academy/mq-container
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add TLS support (#243)

Browse Source 
* Add TLS support

* Security fix for libsystemd0 systemd systemd-sysv libudev1
This commit is contained in:
Stephen Marshall
2018-11-07 11:47:41 +00:00
committed by Rob Parker
parent b8227abf7f
commit 3064699198
4 changed files with 21 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
cmd/runmqserver/webserver.go
View File

@@ -159,17 +159,17 @@ func configureSSO_TLS() error {
if err != nil { if err != nil {
return err return err
} }
log.Debug("Creating self-signed certificate in key store") log.Debug("Generating PKCS12 file")
err = ks.CreateSelfSignedCertificate("default", "CN=IBMMQWeb,O=IBM,OU=Platform,C=GB") err = ks.GeneratePKCS12("/mnt/tls/tls.key", "/mnt/tls/tls.crt", "/run/tls/tls.p12", "default", "password")
if err != nil { if err != nil {
return err return err
} }
log.Debug("Importing self-signed certificate into trust store") log.Debug("Importing certificate into key store")
err = ts.Import(ks.Filename, ks.Password) err = ks.Import("/run/tls/tls.p12", "password")
if err != nil { if err != nil {
return err return err
} }
log.Debug("Adding OIDC CA certificate to trust store") log.Debug("Adding OIDC certificate to trust store")
err = ts.Add(os.Getenv("MQ_OIDC_CERTIFICATE"), "OIDC") err = ts.Add(os.Getenv("MQ_OIDC_CERTIFICATE"), "OIDC")
return err return err
} }

8
install-mq.sh
View File

@@ -63,7 +63,8 @@ if ($UBUNTU); then
procps \ procps \
sed \ sed \
tar \ tar \
util-linux util-linux \
openssl
fi fi
# Install additional packages required by MQ, this install process and the runtime scripts # Install additional packages required by MQ, this install process and the runtime scripts
@@ -82,7 +83,8 @@ $RHEL && yum -y install \
procps-ng \ procps-ng \
sed \ sed \
tar \ tar \
util-linux util-linux \
openssl
# Download and extract the MQ installation files # Download and extract the MQ installation files
DIR_EXTRACT=/tmp/mq DIR_EXTRACT=/tmp/mq
@@ -139,7 +141,7 @@ rm -rf ${DIR_EXTRACT}
# Apply any bug fixes not included in base Ubuntu or MQ image. # Apply any bug fixes not included in base Ubuntu or MQ image.
# Don't upgrade everything based on Docker best practices https://docs.docker.com/engine/userguide/eng-image/dockerfile_best-practices/#run # Don't upgrade everything based on Docker best practices https://docs.docker.com/engine/userguide/eng-image/dockerfile_best-practices/#run
$UBUNTU && apt-get install -y libapparmor1 --only-upgrade $UBUNTU && apt-get install -y libsystemd0 systemd systemd-sysv libudev1 --only-upgrade
# End of bug fixes # End of bug fixes
# Clean up cached files # Clean up cached files

9
internal/keystore/keystore.go
View File

@@ -125,6 +125,15 @@ func (ks *KeyStore) CreateStash(log *logger.Logger) error {
return nil return nil
} }
// GeneratePKCS12 generates a PKCS12 file
func (ks *KeyStore) GeneratePKCS12(keyFile, crtFile, pkcs12File, label, password string) error {
out, _, err := command.Run("openssl", "pkcs12", "-export", "-inkey", keyFile, "-in", crtFile, "-out", pkcs12File, "-name", label, "-passout", "pass:"+password)
if err != nil {
return fmt.Errorf("error running \"openssl pkcs12 -export\": %v %s", err, out)
}
return nil
}
// Import imports a certificate file in the keystore // Import imports a certificate file in the keystore
func (ks *KeyStore) Import(inputFile, password string) error { func (ks *KeyStore) Import(inputFile, password string) error {
out, _, err := command.Run(ks.command, "-cert", "-import", "-file", inputFile, "-pw", password, "-target", ks.Filename, "-target_pw", ks.Password, "-target_type", ks.keyStoreType) out, _, err := command.Run(ks.command, "-cert", "-import", "-file", inputFile, "-pw", password, "-target", ks.Filename, "-target_pw", ks.Password, "-target_type", ks.keyStoreType)

3
mq-advanced-server-rhel/mq-buildah.sh
View File

@@ -57,7 +57,8 @@ buildah run $ctr_mq -- yum install -y --setopt install_weak_deps=false --setopt=
procps-ng \ procps-ng \
sed \ sed \
tar \ tar \
util-linux util-linux \
openssl
# Clean up cached files # Clean up cached files
buildah run $ctr_mq -- yum clean all buildah run $ctr_mq -- yum clean all