Jumpserver(堡壘機)的安裝與應用

官網：http://docs.jumpserver.org/zh/docs/introduce.html

參考：http://www.javashuo.com/article/p-tcolhufl-bn.html

 做者:鄧聰聰

環境

• 系統: CentOS 7.6
• IP: 172.16.16.2
• 關閉 selinux 和防火牆
• jumpserver和coco、luna的版本必須保持一致

[root@bogon ~]# setenforce 0
[root@bogon ~]# sed -i "s/enforcing/disabled/g" /etc/selinux/config
[root@bogon ~]# iptables -F

1.準備 Python3 和 Python 虛擬環境

1. 安裝依賴包

   [root@bogon ~]# yum -y install wget gcc epel-release git

2. 安裝 Python3.6

   [root@bogon ~]# yum -y install python36 python36-devel

3. 創建 Python 虛擬環境

   [root@bogon ~]#  cd /opt
   [root@bogon opt]#  python3.6 -m venv py3
   [root@bogon opt]#  source /opt/py3/bin/activate
   # 看到下面的提示符表明成功,之後運行 Jumpserver 都要先運行以上 source 命令,如下全部命令均在該虛擬環境中運行
   (py3)[root@bogon opt]#

2.安裝 Jumpserver

1. Clone 項目也能夠選擇去 Github 項目頁面直接下載zip包

   (py3)[root@bogon opt]# git clone https://github.com/jumpserver/jumpserver.git

2. 安裝依賴 RPM 包

   (py3)[root@bogon opt]#cd /opt/jumpserver/requirements
   (py3)[root@bogon requirements]#yum -y install $(cat rpm_requirements.txt)

3. 安裝 Python 庫依賴

   (py3)[root@bogon requirements]#pip install --upgrade pip setuptools
   (py3)[root@bogon requirements]#pip install -r requirements.txt

4. 安裝 Redis, Jumpserver 使用 Redis 作 cache 和 celery broke

   (py3)[root@bogon requirements]#yum -y install redis
   (py3)[root@bogon requirements]#systemctl start redis

5.  安裝 MySQL

   (py3) [root@bogon requirements]# yum -y install mariadb mariadb-devel mariadb-server # centos7下安裝的是mariadb
   (py3) [root@bogon requirements]# systemctl start mariadb

6. 建立數據庫 Jumpserver 並受權

   (py3) [root@bogon requirements]#mysql -uroot
   mysql> create database jumpserver default charset 'utf8';
   mysql> grant all on jumpserver.* to 'jumpserver'@'127.0.0.1' identified by 'weakPassword';
   mysql> flush privileges;
   mysql> quit

7. 修改 Jumpserver 配置文件    注意: 配置文件是 Python 格式,不要用 TAB,而要用空

   (py3) [root@bogon requirements]#cd  ..
   (py3) [root@bogon jumpserver]# cp config_example.py config.py
   (py3) [root@bogon jumpserver]# vi config.py

   #!/usr/bin/env python3
   # -*- coding: utf-8 -*-
   """
       jumpserver.config
       ~~~~~~~~~~~~~~~~~
   
       Jumpserver project setting file
   
       :copyright: (c) 2014-2017 by Jumpserver Team
       :license: GPL v2, see LICENSE for more details.
   """
   import os
   
   BASE_DIR = os.path.dirname(os.path.abspath(__file__))
   
   
   class Config:
       """
       Jumpserver Config File
       Jumpserver 配置文件
   
       Jumpserver use this config for drive django framework running,
       You can set is value or set the same envirment value,
       Jumpserver look for config order: file => env => default
   
       Jumpserver使用配置來驅動Django框架的運行，
       你能夠在該文件中設置，或者設置一樣名稱的環境變量,
       Jumpserver使用配置的順序: 文件 => 環境變量 => 默認值
       """
       # SECURITY WARNING: keep the secret key used in production secret!
       # 加密祕鑰 生產環境中請修改成隨機字符串，請勿外泄
       SECRET_KEY = '2vym+ky!997d5kkcc64mnz06y1mmui3lut#(^wd=%s_qj$1%x'
       ALLOWED_HOSTS = ['*']
   
