# Installing PAM using Docker How to install PAM using Docker # PAM Jump Server Installation The purpose of this tutorial is to show how to install Jump servers and configure PAM using Dockers, to use critical resources without knowing the password required. ### Jump Server > A jump server, jump host or jump box is a system on a network used to access and manage devices in a separate security zone. A jump server is a hardened and monitored device that spans two dissimilar security zones and provides a controlled means of access between them. (\*)
From version **1.4.36 and higher,** Soffid PAM Launcher and Store installs allowing only **TLSv1.3 protocol.**
## Prerequisites Prerequisites to install PAM using Dockers: 1\. Install docker ( [https://docs.docker.com/install/](https://docs.docker.com/install/) ) 2\. Create a Docker network(\*), that network allows you to connect containers to the same bridge network to communicate: ``` sudo docker network create -d bridge NETWORKNAME ``` *\* You can use the same network defined in the Console and Sync Server installation to avoid visibility problems.* ## Screen overview ## Installation The steps required to install PAM are: 1. Create the storage server container. 2. Create the launcher container. 3. Register storage server in Soffid console. ### Fast path to create storage server and launcher containers 1\. To create both containers, you can download the following script: **[install-pam.sh](https://bookstack.soffid.com/attachments/15)** 2\. Before installing, you have to edit the file and set the name of the new network you have created, and the latest versions of the store and launcher ```shell ......... docker create \ --network soffid \ -v soffid-pam-store:/opt/soffid/tomee/data \ -p 8081:8080 \ --name soffid-pam-store \ soffid/pam-store:1.3.0 >/dev/null ...... ``` ```shell ...... docker create \ --network soffid \ -v soffid-pam-launcher:/opt/soffid/tomee/launcher \ -v /var/run/docker.sock:/var/run/docker.sock \ -p 8082:8080 \ -e STORE_SERVER="http://$PUBLIC_IP:8081/" \ -e STORE_USER="$userid" \ -e STORE_PASSWORD="$pass" \ --name soffid-pam-launcher \ soffid/pam-launcher:1.3.0 >/dev/null ...... ``` 3\. Finally, you can execute the script ``` ~/Downloads$ bash ./install-pam.sh ``` ##### A brief description of the script 1. Creates two volumes, one for the storage and the other for the launcher. 2. Creates a storage server container: 2.1. In that container the files and videos recorded will be saved. 2.2. All the data will be saved using a key. 2.3. By default, it will use the 8081 port. 3. Starts the storage container. 4. Generates the user and password to connect the launcher. 5. Creates a launcher server container: 5.1. That container will be in charge of recording and sending the recording files to the storage. 5.2. Soffid allows you to configure some environment variables:Variable | Description |
STORE\_SERVER | Store URL |
STORE\_USER | Store user |
STORE\_PASSWORD | Store password |
JAVA\_KEYSTORE | (optional) Key store path that contains the key SSL |
KEYSTORE\_PASS | (optional) SSL key |
NETWORK\_ID | (optional) Network ID for docker services |
From version **1.4.36 and higher,** Soffid PAM Launcher and Store installs allowing only **TLSv1.3 protocol.**
\------------------------------------------------------------------------- \--- CREAR VOLUMNES \------------------------------------------------------------------------- docker volume create certificados-2 docker volume create soffid-pam-store-2 docker volume create soffid-pam-launcher-2 docker volume create soffid-pam-store-conf-2 docker volume create soffid-pam-launcher-conf-2 docker volume create soffid-pam-trustedcerts-2 \------------------------------------------------------------------------- \--- CREAR CERTIFICADOS JKS \------------------------------------------------------------------------- sudo openssl genrsa -aes256 -out soffid-pam-store-2.key sudo openssl req -x509 -days 1000 -new -key soffid-pam-store-2.key -out soffid-pam-store-2.pem sudo openssl pkcs12 -export -in soffid-pam-store-2.pem -inkey soffid-pam-store-2.key -out soffid-pam-store-2.pfx sudo openssl genrsa -aes256 -out soffid.pat.pam-2.key sudo openssl req -x509 -days 1000 -new -key soffid.pat.pam-2.key -out soffid.pat.pam-2.pem sudo openssl pkcs12 -export -in soffid.pat.pam-2.pem -inkey soffid.pat.pam-2.key -out soffid.pat.pam-2.pfx sudo keytool -v -importkeystore -srckeystore soffid-pam-store-2.pfx -srcstoretype PKCS12 \\ -destkeystore soffid-pam-store-2.jks \\ -deststoretype JKS \\ -destkeypass 123456 -srcstorepass 123456 -deststorepass 123456 sudo keytool -v -importkeystore -srckeystore soffid.pat.pam-2.pfx -srcstoretype