基於docker-compose部署jumpserver

時間  2020-12-03
標籤 前端 mysql linux nginx git github redis sql docker shell 欄目 Docker 简体版
原文   原文鏈接

基於docker-compose部署jumpserver前端

組件說明

Jumpserver 爲管理後臺, 管理員能夠經過 Web 頁面進行資產管理、用戶管理、資產受權等操做, 用戶能夠經過 Web 頁面進行資產登陸, 文件管理等操做
koko 爲 SSH Server 和 Web Terminal Server 。用戶可使用本身的帳戶經過 SSH 或者 Web Terminal 訪問 SSH 協議和 Telnet 協議資產
Luna 爲 Web Terminal Server 前端頁面, 用戶使用 Web Terminal 方式登陸所須要的組件
Guacamole 爲 RDP 協議和 VNC 協議資產組件, 用戶能夠經過 Web Terminal 來鏈接 RDP 協議和 VNC 協議資產 (暫時只能經過 Web Terminal 來訪問)


mysql

端口說明

Jumpserver 默認 Web 端口爲 8080/tcp, 默認 WS 端口爲 8070/tcp, 配置文件 jumpserver/config.yml
koko 默認 SSH 端口爲 2222/tcp, 默認 Web Terminal 端口爲 5000/tcp 配置文件在 koko/config.yml
Guacamole 默認端口爲 8081/tcp, 配置文件 /config/tomcat9/conf/server.xml
Nginx 默認端口爲 80/tcp
Redis 默認端口爲 6379/tcp
Mysql 默認端口爲 3306/tcp




linux

Protocol Server name Port
TCP Jumpserver 80
TCP Guacamole
TCP Db 3306
TCP Redis 6379
TCP koko 2222
環境

系統: Centos 7nginx

NFS-server: 192.168.150.192git

數據庫 IP: 192.168.150.45github

Redis ip: 192.168.150.45redis

Jumpserver IP: 192.168.150.45 192.168.150.26sql

koko IP: 192.168.150.45 192.168.150.26docker

Guacamole IP: 192.168.150.45 192.168.150.26shell

Tengine 代理IP: 192.168.150.45 192.168.150.26

安全設置

ssh、telnet協議 資產的防火牆設置容許 koko 與 jumpserver 訪問

rdp協議 資產的防火牆設置容許 guacamole 與jumpserver 訪問

防火牆設置

根據需求開放對應的端口,或者直接關閉防火牆

systemctl stop firewalld.service
systemctl disable firewalld.service
NFS部署

  1. 安裝epel庫

    yum -y install epel-release wget

  2. 安裝nfs-server

    yum -y install nfs-utils rpcbind
systemctl enable rpcbind nfs-server nfs-lock nfs-idmap
systemctl start rpcbind nfs-server nfs-lock nfs-idmap

  3. 建立NFS共享目錄

    mkdir /data

  4. 設置NFS訪問權限

    vim /etc/exports
/data 192.168.150.*(rw,sync,no_root_squash)

    /data 是剛纔建立的將被共享的目錄, 192.168.150. 表示整個 192.168.150. 的資產都有括號裏面的權限
    也能夠寫具體的受權對象 /data 192.168.150.45(rw,sync,no_root_squash) 192.168.150.26(rw,sync,no_root_squash)

  5. 使exports生效

    exportfs -a

  6. 安裝nfs-client (150.45 and 150.26)

    showmount -e 192.168.150.192
mkdir -p /opt/jumpserver/data
restorecon -R /opt/jumpserver/data/
mount -t nfs 192.168.150.192:/data /opt/jumpserver/data
echo "192.168.150.192:/data /opt/jumpserver/data nfs defaults 0 0" >> /etc/fstab
docker-compose部署
  1. 安裝docker

安裝如下依賴包

yum install -y yum-utils device-mapper-persistent-data lvm2

添加docker的yum源

yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo

更新yum源緩存， 安裝docker-ce

$ sudo yum makecache fast
$ sudo yum install docker-ce

配置鏡像加速器

sudo mkdir -p /etc/docker
sudo tee /etc/docker/daemon.json <<-'EOF'
{
  "registry-mirrors": ["https://zggyaen3.mirror.aliyuncs.com"]
}
EOF
sudo systemctl daemon-reload
sudo systemctl restart docker

普通用戶須要加入docker組

$ sudo usermod -a -G docker ${USER}

修改docker存儲位置(能夠不改)

