jumpserver一體機安裝

第一節實驗環境

系統: CentOS 7

IP: 192.168.68.156

目錄: /opt

數據庫: mariadb

代理: nginx

第二節實戰操做

實驗前提：

[root@Jumpserver156 ~]# systemctl stop firewalld

[root@Jumpserver156 ~]# systemctl disable firewalld

[root@Jumpserver156 ~]# setenforce 0

[root@Jumpserver156 ~]# sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config

#安裝依賴

[root@Jumpserver156 ~]# yum -y install wget gcc epel-release git

2.1安裝redis

Jumpserver 使用 Redis 作 cache 和 celery broke

[root@Jumpserver156 ~]# yum -y install redis

[root@Jumpserver156 ~]# systemctl enable redis

[root@Jumpserver156 ~]# systemctl start redis

[root@Jumpserver156 ~]# ss -tunlp | grep :6379

tcp    LISTEN    0      128    127.0.0.1:6379                  *:*                  users:(("redis-server",pid=4819,fd=4))

2.2安裝mariadb

#安裝

[root@Jumpserver156 ~]# yum -y install mariadb mariadb-devel mariadb-server MariaDB-shared

[root@Jumpserver156 ~]# systemctl enable mariadb

[root@Jumpserver156 ~]# systemctl start mariadb

[root@Jumpserver156 ~]# ss -tunlp | grep :3306

tcp    LISTEN    0      50        *:3306                  *:*                  users:(("mysqld",pid=5237,fd=13))

#建立數據庫與受權

[root@Jumpserver156 ~]# mysql -uroot -e "create database jumpserver default charset 'utf8'; grant all on jumpserver.* to 'jumpserver'@'127.0.0.1' identified by '123456'; flush privileges;"

2.3安裝nginx

[root@Jumpserver156 ~]# yum -y install nginx

[root@Jumpserver156 ~]# systemctl enable nginx

2.4安裝 Python3.6

[root@Jumpserver156 ~]# yum -y install python36 python36-devel

#配置並載入 Python3 虛擬環境

[root@Jumpserver156 ~]# cd /opt/

## py3 爲虛擬環境名稱, 可自定義

[root@Jumpserver156 opt]# python3.6 -m venv py3

##退出虛擬環境可使用 deactivate 命令

[root@Jumpserver156 opt]#  source /opt/py3/bin/activate

##看到下面的提示符表明成功, 之後運行 Jumpserver 都要先運行以上 source 命令, 載入環境後默認如下全部命令均在該虛擬環境中運行

(py3) [root@Jumpserver156 opt]#

2.5下載 Jumpserver

(py3) [root@Jumpserver156 opt]# git clone --depth=1 https://github.com/jumpserver/jumpserver.git

(py3) [root@Jumpserver156 opt]# ls

jumpserver  py3  rh

#安裝依賴 RPM 包

(py3) [root@Jumpserver156 opt]# yum -y install $(cat /opt/jumpserver/requirements/rpm_requirements.txt)

#安裝 Python 庫依賴

(py3) [root@Jumpserver156 opt]# pip install --upgrade pip setuptools

(py3) [root@Jumpserver156 opt]# pip install -r /opt/jumpserver/requirements/requirements.txt

看到Successfully installed就Ok了

#修改 Jumpserver 配置文件

(py3) [root@Jumpserver156 opt]# cd /opt/jumpserver

(py3) [root@Jumpserver156 jumpserver]# cp config_example.yml config.yml

# #生成隨機SECRET_KEY

(py3) [root@Jumpserver156 jumpserver]# SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 50`

(py3) [root@Jumpserver156 jumpserver]# echo "SECRET_KEY=$SECRET_KEY">> ~/.bashrc

# #生成隨機BOOTSTRAP_TOKEN

(py3) [root@Jumpserver156 jumpserver]# BOOTSTRAP_TOKEN=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 16`

(py3) [root@Jumpserver156 jumpserver]# echo "BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN" >> ~/.bashrc

(py3) [root@Jumpserver156 jumpserver]# sed -i "s/SECRET_KEY:/SECRET_KEY: $SECRET_KEY/g" /opt/jumpserver/config.yml

(py3) [root@Jumpserver156 jumpserver]# sed -i "s/BOOTSTRAP_TOKEN:/BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g" /opt/jumpserver/config.yml

(py3) [root@Jumpserver156 jumpserver]# sed -i "s/# DEBUG: true/DEBUG: false/g" /opt/jumpserver/config.yml

