オープンソースのパスワード管理システムbitwardenについてブログします。例えば社内のアカウント系って社内ファイルサーバーに管理してエクセルにまとめたりして管理が煩雑になってしまったり…色々と解決してくれそうなので早速ローカルで試してみました。
■bitwarden.com
https://bitwarden.com/#organizations
個人的に使いたい人もクラウド版無料でアカウント作れば使えるので今回はこっち↓。
docker-compose使ってちゃちゃっと構築ができるそうです。それにアプリはcliも今後使えるそうで熱いですね。
■Installing and deploying
https://help.bitwarden.com/article/install-on-premise/
・Environment
|
1 2 3 4 5 |
$ docker -v Docker version 17.09.0-ce, build afdb6d4 $ docker-compose -v docker-compose version 1.17.1, build 6d101fb |
※bitwardenはメモリー4GB必須なので注意！
・Get an installation id and key
メールアドレス指定して、Installation IdとInstallation Keyの2つをメモります。
・Install & deploy bitwarden.
|
1 2 3 4 5 6 |
$ cd $ mkdir bitwarden $ cd bitwarden $ curl -s -o bitwarden.sh \ https://raw.githubusercontent.com/bitwarden/core/master/scripts/bitwarden.sh \ && sudo chmod u+x bitwarden.sh |
とりあえずbitwardenをインストールするためのスクリプトを落としてきます。
・./bitwarden.sh install
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 |
$ ./bitwarden.sh install _ _ _ _ | |__ (_) |___ ____ _ _ __ __| | ___ _ __ | '_ \| | __\ \ /\ / / _` | '__/ _` |/ _ \ '_ \ | |_) | | |_ \ V V / (_| | | | (_| | __/ | | | |_.__/|_|\__| \_/\_/ \__,_|_| \__,_|\___|_| |_| Open source password management solutions Copyright 2015-2017, 8bit Solutions LLC https://bitwarden.com, https://github.com/bitwarden =================================================== Docker version 17.09.0-ce, build afdb6d4 docker-compose version 1.16.1, build 6d1ac21 (!) Enter the domain name for your bitwarden instance (ex. bitwarden.company.com): localhost 1.14.1: Pulling from bitwarden/setup 3e17c6eae66c: Pull complete fd02a69b6611: Pull complete aa0ea6a3aa0f: Pull complete 532afbbd7567: Pull complete df93b2e648f1: Pull complete ae099fcaaa94: Pull complete 96e61edca842: Pull complete Digest: sha256:ac28e542707d10b4508219a23a70367fab9e85b6cf6cc1f501af3652ae041215 Status: Downloaded newer image for bitwarden/setup:1.14.1 (!) Enter your installation id (get it at https://bitwarden.com/host): xxxxxxxxxx-xxxxxxxxxxxxxxxx (!) Enter your installation key: wwwwwwwwwwwwwwwwwwwwwwwww (!) Do you have a SSL certificate to use? (y/n): n Generating self signed SSL certificate. Generating a 4096 bit RSA private key .....................................++ ................................................................................................................................................++ writing new private key to '/bitwarden/ssl/self/localhost/private.key' ----- Generating key for IdentityServer. Generating a 4096 bit RSA private key .....................................++ ................................................................++ writing new private key to 'identity.key' ----- (!) Do you want to use the default ports for HTTP (80) and HTTPS (443)? (y/n): y (!) Do you want to use push notifications? (y/n): y Building nginx config. Building docker environment files. Building docker environment override files. Building app settings. Building FIDO U2F app id. Building docker-compose.yml. Setup complete |
