jumpserver篇--安裝（高可用性 mariadb+haproxy）

時間 2019-11-13

標籤 jumpserver 安裝用性 mariadb+haproxy mariadb haproxy 欄目負載均衡简体版

原文原文鏈接

1. 需求

爲了解決目前登錄方式多種多樣,防火牆配置複雜，歷史操做無記錄，用戶權限混亂等等html

2. Jumpserver測試環境搭建

2.1. 環境

os：CentOS release 6.8 mini版本

JMS_Master      192.168.1.75    Centos-6.8-x86_64   mini

JMS_Slave        192.168.1.76    Centos-6.8-x86_64   mini

MySQL_Master    192.168.1.72   Centos-6.8-x86_64   mini

MySQL_Master    192.168.1.73    Centos-6.8-x86_64   mini

keepalive_VIP      192.168.1.74

haproxy vip: 192.168.1。74

2.2. 架構圖

3. 相關軟件安裝

3.1. JDK 1.7安裝

yum -y install java-1.7.0-openjdk java-1.7.0-openjdk-develjava

vim /etc/profilenode

最後增長兩行python

#JAVA_HOME根據不一樣的機器選擇不一樣的路徑便可mysql

export JAVA_HOME=/usr/lib/jvm/java-1.7.0-openjdk.x86_64git

export PATH=$PATH:$JAVA_HOME/bingithub

當即生效:source /etc/profileweb

javac命令確保可用sql

JAVA_HOME必定要配置好!!!用 echo $JAVA_HOME 命令驗證!數據庫

3.2. mariadb Galera Cluster 安裝

新增虛擬機具體配置配置MariaDByum

vim /etc/yum.repos.d/mariadb.repo

[mariadb]

name = MariaDB

baseurl = http://yum.mariadb.org/10.0/centos6-amd64

gpgkey=https://yum.mariadb.org/RPM-GPG-KEY-MariaDB

gpgcheck=1

yum install -y epel-release

yum update -y

yum -y install http://dl.fedoraproject.org/pub/epel/6/x86_64/socat-1.7.2.3-1.el6.x86_64.rpm

yum -y install MariaDB-Galera-server MariaDB-client rsync galerasystemctl enable mariadb

---修改mariadb存儲目錄(不修改可忽略)

http://lddyw.blog.51cto.com/4151746/1684364

mkdir /home/data

cp -r /var/lib/mysql/ /home/data/

chown -R mysql:mysql /home/data/

vim /etc/my.cnf.d/server.cnf

[mariadb-10.0]

binlog_format=ROW

default-storage-engine=innodb

innodb_autoinc_lock_mode=2

innodb_locks_unsafe_for_binlog=1

query_cache_size=0

query_cache_type=0

bind-address=0.0.0.0

max_allowed_packet = 16M

datadir=/home/data/mysql

service mysql start

/usr/bin/mysql_secure_installation --root 容許遠程登錄密碼:jumpserverDb

[root@maria-server1 mysql]# mysql -u root -pjumpserverDb

Welcome to the MariaDB monitor. Commands end with ; or \g.

Your MariaDB connection id is 5

Server version: 5.5.40-MariaDB-wsrep MariaDB Server, wsrep_25.11.r4026

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> grant all privileges on *.* to 'root'@'%' identified by 'jumpserverDb' with grant option;

flush privileges;

MariaDB [(none)]> select host, user from mysql.user;

+---------------+------+

| host | user |

+---------------+------+

| % | root |

| 127.0.0.1 | root |

| ::1 | root |

| localhost | |

| localhost | root |

| maria-server1 | |

| maria-server1 | root |

+---------------+------+

7 rows in set (0.00 sec)

3.3. 配置 MariaDB Galera Cluster

http://blog.sina.com.cn/s/blog_6de3aa8a0102w00d.html

---192.168.1.72

vim /etc/my.cnf.d/server.cnf

# * Galera-related settings

[galera]

# Mandatory settings

#wsrep_provider=

#wsrep_cluster_address=

# These groups are read by MariaDB server.

# Use it for options that only the server (but not clients) should see

# See the examples of server my.cnf files in /usr/share/mysql/

# this is read by the standalone daemon and embedded servers

[server]

