tiredofit/docker-self-service-password tiredofit/docker-self-service-password

  • Stars
    star
    115
  • Rank 305,916 (Top 7 %)
  • Language
    Dockerfile
  • License
    MIT License
  • Created about 7 years ago
  • Updated over 1 year ago
Twitter logo Share LinkedIn logo Share Facebook logo Share
tiredofit/docker-self-service-password
github

tiredofit

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Dockerized LDAP Tollbox Self Service Password Changer with many customizable options

github.com/tiredofit/docker-self-service-password

GitHub release Build Status Docker Stars Docker Pulls Become a sponsor Paypal Donate

About

Dockerfile to build a LTB-Self Service Password self service password reset tool for infrastructure with an LDAP backend.

Maintainer

Table of Contents

Prerequisites and Assumptions

  • Assumes you are using some sort of SSL terminating reverse proxy such as:
  • Require - Access to an LDAP Server
  • Require - Access to a SMTP Server

Installation

Build from Source

Clone this repository and build the image with docker build <arguments> (imagename) .

Prebuilt Images

Builds of the image are available on Docker Hub and is the recommended method of installation.

The following image tags are available along with their taged release based on what's written in the Changelog:

Container OS Tag
Alpine :latest

Multi Archictecture

Images are built primarily for amd64 architecture, and may also include builds for arm/v6, arm/v7, arm64 and others. These variants are all unsupported. Consider sponsoring my work so that I can work with various hardware. To see if this image supports multiple architecures, type docker manifest (image):(tag)

Configuration

Quick Start

Persistent Storage

The following directories are used for configuration and can be mapped for persistent storage.

Directory Description
/www/ssp Root SelfService Password Directory

OR

Don't map anything and let it run with the included source inside the image. If you wish to customize the source on each container restart map the following

Directory Description
/assets/custom Place files to be added/updated on container start following the /www/ssp file / folder structure

OR

If you want to manually configure the application you can set SETUP_TYPE=MANUAL in environment variables and map the following:

Directory Description
/www/ssp/conf SSP Configuration Directory

Environment Variables

Base Images used

This image relies on an Alpine Linux or Debian Linux base image that relies on an init system for added capabilities. Outgoing SMTP capabilities are handlded via msmtp. Individual container performance monitoring is performed by zabbix-agent. Additional tools include: bash,curl,less,logrotate,nano,vim.

Be sure to view the following repositories to understand all the customizable options:

Image Description
OS Base Customized Image based on Alpine Linux
Nginx Nginx webserver
PHP-FPM PHP Interpreter
Parameter Description Default
SETUP_TYPE Configure SSP via environment variables AUTO or MANUAL - If true, ignore everything below AUTO

LDAP Settings

Parameter Description Default
LDAP_SERVER Ldap server.
LDAP_STARTTLS Enable TLS on Ldap bind.
LDAP_BINDDN Ldap bind dn.
LDAP_BINDPASS Ldap bind password.
LDAP_BASE_SEARCH Base where we can search for users.
LDAP_FILTER LDAP Lookup Filter (&(objectClass=person)(\$ldap_login_attribute={login}))
LDAP_ANSWER_ATTRIBUTE Ldap property to get user's answers if Questions enabled. info
LDAP_LOGIN_ATTRIBUTE Ldap property used for user searching. uid
LDAP_FULLNAME_ATTRIBUTE Ldap property to get user fullname. cn
LDAP_MAIL_ATTRIBUTE Ldap property to get user mail. mail
LDAP_SMS_ATTRIBUTE Ldap property to get user SMS Phone Number. mobile
LDAP_SSHKEY_ATTRIBUTE Ldap property to get user mail. sshKey
LDAP_CA_CERTIFICATE Path to Root CA if using ldaps.
AD_OPT_CHANGE_EXPIRED_PASSWORD Allow user with expired password to change password. false
AD_OPT_FORCE_PWD_CHANGE Force user change password at next login. false
AD_OPT_FORCE_UNLOCK Force account unlock when password is changed. Default to false
ADMODE Specifies if LDAP server is Active Directory LDAP server. If your LDAP server is AD, set this to true. false
PASSWORD_HASH_CRYPT_SALT_LENGTH - If CRYPT selected what is the hash salt length 6
PASSWORD_HASH_CRYPT_SALT_PREFIX - If CRYPT selected what is the hash prefix $6$
PASSWORD_HASH Hash mechanism for passwordSSHA SHA SMD5 MD5 CRYPT clear (the default) auto (will check the hash of current password - if no password existed before, it will set as clear) This option is not used with ad_mode = true
QUESTIONS_ANSWER_OBJECTCLASS Default Object Class extensibleObject
SAMBA_EXPIRE_DAYS Set Password Expiry in Days 90
SAMBA_MAX_AGE Set Password maximum age in AD 45
SAMBA_MIN_AGE Set Password minimum age in AD 5
SAMBA_MODE Samba mode, if is true update sambaNTpassword and the following SAMBA attributes too; if is false just update the password. false
SHADOW_OPT_UPDATE_SHADOWEXPIRE If true update ShadowLastExpire. false
SHADOW_OPT_UPDATE_SHADOWLASTCHANGE If true update shadowLastChange. false

