【GitHub活用メモ】GitHubの認証をSSH接続方式にしてみる(Dockerコンテナ対応済)

            #👇-Cオプションでコメントが付けられます
$ ssh-keygen -t ed25519 -C 'tacoskingdom'
Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/*******/.ssh/id_ed25519):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/*******/.ssh/id_ed25519.
Your public key has been saved in /home/*******/.ssh/id_ed25519.pub.
The key fingerprint is:
SHA256:******************************************* tacoskingdom
The key's randomart image is:
+--[ED25519 256]--+
#以下略

        

            $ cat ~/.ssh/id_ed25519.pub
ssh-ed25519 A***********************************************************h tacoskingdom

        

            $ ssh -T git@github.com
The authenticity of host 'github.com (xx.xxxx.xx.xx)' can't be established.
RSA key fingerprint is SHA256:n***********************************8.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'github.com,xx.xxxx.xx.xx' (RSA) to the list of known hosts.
Hi tacoskingdom! You've successfully authenticated, but GitHub does not provide shell access.

        

            $ nano ~/.ssh/config
#👇ホストがgithub.comの場合
Host github.com
  HostName github.com
  User git
  IdentityFile "~/.ssh/id_ed25519"

        

            COPY [ホスト側Dockerfileのあるディレクトリからの相対パス] [コンテナ側の絶対パス]

        

            .
├── Dockerfile
├── docker-compose.yml
├── .gitignore
└── .ssh
  └── id_ed25519

        

            #👇追加
/.ssh

        

            FROM alpine:3.18

RUN apk update && apk upgrade && \
    apk add --no-cache bash git openssh

#👇Dockerコンテナの作業ルートディレクトリ(今回は'/usr/src/app/')へ秘密鍵をコピー
WORKDIR /usr/src/app/
COPY .ssh/ /usr/src/app/.ssh

CMD ["bash"]

        

            version: '3.9'

services:
  app:
    image: my-app-dev:alpine3.18
    build: .
    container_name: my-app-dev
    working_dir: "/usr/src/app"
    tty: true

        

            $ docker-compose build
$ docker-compose up -d
$ docker-compose exec app bash

#...インタラクティブモードでコンテナに入る

$ ls -la | grep .ssh
drwxr-xr-x    2 1000     1000          4096 Jan 26 01:48 .ssh
$ ls -la .ssh
total 12
-rw-------    1 1000     1000           399 Jan 26 01:48 id_ed25519

        

            version: '3.9'

volumes:
  #別のダミーボリュームを準備
  ssh_key:

services:
  app:
    image: my-app-dev:alpine3.18
    build: .
    container_name: my-app-dev
    volumes:
      - ./:/usr/src/app
      #👇秘密鍵だけダミーへマウント
      - ssh_key:/usr/src/app/.ssh
    working_dir: "/usr/src/app"
    tty: true

        

            FROM alpine:3.18

RUN apk update && apk upgrade && \
    apk add --no-cache bash git openssh

CMD ["bash"]

        

            version: '3.9'

services:
  app:
    image: my-app-dev:alpine3.18
    build: .
    container_name: my-app-dev
    volumes:
      - ./:/usr/src/app
    working_dir: "/usr/src/app"
    tty: true

        

            $ eval "$(ssh-agent)"
Agent pid 16
$ ssh-add .ssh/id_ed25519
Identity added: .ssh/id_ed25519 (tacoskingdom)
$ ssh -T git@github.com
The authenticity of host 'github.com (xx.xxxx.xx.xx)' can't be established.
RSA key fingerprint is SHA256:n***********************************8.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'github.com,xx.xxxx.xx.xx' (RSA) to the list of known hosts.
Hi tacoskingdom! You've successfully authenticated, but GitHub does not provide shell access.

        

            FROM alpine:3.18

RUN apk update && apk upgrade && \
    apk add --no-cache bash git openssh

CMD ["bash"]

        

            version: '3.9'

services:
  app:
    image: my-app-dev:alpine3.18
    build: .
    container_name: my-app-dev
    volumes:
      - ./:/usr/src/app
      #exclude files in volume
      - /usr/src/app/.ssh
    working_dir: "/usr/src/app"
    tty: true

        

            $ docker-compose build
$ docker-compose up -d
$ docker-compose exec app bash
> ls -la ~/.ssh
#秘密鍵が無いことを確認
#Cntl+Dかexitでインタラクティブモードを抜ける

        

            $ docker cp [ホストから送りたいファイル] [送り先のコンテナ名]:[コンテナ内の送信先ディレクトリ]

        

            #👇秘密鍵をコンテナへ転送する
$ docker cp ~/.ssh/id_ed25519 my-app-dev:/usr/src/app/.ssh/

        

            $ docker cp ~/.ssh/id_ed25519 $(docker-compose ps -q app):/usr/src/app/.ssh/

        

            $ docker-compose exec app bash
bash-5.1# ls -la .ssh/
-rw-------    1 1000     1000           399 Feb 15  2021 id_ed25519

        

            $ docker-compose up -d && \
    docker cp ~/.ssh/id_ed25519 my-app-dev:/usr/src/app/.ssh/ && \
    docker-compose exec app bash

        

            FROM alpine:3.18

RUN apk update && apk upgrade && \
    apk add --no-cache bash git openssh

#👇Expectを追加
RUN apk add --no-cache expect

CMD ["bash"]

        

            #!/bin/bash

docker-compose up -d

docker cp ~/.ssh/id_ed25519 my-app-dev:/usr/src/app/.ssh/

docker-compose exec app bash -c '
    eval "$(ssh-agent)"
    ssh-add .ssh/id_ed25519
    expect -c "
        spawn ssh -T git@github.com
        expect \"Are you sure you want to continue\" { send yes }
    "
    bash
'

        

            $ chmod +x container_start.sh
$ ./container_start.sh
Agent pid 88
Identity added: .ssh/id_ed25519 (tacoskingdom)
Hi *******! You've successfully authenticated, but GitHub does not provide shell access.
bash-5.1#

        

            $ git ...
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@       WARNING: POSSIBLE DNS SPOOFING DETECTED!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
The RSA host key for github.com has changed,
and the key for the corresponding IP address ***.***.***.***
is unknown. This could either mean that
DNS SPOOFING is happening or the IP address for the host
and its host key have changed at the same time.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.
Please contact your system administrator.
Add correct host key in /home/xxxxxx/.ssh/known_hosts to get rid of this message.
Offending RSA key in /home/xxxxxx/.ssh/known_hosts:x
  remove with:
  ssh-keygen -f "/home/xxxxxx/.ssh/known_hosts" -R "github.com"
RSA host key for github.com has changed and you have requested strict checking.
Host key verification failed.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.