インストールでドメインやら先ほど取得したinstallation idなど指定します。SSL証明書も自前のがあれば指定できるのでなかったら自動的に作られます。(本番環境ならDNSで設定したドメインをletsencryptでも取得できます)さらにbwdataというディレクトリが作られ、docker-composeで構成されていることも分かります。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 |
$ tree . ├── bitwarden.sh └── bwdata ├── core │ ├── aspnet-dataprotection │ │ └── key-9fccd947-dbf6-4377-b101-01fdc9ba6cf0.xml │ ├── attachments │ └── logs │ └── Jobs │ └── 20171129.txt ├── docker │ ├── docker-compose.yml │ ├── global.env │ └── mssql.env ├── env │ ├── global.override.env │ └── mssql.override.env ├── identity │ └── identity.pfx ├── letsencrypt ├── mssql │ └── backups ├── nginx │ └── default.conf ├── scripts │ ├── install.sh │ └── run.sh ├── ssl │ └── self │ └── localhost │ ├── certificate.crt │ └── private.key └── web ├── app-id.json └── settings.js 18 directories, 16 files |
・./bitwarden.sh start
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 |
$ ./bitwarden.sh start _ _ _ _ | |__ (_) |___ ____ _ _ __ __| | ___ _ __ | '_ \| | __\ \ /\ / / _` | '__/ _` |/ _ \ '_ \ | |_) | | |_ \ V V / (_| | | | (_| | __/ | | | |_.__/|_|\__| \_/\_/ \__,_|_| \__,_|\___|_| |_| Open source password management solutions Copyright 2015-2017, 8bit Solutions LLC https://bitwarden.com, https://github.com/bitwarden =================================================== Docker version 17.09.0-ce, build afdb6d4 docker-compose version 1.16.1, build 6d1ac21 Removing network docker_default WARNING: Network docker_default not found. Pulling web (bitwarden/web:1.20.1)... 1.20.1: Pulling from bitwarden/web 3e17c6eae66c: Already exists 554051716312: Pull complete 452950efdfa3: Pull complete fc489b660dc2: Pull complete 35da760b8ba4: Pull complete 71dac34bef2d: Pull complete c61b83b9fa96: Pull complete dd0cddda4bb8: Pull complete b28fb7bcd676: Pull complete 37988694dc4b: Pull complete Digest: sha256:06ca14ce33da430d27769d561d2608bd56f1fd8034ff52664357b1a2ef7d3e97 Status: Downloaded newer image for bitwarden/web:1.20.1 Pulling attachments (bitwarden/attachments:1.14.1)... 1.14.1: Pulling from bitwarden/attachments 3e17c6eae66c: Already exists 554051716312: Already exists 452950efdfa3: Already exists fc489b660dc2: Already exists 35da760b8ba4: Already exists 71dac34bef2d: Already exists a6a4e5cec15b: Pull complete 6b70b9263117: Pull complete Digest: sha256:9d571382660a7861c241b1fa2ea7e62e10c160521a55babf36b92d11c9135055 Status: Downloaded newer image for bitwarden/attachments:1.14.1 Pulling icons (bitwarden/icons:1.14.1)... 1.14.1: Pulling from bitwarden/icons 3e17c6eae66c: Already exists 554051716312: Already exists 452950efdfa3: Already exists fc489b660dc2: Already exists 35da760b8ba4: Already exists 3d70b51ed9f8: Pull complete 6bd83ee894dc: Pull complete babe8cbbfb4e: Pull complete 9da0f47da48b: Pull complete 4fd7e28cd133: Pull complete e35037bdd971: Pull complete bb0d4b190746: Pull complete Digest: sha256:d5cb96ce06d661ed23c2c8a0b6117381ee9deb9e886d0d3980055d4c6f4b5929 Status: Downloaded newer image for bitwarden/icons:1.14.1 Pulling nginx (bitwarden/nginx:1.14.1)... 