From e0993db80c396d7e59350b75ac558ff7189f3fbe Mon Sep 17 00:00:00 2001 From: Diego Lendoiro Date: Thu, 14 Sep 2017 11:56:15 +0200 Subject: [PATCH 01/12] add label instead of deprecated maintainer. Fixes #69 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index e459854..9222905 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ FROM alpine:3.6 -MAINTAINER diego@passbolt.com +LABEL maintainer="diego@passbolt.com" ENV PASSBOLT_VERSION 1.6.3 ENV PASSBOLT_URL https://github.com/passbolt/passbolt_api/archive/v${PASSBOLT_VERSION}.tar.gz From 4555b82bf48856a2088e4658bd2fa133a13a9546 Mon Sep 17 00:00:00 2001 From: Diego Lendoiro Date: Thu, 14 Sep 2017 12:11:17 +0200 Subject: [PATCH 02/12] added check to avoid duplicated emails. Fixes #63 --- bin/docker-entrypoint.sh | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/bin/docker-entrypoint.sh b/bin/docker-entrypoint.sh index e3645f2..5ff0135 100755 --- a/bin/docker-entrypoint.sh +++ b/bin/docker-entrypoint.sh @@ -171,7 +171,6 @@ email_cron_job() { chmod +x $cron_task echo "su -c \"$process_email\" -ls /bin/bash nginx" >> $cron_task - crond -f -c /etc/crontabs } @@ -203,6 +202,10 @@ if [ ! -f $ssl_key ] && [ ! -L $ssl_key ] && \ gen_ssl_cert fi +if ! grep run-parts /etc/crontabs/root ; then + email_cron_job +fi + php_fpm_setup install @@ -211,4 +214,4 @@ php-fpm5 nginx -g "pid /tmp/nginx.pid; daemon off;" & -email_cron_job +crond -f -c /etc/crontabs From 5bf046ee78d1fb2eebf157208881c6444ee77172 Mon Sep 17 00:00:00 2001 From: Diego Lendoiro Date: Thu, 14 Sep 2017 14:30:08 +0200 Subject: [PATCH 03/12] removed duplicated header line for hsts. Fixes #65 --- conf/passbolt.conf | 1 - 1 file changed, 1 deletion(-) diff --git a/conf/passbolt.conf b/conf/passbolt.conf index af68783..d51883d 100644 --- a/conf/passbolt.conf +++ b/conf/passbolt.conf @@ -58,7 +58,6 @@ server { ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS; ssl_session_tickets off; add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"; - add_header Strict-Transport-Security "max-age=63072000; includeSubdomains"; add_header X-Frame-Options DENY; add_header X-Content-Type-Options nosniff; From 4db19ba4533798689085e1350daf4960adaaebe9 Mon Sep 17 00:00:00 2001 From: Diego Lendoiro Date: Thu, 14 Sep 2017 14:42:33 +0200 Subject: [PATCH 04/12] strict cipher suite definitions --- conf/passbolt.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/conf/passbolt.conf b/conf/passbolt.conf index d51883d..bd13d67 100644 --- a/conf/passbolt.conf +++ b/conf/passbolt.conf @@ -55,7 +55,7 @@ server { ssl_certificate_key /etc/ssl/certs/certificate.key; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; - ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS; + ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH'; ssl_session_tickets off; add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"; add_header X-Frame-Options DENY; From 9674afb4d5b7057ac52cd490010cec5da73d8921 Mon Sep 17 00:00:00 2001 From: Diego Lendoiro Date: Thu, 14 Sep 2017 14:44:18 +0200 Subject: [PATCH 05/12] removed support for TLSv1 and TLSv1.1. Fixes #66 --- conf/passbolt.