(py3) [root@Jumpserver156 jumpserver]# sed -i "s/# LOG_LEVEL: DEBUG/LOG_LEVEL: ERROR/g" /opt/jumpserver/config.yml

(py3) [root@Jumpserver156 jumpserver]# sed -i "s/# SESSION_EXPIRE_AT_BROWSER_CLOSE: false/SESSION_EXPIRE_AT_BROWSER_CLOSE: true/g" /opt/jumpserver/config.yml

(py3) [root@Jumpserver156 jumpserver]# sed -i "s/DB_PASSWORD: /DB_PASSWORD: '123456'/g" /opt/jumpserver/config.yml

(py3) [root@Jumpserver156 jumpserver]#  echo -e "\033[31m 你的SECRET_KEY是 $SECRET_KEY \033[0m"

你的SECRET_KEY是 lI6PCzXeRNHBEDmK2aj5RpRrq2uIWZ7KkExbBDCAHzeIYIKlxR

(py3) [root@Jumpserver156 jumpserver]#  echo -e "\033[31m 你的BOOTSTRAP_TOKEN是 $BOOTSTRAP_TOKEN \033[0m"

你的BOOTSTRAP_TOKEN是 rD1Q6W8KW7clf2SE

# 確認內容有沒有錯誤

(py3) [root@Jumpserver156 jumpserver]# cat config.yml

# SECURITY WARNING: keep the secret key used in production secret!

# 加密祕鑰 生產環境中請修改成隨機字符串，請勿外泄, 可以使用命令生成，PS: 純數字不能夠

# $ cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 49;echo

SECRET_KEY: lI6PCzXeRNHBEDmK2aj5RpRrq2uIWZ7KkExbBDCAHzeIYIKlxR

# SECURITY WARNING: keep the bootstrap token used in production secret!

# 預共享Token coco和guacamole用來註冊服務帳號，不在使用原來的註冊接受機制

BOOTSTRAP_TOKEN: rD1Q6W8KW7clf2SE

# Development env open this, when error occur display the full process track, Production disable it

# DEBUG 模式 開啓DEBUG後遇到錯誤時能夠看到更多日誌

DEBUG: false

# DEBUG, INFO, WARNING, ERROR, CRITICAL can set. See https://docs.djangoproject.com/en/1.10/topics/logging/

# 日誌級別

LOG_LEVEL: ERROR

# LOG_DIR:

# Session expiration setting, Default 24 hour, Also set expired on on browser close

# 瀏覽器Session過時時間，默認24小時, 也能夠設置瀏覽器關閉則過時

# SESSION_COOKIE_AGE: 86400

SESSION_EXPIRE_AT_BROWSER_CLOSE: true

# Database setting, Support sqlite3, mysql, postgres ....

# 數據庫設置

# See https://docs.djangoproject.com/en/1.10/ref/settings/#databases

# SQLite setting:

# 使用單文件sqlite數據庫

# DB_ENGINE: sqlite3

# DB_NAME:

# MySQL or postgres setting like:

# 使用Mysql做爲數據庫

DB_ENGINE: mysql

DB_HOST: 127.0.0.1

DB_PORT: 3306

DB_USER: jumpserver

DB_PASSWORD: '123456'

DB_NAME: jumpserver

# When Django start it will bind this host and port

# ./manage.py runserver 127.0.0.1:8080

# 運行時綁定端口

HTTP_BIND_HOST: 0.0.0.0

HTTP_LISTEN_PORT: 8080

# Use Redis as broker for celery and web socket

# Redis配置

REDIS_HOST: 127.0.0.1

REDIS_PORT: 6379

# REDIS_PASSWORD:

# REDIS_DB_CELERY: 3

# REDIS_DB_CACHE: 4

# Use OpenID authorization

# 使用OpenID 來進行認證設置

# BASE_SITE_URL: http://localhost:8080

# AUTH_OPENID: false  # True or False

# AUTH_OPENID_SERVER_URL: https://openid-auth-server.com/

# AUTH_OPENID_REALM_NAME: realm-name

# AUTH_OPENID_CLIENT_ID: client-id

# AUTH_OPENID_CLIENT_SECRET: client-secret

#

# Use Radius authorization

# 使用Radius來認證

# AUTH_RADIUS: false

# RADIUS_SERVER: localhost

# RADIUS_PORT: 1812

# RADIUS_SECRET:

# OTP settings

# OTP/MFA 配置

# OTP_VALID_WINDOW: 0

# OTP_ISSUER_NAME: Jumpserver

#運行 Jumpserver

## 後臺運行使用 -d 參數./jms start all -d# 新版本更新了運行腳本, 使用方式./jms start|stop|status all 後臺運行請添加 -d 參數

(py3) [root@Jumpserver156 jumpserver]# ./jms start all -d

.....一路ok過來

553 static files copied to '/opt/jumpserver/data/static'.

