stopRouter stopController startController startRouter ---ziti login using credentials ziti edge login ziti-edge-controller:1280 -u admin -p admin ----create identity Ziti edge create identity device dew-client -o dew-client.jwt -a "clients" Ziti edge create identity device client -o client.jwt -a "clients" ziti edge create identity device demo-server -o demo-server.jwt -a "servers" ziti edge enroll -j client.jwt ziti edge enroll -j server.jwt ziti edge list services ziti edge list identities ziti edge list edge-routers ziti edge list configs ------ Policy advisor ziti edge policy-advisor identities -------------fabric link ziti fabric list links ----------tunnel version ziti-edge-tunnel version ======= docker pull ubuntu docker run -it --name ubuntu1 ubuntu /bin/bash docker run -it --name ubuntu2 ubuntu /bin/bash =====================copy files from local to AWS instance ssh -i "prashant-ubuntu-vm3-ziti-controller-kp.pem" ubuntu@ec2-54-157-176-5.compute-1.amazonaws.com scp -i prashant-ubuntu-vm3-ziti-controller-kp.pem /Users/prashantsavadi/openziti/ziti/docker-compose.yml ubuntu@ec2-54-157-176-5.compute-1.amazonaws.com:./ ===========TEST ziti edge create identity user windowsweb -o windowsweb.jwt ----copy from AWS to local machine scp -i prashant-ubuntu-vm3-ziti-controller-kp.pem ubuntu@ec2-54-157-176-5.compute-1.amazonaws.com:/home/ubuntu/windowsweb.jwt /Users/prashantsavadi/Downloads scp -i prashant-ubuntu-vm3-ziti-controller-kp.pem ubuntu@ec2-54-157-168-45.compute-1.amazonaws.com:/home/ubuntu/awsdockerclint.jwt /Users/prashantsavadi/Downloads ---vm1 ssh -i "prashant-ubuntu-vm1-kp.pem" ubuntu@ec2-100-25-135-50.compute-1.amazonaws.com scp -i prashant-ubuntu-vm1-kp.pem ubuntu@ec2-100-25-135-50.compute-1.amazonaws.com:/path/on/source_ec2/file username@destination_ec2_ip:/path/on/destination_ec2/ ssh -i prashant-ubuntu-vm1-kp.pem /Users/prashantsavadi/Downloads/ubuvm.jwt ubuntu@ec2-100-25-135-50.compute-1.amazonaws.com./ scp -i prashant-ubuntu-vm1-kp.pem /Users/prashantsavadi/Downloads/ubuvm.jwt ubuntu@ec2-100-25-135-50.compute-1.amazonaws.com:./ scp -i prashant-ubuntu-vm3-ziti-controller-kp.pem /home/ubuntu/.ziti/quickstart/ip-172-31-38-253/awsdockerclint.jwt ubuntu@ec2-54-157-176-5.compute-1.amazonaws.com:./ ------ziti-enroll ziti edge enroll --jwt ubuvm.jwt --out ubuvm.json -- host configuration ziti edge create config sample-web-host-host.v1 host.v1 '{"protocol":"tcp", "address":"sample-web-app", "port":80}' ziti edge create config sample-web-host-intercept.v1 intercept.v1 '{"protocols":["tcp"],"addresses":["sample-web-app.ziti"], "portRanges":[{"low":80, "high":80}]}' ---create service ziti edge create service sample-web-app-service --configs sample-web-host-intercept.v1,sample-web-host-host.v1 ---bind policy ziti edge create service-policy sample-web-app.policy.bind Bind --service-roles '@sample-web-app-service' --identity-roles '@ubuvm' --- dial policy ziti edge create service-policy sample-web-app.policy.dial Dial --service-roles '@sample-web-app-service' --identity-roles '@windowsweb' ---check tunnel running status sudo systemctl status ziti-edge-tunnel sudo systemctl stop ziti-edge-tunnel sudo systemctl start ziti-edge-tunnel ec2-100-25-135-50.compute-1.amazonaws.com ------- create private web service service="private.web" private_web_server_ip=172.31.37.62 ziti edge create config "${service}.intercept.v1" intercept.v1 '{"protocols":["tcp"],"addresses":["'${service}'"], "portRanges":[{"low":80, "high":80}]}' ziti edge create config "${service}.host.v1" host.v1 '{"protocol":"tcp", "address":"'${private_web_server_ip}'","port":80}' ziti edge create service ${service} --configs "${service}.intercept.v1","${service}.host.v1" ziti edge create service-policy "${service}.bind" Bind --service-roles "@${service}" --identity-roles "#${service}.binders" ziti edge create service-policy "${service}.dial" Dial --service-roles "@${service}" --identity-roles "#${service}.dialers" ziti edge create identity user awsdockerclint -a "${service}.dialers" -o awsdockerclint.jwt ziti edge update identity ip-172-31-38-253-edge-router -a "${service}.binders" ------- environment setup for local ziti installation export EXTERNAL_DNS="ec2-54-175-225-246.compute-1.amazonaws.com" export EXTERNAL_IP="$(curl -s eth0.me)" export ZITI_CTRL_EDGE_IP_OVERRIDE="${EXTERNAL_IP}" export ZITI_ROUTER_IP_OVERRIDE="${EXTERNAL_IP}" export ZITI_CTRL_EDGE_ADVERTISED_ADDRESS="${EXTERNAL_DNS:-${EXTERNAL_IP}}" export ZITI_ROUTER_ADVERTISED_ADDRESS="${EXTERNAL_DNS:-${EXTERNAL_IP}}" export