# this is only for the mysqld standalone daemon

[mysqld]

# * Galera-related settings

[galera]

# Mandatory settings

#wsrep_provider=

#wsrep_cluster_address=

#binlog_format=row

#default_storage_engine=InnoDB

#innodb_autoinc_lock_mode=2

#bind-address=0.0.0.0

# Optional setting

#wsrep_slave_threads=1

#innodb_flush_log_at_trx_commit=0

# this is only for embedded server

[embedded]

# This group is only read by MariaDB servers, not by MySQL.

# If you use the same .cnf file for MySQL and MariaDB,

# you can put MariaDB-only options here

[mariadb]

# This group is only read by MariaDB-10.0 servers.

# If you use the same .cnf file for MariaDB of different versions,

# use this group for options that older servers don't understand

[mariadb-10.0]

binlog_format=ROW

default-storage-engine=innodb

innodb_autoinc_lock_mode=2

innodb_locks_unsafe_for_binlog=1

query_cache_size=0

query_cache_type=0

bind-address=0.0.0.0

datadir=/var/lib/mysql

innodb_log_file_size=100M

innodb_file_per_table

innodb_flush_log_at_trx_commit=2

wsrep_provider=/usr/lib64/galera/libgalera_smm.so

wsrep_cluster_address="gcomm:// 192.168.1.72, 192.168.1.73"

#wsrep_cluster_address="gcomm://"

wsrep_cluster_name='dbcluster'

wsrep_node_address='192.168.1.72'

wsrep_node_name='dbserver1'

wsrep_sst_method=rsync

#wsrep_sst_auth=sst_user:dbpass

[mysqld_safe]

log-error=/var/log/mysqld.log

---192.168.1.73

vim /etc/my.cnf.d/server.cnf

[server]

# this is only for the mysqld standalone daemon

[mysqld]

# * Galera-related settings

[galera]

# Mandatory settings

#wsrep_provider=

#wsrep_cluster_address=

#binlog_format=row

#default_storage_engine=InnoDB

#innodb_autoinc_lock_mode=2

#bind-address=0.0.0.0

# Optional setting

#wsrep_slave_threads=1

#innodb_flush_log_at_trx_commit=0

# this is only for embedded server

[embedded]

# This group is only read by MariaDB servers, not by MySQL.

# If you use the same .cnf file for MySQL and MariaDB,

# you can put MariaDB-only options here

[mariadb]

# This group is only read by MariaDB-10.0 servers.

# If you use the same .cnf file for MariaDB of different versions,

# use this group for options that older servers don't understand

[mariadb-10.0]

binlog_format=ROW

default-storage-engine=innodb

innodb_autoinc_lock_mode=2

innodb_locks_unsafe_for_binlog=1

query_cache_size=0

query_cache_type=0

bind-address=0.0.0.0

datadir=/var/lib/mysql

innodb_log_file_size=100M

innodb_file_per_table

innodb_flush_log_at_trx_commit=2

wsrep_provider=/usr/lib64/galera/libgalera_smm.so

wsrep_cluster_address="gcomm:// 192.168.1.72, 192.168.1.73"

wsrep_cluster_name='dbcluster'

wsrep_node_address='192.168.1.73'

wsrep_node_name='dbserver2'

wsrep_sst_method=rsync

[mysqld_safe]

log-error=/var/log/mysqld.log

wsrep_cluster_address ==注意必定要保證有節點存在

第一次初始化爲wsrep_cluster_address= gcomm://

3.4. 查看集羣狀態

MariaDB [(none)]> show status like '%wsrep_%';