PKCS12 \\ -destkeystore soffid.pat.pam-2.jks \\ -deststoretype JKS \\ -destkeypass 123456 -srcstorepass 123456 -deststorepass 123456 \------------------------------------------------------------------------- \--- COPIAR CERTIFICADOS JKS EN EL VOLUMEN LOS CERTFICADOS \------------------------------------------------------------------------- cp \*.jks /var/lib/docker/volumes/certificados-2/\_data \------------------------------------------------------------------------- \--- CREAR CONTENDOR STORE https://soffid-pam-store-2:8443 \------------------------------------------------------------------------- docker stop soffid-pam-store-2 docker rm soffid-pam-store-2 docker create \\ -v certificados-2:/opt/soffid/tomee/certificados \\ -v soffid-pam-store-conf-2:/opt/soffid/tomee/conf \\ -v soffid-pam-trustedcerts-2:/opt/soffid/tomee/trustedcerts \\ \--network netcompose \\ -p 8081:8443 \\ -v soffid-pam-store-2:/opt/soffid/tomee/data \\ \--name soffid-pam-store-2 \\ -e JAVA\_KEYSTORE=/opt/soffid/tomee/certificados/soffid-pam-store-2.jks \\ -e KEYSTORE\_PASS=123456 \\ soffid/pam-store:1.4.34 docker start soffid-pam-store-2 >/dev/null keytool -list -keystore keystore.jks docker exec soffid-pam-store-2 cat /opt/soffid/tomee/data/passwd docker exec soffid-pam-store-2 /opt/soffid/tomee/bin/add-user.sh soffid.pat.lab-launcher launcher Pass: i8h3CLzYxIzRb6d4RRhjpuKF6MOmZIlF0aZBxu8Nk5aPJfkKDYegbiOyzUzSggn7 \------------------------------------------------------------------------- \--- CREAR CONTENDOR LAUNCHER \------------------------------------------------------------------------- docker stop soffid-pam-launcher-2 docker rm soffid-pam-launcher-2 docker create \\ -v certificados-2:/opt/soffid/tomee/certificados \\ -v soffid-pam-launcher-conf-2:/opt/soffid/tomee/conf \\ -v soffid-pam-trustedcerts-2:/opt/soffid/tomee/trustedcerts \\ \--network netcompose \\ -v soffid-pam-launcher-2:/opt/soffid/tomee/launcher \\ -v /var/run/docker.sock:/var/run/docker.sock \\ -p 8082:8443 \\ -e STORE\_SERVER="https://soffid-pam-store-2:8443/" \\ -e STORE\_USER="soffid.pat.lab-launcher" \\ -e STORE\_PASSWORD="i8h3CLzYxIzRb6d4RRhjpuKF6MOmZIlF0aZBxu8Nk5aPJfkKDYegbiOyzUzSggn7" \\ -e JAVA\_KEYSTORE=/opt/soffid/tomee/certificados/soffid.pat.pam-2.jks \\ -e KEYSTORE\_PASS=123456 \\ \--name soffid-pam-launcher-2 \\ soffid/pam-launcher:1.4.35 docker start soffid-pam-launcher-2 keytool -list -keystore keystore.jks keytool -list -keystore soffid.pat.pam-2.jks \------------------------------------------------------------------------- \--- CERTIFICADOS DE CONFIANZA \------------------------------------------------------------------------- openssl s\_client -connect sync-server.netcompose:1760 < /dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > sync-server.netcompose.crt keytool -import -file sync-server.netcompose.crt -keystore cacerts -alias sync-server.netcompose docker restart soffid-pam-store-2 docker restart soffid-pam-launcher-2 \------------------------------------------------------------------------- \--- USUARIO EN STORE PARA CONSOLA \------------------------------------------------------------------------- docker exec soffid-pam-store-2 /opt/soffid/tomee/bin/add-user.sh soffid.pat.lab-console console Password: BWP0j7Ean8p0FrYVZsjnacYrYsDxs0UlG975HwJ3dYRGOF8YbuCnlUbHZnHlcw9c \------------------------------------------------------------------------- \--- CERTIFICADOS DE CONFIANZA EN LA CONSOLA \------------------------------------------------------------------------- cd /opt/soffid/iam-console-3/trustedcerts openssl s\_client -connect soffid-pam-store-2:8443 < /dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > soffid-pam-store-2.crt openssl s\_client -connect soffid.pat.pam-2:8082 < /dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > soffid.pat.pam-2.crt docker restart consola \------------------------------------------------------------------------- \--- CERTIFICADOS DE CONFIANZA EN EL SYNC SERVER \------------------------------------------------------------------------- cd /opt/soffid/iam-sync/conf/ openssl s\_client -connect soffid-pam-store-2:8443 < /dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > soffid-pam-store-2.crt \------------------------------------------------------------------------- \--- CERTIFICADOS DE CONFIANZA EN EL LAUNCHER \------------------------------------------------------------------------- openssl s\_client -connect soffid-pam-store-2:8443 < /dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > soffid-pam-store-2.crt keytool -import -file soffid-pam-store-2.crt -cacerts \------------------------------------------------------------------------- soffid.pat.pam-2:192.168.122.1