       # SECURITY WARNING: keep the bootstrap token used in production secret!
       # 預共享Token coco和guacamole用來註冊服務帳號，不在使用原來的註冊接受機制
       BOOTSTRAP_TOKEN = 'nwv4RdXpM82LtSvmV'
   
       # Development env open this, when error occur display the full process track, Production disable it
       # DEBUG 模式 開啓DEBUG後遇到錯誤時能夠看到更多日誌
       # DEBUG = True
       DEBUG = False
   
       # DEBUG, INFO, WARNING, ERROR, CRITICAL can set. See https://docs.djangoproject.com/en/1.10/topics/logging/
       # 日誌級別
       # LOG_LEVEL = 'DEBUG'
       # LOG_DIR = os.path.join(BASE_DIR, 'logs')
       LOG_LEVEL = 'ERROR'
       LOG_DIR = os.path.join(BASE_DIR, 'logs')
   
       # Session expiration setting, Default 24 hour, Also set expired on on browser close
       # 瀏覽器Session過時時間，默認24小時, 也能夠設置瀏覽器關閉則過時
       # SESSION_COOKIE_AGE = 3600 * 24
       # SESSION_EXPIRE_AT_BROWSER_CLOSE = False
       SESSION_EXPIRE_AT_BROWSER_CLOSE = True
       # Database setting, Support sqlite3, mysql, postgres ....
       # 數據庫設置
       # See https://docs.djangoproject.com/en/1.10/ref/settings/#databases
   
       # SQLite setting:
       # 使用單文件sqlite數據庫
       # DB_ENGINE = 'sqlite3'
       # DB_NAME = os.path.join(BASE_DIR, 'data', 'db.sqlite3')
   
       # MySQL or postgres setting like:
       # 使用Mysql做爲數據庫
       DB_ENGINE = 'mysql'
       DB_HOST = '127.0.0.1'
       DB_PORT = 3306
       DB_USER = 'jumpserver'
       DB_PASSWORD = '123456'
       DB_NAME = 'jumpserver'
   
       # When Django start it will bind this host and port
       # ./manage.py runserver 127.0.0.1:8080
       # 運行時綁定端口
       HTTP_BIND_HOST = '0.0.0.0'
       HTTP_LISTEN_PORT = 8080
   
       # Use Redis as broker for celery and web socket
       # Redis配置
       REDIS_HOST = '127.0.0.1'
       REDIS_PORT = 6379
       # REDIS_PASSWORD = ''
       # REDIS_DB_CELERY = 3
       # REDIS_DB_CACHE = 4
   
       # Use OpenID authorization
       # 使用OpenID 來進行認證設置
       # BASE_SITE_URL = 'http://localhost:8080'
       # AUTH_OPENID = False  # True or False
       # AUTH_OPENID_SERVER_URL = 'https://openid-auth-server.com/'
       # AUTH_OPENID_REALM_NAME = 'realm-name'
       # AUTH_OPENID_CLIENT_ID = 'client-id'
       # AUTH_OPENID_CLIENT_SECRET = 'client-secret'
   
       #
       # OTP_VALID_WINDOW = 0
   
       def __init__(self):
           pass
   
       def __getattr__(self, item):
           return None
   
   
   class DevelopmentConfig(Config):
       pass
   
   
   class TestConfig(Config):
       pass
   
   
   class ProductionConfig(Config):
       pass
   
   
   # Default using Config settings, you can write if/else for different env
   config = DevelopmentConfig()

   View Code
8. 運行 Jumpserver

   (py3) [root@bogon jumpserver]#./jms start all   #後臺運行使用 -d 參數./jms start all -d
   (py3) [root@bogon jumpserver]#./jms start|stop|status|restart all  #其餘參數

3.安裝 SSH Server 和 WebSocket Server: Coco

1.  Clone 項目

   (py3) [root@bogon jumpserver]# cd ..
   (py3) [root@bogon opt]# git clone https://github.com/jumpserver/coco.git
   (py3) [root@bogon opt]#cd /opt/coco/requirements
   (py3) [root@bogon requirements]#yum -y  install $(cat rpm_requirements.txt)
   (py3) [root@bogon requirements]#pip install -r requirements.txt

2. 修改配置文件並運行 

   (py3) [root@bogon requirements]#cd /opt/coco 
   [root@bogon coco]# mkdir keys logs 
   [root@bogon coco]# cp conf_example.py conf.py 
   [root@bogon coco]# vi conf.py