+------------------------------+-----------------------------------------+

| Variable_name | Value |

+------------------------------+-----------------------------------------+

| wsrep_local_state_uuid | 2489b818-219b-11e6-9021-b61cb5e054fb |

| wsrep_protocol_version | 5 |

| wsrep_last_committed | 18 |

| wsrep_replicated | 0 |

| wsrep_replicated_bytes | 0 |

| wsrep_repl_keys | 0 |

| wsrep_repl_keys_bytes | 0 |

| wsrep_repl_data_bytes | 0 |

| wsrep_repl_other_bytes | 0 |

| wsrep_received | 3 |

| wsrep_received_bytes | 238 |

| wsrep_local_commits | 0 |

| wsrep_local_cert_failures | 0 |

| wsrep_local_replays | 0 |

| wsrep_local_send_queue | 0 |

| wsrep_local_send_queue_avg | 0.000000 |

| wsrep_local_recv_queue | 0 |

| wsrep_local_recv_queue_avg | 0.000000 |

| wsrep_local_cached_downto | 18446744073709551615 |

| wsrep_flow_control_paused_ns | 0 |

| wsrep_flow_control_paused | 0.000000 |

| wsrep_flow_control_sent | 0 |

| wsrep_flow_control_recv | 0 |

| wsrep_cert_deps_distance | 0.000000 |

| wsrep_apply_oooe | 0.000000 |

| wsrep_apply_oool | 0.000000 |

| wsrep_apply_window | 1.000000 |

| wsrep_commit_oooe | 0.000000 |

| wsrep_commit_oool | 0.000000 |

| wsrep_commit_window | 1.000000 |

| wsrep_local_state | 4 |

| wsrep_local_state_comment | Synced |

| wsrep_cert_index_size | 0 |

| wsrep_causal_reads | 0 |

| wsrep_cert_interval | 0.000000 |

| wsrep_incoming_addresses | 192.168.32.154:3306,192.168.32.153:3306 |

| wsrep_cluster_conf_id | 24 |

| wsrep_cluster_size | 2 |

| wsrep_cluster_state_uuid | 2489b818-219b-11e6-9021-b61cb5e054fb |

| wsrep_cluster_status | Primary |

| wsrep_connected | ON |

| wsrep_local_bf_aborts | 0 |

| wsrep_local_index | 0 |

| wsrep_provider_name | Galera |

| wsrep_provider_vendor | Codership Oy <info@codership.com> |

| wsrep_provider_version | 3.5(rXXXX) |

| wsrep_ready | ON |

| wsrep_thread_count | 2 |

+------------------------------+-----------------------------------------+

48 rows in set (0.00 sec)

咱們能夠關注幾個關鍵的參數：

wsrep_connected = on 連接已開啓

wsrep_local_index = 1 在集羣中的索引值

wsrep_cluster_size =3 集羣中節點的數量

wsrep_incoming_addresses =192.168.32.154:3306,192.168.32.153:3306集羣中節點的訪問地址

3.5. 驗證數據同步

maria-server1

MariaDB [(none)]> create database galera_test7;

MariaDB [(none)]> create database galera_test8;

MariaDB [(none)]> show databases;

+--------------------+

| Database |

+--------------------+

| information_schema |

| galera_test7 |

| galera_test8 |

| mysql |

| performance_schema |

| test |

+--------------------+

6 rows in set (0.00 sec)

maria-server2上查看

MariaDB [(none)]> show databases;

+--------------------+

| Database |

+--------------------+

| information_schema |

| galera_test7 |

| galera_test8 |

| mysql |

| performance_schema |

| test |

+--------------------+

6 rows in set (0.00 sec)

3.6. keepalived實現高可用

安裝keepalived --2個節點

yum -y install keepalived

---192.168.1.75

[root@maria-server1 keepalived]# vim /etc/keepalived/keepalived.conf

! Configuration File for keepalived

global_defs {

notification_email {

acassen@firewall.loc

failover@firewall.loc

sysadmin@firewall.loc

}

notification_email_from Alexandre.Cassen@firewall.loc

smtp_server 127.0.0.1

smtp_connect_timeout 30

router_id LVS_DEVEL

}

vrrp_script check_haproxy {

script "/etc/keepalived/check_haproxy.sh"

interval 1

weight 2

}

vrrp_instance VI_1 {

state MASTER

interface eth1

virtual_router_id 88[i1]

priority 100[i2]