ZITI_CTRL_ADVERTISED_PORT=8440 export ZITI_CTRL_EDGE_ADVERTISED_PORT=8441 export ZITI_ROUTER_PORT=8442 --------clean old installation --since default ziti installation uses .ziti folder for all set up and installation rm -r .ziti ======= Openziti Java SDK zero trust implementation Step1: set open ziti network using docker compose Step2: generate identities A. Login to docker container which is running ziti controller docker exec -it docker-ziti-controller-1 bash B. Login ziti controller using below command ssh -J rahulcs@bastion.production.netfoundry.io ziggy@132.145.153.235 ziti edge login ziti-edge-controller:1280 -u admin -p admin --check edge routers ziti edge list edge-routers C. Create client identity ziti edge create identity device zdew-client -o zdew-client.jwt -a "clients" ziti edge create identity device client -o client.jwt -a "clients" D. Create server identity ziti edge create identity demo-server -o demo-server.jwt -a "servers" E. Create edge router policy ziti edge create edge-router-policy public-server-all --identity-roles "#all" --edge-router-roles "#public" F. Create service edge router policy ziti edge create service-edge-router-policy public-service-router-policy --service-roles "#servers" --edge-router-roles "#public" G. Create configuration ziti edge create config demo-service-config ziti-tunneler-client.v1 '{"hostname":"tv.openziti","port":8080}' H. Create a service ziti edge create service demo-service --configs demo-service-config -a "services" I. Create service policy A. Create dial policy ziti edge create service-policy service-dial-policy Dial --identity-roles "#clients" --service-roles "#services" B. Create Bind policy ziti edge create service-policy service-bind-policy Bind --identity-roles "#servers" --service-roles "#services" J. Copy json files to host machine. These json files are required to point in spring boot app server and java client app. zdew-client.json is just show in desktop edge tunneler but not for emdedded zero trust demostration Here "c71c9fe1d94b" is the docker controller id. You can get it by docker ps command. docker cp d45a876c21ad:/persistent/demo-server.json . docker cp d45a876c21ad:/persistent/client.json . K. Enroll above generated identities . This is very important since ziti controller has to authorize for connections. It's a MTLS concept. Below commands will enroll with ziti controller and generate json files . Example client.json and demo-server.json a. ziti edge enroll -j client.jwt b. Ziti edge enroll -j demo-server.jwt Coding section A. Create a spring boot application . This is going to be a server app in above case . Which will bind to service defined in ziti controller Minimum ziti configuration ziti.id =/path/demo-server.json ziti.serviceName = demo-service Dependency: org.openziti ziti-springboot 0.23.12 B. Create a java based rest client application to dial service defined in ziti controller Notes: Reference implementation: https://blogs.oracle.com/javamagazine/post/java-zero-trust-openziti Demo source code: https://github.com/netfoundry/openziti-spring-boot/releases =====================================ziti docker compose set up======================== A. Once we check out simplified docker compose file to local directory we can see .env file also. Customize .env file as given below. Here we can update the ziti admin console password.This will override the default password generation . After login to ZAC (ziti admin console) even we can change the password. Link to change the password: https://localhost:8443/profile # OpenZiti Variables ZITI_IMAGE=openziti/quickstart ZITI_VERSION=latest # the user and password to use # Leave password blank to have a unique value generated or set the password explicitly ZITI_USER=admin ZITI_PWD= ZITI_INTERFACE=0.0.0.0 # controller name, address/port information ZITI_CTRL_NAME=ziti-controller ZITI_CTRL_EDGE_ADVERTISED_ADDRESS=ziti-edge-controller ZITI_CTRL_ADVERTISED_ADDRESS=ziti-controller #ZITI_CTRL_EDGE_IP_OVERRIDE=10.10.10.10 #ZITI_CTRL_EDGE_ADVERTISED_PORT=8441 #ZITI_CTRL_ADVERTISED_PORT=8440 # The duration of the enrollment period (in minutes), default if not set. shown - 7days ZITI_EDGE_IDENTITY_ENROLLMENT_DURATION=10080 ZITI_ROUTER_ENROLLMENT_DURATION=10080 # router address/port information #ZITI_ROUTER_NAME=ziti-edge-router #ZITI_ROUTER_ADVERTISED_ADDRESS=ziti-edge-router #ZITI_ROUTER_PORT=8442 #ZITI_ROUTER_IP_OVERRIDE=10.10.10.10 #ZITI_ROUTER_LISTENER_BIND_PORT=8444 #ZITI_ROUTER_ROLES=public