I want to get Docker-Content-Digest header response for request to logstash container.

[tadashi-oya]

Sorry for the topic about Docker, not about Honeypot.

I want to get Docker-Content-Digest header response for request to logstash container.

How can I assemble curl URL for logstash?

The following sample succeeds.

tadashi@S1056419:~$ TOKEN=$(curl -s "https://auth.docker.io/token?service=registry.docker.io&scope=repository:library/alpine:pull" | jq -r '.token')
tadashi@S1056419:~$ echo $TOKEN
(TOKEN string)

tadashi@S1056419:~$ curl --head -H 'Accept: application/vnd.docker.distribution.manifest.v2+json' -H "Authorization: Bearer $TOKEN" https://registry-1.docker.io/v2/library/alpine/manifests/3.10
HTTP/1.1 200 OK
content-length: 528
content-type: application/vnd.docker.distribution.manifest.v2+json
docker-content-digest: sha256:e515aad2ed234a5072c4d2ef86a1cb77d5bfe4b11aa865d9214875734c4eeb3c   <<<I want.
docker-distribution-api-version: registry/2.0
etag: "sha256:e515aad2ed234a5072c4d2ef86a1cb77d5bfe4b11aa865d9214875734c4eeb3c"
date: Mon, 23 Jan 2023 04:17:40 GMT
strict-transport-security: max-age=31536000
ratelimit-limit: 100;w=21600
ratelimit-remaining: 98;w=21600
docker-ratelimit-source: my-ip-addr

I would like to do the same thing for logstash of tpotce, but something is wrong and I can't succeed.

tadashi@S1056419:~$ TOKEN=$(curl -s "https://auth.docker.io/token?service=registry.docker.io&scope=repository:library/dtagdevsec/logstash:pull" | jq -r '.token')
tadashi@S1056419:~$ echo $TOKEN
(TOKEN string)

tadashi@S1056419:~$ curl -v -H 'Accept: application/vnd.docker.distribution.manifest.v2+json' -H "Authorization: Bearer
$TOKEN" https://registry-1.docker.io/v2/library/dtagdevsec/logstash/manifests/2204
*   Trying 44.205.64.79:443...
* TCP_NODELAY set
* Connected to registry-1.docker.io (44.205.64.79) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: CN=*.docker.com
*  start date: Oct 31 00:00:00 2022 GMT
*  expire date: Nov 30 23:59:59 2023 GMT
*  subjectAltName: host "registry-1.docker.io" matched cert's "*.docker.io"
*  issuer: C=US; O=Amazon; OU=Server CA 1B; CN=Amazon
*  SSL certificate verify ok.
> GET /v2/library/dtagdevsec/logstash/manifests/2204 HTTP/1.1
> Host: registry-1.docker.io
> User-Agent: curl/7.68.0
> Accept: application/vnd.docker.distribution.manifest.v2+json
> Authorization: Bearer (TOKEN string)
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 401 Unauthorized
< content-type: application/json
< docker-distribution-api-version: registry/2.0
< www-authenticate: Bearer realm="https://auth.docker.io/token",service="registry.docker.io",scope="repository:library/dtagdevsec/logstash:pull",error="insufficient_scope"
< date: Mon, 23 Jan 2023 04:29:04 GMT
< content-length: 170
< strict-transport-security: max-age=31536000
<
{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"repository","Class":"","Name":"library/dtagdevsec/logstash","Action":"pull"}]}]}
* Connection #0 to host registry-1.docker.io left intact

(refs.)

• https://hub.docker.com/r/dtagdevsec/logstash
• https://index.docker.io/search?q=dtagdevsec
• https://index.docker.io/r/dtagdevsec/logstash

[tadashi-oya]

It was a simple mistake.

"dtagdevsec/logstash" instead of "library/dtagdevsec/logstash" was the correct choice.

tadashi@S1056419:~$ TOKEN=$(curl -s "https://auth.docker.io/token?service=registry.docker.io&scope=repository:dtagdevsec/logstash:pull" | jq -r '.token')

tadashi@S1056419:~$ curl --head -H 'Accept: application/vnd.docker.distribution.manifest.v2+json' -H "Authorization: Bearer $TOKEN" https://registry-1.docker.io/v2/dtagdevsec/logstash/manifests/2204
HTTP/1.1 200 OK
content-length: 950
content-type: application/vnd.docker.distribution.manifest.v2+json
docker-content-digest: sha256:01ae60146d910da0a779d892a9fe08415778ba4ee20d5c94d5a3d7d5ebc5bdc3