lightweight openssh 9.3 on alpine 3.18.3 (with public key authentication and IP restrictions)
1.1K
Description: Creates a basic openssh container with public key authentication and IP restrictions.
environment variables:
SSHD_PUBLICKEY=ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA26/RVDqaqrkapqrCG9MmYOY841zJ8G/Hx6diiMoMhV [email protected]
SSHD_PUBLICKEY_URL=https://tacquet.be/m/vince_ed25519.pub
[email protected] [email protected]
GROUPID=101
USERID=100
DATAPATH=/data
the SSHD_PUBLICKEY and SSHD_PUBLICKEY_URL will use the environment variable and/or the url to put the key in the authorized_keys file, it will check if the key is already used, you can also skip these parameters and map the /config/authorized_keys file to a file outside of the container, it will be copied to the correct location and used when the container is restarted.
the SSHD_ALLOWUSERS environment variable allows you to block all non-listed IPs to the service, it defaults to data@* (user data from anywhere).
the GROUPID, USERID and DATAPATH environment variables allows you to change the groupid, userid and location of the storage files, it defaults to the ones in the example above.
docker-compose example:
openssh:
hostname: openssh
container_name: openssh
image: vtacquet/openssh:latest
restart: unless-stopped
ports:
- "2222:2222"
volumes:
- /etc/localtime:/etc/localtime:ro
- /opt/docker/openssh/config:/config
- /opt/docker/openssh/log/auth.log:/var/log/auth.log
- samba_data:/data
environment:
- TZ=Europe/Brussels
- SSHD_PUBLICKEY=ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA26/RVDqaqrkapqrCG9MmYOY841zJ8G/Hx6diiMoMhV [email protected]
- SSHD_PUBLICKEY_URL=https://tacquet.be/m/vince_ed25519.pub
- [email protected]
make sure you map the /config folder outside of the container otherwise it will regenerate its host keys everytime it is recreated
- /opt/docker/openssh/config:/config
if you want to use fail2ban to block all invalid logon attempts, make sure you map the /var/log/auth.log file outside of the container (change the jail file if you map the auth.log file elsewhere)
- /opt/docker/openssh/log/auth.log:/var/log/auth.log
use the following fail2ban filter in /etc/fail2ban/filter.d/openssh-keys.conf
[INCLUDES]
before = common.conf
[Definition]
failregex = crit sshd\[\d+\]: fatal: Timeout before authentication for <HOST> port \d+.*$
err sshd\[\d+\]: Disconnecting authenticating user \S+ <HOST> port \d+: Too many authentication failures.*$
err sshd\[\d+\]: error: maximum authentication attempts exceeded for invalid user \S+ from <HOST> port \d+.*$
info sshd\[\d+\]: banner exchange: Connection from <HOST> port \d+: invalid format.*$
info sshd\[\d+\]: Connection closed by \S+ user \S+ <HOST> port \d+ \[preauth\].*$
info sshd\[\d+\]: Connection reset by \S+ user \S+ <HOST> port \d+ \[preauth\].*$
info sshd\[\d+\]: Disconnected from invalid user \S+ <HOST> port \d+.*$
info sshd\[\d+\]: Failed password for \S+ from <HOST> port \d+.*$
info sshd\[\d+\]: Failed password for invalid user \S+ from <HOST> port \d+.*$
info sshd\[\d+\]: Invalid user \S+ from <HOST> port \d+.*$
info sshd\[\d+\]: Unable to negotiate with <HOST> port \d+.*$
info sshd\[\d+\]: User \S+ from <HOST> not allowed because not listed in AllowUsers.*$
ignoreregex = info sshd\[\d+\]: Server listening on.*$
info sshd\[\d+\]: Accepted publickey for data from <HOST> port \d+.*$
[Init]
maxlines = 1
use the following fail2ban jail in /etc/fail2ban/jail.d/openssh.conf
[openssh]
enabled = true
filter = openssh-keys
logpath = /opt/docker/openssh/log/auth.log
maxretry = 3
bantime = 4h
Content type
Image
Digest
sha256:41f273109…
Size
46.7 MB
Last updated
about 3 years ago
docker pull vtacquet/openssh