This is self-contained implementation of a basic Conjur implementation to demonstrate all key capabilities and to serve as a foundation for POCs and implementations.
Dependencies:
- locally available conjur docker image tarfile - v4.9.10 or greater required for auto-failover
- request download image via https://www.cyberark.com/get-conjur-enterprise/
- docker & docker-compose - can be installed w/ ./etc/install-dependencies.sh
- internet access required for initial builds, can run standalone after that
Demo root directory (.../cdemo):
- 0-startup-conjur.sh - takes no arguments - initializes demo environment:
- EDIT SCRIPT WITH PATH TO CONJUR TARFILE BEFORE RUNNING.
- triggers builds of ALL demo images - this can take 30 minutes or more - prepare accordingly!
- startups up Conjur, Conjur client CLI and Weave Scope containers
- Loads users-policy.yml and sets all user passwords to “foo”
- loads demo policies and sets secret values to the secret name prefixed with “ThisIsThe"
- 1-setup-containers.sh - takes two arguments (see demo scenario below) - starts up client application containers that fetch secrets from Conjur.
- 2-shutdown-containers.sh - takes no arguments - shuts down all client application containers.
- docker-compose.yml - file that drives all container builds and configurations.
- .env - file of environment variables for client application containers, referenced from docker-compose.yml, dynamically created by 1-setup-containers.sh
- load_policy.sh - loads a supplied policy file
- audit_policy.sh - compares a supplied policy file against current Conjur state, reports any deviations.
- watch_container_log.sh - takes no arguments - runs tail on container #1 script logfile to monitor fetch activity
- dbpassword_rotator.sh - sets the database password to a random hex value every 5 seconds
- apikey_rotator.sh - rotates the API key once.
Basic demo scenario: Spin up a bunch of minimal containers, each of which fetches a secret every few seconds in a continuous loop. Change the secret, deny access, rotate the API key and watch effects.
- run 0-startup-conjur.sh. REQUIRES INTERNET ACCESS FOR FIRST RUN ONLY. When complete demo environment is ready.
- run 1-setup_containers.sh w/ 2 args:
- number of containers to create
- number seconds for each container client to sleep betwixt secrets fetches
- run watch_container_log.sh on one of the containers (containers named cont-1 to cont-n)
- OR run weave scope (https://www.weave.works/oss/scope/), click into a container and 'tail -f cc.log'
- change secret in UI - watch it change in watched log
- audit_policy to show how we can see if current state is compliant with policy doc, change "permit" to "deny" for tomcat_hosts permissions, re-run audit_policy to show how to detect non-compliance
- change "permit" to "deny" in policy file, reload policy and show how none of the containers can fetch secrets
- 2-shutdown-containers.sh - brings down all webapp containers.
- docker-compose down - brings down all containers incl. conjur, cli & scope.
./ldap - LDAP demo directory:
- 0-setup-ldap.sh - brings up OpenLDAP server container and loads ldap-boostrap.ldif to populate it
- 1-ldap-sync.sh - imports ldap-sync.yml created by the Conjur web UI LDAP interface
./splunk - Splunk demo directory:
- 0-setup-splunk.sh - brings up the Splunk Enterprise container - watch the log till you see its listening then ctrl-C
./ssh - SSH demo directory:
- 0-setup-ssh.sh - takes 1 argument for # of "rack VMs" to bring up, configures each w/ Chef cookbook
- 1_create_key_for_user.sh - takes 1 argument (user name) - creates SSH key for given user and stored pub key in Conjur
- 2_test_fetch_userkey_from_host.sh - takes 2 arguments (user, container name) - tests if container can fetch user's pub key
- 3_ssh_user_to_host.sh - takes 2 arguments (user, container) - attempts to ssh as user to container/host
- 4_roles_with_resource_permissions.sh - takes 2 arguments (host:container, privilege) - shows all roles holding privilege on resource
- 5_review_activity_on_resource.sh - takes 1 argument (host:container) - displays audit records for resource
- rack.yml - policy file created and loaded by 0-setup-ssh.sh
- load_policy.sh - utility for loading ssh-mgmt.yml during demo to effect access changes
- ssh-mgmt.yml - defines access policies for Dev and Prod VM access
./simple_hf_example - very basic Host Factory demo:
- 1_set_hf_token.sh - one argument: output file, creats HF token, hostname and variable to retrieve
- 2_get_secret_restapi.sh - one argument: outfile from above, redeems HF token, retrieves variable w/ REST API
- 2_get_secret_summon.sh - one argument: outfile from above, redeems HF token, retrieves variable w/ Summon
- 3_cleanup.sh - deletes old HF tokens
- EDIT.ME - connection info for Conjur
- policy.yml - webapp policy to create variable for retrieval
- setup_summon.sh - installs summon
- tomcat.xml.erb - example template for secrets injection via Summon
./cluster - adds standbys and a follower to cluster:
- 0-setup-cluster.sh - brings cluster to default state of 1-master/2-standbys/1-follower
- 1-cluster-failover.sh - removes current master to trigger auto-failover, adds replacement standy
./etc directory:
- _conjur_init.sh - Conjur initialization script run from CLI container.
- _demo_init.sh - demo initialization script run from CLI container.
- conjur.conf, conjur-xxx.pem - configuration files for conjurization
- install-dependencies.sh - installs docker and docker-compose
Build directories - all image builds are triggered via docker-compose.yml (i.e. no build scripts):
- build/conjurcli:
- Dockerfile - builds a rich Conjur CLI client container
- build/etcd:
- Dockerfile - builds a container to run etcd cluster
- build/ldap:
- Dockerfile - builds a OpenLDAP server container
- build/splunk
- Dockerfile - builds a Splunk Enterprise container
- build/vm:
- Dockerfile - builds a "rack VM" image for SSH key management demo
- configure-ssh.sh - script to startup services on rack VM after configuration
- build/webapp:
- Dockerfile - builds webapp image based on Alpine w/ bash and curl installed
- webapp1.sh - script loaded into image as entry point when container is started. It is resilient to API key rotation.