- Start Celery as Distributed Task Queue

- Start Beat as Periodic Task Scheduler

gunicorn is running: 7987

celery is running: 8009

beat is running: 8011

2.6安裝 docker 部署 koko 與 guacamole

(py3) [root@Jumpserver156 jumpserver]# yum install -y yum-utils device-mapper-persistent-data lvm2

(py3) [root@Jumpserver156 jumpserver]# yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo

(py3) [root@Jumpserver156 jumpserver]# yum makecache fast

(py3) [root@Jumpserver156 jumpserver]# rpm --import https://mirrors.aliyun.com/docker-ce/linux/centos/gpg

(py3) [root@Jumpserver156 jumpserver]# yum -y install docker-ce

(py3) [root@Jumpserver156 jumpserver]# curl -sSL https://get.daocloud.io/daotools/set_mirror.sh | sh -s http://f1361db2.m.daocloud.io

(py3) [root@Jumpserver156 jumpserver]# systemctl enable docker

(py3) [root@Jumpserver156 jumpserver]# systemctl restart docker

# 獲取當前服務器 IP

(py3) [root@Jumpserver156 jumpserver]# Server_IP=`ip addr | grep inet | egrep -v '(127.0.0.1|inet6|docker)' | awk '{print $2}' | tr -d "addr:" | head -n 1 | cut -d / -f1`

(py3) [root@Jumpserver156 jumpserver]# echo -e "\033[31m 你的服務器IP是 $Server_IP \033[0m"

你的服務器IP是 192.168.68.156

# http://<Jumpserver_url> 指向 jumpserver 的服務端口, 如 http://192.168.68.156:8080# BOOTSTRAP_TOKEN 爲 Jumpserver/config.yml 裏面的 BOOTSTRAP_TOKEN

(py3) [root@Jumpserver156 jumpserver]# docker run --name jms_koko -d -p 2222:2222 -p 5000:5000 -e CORE_HOST=http://$Server_IP:8080 -e BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN jumpserver/jms_koko:1.5.0

Unable to find image 'jumpserver/jms_koko:1.5.0' locally

1.5.0: Pulling from jumpserver/jms_koko

921b31ab772b: Pull complete

.....

69987f4a11b3: Pull complete

Digest: sha256:efce4b9b613639f63c666005f0ac6496a3b3c0fd45a758d25325041443c178f0

Status: Downloaded newer image for jumpserver/jms_koko:1.5.0

452fb45cf70343335725a46e3274ac13e10f82fe5a695f6728e78ac4d49d38bf

(py3) [root@Jumpserver156 jumpserver]# docker run --name jms_guacamole -d -p 8081:8081 -e JUMPSERVER_SERVER=http://$Server_IP:8080 -e BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN jumpserver/jms_guacamole:1.5.0

Unable to find image 'jumpserver/jms_guacamole:1.5.0' locally

1.5.0: Pulling from jumpserver/jms_guacamole

24ba68623a54: Pull complete

.....

e486d153fd52: Pull complete

Digest: sha256:c6c3c42994b2b6e907110cf5c4fa39419c3aa180d385560bab2673afe0c38907

Status: Downloaded newer image for jumpserver/jms_guacamole:1.5.0

390b51e4b060c450b911188bd06bdaf83209a5a8f09ee8e8b7b4edb485601a7f

(py3) [root@Jumpserver156 jumpserver]# docker ps

CONTAINER ID        IMAGE                            COMMAND            CREATED            STATUS              PORTS                                            NAMES

e3c9c66ada67        jumpserver/jms_koko:1.5.0        "./entrypoint.sh"  12 seconds ago      Up 11 seconds      0.0.0.0:2222->2222/tcp, 0.0.0.0:5000->5000/tcp  jms_koko

390b51e4b060        jumpserver/jms_guacamole:1.5.0  "entrypoint.sh"    39 minutes ago      Up 39 minutes      4822/tcp, 0.0.0.0:8081->8081/tcp                jms_guacamole

2.7 安裝 Web Terminal

前端: Luna 須要 Nginx 來運行訪問 訪問(https://github.com/jumpserver/luna/releases)下載對應版本的 release 包, 直接解壓, 不須要編譯

(py3) [root@Jumpserver156 jumpserver]# cd /opt

(py3) [root@Jumpserver156 opt]# wget https://github.com/jumpserver/luna/releases/download/1.5.0/luna.tar.gz

