Merge pull request #79 from UKHomeOffice/nginx_user_dacm

Don't run as root

Author: lewismarshall

.drone.yml

@@ -30,7 +30,7 @@ pipeline:
 
 services:
   dind:
-    image: docker:1.11-dind
+    image: docker:1.13-dind
     privileged: true
     command:
       - "-s"

.drone.yml.sig

@@ -1 +1 @@
-eyJhbGciOiJIUzI1NiJ9.cGlwZWxpbmU6CgogIGJ1aWxkX2ltYWdlOgogICAgaW1hZ2U6IHF1YXkuaW8vdWtob21lb2ZmaWNlZGlnaXRhbC9jZW50b3MtYmFzZTpsYXRlc3QKICAgIGVudmlyb25tZW50OgogICAgICAtIERPQ0tFUl9IT1NUPXRjcDovLzEyNy4wLjAuMToyMzc1CiAgICBjb21tYW5kczoKICAgICAgLSB5dW0gaW5zdGFsbCAteSAtcSBkb2NrZXIgb3BlbnNzbCB3Z2V0CiAgICAgIC0gLi9jaS1idWlsZC5zaAogICAgd2hlbjoKICAgICAgZXZlbnQ6IFtwdWxsX3JlcXVlc3QsIHB1c2gsIHRhZ10KCiAgcHVzaF9pbWFnZToKICAgIGltYWdlOiBkb2NrZXI6MS4xMQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gRE9DS0VSX0hPU1Q9dGNwOi8vMTI3LjAuMC4xOjIzNzUKICAgIGNvbW1hbmRzOgogICAgICAtIFJFUE89ImFydGlmYWN0b3J5LWludGVybmFsLmRpZ2l0YWwuaG9tZW9mZmljZS5nb3YudWsiCiAgICAgIC0gQkFTRT0iLyIKICAgICAgLSBOQU1FPSJuZ2lueC1wcm94eSIKICAgICAgLSBGVUxMX05BTUU9IiR7UkVQT30ke0JBU0V9JHtOQU1FfSIKICAgICAgLSBET0NLRVJfVVNFUk5BTUU9Imxldi13ZWItcm9ib3QiCiAgICAgIC0gZG9ja2VyIGxvZ2luIC11PSIke0RPQ0tFUl9VU0VSTkFNRX0iIC1wPSIke0RPQ0tFUl9QQVNTV09SRH0iICIke1JFUE99IgogICAgICAtIGRvY2tlciB0YWcgbmd4ICIke0ZVTExfTkFNRX06JHtEUk9ORV9UQUd9IgogICAgICAtIGRvY2tlciB0YWcgbmd4ICIke0ZVTExfTkFNRX06bGF0ZXN0IgogICAgICAtIGRvY2tlciBwdXNoICIke0ZVTExfTkFNRX06JHtEUk9ORV9UQUd9IgogICAgICAtIGRvY2tlciBwdXNoICIke0ZVTExfTkFNRX06bGF0ZXN0IgogICAgd2hlbjoKICAgICAgZXZlbnQ6IHRhZwoKc2VydmljZXM6CiAgZGluZDoKICAgIGltYWdlOiBkb2NrZXI6MS4xMS1kaW5kCiAgICBwcml2aWxlZ2VkOiB0cnVlCiAgICBjb21tYW5kOgogICAgICAtICItcyIKICAgICAgLSAib3ZlcmxheSIK.OzQqg55eKQsD7DOlW6CzDEFItNDioORmOo1vI2y7JQI
+eyJhbGciOiJIUzI1NiJ9.cGlwZWxpbmU6CgogIGJ1aWxkX2ltYWdlOgogICAgaW1hZ2U6IHF1YXkuaW8vdWtob21lb2ZmaWNlZGlnaXRhbC9jZW50b3MtYmFzZTpsYXRlc3QKICAgIGVudmlyb25tZW50OgogICAgICAtIERPQ0tFUl9IT1NUPXRjcDovLzEyNy4wLjAuMToyMzc1CiAgICBjb21tYW5kczoKICAgICAgLSB5dW0gaW5zdGFsbCAteSAtcSBkb2NrZXIgb3BlbnNzbCB3Z2V0CiAgICAgIC0gLi9jaS1idWlsZC5zaAogICAgd2hlbjoKICAgICAgZXZlbnQ6IFtwdWxsX3JlcXVlc3QsIHB1c2gsIHRhZ10KCiAgcHVzaF9pbWFnZToKICAgIGltYWdlOiBkb2NrZXI6MS4xMQogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gRE9DS0VSX0hPU1Q9dGNwOi8vMTI3LjAuMC4xOjIzNzUKICAgIGNvbW1hbmRzOgogICAgICAtIFJFUE89ImFydGlmYWN0b3J5LWludGVybmFsLmRpZ2l0YWwuaG9tZW9mZmljZS5nb3YudWsiCiAgICAgIC0gQkFTRT0iLyIKICAgICAgLSBOQU1FPSJuZ2lueC1wcm94eSIKICAgICAgLSBGVUxMX05BTUU9IiR7UkVQT30ke0JBU0V9JHtOQU1FfSIKICAgICAgLSBET0NLRVJfVVNFUk5BTUU9Imxldi13ZWItcm9ib3QiCiAgICAgIC0gZG9ja2VyIGxvZ2luIC11PSIke0RPQ0tFUl9VU0VSTkFNRX0iIC1wPSIke0RPQ0tFUl9QQVNTV09SRH0iICIke1JFUE99IgogICAgICAtIGRvY2tlciB0YWcgbmd4ICIke0ZVTExfTkFNRX06JHtEUk9ORV9UQUd9IgogICAgICAtIGRvY2tlciB0YWcgbmd4ICIke0ZVTExfTkFNRX06bGF0ZXN0IgogICAgICAtIGRvY2tlciBwdXNoICIke0ZVTExfTkFNRX06JHtEUk9ORV9UQUd9IgogICAgICAtIGRvY2tlciBwdXNoICIke0ZVTExfTkFNRX06bGF0ZXN0IgogICAgd2hlbjoKICAgICAgZXZlbnQ6IHRhZwoKc2VydmljZXM6CiAgZGluZDoKICAgIGltYWdlOiBkb2NrZXI6MS4xMy1kaW5kCiAgICBwcml2aWxlZ2VkOiB0cnVlCiAgICBjb21tYW5kOgogICAgICAtICItcyIKICAgICAgLSAib3ZlcmxheSIK.fsCfmLyIOwFA4sTrzWETpFtSeUEgeNMFAvQhFFnONl0

