For educational reasons I've decided to create my own CA. Here is what I learned.
Lets get some context first.
| FROM nginx:alpine AS builder | |
| # nginx:alpine contains NGINX_VERSION environment variable, like so: | |
| # ENV NGINX_VERSION 1.15.0 | |
| # Our NCHAN version | |
| ENV NCHAN_VERSION 1.1.15 | |
| # Download sources | |
| RUN wget "http://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz" -O nginx.tar.gz && \ |
| # Install dependencies that nginx was originally compiled with | |
| sudo apt install libperl-dev libgeoip-dev libgd-dev | |
| # Get the nginx source | |
| wget https://nginx.org/download/nginx-1.14.0.tar.gz | |
| tar zxf nginx-1.14.0.tar.gz | |
| # Get the module source | |
| wget https://github.com/fdintino/nginx-upload-module/archive/master.zip | |
| unzip master.zip |
| # Install dependencies that nginx was originally compiled with | |
| sudo apt install libperl-dev libgeoip-dev libgd-dev | |
| # Get the nginx source | |
| wget https://nginx.org/download/nginx-1.14.0.tar.gz | |
| tar zxf nginx-1.14.0.tar.gz | |
| # Get the module source | |
| wget https://github.com/fdintino/nginx-upload-module/archive/master.zip | |
| unzip master.zip |
| # create keytab for radius user | |
| ipa-getkeytab -p 'radius/HOSTNAME' -k /etc/raddb/radius.keytab | |
| chown root:radiusd /etc/raddb/radius.keytab | |
| chmod 640 /etc/raddb/radius.keytab | |
| # make radius use the keytab for SASL GSSAPI | |
| mkdir -p /etc/systemd/system/radiusd.service.d | |
| cat > /etc/systemd/system/radiusd.service.d/krb5_keytab.conf << EOF | |
| [Service] | |
| Environment=KRB5_CLIENT_KTNAME=/etc/raddb/radius.keytab |