# 提示：若是網絡有問題致使下載沒法完成可使用下面地址

https://demo.jumpserver.org/download/luna/1.5.0/luna.tar.gz

(py3) [root@Jumpserver156 opt]# tar xf luna.tar.gz

(py3) [root@Jumpserver156 opt]# chown -R root:root luna

2.8配置 Nginx 整合各組件

(py3) [root@Jumpserver156 ~]# rm -rf /etc/nginx/conf.d/default.conf

(py3) [root@Jumpserver156 ~]# vi /etc/nginx/conf.d/jumpserver.conf

server {

    listen 80;

    client_max_body_size 100m;  # 錄像及文件上傳大小限制

    location /luna/ {

        try_files $uri / /index.html;

        alias /opt/luna/;  # luna 路徑, 若是修改安裝目錄, 此處須要修改

    }

    location /media/ {

        add_header Content-Encoding gzip;

        root /opt/jumpserver/data/;  # 錄像位置, 若是修改安裝目錄, 此處須要修改

    }

    location /static/ {

        root /opt/jumpserver/data/;  # 靜態資源, 若是修改安裝目錄, 此處須要修改

    }

    location /socket.io/ {

        proxy_pass      http://localhost:5000/socket.io/;

        proxy_buffering off;

        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;

        proxy_set_header Connection "upgrade";

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        access_log off;

    }

    location /coco/ {

        proxy_pass      http://localhost:5000/coco/;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        access_log off;

    }

    location /guacamole/ {

        proxy_pass      http://localhost:8081/;

        proxy_buffering off;

        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;

        proxy_set_header Connection $http_connection;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        access_log off;

    }

    location / {

        proxy_pass http://localhost:8080;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    }

}

#註釋掉/etc/nginx/nginx.conf文件中的server的所有內容

38 # server {

39 #        listen      81 default_server;

40 #        #listen      [::]:80 default_server;

41 #        server_name  _;

42 #        root        /usr/share/nginx/html;

43 #

44 #        # Load configuration files for the default server block.

45 #        include /etc/nginx/default.d/*.conf;

46 #

47 #        location / {

48 #        }

49 #

50 #        error_page 404 /404.html;

51 #            location = /40x.html {

52 #        }

53 #

54 #        error_page 500 502 503 504 /50x.html;

55 #            location = /50x.html {

56 #        }

57 #    }

# 運行 Nginx

[root@Jumpserver156 ~]# nginx -t   # 確保配置沒有問題, 有問題請先解決

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok

nginx: configuration file /etc/nginx/nginx.conf test is successful

[root@Jumpserver156 ~]# systemctl restart nginx

第三節測試

3.1測試1

訪問 http://192.168.244.144 (注意 沒有 :8080 經過 nginx 代理端口進行訪問)

默認帳號: admin 密碼: admin 到會話管理-終端管理 接受 koko Guacamole 等應用的註冊

3.2測試2

(py3) [root@Jumpserver156 jumpserver]# ssh -p2222 admin@192.168.68.156

The authenticity of host '[192.168.68.156]:2222 ([192.168.68.156]:2222)' can't be established.

RSA key fingerprint is SHA256:R9rfDzIJIweoKmvHSoYeOI3rOSY2oZl/eCdmowQA+mQ.

RSA key fingerprint is MD5:6a:45:34:26:58:8c:e4:f5:32:76:9a:ca:ad:4d:02:82.

Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added '[192.168.68.156]:2222' (RSA) to the list of known hosts.

admin@192.168.68.156's password:

Administrator,  歡迎使用Jumpserver開源堡壘機系統

1) 輸入 ID 進行直接登錄.

2) 輸入 部分IP、主機名、備註 進行進行搜索登陸(若是惟一).

3) 輸入 / + IP, 主機名 or 備註 進行搜索， 如: /192.168.

4) 輸入 p 進行顯示您有權限的主機.

5) 輸入 g 進行顯示您有權限的節點.

6) 輸入 r 進行刷新最新的機器和節點信息.

7) 輸入 h 進行顯示幫助.

8) 輸入 q 進行退出.