   #!/usr/bin/env python3
   # -*- coding: utf-8 -*-
   #
   import os
   
   BASE_DIR = os.path.dirname(__file__)
   
   class Config:
       """
       Coco config file, coco also load config from server update setting below
       """
       # 項目名稱, 會用來向Jumpserver註冊, 識別而已, 不能重複
       # NAME = "localhost"
       # Jumpserver項目的url, api請求註冊會使用
       # CORE_HOST = os.environ.get("CORE_HOST") or 'http://127.0.0.1:8080'
       CORE_HOST = 'http://127.0.0.1:8080'
       # Bootstrap Token, 預共享祕鑰, 用來註冊coco使用的service account和terminal
       # 請和jumpserver 配置文件中保持一致，註冊完成後能夠刪除
       # BOOTSTRAP_TOKEN = "PleaseChangeMe"
       BOOTSTRAP_TOKEN = "nwv4RdXpM82LtSvmV"
       # 啓動時綁定的ip, 默認 0.0.0.0
       # BIND_HOST = '0.0.0.0'
       # 監聽的SSH端口號, 默認2222
       # SSHD_PORT = 2222
       # 監聽的HTTP/WS端口號，默認5000
       # HTTPD_PORT = 5000
       # 項目使用的ACCESS KEY, 默認會註冊,並保存到 ACCESS_KEY_STORE中,
       # 若是有需求, 能夠寫到配置文件中, 格式 access_key_id:access_key_secret
       # ACCESS_KEY = None
       # ACCESS KEY 保存的地址, 默認註冊後會保存到該文件中
       # ACCESS_KEY_STORE = os.path.join(BASE_DIR, 'keys', '.access_key')
       # 加密密鑰
       # SECRET_KEY = None
       # 設置日誌級別 ['DEBUG', 'INFO', 'WARN', 'ERROR', 'FATAL', 'CRITICAL']
       # LOG_LEVEL = 'INFO'
       LOG_LEVEL = 'ERROR'
       # 日誌存放的目錄
       # LOG_DIR = os.path.join(BASE_DIR, 'logs')
       # Session錄像存放目錄
       # SESSION_DIR = os.path.join(BASE_DIR, 'sessions')
       # 資產顯示排序方式, ['ip', 'hostname']
       # ASSET_LIST_SORT_BY = 'ip'
       # 登陸是否支持密碼認證
       # PASSWORD_AUTH = True
       # 登陸是否支持祕鑰認證
       # PUBLIC_KEY_AUTH = True
       # SSH白名單
       # ALLOW_SSH_USER = 'all'  # ['test', 'test2']
       # SSH黑名單, 若是用戶同時在白名單和黑名單，黑名單優先生效
       # BLOCK_SSH_USER = []
       # 和Jumpserver 保持心跳時間間隔
       # HEARTBEAT_INTERVAL = 5
   
       # Admin的名字，出問題會提示給用戶
       # ADMINS = ''
       COMMAND_STORAGE = {
           "TYPE": "server"
       }
       REPLAY_STORAGE = {
           "TYPE": "server"
       }
   
       # SSH鏈接超時時間 (default 15 seconds)
       # SSH_TIMEOUT = 15
       # 語言 = en
       LANGUAGE_CODE = 'zh'
   
   config = Config()

   View Code

   (py3) [root@bogon coco]#./cocod start      #後臺運行使用 -d 參數./cocod start -d
   (py3) [root@bogon coco]#./cocod start|stop|status|restart  #腳本使用方式

    

4.安裝 Web Terminal 前端: Luna

1. (py3) [root@bogon opt]# cd /opt
   # 訪問(https://github.com/jumpserver/luna/releases)下載對應版本的 release 包,直接解壓,不須要編譯
   (py3) [root@bogon opt]# wget https://github.com/jumpserver/luna/releases/download/1.4.6/luna.tar.gz
   (py3) [root@bogon opt]# tar -xf luna.tar.gz
   (py3) [root@bogon opt]# chown -R root:root luna

5.配置 Nginx 整合各組件

1. 安裝 Nginx

   vi /etc/yum.repos.d/nginx.repo
   
   [nginx]
   name=nginx repo
   baseurl=http://nginx.org/packages/centos/7/$basearch/
   gpgcheck=0
   enabled=1

