jumpserver堡壘機部署

@環境

    #系統：CentOS 7

    #systemctl stop firewalld

    #systemctl disable firewalld

    #setenforce 0

    #sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config

    #wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo

    #yum clean all

    #yum makecache

@準備Python3和python虛擬環境

    #安裝依賴包

        #yum -y install wget gcc epel-release git

    #安裝Python3.6

        #yum -y install python36 python36-devel

    #創建Python虛擬環境

        # cd /data

        python3.6 -m venv py3

        source /data/py3/bin/activate

@安裝jumpserver

    #下載或clone項目

        #cd /data/ && git clone --depth=1 https://github.com/jumpserver/jumpserver.git

    #安裝依賴rpm包

        #cd /data/jumpserver/requirements

        yum -y install $(cat rpm_requirements.txt)

    #安裝Python庫依賴

        #pip install --upgrade pip setuptools

        pip install -r requirements.txt

    #安裝redis

        #yum -y install redis

        systemctl enable redis

        systemctl start redis

    #安裝mariadb

        #yum -y install mariadb mariadb-devel mariadb-server mariadb-shared

         systemctl enable mariadb

         systemctl start mariadb

    #建立數據看看jumpserver並受權

        #DB_PASSWORD=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 24`

        echo -e "\033[31m 你的數據庫密碼是 $DB_PASSWORD \033[0m"

        mysql -uroot -e "create database jumpserver default charset 'utf8'; grant all on jumpserver.* to 'jumpserver'@'127.0.0.1' identified by '$DB_PASSWORD'; flush privileges;"

    #修改jumpserver配置文件

        #cd /data/jumpserver

        cp config_example.yml config.yml

        SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 50`  # 生成隨機SECRET_KEY

        echo "SECRET_KEY=$SECRET_KEY" >> ~/.bashrc

        BOOTSTRAP_TOKEN=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 16`  # 生成隨機BOOTSTRAP_TOKEN

        echo "BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN" >> ~/.bashrc

        sed -i "s/SECRET_KEY:/SECRET_KEY: $SECRET_KEY/g" /data/jumpserver/config.yml

        sed -i "s/BOOTSTRAP_TOKEN:/BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g" /data/jumpserver/config.yml

        sed -i "s/# DEBUG: true/DEBUG: false/g" /data/jumpserver/config.yml

        sed -i "s/# LOG_LEVEL: DEBUG/LOG_LEVEL: ERROR/g" /data/jumpserver/config.yml

        sed -i "s/# SESSION_EXPIRE_AT_BROWSER_CLOSE: false/SESSION_EXPIRE_AT_BROWSER_CLOSE: true/g" /data/jumpserver/config.yml

        sed -i "s/DB_PASSWORD: /DB_PASSWORD: $DB_PASSWORD/g" /data/jumpserver/config.yml

        echo -e "\033[31m 你的SECRET_KEY是 $SECRET_KEY \033[0m"

        echo -e "\033[31m 你的BOOTSTRAP_TOKEN是 $BOOTSTRAP_TOKEN \033[0m"

 

        vi config.yml  # 確認內容有沒有錯誤

        SECRET_KEY:

        # 預共享Token coco和guacamole用來註冊服務帳號, 不在使用原來的註冊接受機制

        BOOTSTRAP_TOKEN:

        # DEBUG 模式 開啓DEBUG後遇到錯誤時能夠看到更多日誌

        DEBUG: false

        # 日誌級別

        LOG_LEVEL: ERROR

        SESSION_EXPIRE_AT_BROWSER_CLOSE: true

        # 使用Mysql做爲數據庫

        DB_ENGINE: mysql

        DB_HOST: 127.0.0.1

        DB_PORT: 3306

        DB_USER: jumpserver

        DB_PASSWORD:

