enrol-broker: run in serving stack + fix step signer path end-to-end
Verifying the step signer against a real step-ca surfaced two real bugs the mock signer had hidden, plus made the bench CA actually initialise: - signer.go: move --not-after from `step ca token` (validity caps ~1h -> "token validity too long") to `step ca sign` (it is the CERT lifetime). Without this the step signer never issues a cert. - dot1x-bench compose: DOCKER_STEPCA_INIT_PASSWORD_FILE pointed at a file that does not exist at first init (it is an INPUT path), so `step ca init` failed and never wrote secrets/password. Use DOCKER_STEPCA_INIT_PASSWORD (the value) which the entrypoint writes to secrets/password, where bootstrap + broker read. - bootstrap.sh: self-heal the root-owned ./pki Docker auto-creates; detect the CA password at $STEPPATH/password or secrets/password (varies by image version); raise authority.claims.maxTLSCertDuration so 720h fleet certs are allowed (stock cap 24h, which also blocked bootstrap's own RADIUS cert); fix RADIUS cert paths to write via the /export mount (were host paths run inside the container, so they never resolved). - serving stack: add the enrol-broker service (temporary home; nginx already proxies /enrol/) defaulting to the zero-dependency lab path (mock signer + insecure loopback admin), with ENROL_* knobs to switch to step + mTLS. - verify-serving.sh: exercise request -> approve -> cert through the deployed nginx /enrol/ proxy. - TODO #11: record the step-signer verification + the two fixes. Step signer VERIFIED end-to-end against a real step-ca: issued cert chains to the fleet root, EKU clientAuth, hostnqn derived from serial.
This commit is contained in:
Audiobuzz
@@ -25,7 +25,13 @@ services:
|
||||
DOCKER_STEPCA_INIT_DNS_NAMES: "${CA_DNS:-ca.fleet.lab},localhost"
|
||||
DOCKER_STEPCA_INIT_ADDRESS: ":${CA_PORT:-8443}"
|
||||
DOCKER_STEPCA_INIT_PROVISIONER_NAME: "enrol"
|
||||
DOCKER_STEPCA_INIT_PASSWORD_FILE: "/home/step/secrets/password"
|
||||
# Password to encrypt the CA keys + 'enrol' provisioner. Must be the VALUE
|
||||
# (_PASSWORD), not _PASSWORD_FILE: the latter is an INPUT path the entrypoint
|
||||
# reads FROM (for a mounted docker secret), which doesn't exist at first
|
||||
# init → `step ca init` fails → no CA, no secrets/password (the "CA not
|
||||
# initialised" error). With _PASSWORD the entrypoint WRITES it to
|
||||
# /home/step/secrets/password, where bootstrap.sh + the enrol-broker read it.
|
||||
DOCKER_STEPCA_INIT_PASSWORD: "${CA_PASSWORD:-changeme-bench}"
|
||||
volumes:
|
||||
- ./pki/stepca:/home/step # CA state (root/intermediate/keys/db) — gitignored
|
||||
- ./pki:/export # bootstrap.sh drops root_ca.crt here for the image/radius
|
||||
|
||||
@@ -1,12 +1,16 @@
|
||||
#!/usr/bin/env bash
|
||||
# bootstrap.sh — one-time setup of the bench CA after `docker compose up -d step-ca`.
|
||||
#
|
||||
# 1. wait for step-ca, export its root to pki/root_ca.crt (-> image radius-ca.pem)
|
||||
# 1. export the CA root to pki/root_ca.crt (-> image radius-ca.pem)
|
||||
# 1b. raise the cert-duration claim (so 720h fleet certs are allowed)
|
||||
# 2. ensure an enrolment provisioner exists (signs each host's TPM CSR)
|
||||
# 3. issue the RADIUS server cert/key into pki/radius/ (FreeRADIUS mounts it)
|
||||
#
|
||||
# Runs the `step` CLI against the running CA. Flags vary a little across step
|
||||
# versions — BENCH-VERIFY against your `step version` and adjust. Reads .env.
|
||||
# `step` runs INSIDE the CA container (docker compose exec). Container paths:
|
||||
# /home/step = CA state (certs/root_ca.crt, secrets/password, config/ca.json)
|
||||
# /export = host ./pki (files written here appear on the host)
|
||||
# Flags vary a little across step versions — BENCH-VERIFY against your `step
|
||||
# version` and adjust. Reads .env.
|
||||
set -euo pipefail
|
||||
|
||||
cd "$(dirname "$0")/.."