Local Password Policy Settings

Parameter Description Default
PASSWORD_DIFFERENT_LOGIN Should password be different than login true
PASSWORD_MAX_LENGTH Maximal length. 0 (unchecked).
PASSWORD_MIN_DIGIT Minimal digit characters. 0 (unchecked).
PASSWORD_MIN_LENGTH Minimal length. 0 (unchecked).
PASSWORD_MIN_LOWERCASE Minimal lower characters. 0 (unchecked).
PASSWORD_MIN_SPECIAL Minimal special characters. 0 (unchecked).
PASSWORD_MIN_UPPERCASE Minimal upper characters. 0 (unchecked).
PASSWORD_COMPLEXITY Minimum number of different classes of characters. 0 (unchecked).
PASSWORD_NO_REUSE Dont reuse the same password as currently. true.
PASSWORD_NO_SPECIAL_ENDS Dont allow special characters at start and end of password false
PASSWORD_SHOW_POLICY_POSITION Position of password policy constraints message above below above
PASSWORD_SHOW_POLICY Show policy constraints messagealways never onerror never
PASSWORD_SPECIAL_CHARACTERS Define Special Characters ^a-zA-Z0-9
PASSWORD_USE_PWNED Utilize HaveIbeenpwned.com Password checking service false
WHO_CAN_CHANGE_PASSWORD Who changes the password? Also applicable for question/answer save user: the user itself manager: the above binddn. user

Questions Settings

Parameter Description Default
USE_QUESTIONS Use questions/answers? true or false false
QUESTIONS_ANSWER_CRYPT true
QUESTIONS_MULTIPLE_ANSWERS Allow multiple answers for Questions false

Mail Settings

Parameter Description Default
MAIL_CHARSET Mail Character set utf8
MAIL_CONTENTTYPE Content Type Delcaration plain/text
MAIL_FROM_NAME Name for MAIL_FROM. Self Service Password
MAIL_FROM Who the email should come from. [email protected]
MAIL_NEWLINE How to address New lines PHP_EOL
MAIL_PRIORITY Priority tag of mail 3
MAIL_SIGNATURE Mail Signature ``
MAIL_USE_LDAP Use first address in LDAP attribute skipping asking for mail false
MAIL_WORDWRAP Amount of characters to wordwrap email 80
NOTIFY_ON_CHANGE Notify users anytime their password is changed. false
NOTIFY_ON_SSHKEY_CHANGE Notify on SSH Key Change true
SMTP_AUTH_ON Force smtp auth with SMTP_USER and SMTP_PASS. false
SMTP_AUTOTLS SMTP Auto TLS true or false false
SMTP_DEBUG SMTP debug mode (following https:////github.com/PHPMailer/PHPMailer instructions). 0
SMTP_HOST SMTP host.
SMTP_KEEPALIVE SMTP Keepalive false
SMTP_PASS SMTP password.
SMTP_PORT SMTP port. 587
SMTP_SECURE_TYPE SMTP secure type to use. ssl or tls. tls
SMTP_TIMEOUT SMTP Timeout in seconds 30
SMTP_USER SMTP user.

Token Settings

Parameter Description Default
USE_TOKENS Use email to send reset tokens. true
TOKEN_CRYPT Encrypt tokens true
TOKEN_LIFETIME How long are tokens valid in seconds 3600

SMS Settings

Parameter Description Default
USE_SMS Enable sms verification. false
SMS_API_LIB API Library location for SMS /lib/smsapi.inc.php
SMS_MAIL_SUBJECT Subject for SMS message Provider Code
SMS_MAIL_TO Mail Address {sms_attribute}@service.provider.com}
SMS_MESSAGE SMS Message {snsresetnessae} {smstoken}
SMS_METHOD How to send SMS mail or api mail
SMS_PARTIAL_HIDE_NUMBER Partially hide SMS number in true
SMS_SANITIZE_NUMBER Sanitize non numbers from number false
SMS_TOKEN_LENGTH How many digits for a SMS Code 6
SMS_TRUNCATE_NUMBER_LENGTH How many characters for above 10
SMS_TRUNCATE_NUMBER Truncate Characters of number false