Dockerfile

@@ -39,9 +39,27 @@ ADD ./refresh_GeoIP.sh /
 RUN yum remove -y kernel-headers && \
     yum clean all
 
+RUN useradd nginx && \
+    mkdir /usr/local/openresty/naxsi/locations && \
+    mkdir /usr/local/openresty/nginx/client_body_temp && \
+    mkdir /usr/local/openresty/nginx/proxy_temp && \
+    mkdir /usr/local/openresty/nginx/fastcgi_temp && \
+    mkdir /usr/local/openresty/nginx/uwsgi_temp && \
+    mkdir /usr/local/openresty/nginx/scgi_temp && \
+    chown -R nginx:nginx /usr/local/openresty/naxsi/locations && \
+    chown -R nginx:nginx /usr/local/openresty/nginx/conf && \
+    chown -R nginx:nginx /usr/local/openresty/nginx/logs && \
+    chown -R nginx:nginx /usr/local/openresty/nginx/client_body_temp && \
+    chown -R nginx:nginx /usr/local/openresty/nginx/proxy_temp && \
+    chown -R nginx:nginx /usr/local/openresty/nginx/fastcgi_temp && \
+    chown -R nginx:nginx /usr/local/openresty/nginx/uwsgi_temp && \
+    chown -R nginx:nginx /usr/local/openresty/nginx/scgi_temp && \
+    chown -R nginx:nginx /usr/share/GeoIP
+
 WORKDIR /usr/local/openresty
 
 ENTRYPOINT ["/go.sh"]
 