|
||||
@@ -15,29 +19,92 @@ CA_DNS=${CA_DNS:-ca.fleet.lab}
|
||||
CA_PORT=${CA_PORT:-8443}
|
||||
CA_URL="https://${CA_DNS}:${CA_PORT}"
|
||||
PKI=pki
|
||||
mkdir -p "$PKI/radius"
|
||||
|
||||
# The CA's password (auto-init wrote it from this file in the container volume).
|
||||
PW="$PKI/stepca/secrets/password"
|
||||
[ -f "$PW" ] || { echo "CA not initialised yet ($PW missing) — is step-ca up?" >&2; exit 1; }
|
||||
# step-ca initialises its state into ./pki/stepca as uid 1000, but Docker created
|
||||
# the top-level ./pki as ROOT (it auto-creates a missing bind-mount source), so
|
||||
# the host user can't write into it ("mkdir: Permission denied"). Self-heal — LAB
|
||||
# ONLY: make the tree read/write for everyone, so BOTH your host user and the
|
||||
# uid-1000 CA container can use it. (Pre-creating ./pki owned by you before
|
||||
# `compose up` avoids this; once fixed it stays fixed.)
|
||||
# The CA's password (auto-init wrote it here in the container volume). Also the
|
||||
# 'enrol' provisioner password the broker needs (copy to ../enrol-pki/password).
|
||||
# Location varies by smallstep image version: newer writes $STEPPATH/password,
|
||||
# older $STEPPATH/secrets/password — accept whichever exists.
|
||||
PW="$PKI/stepca/password"
|
||||
[ -e "$PW" ] || { [ -e "$PKI/stepca/secrets/password" ] && PW="$PKI/stepca/secrets/password"; }
|
||||
# same file as seen inside the container (/home/step is the ./pki/stepca mount).
|
||||
CONTAINER_PW="/home/step/${PW#"$PKI/stepca/"}"
|
||||
|
||||
step() { docker compose exec -T step-ca step "$@"; }
|
||||
# Two uid hazards, both self-healed here (LAB ONLY):
|
||||
# - Docker auto-creates a missing ./pki as ROOT -> host mkdir denied.
|
||||
# - step-ca writes its state as uid 1000 mode 600 -> host user can't read $PW.
|
||||
# If we can't create the radius dir OR can't read the password, chmod the tree
|
||||
# readable/writable for everyone (your user AND the uid-1000 CA container).
|
||||
if ! mkdir -p "$PKI/radius" 2>/dev/null || { [ -e "$PKI/stepca" ] && [ ! -r "$PW" ]; }; then
|
||||
echo "==> fixing $PKI perms with sudo (docker/uid-1000 owns it; lab)"
|
||||
sudo chmod -R a+rwX "$PKI"
|
||||
mkdir -p "$PKI/radius"
|
||||
fi
|
||||
|
||||
if [ ! -r "$PW" ]; then
|
||||
echo "ERROR: CA password $PW missing/unreadable — step-ca did not initialise." >&2
|
||||
echo " Check: docker compose logs step-ca (look for an init failure)." >&2
|
||||
echo " Common cause: DOCKER_STEPCA_INIT_PASSWORD not set (see compose). To reset:" >&2
|
||||
echo " docker compose down && sudo rm -rf $PKI && docker compose up -d step-ca" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
step() { docker compose exec -T step-ca step "$@"; }
|
||||
incca() { docker compose exec -T step-ca "$@"; }
|
||||
|
||||
# --- 1. export the root (becomes files/etc/dot1x/radius-ca.pem) --------------
|
||||
echo "==> exporting CA root"
|
||||
docker compose exec -T step-ca cat /home/step/certs/root_ca.crt > "$PKI/root_ca.crt"
|
||||
FP=$(step certificate fingerprint "$PKI/root_ca.crt" 2>/dev/null || \
|
||||
openssl x509 -in "$PKI/root_ca.crt" -noout -fingerprint -sha256 | cut -d= -f2)
|
||||
incca cp /home/step/certs/root_ca.crt /export/root_ca.crt
|
||||
FP=$(openssl x509 -in "$PKI/root_ca.crt" -noout -fingerprint -sha256 | cut -d= -f2)
|
||||
echo " root fingerprint: $FP"
|
||||
echo " copy to: files/etc/dot1x/radius-ca.pem (image trust anchor)"