   View Code

   (py3) [root@bogon opt]# yum install -y nginx
   (py3) [root@bogon opt]# rm -rf /etc/nginx/conf.d/default.conf
   (py3) [root@bogon opt]# vi /etc/nginx/conf.d/jumpserver.conf

   server {
       listen 80;  # 代理端口，之後將經過此端口進行訪問，再也不經過8080端口
       server_name demo.jumpserver.org;  # 修改爲你的域名
    
       client_max_body_size 100m;  # 錄像及文件上傳大小限制
    
       location /luna/ {
           try_files $uri / /index.html;
           alias /opt/luna/;  # luna 路徑，若是修改安裝目錄，此處須要修改
       }
    
       location /media/ {
           add_header Content-Encoding gzip;
           root /opt/jumpserver/data/;  # 錄像位置，若是修改安裝目錄，此處須要修改
       }
    
       location /static/ {
           root /opt/jumpserver/data/;  # 靜態資源，若是修改安裝目錄，此處須要修改
       }
    
       location /socket.io/ {
           proxy_pass       http://localhost:5000/socket.io/;  # 若是coco安裝在別的服務器，請填寫它的ip
           proxy_buffering off;
           proxy_http_version 1.1;
           proxy_set_header Upgrade $http_upgrade;
           proxy_set_header Connection "upgrade";
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header Host $host;
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
           access_log off;
       }
    
       location /coco/ {
           proxy_pass       http://localhost:5000/coco/;  # 若是coco安裝在別的服務器，請填寫它的ip
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header Host $host;
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
           access_log off;
       }
    
       location /guacamole/ {
           proxy_pass       http://localhost:8081/;  # 若是guacamole安裝在別的服務器，請填寫它的ip
           proxy_buffering off;
           proxy_http_version 1.1;
           proxy_set_header Upgrade $http_upgrade;
           proxy_set_header Connection $http_connection;
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header Host $host;
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
           access_log off;
       }
    
       location / {
           proxy_pass http://localhost:8080;  # 若是jumpserver安裝在別的服務器，請填寫它的ip
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header Host $host;
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       }
   }

   View Code
2. 運行nginx

   (py3) [root@bogon opt]#nginx -t   # 確保配置沒有問題, 有問題請先解決
   (py3) [root@bogon opt]#systemctl start nginx

3. 使用 Jumpserver,服務所有啓動後,訪問 http://IP
   
4. jumpsever的服務啓動流程

   [root@bogon ~]#  cd /opt
   [root@bogon opt]#  source /opt/py3/bin/activate  #進入python環境
   (py3)[root@bogon opt]#systemctl start redis         #啓動redis
   (py3)[root@bogon opt]#systemctl start mariadb    #啓動數據庫服務
   (py3)[root@bogon opt]#cd /opt/jumpserver
   (py3)[root@bogon jumpserver]# ./jms start -d     #啓動jumpserver服務，後臺運行
   (py3)[root@bogon coco]#./coco start -d          #後臺運行coco服務
   (py3)[root@bogon coco]#systemctl start nginx     #啓動nginx服務
   (py3)[root@bogon coco]#systemctl enable nginx    #開機自啓動
   (py3)[root@bogon coco]#systemctl enable mariadb 
   (py3)[root@bogon coco]#systemctl enable redis

    

使用jumpserver時，打開會話管理-web終端無顯示可能因爲瀏覽器形成的，更換其餘第三方瀏覽下便可

6.Jumpserver的使用

1. 登錄後建立用戶組，方便之後的受權操做

2. 添加系統用戶

    

    

    

 爲了更方便快捷的使用jumpserver,默認管理員沒法直接生成密碼給用戶，有大拿提供了一下修改配置文件的辦法，直接建立密碼給用戶，感受挺好用就分享給你們

    配置文件路徑：/opt/jumpserver/apps/users/templates/users

(py3) [root@bogon users]# more _user.html
{% extends '_base_create_update.html' %}
{% load i18n %}
{% load static %}
{% load bootstrap3 %}
{% block form %}
    {% if form.non_field_errors %}
         <div class="alert alert-danger">
            {{ form.non_field_errors }}
         </div>
    {% endif %}
    <form method="post" class="form-horizontal" action="" enctype="multipart/form-data">
        {% csrf_token %}
        <h3>{% trans 'Account' %}</h3>
        {% bootstrap_field form.name layout="horizontal" %}
        {% bootstrap_field form.username layout="horizontal" %}
        {% bootstrap_field form.email layout="horizontal" %}
        {% bootstrap_field form.groups layout="horizontal" %}