1.14.1: Pulling from bitwarden/nginx bc95e04b23c0: Pull complete f473e7d72364: Pull complete 82cca2490d0d: Pull complete c7f9188cf262: Pull complete e2f87463cb85: Pull complete 2f9624f757a4: Pull complete 5f1669900ae8: Pull complete fa1fc844570e: Pull complete Digest: sha256:7fa99f8764efe1bed8bd496cab3046fb87a17b7524eb2e4cc7ca220bfc8ce32b Status: Downloaded newer image for bitwarden/nginx:1.14.1 Pulling api (bitwarden/api:1.14.1)... 1.14.1: Pulling from bitwarden/api 3e17c6eae66c: Already exists 554051716312: Already exists 452950efdfa3: Already exists fc489b660dc2: Already exists 35da760b8ba4: Already exists 9a07ec34330b: Pull complete b2bb75a0dc3b: Pull complete a8e51398f227: Pull complete ea3e82c8acb1: Pull complete f5c8c68a7922: Pull complete feb6644e5f2a: Pull complete 3adf60b156aa: Pull complete Digest: sha256:fcfb204f514779536d6c9a7bc9b627ff4664f6a2756fa762ccdf194bf35f3f5c Status: Downloaded newer image for bitwarden/api:1.14.1 Pulling mssql (bitwarden/mssql:1.14.1)... 1.14.1: Pulling from bitwarden/mssql aed15891ba52: Pull complete 773ae8583d14: Pull complete d1d48771f782: Pull complete cd3d6cd6c0cf: Pull complete 8ff6f8a9120c: Pull complete 1fd7e8b10447: Pull complete bd485157db89: Pull complete 273a1970ce9c: Pull complete 006581b3a024: Pull complete 25c54ac351f0: Pull complete bf239239f95d: Pull complete 15da1eb70d5a: Pull complete 0d3663bd9022: Pull complete 85d896f2faa5: Pull complete c8e6039eb721: Pull complete c3592b404ce8: Pull complete 080b80dccdb6: Pull complete 49a965f618af: Pull complete Digest: sha256:3db622584d05103bcda9b47fa9f452737bb2bb1de853b23cf1bf0dea09170b05 Status: Downloaded newer image for bitwarden/mssql:1.14.1 Pulling identity (bitwarden/identity:1.14.1)... 1.14.1: Pulling from bitwarden/identity 3e17c6eae66c: Already exists 554051716312: Already exists 452950efdfa3: Already exists fc489b660dc2: Already exists 35da760b8ba4: Already exists b89f3153ed24: Pull complete 5f2d6509dc83: Pull complete 66cd3a4810f4: Pull complete b5349f442d1e: Pull complete Digest: sha256:92bad753e86f472e0d05d4cac87276d192a6b782105c654d149e55399cf59bac Status: Downloaded newer image for bitwarden/identity:1.14.1 Creating network "docker_default" with the default driver Creating volume "docker_mssql_data" with default driver Creating attachments ... Creating web ... Creating icons ... Creating nginx ... Creating api ... Creating mssql ... Creating identity ... Creating icons Creating nginx Creating web Creating mssql Creating attachments Creating identity Creating web ... done Total reclaimed space: 0B 1.14.1: Pulling from bitwarden/setup Digest: sha256:ac28e542707d10b4508219a23a70367fab9e85b6cf6cc1f501af3652ae041215 Status: Image is up to date for bitwarden/setup:1.14.1 bitwarden is up and running! =================================================== visit https://localhost to update, run './bitwarden.sh updateself' and then './bitwarden.sh update' |
startすると一気にdocker imageが取得されて何やらたくさん立ち上がります。この時点でlocalhostで検索すれば管理画面が見れるのですが、下記のようにupdatedbをしないとbitwardenのアカウント作成時にエラーが出るので注意！
|
1 2 3 4 5 6 7 8 9 10 |