|
||||
|
||||
# --- 1b. raise the CA cert-duration claim (idempotent) ----------------------
|
||||
# A stock step-ca caps issued certs at 24h. Both the RADIUS server cert below
|
||||
# AND the enrol-broker (--not-after 720h) need longer-lived fleet certs, so the
|
||||
# CA rejects them with "requested duration ... more than the authorized maximum
|
||||
# certificate duration of 24h". Patch authority.claims in the mounted ca.json
|
||||
# and restart the CA. Set CA_MAX_CERT_DUR / CA_DEFAULT_CERT_DUR in .env to tune.
|
||||
CA_JSON="$PKI/stepca/config/ca.json"
|
||||
CA_MAX_CERT_DUR=${CA_MAX_CERT_DUR:-2160h}
|
||||
CA_DEFAULT_CERT_DUR=${CA_DEFAULT_CERT_DUR:-720h}
|
||||
if [ -f "$CA_JSON" ]; then
|
||||
if python3 - "$CA_JSON" "$CA_MAX_CERT_DUR" "$CA_DEFAULT_CERT_DUR" <<'PY'
|
||||
import json,sys
|
||||
p,maxd,defd=sys.argv[1],sys.argv[2],sys.argv[3]
|
||||
c=json.load(open(p))
|
||||
claims=c.setdefault("authority",{}).setdefault("claims",{})
|
||||
if claims.get("maxTLSCertDuration")==maxd and claims.get("defaultTLSCertDuration")==defd:
|
||||
sys.exit(1) # already set — no restart needed
|
||||
claims["maxTLSCertDuration"]=maxd
|
||||
claims["defaultTLSCertDuration"]=defd
|
||||
json.dump(c,open(p,"w"),indent=2)
|
||||
PY
|
||||
then
|
||||
echo "==> raised CA claims (max=$CA_MAX_CERT_DUR default=$CA_DEFAULT_CERT_DUR); restarting step-ca"
|
||||
docker compose restart step-ca >/dev/null
|
||||
for _ in $(seq 1 50); do
|
||||
curl -fsS -k "$CA_URL/health" >/dev/null 2>&1 && break; sleep 0.2
|
||||
done
|
||||
else
|
||||
echo "==> CA claims already set (max=$CA_MAX_CERT_DUR)"
|
||||
fi
|
||||
else
|
||||
echo "WARNING: $CA_JSON not found — cannot raise cert-duration claim; 720h certs will be REJECTED." >&2
|
||||
fi
|
||||
|
||||
# --- 2. enrolment provisioner (idempotent) ----------------------------------
|
||||
# JWK provisioner 'enrol' is created by auto-init (DOCKER_STEPCA_INIT_PROVISIONER_NAME).
|
||||
# Enrolment authorizes a CSR with a one-time token:
|
||||
# step ca token <host-id> --provisioner enrol → passed to `step ca sign`
|
||||
# That token-gated sign is what enrol/tpm-provision.sh uses.
|
||||
# That token-gated sign is what the enrol-broker and enrol/tpm-provision.sh use.
|
||||
echo "==> provisioners:"
|
||||
step ca provisioner list --ca-url "$CA_URL" --root "$PKI/root_ca.crt" \
|
||||
step ca provisioner list --ca-url "$CA_URL" --root /export/root_ca.crt \
|
||||
| grep -E '"(name|type)"' || true
|
||||
|
||||
# To UPGRADE to TPM attestation later, add an ACME attestation provisioner and
|
||||
@@ -49,13 +116,16 @@ step ca provisioner list --ca-url "$CA_URL" --root "$PKI/root_ca.crt" \
|
||||
# (then `step ca acme` / an ACME client on the host instead of `step ca sign`.)
|
||||
|
||||
# --- 3. RADIUS server cert (FreeRADIUS serves this; supplicant validates it) --
|
||||
# Written via /export so the files land in the host's pki/radius/ that FreeRADIUS
|
||||
# mounts. Uses the in-container CA root + provisioner password (no host copies).
|
||||
echo "==> issuing RADIUS server cert (radius.${CA_DNS#ca.})"
|
||||
RADIUS_CN="radius.${CA_DNS#ca.}"
|
||||
incca mkdir -p /export/radius
|
||||
step ca certificate "$RADIUS_CN" \
|
||||
"$PKI/radius/server.pem" "$PKI/radius/server.key" \
|
||||
--ca-url "$CA_URL" --root "$PKI/root_ca.crt" \
|
||||
--provisioner enrol --provisioner-password-file "$PW" \
|
||||
/export/radius/server.pem /export/radius/server.key \
|
||||
--ca-url "$CA_URL" --root /export/root_ca.crt \
|
||||
--provisioner enrol --provisioner-password-file "$CONTAINER_PW" \
|
||||
--not-after 720h --force
|
||||
cp "$PKI/root_ca.crt" "$PKI/radius/ca.pem"
|
||||
incca cp /export/root_ca.crt /export/radius/ca.pem
|
||||
echo "==> done. FreeRADIUS will read pki/radius/{server.pem,server.key,ca.pem}."
|
||||
echo " Next: cp $PKI/root_ca.crt ../../files/etc/dot1x/radius-ca.pem && rebuild secure-path image."
|
||||
|
||||
Reference in New Issue
Block a user