SSH Settings

Parameter Description Default
CHANGE_SSHKEY Enable Changing SSH Key. false
WHO_CAN_CHANGE_SSHKEY Who changes the password? Also applicable for question/answer save user: the user itself manager: the above binddn. user

Recaptcha Settings

Parameter Description Default
USE_RECAPTCHA Use Google reCAPTCHA (http://www.google.com/recaptcha). false
RECAPTCHA_PUB_KEY Go on the site to get public key
RECAPTCHA_PRIV_KEY Go on the site to get private key
RECAPTCHA_THEME Theme of ReCaptcha. Default: light
RECAPTCHA_TYPE Type of ReCaptcha Default: image
RECAPTCHA_SIZE Size of ReCaptcha Default: small
RECAPTCHA_REQUEST_METHOD Special cases null

Misc Application and Branding Settings

Parameter Description Default
BACKGROUND_IMAGE Change background Default images/unsplash-space.jpg
DEBUG_MODE Debug mode. false
DEFAULT_ACTION Default actionchange sendtoken sendsms. change
ENABLE_RESET_LOG - Write to log detailing password resets FALSE
IS_BEHIND_PROXY Enable reset url parameter to accept reverse proxy. false
SITE_URL Use this to hardcode a Site URL if IS_BEHIND_PROXY=true - By default it will pull from various HTTP Headers. Example -``https://site.example.com`
LANG Language. en.
LOG_LOCATION Log Folder /www/logs/self-service-password/
LOG_RESET - Reset Logfile reset.log
LOGO Main Logo - Default images/ltb-logo.png
SECRETKEY Encryption, decryption keyphrase. Defaults tosecret
SHOW_HELP Display help messages. true.

Networking

The following ports are exposed.

Port Description
80 HTTP

Maintenance

Shell Access

For debugging and maintenance purposes you may want access the containers shell.

bash docker exec -it (whatever your container name is) bash

Support

These images were built to serve a specific need in a production environment and gradually have had more functionality added based on requests from the community.

Usage

  • The Discussions board is a great place for working with the community on tips and tricks of using this image.
  • Consider sponsoring me personalized support.

Bugfixes

  • Please, submit a Bug Report if something isn't working as expected. I'll do my best to issue a fix in short order.

Feature Requests

  • Feel free to submit a feature request, however there is no guarantee that it will be added, or at what timeline.
  • Consider sponsoring me regarding development of features.

Updates

  • Best effort to track upstream changes, More priority if I am actively using the image in a production environment.
  • Consider sponsoring me for up to date releases.

License

MIT. See LICENSE for more details.## References

References

More Repositories

1

docker-freepbx

Dockerized FreePBX 15 w/Asterisk 17, Seperate MySQL Database support, and Data Persistence and UCP
496
star
2

docker-db-backup

Backup multiple database types on a scheduled basis with many customizable options
Dockerfile
472
star
3

docker-traefik-cloudflare-companion

Automatically Create CNAME records for containers served by Traefik
Python
274
star
4

docker-freescout

Dockerized Freescout Helpdesk
Dockerfile
146
star
5

docker-nginx-php-fpm

Dockerized Nginx + PHP FPM images with many customizable options
Dockerfile
106
star
6

docker-openldap

Dockerized OpenLDAP server with many customizable options
99
star
7

docker-jitsi-meet

Docker Jitsi Meet WebRTC conferencing system w/Prosody XMPP and s6 overlay
Dockerfile
64
star
8

docker-collabora-online

Dockerized Collabora Office Online with customizable options
Dockerfile
62
star
9

docker-osticket

Dockerized Help Desk Software
PHP
48
star
10

docker-tinc

Docker Tinc VPN Mesh server w/S6 Overlay Init, Zabbix Monitoring, and distributed configuration updating based on Alpine
Dockerfile
43
star
11

docker-postal

Dockerized Postal SMTP Server based on Alpine Linux and Ruby
Dockerfile
40
star
12

docker-fusiondirectory

Dockerized FusionDirectory LDAP Manager
Dockerfile
39
star
13

docker-lemonldap

Dockerized Authentication Server with Single Sign On SAML, OpenID Connect, CAS, and Header support
Dockerfile
39
star
14

