running a tool like scapy or aircrack on the Raspberry Pi to capture and process network data local to the Pi. Only small, digested, processed data is sent back to the server.		* The UGR wifi pod does not receive or process raw packet data. The Raspberry Pi device will extract network data, either by using a tool that extracts relevant information or by running a tool like scapy or aircrack on the Raspberry Pi to capture and process network data local to the Pi. Only small, digested, processed data is sent back to the server.

	==Getting Set Up For The ~~Boat~~==		==Getting Set Up For The Pod==

	Make sure your node is all set: [[Deployment/New Node Checklist]]		Make sure your node is all set: [[Deployment/New Node Checklist]]
Line 21:		Line 21:
	Make sure docker installed: [[Docker/Installing]]		Make sure docker installed: [[Docker/Installing]]

	=~~Boat~~ Containers=		=Pod Containers=

	==Stunnel==		==Stunnel==
Line 160:		Line 160:

	[[Category:Docker]]		[[Category:Docker]]
	[[Category:~~Boats~~]]		[[Category:Docker Pods]]
	[[Category:Wireless]]		[[Category:Wireless]]

Admin: Admin moved page Docker/Boats/Wifi to Docker/Pods/Wifi

2017-04-15T21:22:26Z

Admin moved page Docker/Boats/Wifi to Docker/Pods/Wifi

← Older revision	Revision as of 21:22, 15 April 2017
(No difference)

Admin: /* Configure Client */

2017-03-31T05:10:52Z

Configure Client

← Older revision		Revision as of 05:10, 31 March 2017
Line 68:		Line 68:
	* [[Stunnel/Scp]] - tunneling secure copy over port 443		* [[Stunnel/Scp]] - tunneling secure copy over port 443
	* [[Stunnel/HTTP]] - tunneling HTTP traffic over port 8000		* [[Stunnel/HTTP]] - tunneling HTTP traffic over port 8000

			====Configure Raspberry Pi Client====

			Stunnel client config files for Raspberry Pi: https://charlesreid1.com:3000/rpi/p-stunnel

	===Configure Server===		===Configure Server===

Admin: /* Links */

2017-03-31T03:50:43Z

Links

← Older revision		Revision as of 03:50, 31 March 2017
Line 151:		Line 151:
	Running the stunnel command should work okay.		Running the stunnel command should work okay.

	==~~=Links===~~		=Flags=

	~~Stunnel documentation (man page): https://www.stunnel.org/static/stunnel.html~~

	~~Stunnel Dockerfile that is about as simple as it is going to get: https://github.com/taskworld/docker-stunnel/blob/master/Dockerfile~~

	~~Note: ufw needs to accept, not drop, traffic: [https://www.digitalocean.com/community/tutorials/docker-explained-how-to-create-docker-containers-running-memcached]~~

	~~Note: container needs to bind to 0.0.0.0, not localhost, or it won't be accessible outside the container: [http://serverfault.com/questions/714340/ssh-tunnel-to-docker-container]~~



			{{DockerFlag}}

	[[Category:Docker]]		[[Category:Docker]]

Admin: /* Load Image with Networking/Ports Configured */

2017-03-31T03:50:25Z

Load Image with Networking/Ports Configured

← Older revision		Revision as of 03:50, 31 March 2017
Line 150:		Line 150:

	Running the stunnel command should work okay.		Running the stunnel command should work okay.

	~~===Load Image with Networking/Ports Configured===~~


	===Links===		===Links===

Admin: /* Port Mapping */

2017-03-31T03:50:15Z

Port Mapping

← Older revision		Revision as of 03:50, 31 March 2017
Line 150:		Line 150:

	Running the stunnel command should work okay.		Running the stunnel command should work okay.

	~~===Port Mapping===~~

	~~Docker networking guide provides some useful info: https://docs.docker.com/engine/userguide/networking/~~

	~~We can specify three networks: the host network, a bridge network (shared between host and container only), or no network at all.~~

	~~We want to attach the container to the outside world via the standard network interface onboard the host. Use <code>--network=host</code> when running the container .~~

	~~ok,~~

	~~but now prob is,~~

	~~how to id self, container missing ifconfig~~




	===Load Image with Networking/Ports Configured===		===Load Image with Networking/Ports Configured===

