Skip to content

[2/3] Cloud-ready SSH on Docker

This article details the auxiliary SSH container mentioned in:

Why?

While this SSH container was initially designed to support the Burp Suite container, it does not depend on the Burp container. In other words, the SSH container can be used generically* to provide an auxiliary SSH service to any other container.

*with minor adjustments to its entrypoint.sh

Here are some advantages provided by its design:

  • Default SSH configuration:
    • sshd executes as root but does not allow login as root.
  • Creates unprivileged account for primary use.
    • Meant for file operations only; not administration of the SSH container itself.
    • Login is performed with SSH keys set up when building the container.
  • Provides file access in other containers via shared volumes.

dockerfile

The following is based on this dockerfile version.

This is a simple setup based on debian:buster-slim:
1
from debian:buster-slim
2
3
run apt-get update \
4
 && apt-get upgrade -y
5
6
run apt-get install --no-install-recommends -y openssh-server
7
8
run apt autoremove -y
9
After that, set up the unprivileged user, scribe:
10
run groupadd scribe && mkdir /home/scribe     \
11
 && useradd -s /bin/bash -g scribe scribe     \
12
 && cp /etc/skel/.bashrc /home/scribe/.bashrc \
13
 && echo "cd ~/share" >> /home/scribe/.bashrc
14

Note line 13: for convenience, it will cause the current directory to be ~/share upon login.

Finally…
15
run mkdir /run/sshd
16
17
copy ./entrypoint.sh   /home/scribe/
18
copy ./authorized_keys /home/scribe/.ssh/
19
20
run chmod 600 /home/scribe/.ssh/authorized_keys
21
22
expose 22/tcp
23
24
entrypoint ["/bin/bash", "/home/scribe/entrypoint.sh"]
  • Make sure /run/sshd exists, so that sshd can run.
  • Copy entrypoint.sh and authorized_keys to the container.
  • Set read/write privileges for scribe on authorized_keys.
  • Expose port 22 and set entrypoint.sh to execute when the container runs.

entrypoint.sh

The following is based on this entrypoint.sh version.

1
#! /bin/bash
2
3
_home="/home/scribe"
4
5
mkdir -p ${_home}/burp_share/user_configs
6
mkdir -p ${_home}/burp_share/project_configs
7
mkdir -p ${_home}/novnc_share
8

Create a few directories to host files from shared volumes. These directory names are the only adjustment needed to use the SSH container generically. They simply need to correspond to shared Docker volumes.

9
chown -R scribe:scribe ${_home}
10
11
exec /usr/sbin/sshd -D

Then, just give scribe access to its own home directory, and run sshd by means of exec in order to clean up the parent process.

Building and running

You can find interactive build and execution scripts for the Burp Suite and its auxiliary containers at github.com/elespike/burp_containers!

To build the container, simply:

  1. Ensure the current directory is where the dockerfile resides.
  2. Copy your desired authorized_keys file to the current directory.
  3. Execute sudo docker build <span class"hl">-t sshd:latest</span> ..

Note the trailing ., which just represents the current directory.
-t sshd:latest tags the build so we can reference it when running the container, as outlined below.

sudo docker run -d -it --rm Runs the container as a daemon (background process), with an interactive TTY, and remove it from disk when stopped.
--mount src=burp_share,dst=/home/scribe/burp_share,ro=false Mounts the burp_share volume to /home/scribe/burp_share in the SSH container.
--mount src=novnc_share,dst=/home/scribe/novnc_share,ro=false Mounts the novnc_share volume to /home/scribe/novnc_share in the SSH container.
-p 0.0.0.0:2200:22/tcp Listens on all of the host’s interfaces (0.0.0.0), on port 2200, and forwards all TCP traffic to port 22 on the container.
sshd:latest Runs the build tagged sshd:latest.

The --mount options should match the Docker volumes and directories you’ll be using with your own containers, if not the Burp and noVNC ones discussed in the previous article.

Needless to say, the same volumes should be mounted on each container whose files you’d like to access via the SSH container.

A complete example, with definitions for all containers discussed in this series as well as interactive build and run scripts, is present at github.com/elespike/burp_containers.

Stay tuned for future articles exploring containers that provide a noVNC client and server for remote GUI display, or for local GUI display in the absence of an X server.

Published inUncategorized

Be First to Comment

Leave a Reply

Your email address will not be published.