Opt> p

沒有資產

Opt> q

(py3) [root@Jumpserver156 jumpserver]# sftp -P2222 admin@192.168.68.156

admin@192.168.68.156's password:

Connected to 192.168.68.156.

sftp> ls

# 若是是用在 Windows 下, Xshell Terminal 登陸語法以下

$ ssh admin@192.168.244.1442222

$ sftp admin@192.168.244.1442222密碼: admin 

若是能登錄表明部署成功

# sftp默認上傳的位置在資產的 /tmp 目錄下

# windows拖拽上傳的位置在資產的 Guacamole RDP上的 G 目錄下

第四節多組件負載說明

# koko 服務默認運行在單核心下面, 當負載太高時會致使用戶訪問變慢, 這時可運行多個 docker 容器緩解

$docker run --name jms_koko01 -d -p2223:2222 -p5001:5000 -eCORE_HOST=http:// -eBOOTSTRAP_TOKEN=****** jumpserver/jms_koko:1.5.0

$ docker run --name jms_koko02 -d -p2224:2222 -p5002:5000 -eCORE_HOST=http:// -eBOOTSTRAP_TOKEN=****** jumpserver/jms_koko:1.5.0

# guacamole 也是同樣

$ docker run --name jms_guacamole01 -d -p8082:8081 -eJUMPSERVER_SERVER=http:// -eBOOTSTRAP_TOKEN=****** jumpserver/jms_guacamole:1.5.0

$ docker run --name jms_guacamole02 -d -p8083:8081 -eJUMPSERVER_SERVER=http:// -eBOOTSTRAP_TOKEN=****** jumpserver/jms_guacamole:1.5.0

# nginx 代理設置

$ vi /etc/nginx/nginx.conf

user nginx;

worker_processes  auto;

error_log  /var/log/nginx/error.log warn;

pid        /var/run/nginx.pid;

events {

    worker_connections  1024;

}

# 加入 tcp 代理

stream {

    log_format  proxy  '$remote_addr [$time_local] '

                      '$protocol $status $bytes_sent $bytes_received '

                      '$session_time "$upstream_addr" '

                      '"$upstream_bytes_sent" "$upstream_bytes_received" "$upstream_connect_time"';

    access_log /var/log/nginx/tcp-access.log  proxy;

    open_log_file_cache off;

    upstream kokossh {

        server localhost:2222 weight=1;

        server localhost:2223 weight=1;  # 多節點

        server localhost:2224 weight=1;  # 多節點

        # 這裏是 koko ssh 的後端ip

        hash $remote_addr;

    }

    server {

        listen 2220;  # 不能使用已經使用的端口, 自行修改, 用戶ssh登陸時的端口

        proxy_pass kokossh;

        proxy_connect_timeout 10s;

    }

}

# 到此結束

http {

    include      /etc/nginx/mime.types;

    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '

                      '$status $body_bytes_sent "$http_referer" '

                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;

    # tcp_nopush    on;

    keepalive_timeout  65;

    # 關閉版本顯示

    server_tokens off;

    include /etc/nginx/conf.d/*.conf;

}

$ firewall-cmd --zone=public --add-port=2220/tcp --permanent

$ firewall-cmd --reload

$ vi /etc/nginx/conf.d/jumpserver.conf

upstream jumpserver {

    server localhost:8080;

    # 這裏是 jumpserver 的後端ip

}

upstream kokows {

    server localhost:5000 weight=1;

    server localhost:5001 weight=1;  # 多節點

    server localhost:5002 weight=1;  # 多節點

    # 這裏是 koko ws 的後端ip

    ip_hash;

}

upstream guacamole {

    server localhost:8081 weight=1;

    server localhost:8082 weight=1;  # 多節點

    server localhost:8083 weight=1;  # 多節點

    # 這裏是 guacamole 的後端ip

    ip_hash;

}

server {

    listen 80;

    server_name demo.jumpserver.org;  # 自行修改爲你的域名

    client_max_body_size 100m;  # 錄像上傳大小限制

    location / {

        proxy_pass http://jumpserver;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        access_log off;

    }

    location /luna/ {

        try_files $uri / /index.html;

        alias /opt/luna/;

    }

    location /socket.io/ {

        proxy_pass      http://kokows/socket.io/;  # koko

        proxy_buffering off;

        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;

        proxy_set_header Connection "upgrade";

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        access_log off;

    }

    location /coco/ {

        proxy_pass      http://kokows/coco/;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        access_log off;

    }

    location /guacamole/ {

        proxy_pass      http://guacamole/;  #  guacamole

        proxy_buffering off;

        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;

        proxy_set_header Connection $http_connection;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        access_log off;

    }

}

$ nginx -t

$ nginx -s reload

參考文檔：http://docs.jumpserver.org/zh/master/setup_by_centos7.html

官方文檔：http://docs.jumpserver.org/zh/master/

---

結束語：

更多精彩內容持續更新中，關注我微信公衆號，有你更精彩。