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/conf/passbolt.conf b/conf/passbolt.conf index bd13d67..9252cdf 100644 --- a/conf/passbolt.conf +++ b/conf/passbolt.conf @@ -53,7 +53,7 @@ server { ssl on; ssl_certificate /etc/ssl/certs/certificate.crt; ssl_certificate_key /etc/ssl/certs/certificate.key; - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; + ssl_protocols TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH'; ssl_session_tickets off; From 18e05a5eeecffa5c4cd59ca5c94ec6d454403963 Mon Sep 17 00:00:00 2001 From: Diego Lendoiro Date: Thu, 14 Sep 2017 15:03:11 +0200 Subject: [PATCH 06/12] removed duplicate --- conf/passbolt.conf | 3 --- 1 file changed, 3 deletions(-) diff --git a/conf/passbolt.conf b/conf/passbolt.conf index 9252cdf..c48a17a 100644 --- a/conf/passbolt.conf +++ b/conf/passbolt.conf @@ -72,9 +72,6 @@ server { # This header enables the Cross-site scripting (XSS) filter add_header X-XSS-Protection "1; mode=block"; - # This will enforce HTTP browsing into HTTPS and avoid ssl stripping attack - add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;"; - location / { try_files $uri $uri/ /index.php?$args; index index.php; From e3458ab264edd2b5a6083426bc79d61088390a42 Mon Sep 17 00:00:00 2001 From: Diego Lendoiro Date: Thu, 14 Sep 2017 15:37:32 +0200 Subject: [PATCH 07/12] added redis instead memcached --- Dockerfile | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 9222905..c0f3ee0 100644 --- a/Dockerfile +++ b/Dockerfile @@ -56,9 +56,10 @@ RUN apk add --no-cache $PHP_GNUPG_DEPS \ && ln -s /usr/bin/phpize5 /usr/bin/phpize \ #https://bugs.alpinelinux.org/issues/5378 && sed -i "s/ -n / /" $(which pecl) \ - && pecl install gnupg memcache \ - && echo "extension=memcache.so" > /etc/php5/conf.d/memcache.ini \ + && pecl install gnupg \ + && pecl install redis \ && echo "extension=gnupg.so" > /etc/php5/conf.d/gnupg.ini \ + && echo "extension=redis.so" > /etc/php5/conf.d/redis.ini \ && apk del $PHP_GNUPG_DEPS \ && curl -sS https://getcomposer.org/installer | php \ && mv composer.phar /usr/local/bin/composer \ From f888662faa0cb52cb77fca5eb4625e04505202cc Mon Sep 17 00:00:00 2001 From: Diego Lendoiro Date: Thu, 14 Sep 2017 15:59:11 +0200 Subject: [PATCH 08/12] remove continuation lines --- Dockerfile | 1 - 1 file changed, 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index c0f3ee0..c905c2d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -54,7 +54,6 @@ RUN apk add --no-cache $BASE_PHP_DEPS \ RUN apk add --no-cache $PHP_GNUPG_DEPS \ && ln -s /usr/bin/php5 /usr/bin/php \ && ln -s /usr/bin/phpize5 /usr/bin/phpize \ - #https://bugs.alpinelinux.org/issues/5378 && sed -i "s/ -n / /" $(which pecl) \ && pecl install gnupg \ && pecl install redis \ From 6bc808fde085b6d4b25a33a4d8515c19a879b489 Mon Sep 17 00:00:00 2001 From: Diego Lendoiro Date: Thu, 14 Sep 2017 16:02:20 +0200 Subject: [PATCH 09/12] output supressed --- bin/docker-entrypoint.