THURSDAY, APRIL 25, 2019 CloudHSM client container based on Ubuntu with CloudHSM client, PKCS#11 library and PyKCS11 module installed and ready to use within a Docker/Kubernetes.

Docker Hub: https://hub.docker.com/r/walkerk1980/cloudhsm-pkcs11-python
View the code on GitHub: https://github.com/walkerk1980/cloudhsm-pkcs11-python

Prerequisites:

Container host Instance requires either an EC2 Instance Profile to be attached to the host Instance with IAM permissions that allow the container to pull the CloudHSM Cluster information or you can alternatively pass the container IAM Access Key Credential via Docker Environment Variables. [1][2]

[1] Using Instance Profiles - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html

[2] Environment Variables - https://docs.aws.amazon.com/cli/latest/userguide/cli-environment.html

This container requires you to provide the CLUSTERID of an HSM Cluster with at least one running HSM in the same Region/VPC as the host.

The Cluster/HSM requires the proper Security Groups allowing the Instance/Container to communicate with the Cluster.

For more information please see the CloudHSM documentation. [3]

  [3] Getting Started with AWS CloudHSM - https://docs.aws.amazon.com/cloudhsm/latest/userguide/getting-started.html

Getting Started:

$ docker volume create --name cloudhsm_data

$ docker run -it -d --rm --name cloudhsm -v cloudhsm_data:/root/data/ walkerk1980/cloudhsm-pkcs11-python /bin/bash

$ docker cp /path/to/customerCA.crt cloudhsm:/root/data/

$ docker stop cloudhsm

$ docker run -it -d -e CLUSTERID=cluster-5la5cwabs7v -v cloudhsm_data:/root/data --name cloudhsm -e REGION=us-west-2 walkerk1980/cloudhsm-pkcs11-python /usr/local/bin/startup.sh

Example commands once the container is running:

ensure that client is connected: 

$ docker logs cloudhsm

connect to bash on container: 

$ docker exec -it cloudhsm

Within bash - create CA: 

$ createCA.sh

Within bash - CloudHSM Managment Utilitiy: 

$ /opt/cloudhsm/bin/cloudhsm_mgmt_util /opt/cloudhsm/etc/cloudhsm_mgmt_util.cfg

ENVIRONMENT VARIABLES:

CLUSTERID is for the Cluster Id of your initialized CloudHSM Cluster containing at least one running HSM.

REGION is for the AWS Region that your CloudHSM Cluster is located in.

CASUBJECT (Optional) is for the subject of the local CA to be created.

CAKEYPASS (Optional) is for the local CA private key password.

AWS_ACCESS_KEY_ID (Optional) is for pulling requried cluster information if Instance Profile is not used.

AWS_SECRET_ACCESS_KEY (Optional) is for pulling requried cluster information if Instance Profile is not used.

AWS_SESSION_TOKEN (Optional) is for pulling requried cluster information if Instance Profile is not used.

Internal Container Commands:

createCA.sh - Set up the local CA using the information provided in CASUBJECT and CAKEYPASS. This will create an openssl CA and move it to the data volume

cainfo.sh - Get info about the customerCA.crt in place within the container

Set up Docker on FreeNAS 11.2 - Part 1 - RancherOS VM

Automate OpenSSL to pull a certificate thumbprint for an OIDC IDP

How to automatically pull the certificate thumbprint for an Open Identity Connect Providers certificate instead of the manual process described at http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html

You could use this process along with 'aws iam update-open-id-connect-provider-thumbprint' to automate the process of regularly pulling the certificate from your IDP and updating it's thumbprint in IAM.

code can be found at: https://github.com/walkerk1980/AWSScripts/blob/master/oidcThumbprint.pl

#!/usr/bin/perl

# The purpose of this script is to automate the process described in the link below
# Use this script at your own risk
# Obtaining the Thumbprint for an OpenID Connect Identity Provider
# http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html

#requires bash
#requires jq package
#requires perl
#requires openssl

#set the oidc idp URL
my $idpURL='https://login.microsoftonline.com/fabrikamb2c.onmicrosoft.com/v2.0/.well-known/openid-configuration';

my $cmd='curl -s ' . $idpURL . ' |jq -r \'.jwks_uri\'';

#run output of curl through jq
my $jwksURI=`$cmd`;

#cut off prepended https://
my $fullURL=substr($jwksURI, 8);

#cut off host of URL
my $hostURL=substr($fullURL, 0, index($fullURL, '/'));

$cmd='openssl s_client -showcerts -connect ' . $hostURL . ':443 </dev/null 2>/dev/null';

#use ssl_connect to get certificate chain
my $sslclientoutput=`$cmd`;

#cut junk off beginning of last cert
my $lastcertsub1=substr(substr($sslclientoutput, rindex($sslclientoutput, 'BEGIN')-5), 'END');
#cut junk off end of cert
my $lastcert=substr($lastcertsub1, 0, index($lastcertsub1, 'END')+20);

#create pem file
$cmd='echo "' . $lastcert . '" >oidcert.pem';
system($cmd);

$cmd='openssl x509 -fingerprint -noout -in oidcert.pem';
my $opensslfinger=`$cmd`;

#cut off junk at beginning
my $fingerprint=substr($opensslfinger, index($opensslfinger, '=')+1);

#get rid of colons
$fingerprint =~  s/://g;

print $fingerprint

Pi-Hole on FreeNAS Corral DNS Ad Block Tutorial

Configure PlexPy to Monitor Plex Usage

Install PlexPy on FreeNAS Corral to get notifications from Plex - Tutorial

Plex Media Server on FreeNAS Corral Tutorial