Admin: /* Run the Docker stunnel container image */

2017-03-31T03:50:06Z

Run the Docker stunnel container image

@@ Line 107: / Line 107: @@
 REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
 cmr_stunnel         latest              2b197f506e02        59 seconds ago      219 MB
 </pre>
@@ Line 114: / Line 142: @@
 <pre>
-$ docker run -ti cmr_stunnel /bin/bash
+docker run \
 </pre>
-Test that the stunnel command works.
+Running the stunnel command should work okay.
 ===Port Mapping===

Admin: /* Networking/Ports Configuration */

2017-03-31T03:49:09Z

Networking/Ports Configuration

← Older revision		Revision as of 03:49, 31 March 2017
Line 80:		Line 80:

	This is the configuration file that will be copied into the Docker container and used with its stunnel instance. It is recommended you check out https://charlesreid1.com:3000/docker/d-stunnel and put it into the d-stunnel/ directory.		This is the configuration file that will be copied into the Docker container and used with its stunnel instance. It is recommended you check out https://charlesreid1.com:3000/docker/d-stunnel and put it into the d-stunnel/ directory.

	~~===Networking/Ports Configuration===~~

	~~First, let's talk about how stunnel works, independently of Docker.~~

	Stunnel will expose one port externally (for clients to connect on). Typically, this is 443, but it can be any port. This is the port on which all of the SSL-wrapped traffic will pass. It then forwards that traffic on to another local port (typically this is a port with a service that is not externally exposed, but that isn't a requirement). The configuration file determines which local port the stunnel server will map traffic to.

	~~Now let's talk about how to do this when running stunnel from within Docker.~~

	The Docker container will be running an stunnel service that listens on some port (say 443) and forwards that traffic on to some other port. The hitch is, Docker containers are not, by default, connected to host ports, so we need to explicitly link ports from the container to ports on the host.

	The first port we want to map is the port on which stunnel is listening - if stunnel listens on 443 inside the container, we can make that available on the host port 443 by specifying <code>-p 443:443</code> when we run the docker container.

	However, we also need to map the destination port, where stunnel is forwarding traffic to, to the host destination port. If we use a simple example of tunneling SSH traffic through stunnel, we need to link the stunnel Docker container's port 22 to the host's port 22.

	Finally, we also need the docker container to share a networking interface with the host - otherwise, the host needs to dedicate a separate listener (on the host) listening to each of the ports that we map. This creates a conflict if there is already an SSH server listening on the port we're trying to bind to. Since these two services are just talking to each other, they should be able to bind to the same network interface. Use the <code>--network=host</code> to force the container and host to share the same network interface.

	~~See [[Docker/Networking]] for the setup and configuration files for tunneling SSH over an stunnel SSL connection on port 443.~~

	===TLDR===		===TLDR===

Admin: /* Networking/Ports Configuration */

2017-03-31T03:48:56Z

Networking/Ports Configuration

← Older revision		Revision as of 03:48, 31 March 2017
Line 94:		Line 94:

	However, we also need to map the destination port, where stunnel is forwarding traffic to, to the host destination port. If we use a simple example of tunneling SSH traffic through stunnel, we need to link the stunnel Docker container's port 22 to the host's port 22.		However, we also need to map the destination port, where stunnel is forwarding traffic to, to the host destination port. If we use a simple example of tunneling SSH traffic through stunnel, we need to link the stunnel Docker container's port 22 to the host's port 22.

			Finally, we also need the docker container to share a networking interface with the host - otherwise, the host needs to dedicate a separate listener (on the host) listening to each of the ports that we map. This creates a conflict if there is already an SSH server listening on the port we're trying to bind to. Since these two services are just talking to each other, they should be able to bind to the same network interface. Use the <code>--network=host</code> to force the container and host to share the same network interface.

	See [[Docker/Networking]] for the setup and configuration files for tunneling SSH over an stunnel SSL connection on port 443.		See [[Docker/Networking]] for the setup and configuration files for tunneling SSH over an stunnel SSL connection on port 443.

			===TLDR===

			You have to map ports from container to host, and your host and container have to share the same network interface. Here is what the final run command looks like:

	<pre>		<pre>
	~~================================================~~		docker run \
	~~================================================~~		--network=host \
	~~================================================~~		-p 443:443 -p 22:22 \
	=~~====== This is the latest point we have reached.~~		-ti cmr_stunnel \
	~~================================================~~		/bin/bash
	~~================================================~~
	~~================================================~~
	</pre>		</pre>