$ docker images REPOSITORY TAG IMAGE ID CREATED SIZE bitwarden/web 1.20.1 ccb0e7cb8986 2 weeks ago 289MB bitwarden/setup 1.14.1 d4719ef8b7b6 2 weeks ago 224MB bitwarden/icons 1.14.1 102106c44eb2 2 weeks ago 299MB bitwarden/identity 1.14.1 213e5394be86 2 weeks ago 325MB bitwarden/api 1.14.1 0cf1f0a1d559 2 weeks ago 388MB bitwarden/mssql 1.14.1 88b88ef0d1a7 3 weeks ago 1.41GB bitwarden/attachments 1.14.1 4dbd1988d908 3 weeks ago 285MB bitwarden/nginx 1.14.1 7ca48ea252fe 3 weeks ago 108MB |
・./bitwarden.sh updatedb
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 |
$ ./bitwarden.sh updatedb _ _ _ _ | |__ (_) |___ ____ _ _ __ __| | ___ _ __ | '_ \| | __\ \ /\ / / _` | '__/ _` |/ _ \ '_ \ | |_) | | |_ \ V V / (_| | | | (_| | __/ | | | |_.__/|_|\__| \_/\_/ \__,_|_| \__,_|\___|_| |_| Open source password management solutions Copyright 2015-2017, 8bit Solutions LLC https://bitwarden.com, https://github.com/bitwarden =================================================== Docker version 17.09.0-ce, build afdb6d4 docker-compose version 1.16.1, build 6d1ac21 1.14.1: Pulling from bitwarden/setup Digest: sha256:ac28e542707d10b4508219a23a70367fab9e85b6cf6cc1f501af3652ae041215 Status: Image is up to date for bitwarden/setup:1.14.1 Migrating database. Beginning transaction Beginning database upgrade Fetching list of already executed scripts. The [dbo].[Migration] table could not be found. The database is assumed to be at version 0. Executing SQL Server script 'Bit.Setup.DbScripts.2017-08-19_00_InitialSetup.sql' Creating the [dbo].[Migration] table The [dbo].[Migration] table has been created Executing SQL Server script 'Bit.Setup.DbScripts.2017-08-22_00_LicenseCheckScripts.sql' Executing SQL Server script 'Bit.Setup.DbScripts.2017-08-30_00_CollectionWriteOnly.sql' Executing SQL Server script 'Bit.Setup.DbScripts.2017-09-06_00_CipherDetails.sql' Executing SQL Server script 'Bit.Setup.DbScripts.2017-09-08_00_OrgUserCounts.sql' Executing SQL Server script 'Bit.Setup.DbScripts.2017-10-25_00_OrgUserUpdates.sql' Executing SQL Server script 'Bit.Setup.DbScripts.2017-11-06_00_FamilyPlanAdjustments.sql' Executing SQL Server script 'Bit.Setup.DbScripts.2017-11-13_00_IndexTuning.sql' Upgrade successful Migration successful. Database update complete |
プロセス結構多め。
|
1 2 3 4 5 6 7 8 9 |
$ docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 10174d214839 bitwarden/identity:1.14.1 "/entrypoint.sh" 5 minutes ago Up 5 minutes 80/tcp identity a657198539c9 bitwarden/api:1.14.1 "/entrypoint.sh" 5 minutes ago Up 5 minutes 80/tcp api 8bc26a97a44a bitwarden/web:1.20.1 "/entrypoint.sh" 5 minutes ago Up 5 minutes 80/tcp web a20288cbfc46 bitwarden/attachments:1.14.1 "/entrypoint.sh" 5 minutes ago Up 5 minutes 80/tcp attachments 3648b1a15ca1 bitwarden/mssql:1.14.1 "/entrypoint.sh" 5 minutes ago Up 5 minutes 1433/tcp mssql c15ef25697ab bitwarden/nginx:1.14.1 "/entrypoint.sh" 5 minutes ago Up 5 minutes 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp nginx 135ac2c0bc64 bitwarden/icons:1.14.1 "/entrypoint.sh" 5 minutes ago Up 5 minutes 80/tcp icons |
ちなみにbitwardenはdockerコマンドで管理をするのではなく、bitwarden.shでstartしたり新バージョンが出たらupdateしたりします。(便利かっ)
■localhost
もちろんChromeの拡張機能で検索も可能です。(こっちのほうが楽。1pass的な)
・適当にアカウント追加してみる
UI良さげや！
・会社単位は….