        <div class="hr-line-dashed"></div>

        <h3>{% trans 'Auth' %}</h3> {#{% block password %}{% endblock %}#}    #註釋該行
        {% bootstrap_field form.password layout="horizontal" %}    #追加的行內容
        {% bootstrap_field form.otp_level layout="horizontal" %}

        <div class="hr-line-dashed"></div>
        <h3>{% trans 'Security and Role' %}</h3>
        {% bootstrap_field form.role layout="horizontal" %}
        <div class="form-group {% if form.date_expired.errors %} has-error {% endif %}" id="date_5">
            <label for="{{ form.date_expired.id_for_label }}" class="col-sm-2 control-label">{{ form.date_expired.label }}</label>
            <div class="col-sm-9">
                <div class="input-group date">
                    <span class="input-group-addon"><i class="fa fa-calendar"></i></span>
                    {% if form.errors %}
                    <input id="{{ form.date_expired.id_for_label }}" name="{{ form.date_expired.html_name }}" type="text" class="form-control"  value="{{ form.date_exp
ired.value }}">
                    {% else %}
                    <input id="{{ form.date_expired.id_for_label }}" name="{{ form.date_expired.html_name }}" type="text" class="form-control"  value="{{ form.date_exp
ired.value|date:'Y-m-d H:i' }}">
                    {% endif %}
                </div>
                <span class="help-block ">{{ form.date_expired.errors }}</span>
            </div>
         </div>
        <div class="hr-line-dashed"></div>
        <h3>{% trans 'Profile' %}</h3>
        {% bootstrap_field form.phone layout="horizontal" %}
        {% bootstrap_field form.wechat layout="horizontal" %}
        {% bootstrap_field form.comment layout="horizontal" %}
        <div class="hr-line-dashed"></div>
        <div class="form-group">
            <div class="col-sm-4 col-sm-offset-2">
                <button class="btn btn-white" type="reset">{% trans 'Reset' %}</button>
                <button id="submit_button" class="btn btn-primary" type="submit">{% trans 'Submit' %}</button>
            </div>
        </div>
    </form>

{% endblock %}
{% block custom_foot_js %}
    <script src="{% static 'js/plugins/datepicker/bootstrap-datepicker.js' %}"></script>
    <script type="text/javascript" src='{% static "js/plugins/daterangepicker/moment.min.js" %}'></script>
    <script type="text/javascript" src='{% static "js/plugins/daterangepicker/daterangepicker.min.js" %}'></script>
    <link rel="stylesheet" type="text/css" href={% static "css/plugins/daterangepicker/daterangepicker.css" %} />

    <script>
        var dateOptions = {
            singleDatePicker: true,
            showDropdowns: true,
            timePicker: true,
            timePicker24Hour: true,
            autoApply: true,
            locale: {
                format: 'YYYY-MM-DD HH:mm'
            }
        };
        $(document).ready(function () {
            $('.select2').select2();
            $('#id_date_expired').daterangepicker(dateOptions);
        })
    </script>
{% endblock %}

 ***升級篇***

　　升級 Jumpserver

cd /opt/jumpserver
source /opt/py3/bin/activate
./jms stop
git fetch
git pull

pip install -r requirements/requirements.txt

啓動 jumpserver
cd ../
./jms start all -d

　　升級coco

cd /opt/coco
git pull
source /opt/py3/bin/activate
./cocod stop

pip install -r requirements/requirements.txt
./cocod start -d

　　升級luna

cd /opt
rm -rf luna
wget https://github.com/jumpserver/luna/releases/download/1.4.8/luna.tar.gz

# 若是網絡有問題致使下載沒法完成可使用下面地址
$ wget https://demo.jumpserver.org/download/luna/1.4.8/luna.tar.gz

tar xf luna.tar.gz
chown -R root:root luna