advert_int 1

authentication {

auth_type PASS

auth_pass jumpserverPass

}

virtual_ipaddress {

192.168.1.74

}

track_script {

check_haproxy

}

--集成haproxy 注意腳本權限

chmod +x /etc/keepalived/check_haproxy.sh

vim /etc/keepalived/check_haproxy.sh

A=`ps -C haproxy --no-header |wc -l`

if [ $A -eq 0 ]; then

service haproxy start

sleep 2

if [ `ps -C haproxy --no-header |wc -l` -eq 0 ]; then

/etc/init.d/keepalived stop

---192.168.1.76

[root@maria-server2 mysql]# vim /etc/keepalived/keepalived.conf

! Configuration File for keepalived

global_defs {

notification_email {

acassen@firewall.loc

failover@firewall.loc

sysadmin@firewall.loc

}

notification_email_from Alexandre.Cassen@firewall.loc

smtp_server 127.0.0.1

smtp_connect_timeout 30

router_id LVS_DEVEL

}

vrrp_script check_haproxy {

script "killall -0 haproxy"

interval 1

weight 2

}

vrrp_instance VI_1 {

state BACKUP

interface eth1

virtual_router_id 88

priority 99

advert_int 1

authentication {

auth_type PASS

auth_pass jumpserverPass

}

virtual_ipaddress {

192.168.1.74

}

track_script {

check_haproxy

}

--集成haproxy 注意腳本權限

chmod +x /etc/keepalived/check_haproxy.sh

vim /etc/keepalived/check_haproxy.sh

A=`ps -C haproxy --no-header |wc -l`

if [ $A -eq 0 ]; then

service haproxy start

sleep 2

if [ `ps -C haproxy --no-header |wc -l` -eq 0 ]; then

/etc/init.d/keepalived stop

mysql -u root -ppassword -h 192.168.1.74

mysql> show databases;

+--------------------+

| Database |

+--------------------+

| information_schema |

| galera_test7 |

| galera_test8 |

| mysql |

| performance_schema |

| test |

+--------------------+

6 rows in set (0.00 sec)

3.7. haproxy搭建及配置（兩個節點都安裝）及配置mariadb

yum install -y haproxy

vim /etc/haproxy/haproxy.cfg

listen galera_cluster

mode tcp

bind 0.0.0.0:3306

balance roundrobin

option tcpka

option httpchk

server maria-server1 192.168.1.72:3306 weight 1

server maria-server2 192.168.1.73:3306 weight 1

3.8. 測試mysql集羣是否正常

jumpserver1：

service keepalived start

service haproxy start

mysql -u root -pjumpserverDb -h 192.168.1.74

MariaDB [(none)]> show databases;

+--------------------+

| Database |

+--------------------+

| galera_test7 |

| information_schema |

| mysql |

| performance_schema |

+--------------------+

4 rows in set (0.00 sec)

jumpserver1：

service keepalived stop

mysql -u root -pjumpserverDb -h 192.168.1.74

MariaDB [(none)]> show databases;

+--------------------+

| Database |

+--------------------+

| galera_test7 |

| information_schema |

| mysql |

| performance_schema |

+--------------------+

4 rows in set (0.00 sec)

Jumpserver2：

3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000

link/ether 08:00:27:4b:e1:39 brd ff:ff:ff:ff:ff:ff

inet 192.168.1.76/23 brd 192.168.1.255 scope global eth1

inet 192.168.1.74/32 scope global eth1

說明Kvip已經浮動到jumpserver2 訪問mysql正常。

4. Jumpserver安裝

4.1 JMS_Master:

4.1.1. 數據庫手動建立

mysql -e "create database jumpserver charset='utf8';"

mysql -e "grant all on jumpserver.* to 'jumpserver'@'%' identified by 'jumpserverDb';"

mysql -e "flush privileges;"

4.1.2. 安裝git

 [root@JMS_Master ~]# yum -y install git

4.1.3 下載jumpserver,使用future-lz分支

[root@JMS_Master ~]# cd /opt

[root@JMS_Master opt]# git clone https://github.com/jumpserver/jumpserver.git -b future-lz