ライセンスが必要でエンタープライズ会員にならないとダメなのかい！！
https://help.bitwarden.com/article/licensing-on-premise/
https://blog.bitwarden.com/host-your-own-open-source-password-manager-ace147649936
■エラーが出た場合
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 |
$ ./bitwarden.sh updatedb _ _ _ _ | |__ (_) |___ ____ _ _ __ __| | ___ _ __ | '_ \| | __\ \ /\ / / _` | '__/ _` |/ _ \ '_ \ | |_) | | |_ \ V V / (_| | | | (_| | __/ | | | |_.__/|_|\__| \_/\_/ \__,_|_| \__,_|\___|_| |_| Open source password management solutions Copyright 2015-2017, 8bit Solutions LLC https://bitwarden.com, https://github.com/bitwarden =================================================== Docker version 17.09.0-ce, build afdb6d4 docker-compose version 1.17.1, build 6d101fb 1.14.1: Pulling from bitwarden/setup Digest: sha256:ac28e542707d10b4508219a23a70367fab9e85b6cf6cc1f501af3652ae041215 Status: Image is up to date for bitwarden/setup:1.14.1 Migrating database. Unhandled Exception: System.Data.SqlClient.SqlException: Login failed for user 'sa'. at System.Data.SqlClient.SqlInternalConnectionTds..ctor(DbConnectionPoolIdentity identity, SqlConnectionString connectionOptions, Object providerInfo, Boolean redirectedUserInstance, SqlConnectionString userConnectionOptions, SessionData reconnectSessionData, Boolean applyTransientFaultHandling) at System.Data.SqlClient.SqlConnectionFactory.CreateConnection(DbConnectionOptions options, DbConnectionPoolKey poolKey, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningConnection, DbConnectionOptions userOptions) at System.Data.ProviderBase.DbConnectionFactory.CreatePooledConnection(DbConnectionPool pool, DbConnection owningObject, DbConnectionOptions options, DbConnectionPoolKey poolKey, DbConnectionOptions userOptions) at System.Data.ProviderBase.DbConnectionPool.CreateObject(DbConnection owningObject, DbConnectionOptions userOptions, DbConnectionInternal oldConnection) at System.Data.ProviderBase.DbConnectionPool.UserCreateRequest(DbConnection owningObject, DbConnectionOptions userOptions, DbConnectionInternal oldConnection) at System.Data.ProviderBase.DbConnectionPool.TryGetConnection(DbConnection owningObject, UInt32 waitForMultipleObjectsTimeout, Boolean allowCreate, Boolean onlyOneCheckConnection, DbConnectionOptions userOptions, DbConnectionInternal& connection) at System.Data.ProviderBase.DbConnectionPool.TryGetConnection(DbConnection owningObject, TaskCompletionSource`1 retry, DbConnectionOptions userOptions, DbConnectionInternal& connection) at System.Data.ProviderBase.DbConnectionFactory.TryGetConnection(DbConnection owningConnection, TaskCompletionSource`1 retry, DbConnectionOptions userOptions, DbConnectionInternal oldConnection, DbConnectionInternal& connection) at System.Data.ProviderBase.DbConnectionInternal.TryOpenConnectionInternal(DbConnection outerConnection, DbConnectionFactory connectionFactory, TaskCompletionSource`1 retry, DbConnectionOptions userOptions) at System.Data.SqlClient.SqlConnection.TryOpen(TaskCompletionSource`1 retry) at System.Data.SqlClient.SqlConnection.Open() at Bit.Setup.Program.MigrateDatabase() in /Users/kyle/Projects/bitwarden/core/util/Setup/Program.cs:line 199 at Bit.Setup.Program.Main(String[] args) in /Users/kyle/Projects/bitwarden/core/util/Setup/Program.cs:line 55 |
dockerイメージ消して再度作り直すとupdatedbでコケる。なのでbitwarden/mssqlのコンテナに入って/var/opt/mssql/data/配下を消してrestartすれば動作します。
■まとめ
これならコストもかからないし(サーバ運営費くらい)会社でパスワード管理するなら導入するべき。社内のローカルサーバとかでも良さそう。1passwordは個人的に年間で払ってますが、bitwardenもなかなか捗る。
0件のコメント