-EXPOSE 80
-EXPOSE 443
+EXPOSE 10080
+EXPOSE 10443
+USER nginx

README.md

@@ -79,8 +79,8 @@ This is useful when testing or for development instances or when a load-balancer
 * `SERVER_KEY` - Can override where to find the server's SSL key.
 * `SSL_CIPHERS` - Change the SSL ciphers support default only AES256+EECDH:AES256+EDH:!aNULL
 * `SSL_PROTOCOLS` - Change the SSL protocols supported default only TLSv1.2
-* `HTTP_LISTEN_PORT` - Change the default inside the container from 80.
-* `HTTPS_LISTEN_PORT` - Change the default inside the container from 443.
+* `HTTP_LISTEN_PORT` - Change the default inside the container from 10080.
+* `HTTPS_LISTEN_PORT` - Change the default inside the container from 10443.
 * `INTERNAL_LISTEN_PORT` - Change the default inside the container from 10418. Note: This is used for internal processing and is not available externally.
 * `HTTPS_REDIRECT` - Toggle whether or not we force redirects to HTTPS.  Defaults to true.
 * `ALLOW_COUNTRY_CSV` - List of [country codes](http://dev.maxmind.com/geoip/legacy/codes/iso3166/) to allow.

ci-build.sh

@@ -4,7 +4,7 @@ set -e
 
 TAG=ngx
 PORT=8443
-START_INSTANCE="docker run --privileged=true "
+START_INSTANCE="docker run "
 DOCKER_HOST_NAME=127.0.0.1
 MUTUAL_TLS="mutual-tls"
 STANDARD_TLS="standard-tls"
@@ -35,7 +35,7 @@ function clean_up() {
 function start_test() {
     INSTANCE=${TAG}
     tear_down
-    HTTPS_LISTEN_PORT=${HTTPS_LISTEN_PORT:-443}
+    HTTPS_LISTEN_PORT=${HTTPS_LISTEN_PORT:-10443}
     echo ""
     echo ""
     echo "_____________"
@@ -89,9 +89,9 @@ start_test "Start with minimal settings" "${STD_CMD} \
 echo "Test it's up and working..."
 wget -O /dev/null --quiet --no-check-certificate https://${DOCKER_HOST_NAME}:${PORT}/
 echo "Test limited protcol and SSL cipher... "
-docker run --link ${TAG}:${TAG}--rm --entrypoint bash ngx -c "echo GET / | /usr/bin/openssl s_client -cipher 'AES256+EECDH' -tls1_2 -connect ${TAG}:443" &> /dev/null;
+docker run --link ${TAG}:${TAG}--rm --entrypoint bash ngx -c "echo GET / | /usr/bin/openssl s_client -cipher 'AES256+EECDH' -tls1_2 -connect ${TAG}:10443" &> /dev/null;
 echo "Test sslv2 not accepted...."
-if docker run --link ${TAG}:${TAG}--rm --entrypoint bash ngx -c "echo GET / | /usr/bin/openssl s_client -ssl2 -connect ${TAG}:443" &> /dev/null; then
+if docker run --link ${TAG}:${TAG}--rm --entrypoint bash ngx -c "echo GET / | /usr/bin/openssl s_client -ssl2 -connect ${TAG}:10443" &> /dev/null; then
   echo "FAIL SSL defaults settings allow ssl2 ......"
   exit 2
 fi
@@ -116,8 +116,7 @@ start_test "Test GEODB settings can reject..." "${STD_CMD} \
            -e \"ADD_NGINX_LOCATION_CFG=error_page 403 /nginx-proxy/50x.shtml;\" \
            --link mockserver:mockserver "
 echo "Test GeoIP config IS rejected..."
-if ! curl -v -k https://${DOCKER_HOST_NAME}:${PORT}/ 2>&1 \
-  | grep '403 Forbidden' ; then
+if ! curl -v -k https://${DOCKER_HOST_NAME}:${PORT}/ 2>&1 \/ | grep '403 Forbidden' ; then
   echo "We were expecting to be rejected with 403 error here - we are not in the Congo!"
   exit 2
 else
@@ -188,7 +187,7 @@ start_test "Start with SSL CIPHER set and PROTOCOL" "${STD_CMD} \
            -e \"SSL_CIPHERS=RC4-MD5\" \
            -e \"SSL_PROTOCOLS=TLSv1.1\""
 echo "Test excepts defined protocol and cipher....."
-docker run --link ${TAG}:${TAG}--rm --entrypoint bash ngx -c "echo GET / | /usr/bin/openssl s_client -cipher 'RC4-MD5' -tls1_1 -connect ${TAG}:443" &> /dev/null;
+docker run --link ${TAG}:${TAG} --rm --entrypoint bash ngx -c "echo GET / | /usr/bin/openssl s_client -cipher 'RC4-MD5' -tls1_1 -connect ${TAG}:10443" &> /dev/null;
 