        DB_NAME: jumpserver

        # 運行時綁定端口

        HTTP_BIND_HOST: 0.0.0.0

        HTTP_LISTEN_PORT: 8080

        # Redis配置

        REDIS_HOST: 127.0.0.1

        REDIS_PORT: 6379

    #運行jumpserver

        #cd /data/jumpserver

        ./jms start all -d

@安裝 SSH Server 和 WebSocket Server: Coco

    #下載或 Clone 項目

        #cd /data

        source /data/py3/bin/activate

        git clone --depth=1 https://github.com/jumpserver/coco.git

    #安裝依賴

        #cd /data/coco/requirements

        yum -y install $(cat rpm_requirements.txt)

        pip install -r requirements.txt

    #修改配飾文件並運行

        #cd /data/coco

        cp config_example.yml config.yml

 

        sed -i "s/BOOTSTRAP_TOKEN: <PleasgeChangeSameWithJumpserver>/BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g" /data/coco/config.yml

        sed -i "s/# LOG_LEVEL: INFO/LOG_LEVEL: ERROR/g" /data/coco/config.yml

 

        vi config.yml

        CORE_HOST: http://127.0.0.1:8080

        BOOTSTRAP_TOKEN: <PleasgeChangeSameWithJumpserver>

        LOG_LEVEL: ERROR

 

        ./cocod start -d

@安裝 Web Terminal 前端: Luna

    #解壓luna

        #cd /data

        wget https://github.com/jumpserver/luna/releases/download/1.4.10/luna.tar.gz

        tar xf luna.tar.gz

        chown -R root:root luna

@安裝 Windows 支持組件(若是不須要管理 windows 資產, 能夠直接跳過這一步)

    #安裝依賴

        #rpm --import http://li.nux.ro/download/nux/RPM-GPG-KEY-nux.ro

        #rpm -Uvh http://li.nux.ro/download/nux/dextop/el7/x86_64/nux-dextop-release-0-5.el7.nux.noarch.rpm

        #yum -y localinstall --nogpgcheck https://download1.rpmfusion.org/free/el/rpmfusion-free-release-7.noarch.rpm https://download1.rpmfusion.org/nonfree/el/rpmfusion-nonfree-release-7.noarch.rpm

        #yum install -y java-1.8.0-openjdk libtool

        #yum install -y cairo-devel libjpeg-turbo-devel libpng-devel uuid-devel

        #yum install -y ffmpeg-devel freerdp-devel freerdp-plugins pango-devel libssh2-devel libtelnet-devel libvncserver-devel pulseaudio-libs-devel openssl-devel libvorbis-devel libwebp-devel ghostscript

    #編譯安裝 guacamole 服務

        #cd /data

        #git clone --depth=1 https://github.com/jumpserver/docker-guacamole.git

        #cd /data/docker-guacamole/

        #tar -xf guacamole-server-0.9.14.tar.gz

        #cd guacamole-server-0.9.14

        #autoreconf -fi

        #./configure --with-init-dir=/etc/init.d

        #make && make install

        #ln -s /usr/local/lib/freerdp/*.so /usr/lib64/freerdp/

        #cd ..

        #rm -rf guacamole-server-0.9.14

        #ldconfig

    #配置Tomcat

        #mkdir -p /config/guacamole /config/guacamole/lib /config/guacamole/extensions  # 建立 guacamole 目錄

        #ln -sf /data/docker-guacamole/guacamole-auth-jumpserver-0.9.14.jar /config/guacamole/extensions/guacamole-auth-jumpserver-0.9.14.jar

        #ln -sf /data/docker-guacamole/root/app/guacamole/guacamole.properties /config/guacamole/guacamole.properties  # guacamole 配置文件

        #cd /config

        #wget http://mirrors.tuna.tsinghua.edu.cn/apache/tomcat/tomcat-8/v8.5.40/bin/apache-tomcat-8.5.40.tar.gz

        #tar xf apache-tomcat-8.5.40.tar.gz

        #rm -rf apache-tomcat-8.5.40.tar.gz

        #mv apache-tomcat-8.5.40 tomcat8

        #rm -rf /config/tomcat8/webapps/*

        #ln -sf /data/docker-guacamole/guacamole-0.9.14.war /config/tomcat8/webapps/ROOT.war  # guacamole client