注：不要安裝在/root、/home 等目錄下，以避免權限問題

4.1.4 執行安裝腳本

[root@JMS_Master opt]# cd jumpserver/install

[root@JMS_Master install]# python install.py

安裝到數據庫這步選n

請輸入您服務器的IP地址，用戶瀏覽器能夠訪問 [192.168.1.75]: 192.168.1.75

是否安裝新的MySQL服務器? (y/n) [y]: n

請輸入數據庫服務器IP [127.0.0.1]: 192.168.1.74

請輸入數據庫服務器端口 [3306]: 3306

請輸入數據庫服務器用戶 [jumpserver]: jumpserver

請輸入數據庫服務器密碼: jumpserverDb

請輸入使用的數據庫 [jumpserver]: jumpserver

鏈接數據庫成功

請輸入SMTP地址: xxx.qiye.163.com

請輸入SMTP端口 [25]: 25

請輸入帳戶: xxx@.com

請輸入密碼: xxx

請登錄郵箱查收郵件, 而後確認是否繼續安裝

是否繼續? (y/n) [y]: y

開始寫入配置文件

開始安裝Jumpserver ...

開始更新jumpserver

Creating tables ...

Creating table django_admin_log

Creating table auth_permission

Creating table auth_group_permissions

Creating table auth_group

Creating table django_content_type

Creating table django_session

Creating table setting

Creating table juser_usergroup

Creating table juser_user_group

Creating table juser_user_groups

Creating table juser_user_user_permissions

Creating table juser_user

Creating table juser_admingroup

Creating table juser_document

Creating table jasset_assetgroup

Creating table jasset_idc

Creating table jasset_asset_group

Creating table jasset_asset

Creating table jasset_assetrecord

Creating table jasset_assetalias

Creating table jperm_permlog

Creating table jperm_permsudo

Creating table jperm_permrole_sudo

Creating table jperm_permrole

Creating table jperm_permrule_asset_group

Creating table jperm_permrule_role

Creating table jperm_permrule_asset

Creating table jperm_permrule_user_group

Creating table jperm_permrule_user

Creating table jperm_permrule

Creating table jperm_permpush

Creating table jlog_log

Creating table jlog_alert

Creating table jlog_ttylog

Creating table jlog_execlog

Creating table jlog_filelog

Creating table jlog_termlog_user

Creating table jlog_termlog

Installing custom SQL ...

Installing indexes ...

Installed 0 object(s) from 0 fixture(s)

請輸入管理員用戶名 [admin]: jumpserverDb

請輸入管理員密碼: [jumpserverDb]: jumpserverDb

Starting jumpserver service: [ OK ]

安裝成功，請訪問web, 祝你使用愉快。

請訪問 https://github.com/jumpserver/jumpserver/wiki 查看文檔

41.4 查看一下JMS的配置文件中key爲90ga55qu7tgej8rr

[base]

url = http://192.168.1.75

key = 90ga55qu7tgej8rr

ip = 0.0.0.0

port = 8000

log = debug

[db]

engine = mysql

host = 192.168.1.74

port = 3306

user = jumpserver

password = jumpserverDb

database = jumpserver

[mail]

mail_enable = 1

email_host = xxx.qiye.163.com

email_port = 25

email_host_user = xxx@.com

email_host_password =xxx

email_use_tls = False

email_use_ssl = False

[connect]

nav_sort_by = ip

42 JMs_Slave:

42.1. 安裝git

[root@JMS_Slave ~]# yum -y install git

4.2.2 下載jumpserver,使用future-lz分支

[root@JMS_Slave ~]# cd /opt

[root@JMS_Slave opt]# git clone https://github.com/jumpserver/jumpserver.git -b future-lz

注：不要安裝在/root、/home 等目錄下，以避免權限問題

4.2.3 執行安裝腳本

[root@JMS_Slave opt]# cd jumpserver/install/

[root@JMS_Slave install]# python install.py

File "/usr/lib/python2.6/site-packages/pip/_vendor/requests/packages/urllib3/response.py", line 267, in read

raise ReadTimeoutError(self._pool, None, 'Read timed out.')

ReadTimeoutError: HTTPSConnectionPool(host='pypi.python.org', port=443): Read timed out.

