This image packages PaSSHport, a bastion host capable of proxying SSH connections. It allows sysadmins to log what happen on SSH and centralize the users and servers access.
- Docker Hub: https://hub.docker.com/r/frxyt/passhport
- GitHub: https://github.com/frxyt/docker-passhport
frxyt/passhport
- Clone the project:
git clone https://github.com/frxyt/docker-passhport.git
, thencd docker-passhport
- Start it:
docker-compose up -d --build
- Read the admin doc: https://docs.passhport.org/en/latest/getting-started.html
- Configure it:
docker-compose exec -u passhport passhport bash
- Create your first user group:
passhport-admin usergroup create
- Create your first user:
passhport-admin user create
- Add your user to the user group:
passhport-admin usergroup adduser
- Create your first target (server) group:
passhport-admin targetgroup create
- Assign the user group to the target group:
passhport-admin targetgroup addusergroup
- Create your first target:
passhport-admin target create
- Add your target to the target group:
passhport-admin targetgroup addtarget
- Create your first user group:
- Connect to your target using PaSSHport:
ssh [email protected] -p 22
- Clean it:
docker-compose down --volumes
These environment variables can be overriden to change the default behavior of the image and adapt it to your needs:
Name | Default value | Example | Description |
---|---|---|---|
FRX_LOG_PREFIX_MAXLEN |
10 |
16 |
Maximum length of prefix displayed in logs |
PASSHPORT_CERT_DAYS |
365 |
3650 |
PaSSHport certificate duration in days |
PASSHPORT_CERT_SUBJ |
/C=FX/ST=None/L=None/O=None/OU=None/CN=localhost |
/C=FR/ST=67/L=SXB/O=FRXYT/OU=IT/CN=xrdp.frx.yt |
PaSSHport certificate subject |
PASSHPORTD_DB_SALT |
thepasshportsafeandsecuresalt |
VerySecureSalt |
PaSSHport database salt for password encryption |
PASSHPORTD_DB_SESSIONS_TO |
12 |
10 |
PaSSHport database sessions default timeout in hours |
PASSHPORTD_HOSTNAME |
localhost |
bastion.frx.yt |
PaSSHport hostname |
PASSHPORTD_KEEPCONNECT |
True |
True / False |
Relaunch PaSSHport once a session is over |
PASSHPORTD_LISTENING_IP |
0.0.0.0 |
192.168.1.10 |
passhportd listening IP |
PASSHPORTD_MAXLOGSIZE |
5 |
10 |
PaSSHport maximum log file size in MB |
PASSHPORTD_NODE_NAME |
passhport-node |
passhport |
Relaunch Node Name in case of HA |
PASSHPORTD_NOTIF_FROM |
passhport@bastion |
[email protected] |
E-mail address sending PaSSHport notifications |
PASSHPORTD_NOTIF_LOG_TYPE |
email |
email |
Only email |
PASSHPORTD_NOTIF_SMTP |
127.0.0.1 |
smtp |
SMTP server for sending PaSSHport notifications |
PASSHPORTD_NOTIF_TO |
root, admin@passhport |
[email protected] |
Recipients of PaSSHport notifications |
PASSHPORTD_PORT |
443 |
5000 |
PaSSHport admin port |
PASSHPORTD_SCP_THROUGH_TARGET |
False |
True / False |
Allow to directly up/download file to a server behind a target via scp |
PASSHPORTD_SSL |
True |
True / False |
Use SSL for PaSSHport |
PASSHPORTD_UNIQ_TARGETS_ID |
True |
True / False |
Targets identifiants are the same for every user |
SSHD_LISTEN_ADDRESS |
0.0.0.0 |
192.168.1.10 |
SSHD listen address |
SSHD_PASSWD_AUTH |
no |
yes / no |
Enable password authentication in SSHD |
SSHD_PORT |
22 |
2200 |
SSHD listen port |
SSHD_PUBKEY_AUTH |
yes |
yes / no |
Enable public key authentication in SSHD |
TZ |
Etc/UTC |
Europe/Paris |
Container time zone |
UWSGI_PROCESSES |
5 |
50 |
Number of processes for PaSSHport spawned by uWSGI |
docker build -f Dockerfile -t frxyt/passhport:latest .
docker run --rm -d --name passhport frxyt/passhport:latest
docker exec -itu passhport passhport bash
docker stop passhport
Solution: Restart the passhport container.
Error passhport@xxx: Permission denied (publickey,keyboard-interactive).
while connecting to ssh and this error is displayed in passhport logs sshd | Authentication refused: bad ownership or modes for file /home/passhport/.ssh/authorized_keys
Solution: Don't mount /home/passhport/.ssh
folder on a Windows host filesystem directly. Use WSL2 or a named volume instead.
This project and images are published under the MIT License.
MIT License
Copyright (c) 2021 FEROX YT EIRL, www.ferox.yt <[email protected]>
Copyright (c) 2021 Jérémy WALTHER <[email protected]>
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.