        #sed -i 's/Connector port="8080"/Connector port="8081"/g' /config/tomcat8/conf/server.xml  # 修改默認端口爲 8081

        #sed -i 's/FINE/WARNING/g' /config/tomcat8/conf/logging.properties  # 修改 log 等級爲 WARNING

        #cd /config

        #wget https://github.com/ibuler/ssh-forward/releases/download/v0.0.5/linux-amd64.tar.gz

        #tar xf linux-amd64.tar.gz -C /bin/

        #chmod +x /bin/ssh-forward

@配置環境變量

    #勿屢次執行如下環境設置

        #export JUMPSERVER_SERVER= http://127.0.0.1:8080  # http://127.0.0.1:8080 指 jumpserver 訪問地址

        #echo "export JUMPSERVER_SERVER= http://127.0.0.1:8080" >> ~/.bashrc

        #BOOTSTRAP_TOKEN 爲 Jumpserver/config.yml 裏面的 BOOTSTRAP_TOKEN

        #export BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN

        #echo "export BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN" >> ~/.bashrc

        #export JUMPSERVER_KEY_DIR=/config/guacamole/keys

        #echo "export JUMPSERVER_KEY_DIR=/config/guacamole/keys" >> ~/.bashrc

        #export GUACAMOLE_HOME=/config/guacamole

        #echo "export GUACAMOLE_HOME=/config/guacamole" >> ~/.bashrc

@啓動 Guacamole

    #/etc/init.d/guacd start

    #sh /config/tomcat8/bin/startup.sh

@配置 Nginx 整合各組件

    #安裝 Nginx

        #yum install yum-utils

        vi /etc/yum.repos.d/nginx.repo

 

       [nginx-stable]

       name=nginx stable repo

       baseurl= http://nginx.org/packages/centos/$releasever/$basearch/

       gpgcheck=1

       enabled=1

       gpgkey= https://nginx.org/keys/nginx_signing.key

 

       yum makecache fast

       yum install -y nginx

       rm -rf /etc/nginx/conf.d/default.conf

       systemctl enable nginx

    #準備配置文件 修改 /etc/nginx/conf.d/jumpserver.conf

    #vi /etc/nginx/conf.d/jumpserver.conf

 

server {

    listen 80;  # 代理端口, 之後將經過此端口進行訪問, 再也不經過8080端口

    # server_name demo.jumpserver.org;  # 修改爲你的域名或者註釋掉

 

    client_max_body_size 100m;  # 錄像及文件上傳大小限制

 

    location /luna/ {

        try_files $uri / /index.html;

        alias /data/luna/;  # luna 路徑, 若是修改安裝目錄, 此處須要修改

    }

 

    location /media/ {

        add_header Content-Encoding gzip;

        root /data/jumpserver/data/;  # 錄像位置, 若是修改安裝目錄, 此處須要修改

    }

 

    location /static/ {

        root /data/jumpserver/data/;  # 靜態資源, 若是修改安裝目錄, 此處須要修改

    }

 

    location /socket.io/ {

        proxy_pass        http://localhost:5000/socket.io/;  # 若是coco安裝在別的服務器, 請填寫它的ip

        proxy_buffering off;

        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;

        proxy_set_header Connection "upgrade";

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        access_log off;

    }

 

    location /coco/ {

        proxy_pass        http://localhost:5000/coco/;  # 若是coco安裝在別的服務器, 請填寫它的ip

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        access_log off;

    }

 

    location /guacamole/ {

        proxy_pass        http://localhost:8081/;  # 若是guacamole安裝在別的服務器, 請填寫它的ip

        proxy_buffering off;

        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;

        proxy_set_header Connection $http_connection;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        access_log off;

    }

 

    location / {

        proxy_pass http://localhost:8080;  # 若是jumpserver安裝在別的服務器, 請填寫它的ip

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    }

}

    #運行nginx

        #nginx -t   # 確保配置沒有問題, 有問題請先解決

　　systemctl start nginx

　　systemctl enable nginx

    #開始使用 Jumpserver

        #默認帳號: admin 密碼: admin