docker-openldap-fusiondirectory

Dockerized OpenLDAP server with FusionDirectory Schema Support
34
star
15

docker-wordpress

Dockerized Wordpress Image with customizable options
Python
31
star
16

docker-alpine

Docker Alpine Linux Base Images
Dockerfile
30
star
17

docker-traefik

Dockerized Traefik Reverse Proxy with customizable options
Dockerfile
29
star
18

docker-mongodb-backup

Docker MongoDB Backup Container based on Alpine w/S6 init, Zabbix Monitoring
Dockerfile
28
star
19

docker-nginx-proxy-cloudflare-companion

Automatically update CNAME records when Docker container starts via Cloudflare
Python
27
star
20

docker-spamassassin

Docker Spamassassin Spam filtering based on Alpine Linux
Dockerfile
26
star
21

docker-clamav

Docker ClamAV Image with Zabbix Monitoring and Customizable Configuration
Dockerfile
23
star
22

docker-baserow

Dockerized Baserow No/Low code data management application based on Alpine
Dockerfile
22
star
23

docker-nginx

Dockerzed webserver with many customizable options
Dockerfile
22
star
24

docker-nextcloud

Dockerized Nextcloud Server with many customizable options
17
star
25

docker-gitlab-ee

Dockerized Gitlab Enterprise Edition
Dockerfile
17
star
26

docker-debian

Docker Debian Base Images
Dockerfile
15
star
27

docker-discourse

Dockerized Discourse Forum
Dockerfile
15
star
28

docker-backuppc

Docker BackupPC with Zabbix monitoring support
Perl
15
star
29

docker-gcds

Docker Google Cloud Directory Sync service (GADS) w/S6 Overlay, Zabbix Monitoring
Dockerfile
14
star
30

docker-mariadb-backup

Docker MariaDB Backup Container w/ S6 Overlay, Zabbix Monitoring based on Alpine
Dockerfile
13
star
31

docker-zabbix

Dockerized Zabbix Server, Proxy, and Frontend
Dockerfile
13
star
32

docker-insync

Docker Insync Headless Client
Dockerfile
12
star
33

docker-rspamd

Dockerized Anti Spam Filter
Python
12
star
34

docker-nginx-ldap

Docker Nginx Image w/LDAP Authentication, Zabbix agent monitoring, S6 init, logrotate based on Alpine
Dockerfile
11
star
35

docker-bookstack

Dockerized Information Manager
Dockerfile
11
star
36

docker-mariadb

Docker MariaDB server w/ S6 Overlay, Zabbix Monitoring based on Alpine
11
star
37

docker-gitlab

Dockerized Gitlab CE w/Alpine Linux, Zabbix Monitoring and S6 Overlay
Dockerfile
10
star
38

docker-staytus

Docker Staytus Image w/s6 overlay, zabbix monitoring based on Alpine
HTML
10
star
39

docker-leantime

Dockerized Project Managment tool with many configurable options
Dockerfile
10
star
40

docker-otrs

Dockerized OTRS ITSM Helpdesk/Ticketing System based on Alpine w/Nginx
Dockerfile
9
star
41

docker-unbound

Docker Unbound DNS Resolver based on Alpine
Dockerfile
9
star
42

docker-postgres

Dockerized Postgresql Server with multiple databases/users, replication, and monitoring support
Dockerfile
9
star
43

docker-postfix

Dockerized MTA with many customizable features, LDAP, SASL, Milter, Relay Support
Dockerfile
8
star
44

docker-matomo

Dockerized Matomo (Piwik) Analytics
Dockerfile
8
star
45

docker-yourls

Dockerized YOURLS link shortener based on Alpine
Dockerfile
8
star
46

docker-invoiceninja

Dockerized Invoicing web application
Dockerfile
7
star
47

docker-nodejs

Docker NodeJS Base Images
7
star
48

docker-postfix-relay

Dockerized Postfix Relay for easy SMTP capabilities
Shell
7
star
49

docker-openvpn

Dockerized OpenVPN server w/Alpine+Debian Variants w/s6 overlay, and LDAP Authentication support
7
star
50

docker-rocketchat

Docker Rocketchat Server with S6 Initsystem and Zabbix Monitoring based on Alpine
6
star
51

docker-kopano

Dockerized Kopano Groupware server
Dockerfile
6
star
52

docker-n8n

Dockerized n8n workflow automation tool
Dockerfile
6
star
53

docker-listmonk

Dockerized Listmonk Mailing List server built iwth Alpine w/Zabbix Monitoring
Dockerfile
6
star
54