 
 
@@ -266,7 +265,7 @@ ${STD_CMD} -d \
 docker run --link "${MUTUAL_TLS}:${MUTUAL_TLS}" --rm martin/wait
 start_test "Start with upstream client certs" "${STD_CMD} \
            -e \"PROXY_SERVICE_HOST=https://${MUTUAL_TLS}\" \
-           -e \"PROXY_SERVICE_PORT=443\" \
+           -e \"PROXY_SERVICE_PORT=10443\" \
            -e \"DNSMASK=TRUE\" \
            -e \"USE_UPSTREAM_CLIENT_CERT=TRUE\" \
            -v \"${PWD}/client_certs/client.crt:/etc/keys/upstream-client-crt\" \
@@ -284,7 +283,7 @@ ${STD_CMD} -d \
 docker run --link "${STANDARD_TLS}:${STANDARD_TLS}" --rm martin/wait
 start_test "Start with failing upstream server verification" "${STD_CMD} \
            -e \"PROXY_SERVICE_HOST=https://${STANDARD_TLS}\" \
-           -e \"PROXY_SERVICE_PORT=443\" \
+           -e \"PROXY_SERVICE_PORT=10443\" \
            -e \"DNSMASK=TRUE\" \
            -e \"VERIFY_SERVER_CERT=TRUE\" \
            -v \"${PWD}/client_certs/ca.crt:/etc/keys/upstream-server-ca\" \
@@ -312,7 +311,7 @@ ${STD_CMD} -d \
 docker run --link "${STANDARD_TLS}:${STANDARD_TLS}" --rm martin/wait
 start_test "Start with succeeding upstream server verification" "${STD_CMD} \
            -e \"PROXY_SERVICE_HOST=https://${STANDARD_TLS}\" \
-           -e \"PROXY_SERVICE_PORT=443\" \
+           -e \"PROXY_SERVICE_PORT=10443\" \
            -e \"DNSMASK=TRUE\" \
            -e \"VERIFY_SERVER_CERT=TRUE\" \
            -v \"${PWD}/client_certs/ca.crt:/etc/keys/upstream-server-ca\" \
@@ -375,7 +374,7 @@ grep "Thanks for the big doc" /tmp/upload_test.txt &> /dev/null
 
 
 start_test "Start with listen for port 80" "${STD_CMD} \
-           -p 8888:80 \
+           -p 8888:10080 \
            -e \"PROXY_SERVICE_HOST=http://mockserver\" \
            -e \"PROXY_SERVICE_PORT=8080\" \
            -e \"DNSMASK=TRUE\" \

defaults.sh

@@ -8,8 +8,8 @@ export SERVER_CERT=${SERVER_CERT:-/etc/keys/crt}
 export SERVER_KEY=${SERVER_KEY:-/etc/keys/key}
 export SSL_CIPHERS=${SSL_CIPHERS:-'AES256+EECDH:AES256+EDH:!aNULL'}
 export SSL_PROTOCOLS=${SSL_PROTOCOLS:-'TLSv1.2'}
-export HTTP_LISTEN_PORT=${HTTP_LISTEN_PORT:-80}
-export HTTPS_LISTEN_PORT=${HTTPS_LISTEN_PORT:-443}
+export HTTP_LISTEN_PORT=${HTTP_LISTEN_PORT:-10080}
+export HTTPS_LISTEN_PORT=${HTTPS_LISTEN_PORT:-10443}
 export HTTPS_REDIRECT=${HTTPS_REDIRECT:-'TRUE'}
 export NO_LOGGING_BODY=${NO_LOGGING_BODY:-'TRUE'}
 export NO_LOGGING_RESPONSE=${NO_LOGGING_RESPONSE:-'TRUE'}

go.sh

@@ -64,8 +64,8 @@ done
 
 if [ "${NAME_RESOLVER}" == "" ]; then
     if [ "${DNSMASK}" == "TRUE" ]; then
-        dnsmasq
-        export NAME_RESOLVER=127.0.0.1
+        dnsmasq -p 5462
+        export NAME_RESOLVER=127.0.0.1:5462
     else
         export NAME_RESOLVER=$(grep 'nameserver' /etc/resolv.conf | head -n1 | cut -d' ' -f2)
     fi