diff --git a/centos/8/Dockerfile b/centos/8/Dockerfile new file mode 100644 index 0000000..4f92212 --- /dev/null +++ b/centos/8/Dockerfile @@ -0,0 +1,33 @@ +# Dockerfile +FROM centos:7 + +ENV DEBIAN_FRONTEND noninteractive +RUN yum -y update && yum -y install \ + curl-devel \ + openssl-devel \ + pam-devel \ + epel-release \ + python3-devel.x86_64 \ + python36 \ + python \ + python-devel.x86_64 \ + policycoreutils-devel \ + ruby-devel \ + gcc \ + make \ + rpm-build \ + rubygems + +#RUN pip install "python-socketio[client]" + +RUN echo "gem: --no-ri --no-rdoc" >/etc/gemrc +RUN gem install ffi --version 1.12.0 +#RUN gem install fpm +RUN gem install fpm --version 1.11.0 +#RUN gem install fpm-cookery +#RUN gem install buildtasks +#RUN gem install bundler + +COPY . /usr/src + +USER root diff --git a/centos/8/Jenkinsfile b/centos/8/Jenkinsfile new file mode 100644 index 0000000..5ca31e0 --- /dev/null +++ b/centos/8/Jenkinsfile @@ -0,0 +1,52 @@ +pipeline { + agent { + dockerfile { + args '-u root' + } + } + stages { + stage('make') { + steps { + sh 'cd /usr/src/SSH/PAM ; make' + } + } + stage('make selinux') { + steps { + sh 'cd /usr/src/SSH/PAM ; make selinux' + } + } + stage('make install') { + steps { + sh 'cd /usr/src/SSH/PAM ; make install DESTDIR=/usr/src/SSH/PAM' + } + } + stage('Build RPM for centos8') { + when { + branch "master" + } + steps { + sh "fpm \ + -C /usr/src/SSH/PAM \ + -s dir -t rpm \ + -m 'KRI ' \ + --url https://rublon.com/ \ + -n rublon-ssh -v 1.0 \ + --iteration ${currentBuild.number}.el8 \ + --depends openssh-server \ + --depends python3 \ + --depends python3-pip \ + --depends policycoreutils-python-utils \ + --config-files /etc/rublon.config \ + --description \"Rublon SSH\" \ + --after-install /usr/src/SSH/PAM/hooks/installsemodule.sh \ + /etc/rublon.config=/etc/rublon.config \ + /usr/share/rublon-ssh/confirmMethod.py=/usr/share/rublon-ssh/confirmMethod.py \ + /usr/share/rublon-ssh/confirmUser.py=/usr/share/rublon-ssh/confirmUser.py \ + /usr/lib64/security/pam_rublon.so=/usr/lib64/security/pam_rublon.so \ + /usr/share/rublon-ssh/login_rublon.pp=/usr/share/rublon-ssh/login_rublon.pp" + archiveArtifacts artifacts: '*.rpm', fingerprint: true + } + } + } +} + diff --git a/centos/8/Vagrantfile b/centos/8/Vagrantfile new file mode 100644 index 0000000..7c449c9 --- /dev/null +++ b/centos/8/Vagrantfile @@ -0,0 +1,103 @@ +# -*- mode: ruby -*- +# vi: set ft=ruby : + +# All Vagrant configuration is done below. The "2" in Vagrant.configure +# configures the configuration version (we support older styles for +# backwards compatibility). Please don't change it unless you know what +# you're doing. +Vagrant.configure("2") do |config| + config.vm.provider "virtualbox" + + # The most common configuration options are documented and commented below. + # For a complete reference, please see the online documentation at + # https://docs.vagrantup.com. + + # Every Vagrant development environment requires a box. You can search for + # boxes at https://vagrantcloud.com/search. + config.vm.box = "generic/centos8" + + # Disable automatic box update checking. If you disable this, then + # boxes will only be checked for updates when the user runs + # `vagrant box outdated`. This is not recommended. + config.vm.box_check_update = false + + # Create a forwarded port mapping which allows access to a specific port + # within the machine from a port on the host machine. In the example below, + # accessing "localhost:8080" will access port 80 on the guest machine. + # NOTE: This will enable public access to the opened port + # config.vm.network "forwarded_port", guest: 80, host: 8080 + + # Create a forwarded port mapping which allows access to a specific port + # within the machine from a port on the host machine and only allow access + # via 127.0.0.1 to disable public access + # config.vm.network "forwarded_port", guest: 80, host: 8080, host_ip: "127.0.0.1" + + # Create a private network, which allows host-only access to the machine + # using a specific IP. + # config.vm.network "private_network", ip: "192.168.33.10" + + # Create a public network, which generally matched to bridged network. + # Bridged networks make the machine appear as another physical device on + # your network. + #config.vm.network "public_network" + + # Share an additional folder to the guest VM. The first argument is + # the path on the host to the actual folder. The second argument is + # the path on the guest to mount the folder. And the optional third + # argument is a set of non-required options. + config.vm.synced_folder ".", "/home/vagrant/Rublon-Linux" + + # Provider-specific configuration so you can fine-tune various + # backing providers for Vagrant. These expose provider-specific options. + # Example for VirtualBox: + # + config.vm.provider "virtualbox" do |vb| + # Display the VirtualBox GUI when booting the machine + # vb.gui = true + # + # Customize the amount of memory on the VM: + # vb.memory = "1024" + end + # + # View the documentation for the provider you are using for more + # information on available options. + + # Enable provisioning with a shell script. Additional provisioners such as + # Puppet, Chef, Ansible, Salt, and Docker are also available. Please see the + # documentation for more information about their specific syntax and use. + config.vm.provision "shell", inline: <<-SHELL + yum update + + yum install -y curl-devel + yum install -y openssl-devel + yum install -y pam-devel + yum install -y epel-release + yum install -y python36-devel + yum install -y python36 + pip3 install "python-socketio[client]" + yum install -y policycoreutils-devel + yum install -y nano + + sed -i 's/UsePAM .*/UsePAM yes/' /etc/ssh/sshd_config + sed -i 's/ChallengeResponseAuthentication .*/ChallengeResponseAuthentication yes/' /etc/ssh/sshd_config + + cd /home/vagrant/Rublon-Linux/SSH/PAM/ + make + make selinux + make install + + semodule -i login_rublon.pp + + useradd -s /bin/bash -m kri + echo "kri:kri"|chpasswd + + grep -q -e '#auth substack password-auth' /etc/pam.d/sshd || sed -i -e 's/auth substack password-auth/#auth substack password-auth/g' /etc/pam.d/sshd + grep -q -e 'auth requisite pam_unix.so' /etc/pam.d/sshd || sed -i '\$aauth requisite pam_unix.so' /etc/pam.d/sshd + grep -q -e 'auth required pam_rublon.so' /etc/pam.d/sshd || sed -i '\$aauth required pam_rublon.so' /etc/pam.d/sshd + grep -q -e 'account required pam_rublon.so' /etc/pam.d/sshd || sed -i '\$aaccount required pam_rublon.so' /etc/pam.d/sshd + + service sshd restart + + #vagrant ssh -p -- -l psz + SHELL +end