docker-cpuminer

Cryptocurrency Miner based on Alpine
6
star
55

docker-kopano-core

Dockerized Kopano Groupware Server
6
star
56

docker-grafana

Dockerfile
5
star
57

docker-moodle

Dockerized Moodle Learning Management System
Dockerfile
5
star
58

docker-loki

Dockerized Loki Log Analyzer
Dockerfile
5
star
59

docker-teampass

Dockerized Password Vault for Teams based on Alpine w/nginx,php-fpm
Dockerfile
5
star
60

docker-orbeon

Docker Orbeon Forms CE w/S6 Init, Tomcat, based on Alpine
Dockerfile
5
star
61

docker-redis

Docker Redis Server with S6 Initsystem and Zabbix Monitoring based on Alpine
5
star
62

docker-elasticsearch

Dockerized Elasticsearch based on Alpine linux
4
star
63

fusiondirectory-plugin-kopano

Plugin to manage users/groups for Kopano (fork of Zarafa) within Fusion Directory LDAP Manager
PHP
4
star
64

docker-novnc

Run GUI applications within a browser - Base image
Dockerfile
4
star
65

docker-flarum

Dockerized Flarum Web Forum Software based on Alpine
Shell
4
star
66

docker-registry

Dockerized Docker Registry
Dockerfile
4
star
67

docker-rabbitmq

Dockerized RabbitMQ server
Python
4
star
68

docker-gitlab-runner

Docker Gitlab runner w/ Zabbix monitoring support based on Alpine
4
star
69

docker-openeats

Dockerized Openeats Recipe manager based on Alpine Linux w/Zabbix Monitoring
Dockerfile
3
star
70

docker-restic

Dockerized Backup application
Dockerfile
3
star
71

docker-dovecot

Docker Dovecot IMAP server based on Alpine w/LDAP Support
TSQL
3
star
72

docker-uptimekuma

Dockerized Service availability monitoring system
Dockerfile
3
star
73

docker-draw-io

Docker Draw.IO image based on Alpine and Nginx
3
star
74

docker-logrotate

Docker Logrotate to keep logfiles compressed and rotated based on Alpine
Shell
3
star
75

docker-mailhog

Dockerized SMTP Test server
Dockerfile
3
star
76

docker-cachet

Dockerized Cachet Status monitoring application based on Alpine Linux
Dockerfile
3
star
77

docker-sentry

Dockerized Sentry.IO Exception tracking system based on Debian w/LDAP and SAML
Python
3
star
78

docker-airsonic-advanced

Dockerized Airsonic Advanced Server based on Alpine
Dockerfile
3
star
79

docker-limesurvey

Dockerized Limesurvey application based on Alpine
Dockerfile
3
star
80

docker-mongo

Docker MongoDB server w/ S6 Overlay, Zabbix Monitoring based on Alpine
3
star
81

docker-haraka

Docker Haraka MTA based on Alpine
JavaScript
3
star
82

docker-ruby

Docker Ruby base images w/ S6 Overlay and Zabbix monitoring support
3
star
83

docker-ubuntu

Dockerized Ubuntu Base Images
Dockerfile
2
star
84

docker-memcached

Docker Memcached Server w/ S6 Initsystem and Zabbix Monitoring based on Alpine
Dockerfile
2
star
85

home

Home-Manager configuration ala Nix flakes
Nix
2
star
86

docker-kopano-meet

Dockerfile
2
star
87

docker-soulseek

Dockerized Soulseek Client
Dockerfile
2
star
88

docker-kopano-kapi

Dockerfile
2
star
89

docker-kopano-konnect

Dockerfile
2
star
90

docker-olefy

Dockerized Olefy TCP listener for OLE Tools
Dockerfile
2
star
91

docker-logchimp

Dockerized Logchimp Application
Dockerfile
2
star
92

docker-transmission

Dockerized Transmission client
Dockerfile
2
star
93

docker-dind

Docker in Docker Image with Zabbix monitoring Support and --squash --compress options by default based on Alpine
Dockerfile
2
star
94

docker-matrix-bridges

Dockerized Matrix Bridges to interconnect services
Dockerfile
2
star
95

docker-monica

Dockerized Monica PRM
Dockerfile
2
star
96

tiredofit

2
star
97

docker-minio

Dockerized Minio Server based on Alpine
Dockerfile
2
star
98

docker-tomcat

Docker Apache Tomcat based on Alpine
2
star
99

docker-mongo-builder

Docker Image to build MongoDB and associated tools for Alpine Edge from aports/non-free
Dockerfile
2
star
100

nixos-config

NixOS configurations
Nix
1
star