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/docker-entrypoint.sh b/bin/docker-entrypoint.sh index 5ff0135..7f39bb6 100755 --- a/bin/docker-entrypoint.sh +++ b/bin/docker-entrypoint.sh @@ -202,7 +202,7 @@ if [ ! -f $ssl_key ] && [ ! -L $ssl_key ] && \ gen_ssl_cert fi -if ! grep run-parts /etc/crontabs/root ; then +if ! grep run-parts /etc/crontabs/root > /dev/null ; then email_cron_job fi From 5f5e97e516834e38f031160c455eef9b3a8b82b3 Mon Sep 17 00:00:00 2001 From: Diego Lendoiro Date: Thu, 14 Sep 2017 16:26:14 +0200 Subject: [PATCH 10/12] better check of the crontabs and nginx as final command --- bin/docker-entrypoint.sh | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/bin/docker-entrypoint.sh b/bin/docker-entrypoint.sh index 7f39bb6..201a0d5 100755 --- a/bin/docker-entrypoint.sh +++ b/bin/docker-entrypoint.sh @@ -166,11 +166,14 @@ email_cron_job() { mkdir -p $cron_task_dir - echo "* * * * * run-parts $cron_task_dir" >> $root_crontab + if ! grep $cron_task_dir $root_crontab > /dev/null; then + echo "* * * * * run-parts $cron_task_dir" >> $root_crontab + fi echo "#!/bin/sh" > $cron_task chmod +x $cron_task echo "su -c \"$process_email\" -ls /bin/bash nginx" >> $cron_task + crond -f -c /etc/crontabs & } @@ -202,16 +205,13 @@ if [ ! -f $ssl_key ] && [ ! -L $ssl_key ] && \ gen_ssl_cert fi -if ! grep run-parts /etc/crontabs/root > /dev/null ; then - email_cron_job -fi - php_fpm_setup install php-fpm5 -nginx -g "pid /tmp/nginx.pid; daemon off;" & +email_cron_job + +nginx -g "pid /tmp/nginx.pid; daemon off;" -crond -f -c /etc/crontabs From e40beb80e84c05a7274791c72646b6dba0892ff0 Mon Sep 17 00:00:00 2001 From: Diego Lendoiro Date: Thu, 14 Sep 2017 16:27:42 +0200 Subject: [PATCH 11/12] version bump to 1.6.5 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index c905c2d..fc8bd9f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,7 +2,7 @@ FROM alpine:3.6 LABEL maintainer="diego@passbolt.com" -ENV PASSBOLT_VERSION 1.6.3 +ENV PASSBOLT_VERSION 1.6.5 ENV PASSBOLT_URL https://github.com/passbolt/passbolt_api/archive/v${PASSBOLT_VERSION}.tar.gz ARG BASE_PHP_DEPS="php5-curl \ From 9acd8eb0898bc7859c3f7a43cb1c3f22ef5aacd1 Mon Sep 17 00:00:00 2001 From: Diego Lendoiro Date: Thu, 14 Sep 2017 16:41:43 +0200 Subject: [PATCH 12/12] updated changelog --- CHANGELOG.md | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 79911c6..34c1d9e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,17 @@ All notable changes to this project will be documented in this file. This project adheres to [Semantic Versioning](http://semver.org/). -## [Unreleased](https://github.com/passbolt/passbolt_docker/compare/v1.6.3...HEAD) +## [Unreleased](https://github.com/passbolt/passbolt_docker/compare/v1.6.5...HEAD) + +## [1.6.5](https://github.com/passbolt/passbolt_docker/compare/v1.6.3...v1.6.5) - 2017-09-14 + +- Refer to [passbolt_api CHANGELOG](https://github.com/passbolt/passbolt_api/blob/master/CHANGELOG.md) for a list of new features and fixes. + +### Fixed +- PASSBOLT-2406: change to LABEL, add docker-compose file for testing [#69](https://github.com/passbolt/passbolt_docker/pull/69) +- PASSBOLT-2407: Check for email cron before setting it [#63](https://github.com/passbolt/passbolt_docker/issues/63) +- PASSBOLT-2408: Strict Transport Security (HSTS) Invalid Server provided more than one HSTS header [#65](https://github.com/passbolt/passbolt_docker/issues/65) +- PASSBOLT-2410: nginx config sub optimal [#66](https://github.com/passbolt/passbolt_docker/issues/66) ## [1.6.3](https://github.com/passbolt/passbolt_docker/compare/v1.6.2+1...v1.6.3) - 2017-08-31