安裝JumpServer 依賴的python庫失敗！

解決:指定源安裝

pip install -r requirements.txt -i http://pypi.douban.com/simple --trusted-host pypi.douban.com

[root@JMS_Slave install]# python install.py

安裝到數據庫這步選n

請輸入您服務器的IP地址，用戶瀏覽器能夠訪問 [192.168.1.76]: 192.168.1.76

是否安裝新的MySQL服務器? (y/n) [y]: n

請輸入數據庫服務器IP [127.0.0.1]: 192.168.1.74

請輸入數據庫服務器端口 [3306]: 3306

請輸入數據庫服務器用戶 [jumpserver]: jumpserver

請輸入數據庫服務器密碼: jumpserverDb

請輸入使用的數據庫 [jumpserver]: jumpserver

鏈接數據庫成功

請輸入SMTP地址: smtp.qiye.163.com

請輸入SMTP端口 [25]: 25

請輸入帳戶: xxx@.com

請輸入密碼: xxx

請登錄郵箱查收郵件, 而後確認是否繼續安裝

是否繼續? (y/n) [y]: y

開始寫入配置文件

開始安裝Jumpserver ...

開始更新jumpserver

Creating tables ...

Installing custom SQL ...

Installing indexes ...

Installed 0 object(s) from 0 fixture(s)

請輸入管理員用戶名 [admin]: jumpserverDb

請輸入管理員密碼: [5Lov@wife]: jumpserverDb

請再次輸入管理員密碼: [5Lov@wife]: jumpserverDb

Starting jumpserver service: [ OK ]

安裝成功，請訪問web, 祝你使用愉快。

請訪問 https://github.com/jumpserver/jumpserver/wiki 查看文檔

4.2.4 key = nf85skm5dh9oenr9改爲 90ga55qu7tgej8rr 要和JMS_Master的key值同樣

複製代碼

[root@JMS_Slave install]# cd ..

[root@JMS_Slave jumpserver]# vim jumpserver.conf

[base]

url = http://192.168.1.76

key = 90ga55qu7tgej8rr

ip = 0.0.0.0

port = 8000

log = debug

[db]

engine = mysql

host = 192.168.1.74

port = 3306

user = jumpserver

password = jumpserverDb

database = jumpserver

[mail]

mail_enable = 1

email_host = smtp.qiye.163.com

email_port = 25

email_host_user = xxx@.com

email_host_password = xxx

email_use_tls = False

email_use_ssl = False

[connect]

nav_sort_by = ip

4.2.5 重啓一下服務讓修改配置生效

[root@JMS_Slave jumpserver]# ./service.sh restart

Stopping jumpserver service:                               [  OK  ]

Starting jumpserver service:                               [  OK  ]

訪問web並登陸一下

兩臺JMS之間作密鑰免密碼登陸：

參照：http://www.2cto.com/os/201205/133514.html

5. 兩臺JMS之間key&user同步

參考：http://bbs.jumpserver.org/read/617.html

6. Haproxy配置Jumpserver

#---------------------------------------------------------------------

# jumpserver 8080

#---------------------------------------------------------------------

frontend jumpserver

bind *:8080

mode http

option httplog

option httpclose

option forwardfor

log global

use_backend jumpserver_backend

backend jumpserver_backend

balance roundrobin

cookie ServerId insert indirect nocache

server jumpserver_1 192.168.1.75:8000 cookie A check

server jumpserver_2 192.168.1.76:8000 cookie B check backup

192.168.1.76爲備份服務當主服務出現問題後自動接管。

6. 密碼下載異常處理

密鑰下載地址： http://192.168.1.75/juser/key/down/?uuid=e330c18b802946a899f1603d2cfe50a3 --缺乏了8000端口號而且不是虛擬ip

修改兩臺jumpserver 配置文件便可

vim jumpserver.conf --新增8000端口

url = http://192.168.1.74:8000 ---注意此處要用虛擬ip

修改admin默認密碼

update juser_user set password ='d1909090909' where username = 'admin'; --passwd md5

[i1]確保內網中router_id沒有出現88

[i2]優先級高

相關標籤/搜索

每日一句

每一个你不满意的现在，都有一个你没有努力的曾经。