Last updated on 2020-02-23

Why?

While this SSH container was initially designed to support the Burp Suite container, it does not depend on the Burp container. In other words, the SSH container can be used generically* to provide an auxiliary SSH service to any other container.

*with minor adjustments to its entrypoint.sh

Here are some advantages provided by its design:

• Default SSH configuration:
  • sshd executes as root but does not allow login as root.
• Creates unprivileged account for primary use.
  • Meant for file operations only; not administration of the SSH container itself.
  • Login is performed with SSH keys set up when building the container.
• Provides file access in other containers via shared volumes.

dockerfile

from debian:buster-slim

run apt-get update \

 && apt-get upgrade -y

run apt-get install --no-install-recommends -y openssh-server

run apt autoremove -y

…

…

run groupadd scribe && mkdir /home/scribe     \

 && useradd -s /bin/bash -g scribe scribe     \

 && cp /etc/skel/.bashrc /home/scribe/.bashrc \

 && echo "cd ~/share" >> /home/scribe/.bashrc

…

Note line 13: for convenience, it will cause the current directory to be ~/share upon login.

…

run mkdir /run/sshd

copy ./entrypoint.sh   /home/scribe/

copy ./authorized_keys /home/scribe/.ssh/

run chmod 600 /home/scribe/.ssh/authorized_keys

expose 22/tcp

entrypoint ["/bin/bash", "/home/scribe/entrypoint.sh"]

• Make sure /run/sshd exists, so that sshd can run.
• Copy entrypoint.sh and authorized_keys to the container.
  • authorized_keys is supplied when building the container.
• Set read/write privileges for scribe on authorized_keys.
• Expose port 22 and set entrypoint.sh to execute when the container runs.

entrypoint.sh

#! /bin/bash

_home="/home/scribe"

mkdir -p ${_home}/burp_share/user_configs

mkdir -p ${_home}/burp_share/project_configs

mkdir -p ${_home}/novnc_share

…

Create a few directories to host files from shared volumes. These directory names are the only adjustment needed to use the SSH container generically. They simply need to correspond to shared Docker volumes.

…

chown -R scribe:scribe ${_home}

exec /usr/sbin/sshd -D

Then, just give scribe access to its own home directory, and run sshd by means of exec in order to clean up the parent process.

Building and running

To build the container, simply:

1. Ensure the current directory is where the dockerfile resides
2. Copy your desired authorized_keys file to the current directory
3. Execute sudo docker build -t sshd:latest .

Note the trailing ., which just represents the current directory.
-t sshd:latest tags the build so we can reference it when running the container, as outlined below.

The --mount options should match the Docker volumes and directories you’ll be using with your own containers, if not the Burp and noVNC ones discussed in the previous article.

Needless to say, the same volumes should be mounted on each container whose files you’d like to access via the SSH container.

A complete example, with definitions for all containers discussed in this series as well as interactive build and run scripts, is present at github.com/elespike/burp_containers.