$ sudo systemctl stop docker
$ sudo mv /var/lib/docker /home/lan/docker
$ sudo ln -s /home/lan/docker /var/lib/docker
$ sudo systemctl start docker
$ sudo systemctl enable docker
  1. docker-compose安裝
$ sudo curl -L https://github.com/docker/compose/releases/download/1.23.2/docker-compose-`uname -s`-`uname -m` -o /usr/local/bin/docker-compose
$ sudo chmod +x /usr/local/bin/docker-compose

若是下載很慢可手動下載，再上傳至系統

下載路徑: https://github.com/docker/compose/releases/ 能夠選擇對應的版本下載

部署jumpserver

  1. 下載jumpserver壓縮包

    wget https://github.com/jumpserver/Dockerfile.git
unzip Dockerfile-master.zip

  2. 使用shell腳本生成SECRET_KEY和BOOTSTRAP_TOKEN

    if [ ! "$SECRET_KEY" ]; then
 SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 50`;
 echo "SECRET_KEY=$SECRET_KEY" >> ~/.bashrc;
 echo $SECRET_KEY;
else
 echo $SECRET_KEY;
fi  
if [ ! "$BOOTSTRAP_TOKEN" ]; then
 BOOTSTRAP_TOKEN=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 16`;
 echo "BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN" >> ~/.bashrc;
 echo $BOOTSTRAP_TOKEN;
else
 echo $BOOTSTRAP_TOKEN;
fi

  3. 修改.env文件,設置mysql,redis密碼

    vim .env
    # 版本號能夠本身根據項目的版本修改
Version=1.5.9

# MySQL
DB_HOST=192.168.150.45
DB_PORT=3306
DB_USER=jumpserver
DB_PASSWORD=password
DB_NAME=jumpserver

# Redis
REDIS_HOST=192.168.150.45
REDIS_PORT=6379
REDIS_PASSWORD=password

# Core
SECRET_KEY=15hMccXFn40TCKJETDnjlUhkZEXIAcq3E3aQ6T6LDmfLUN0oAV
BOOTSTRAP_TOKEN=HT8qH0wSuyQjcNyh

##
# SECRET_KEY 保護簽名數據的密匙, 首次安裝請必定要修改並牢記, 後續升級和遷移不可更改, 不然將致使加密的數據不可解密。
# BOOTSTRAP_TOKEN 爲組件認證使用的密鑰, 僅組件註冊時用。組件指 koko、guacamole

    在150.45上修改docker-compose

    vim docker-compose.yml
    version: '3' # 因爲測試環境資源有限,個人mysql跟redis也是部署在了150.45, 因此在150.26那臺上面指定mysql跟redis的地址就能夠,不須要在啓動mysql和redis的容器
services:
 mysql:
   image: jumpserver/jms_mysql:${Version}
   container_name: jms_mysql
   restart: always
   tty: true
   environment:
     DB_PORT: $DB_PORT
     DB_USER: $DB_USER
     DB_PASSWORD: $DB_PASSWORD
     DB_NAME: $DB_NAME
   ports:
     - 3306:3306
   volumes:
     - /opt/jumpserver/data/mysql-master:/var/lib/mysql
     - /opt/jumpserver/data/mysql-master.cnf:/etc/my.cnf
   networks:
     - jumpserver

 redis:
   image: jumpserver/jms_redis:${Version}
   container_name: jms_redis
   restart: always
   tty: true
   environment:
     REDIS_PORT: $REDIS_PORT
     REDIS_PASSWORD: $REDIS_PASSWORD
   ports:
     - 6379:6379
   volumes:
     - /opt/jumpserver/data/redis-data:/var/lib/redis/
   networks:
     - jumpserver

 core:
   image: jumpserver/jms_core:${Version}
   container_name: jms_core
   restart: always
   tty: true
   environment:
     SECRET_KEY: $SECRET_KEY
     BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN
     DB_HOST: $DB_HOST
     DB_PORT: $DB_PORT
     DB_USER: $DB_USER
     DB_PASSWORD: $DB_PASSWORD
     DB_NAME: $DB_NAME
     REDIS_HOST: $REDIS_HOST
     REDIS_PORT: $REDIS_PORT
     REDIS_PASSWORD: $REDIS_PASSWORD
   depends_on:
     - mysql
     - redis
   volumes:
     - core-data:/opt/jumpserver/data
   networks:
     - jumpserver

 koko:
   image: jumpserver/jms_koko:${Version}
   container_name: jms_koko
   restart: always
   tty: true
   environment:
     CORE_HOST: http://core:8080
     BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN
   depends_on:
     - core
     - mysql
     - redis
   volumes:
     - koko-keys:/opt/koko/data/keys
   ports:
     - 2222:2222
   networks:
     - jumpserver

 guacamole:
   image: jumpserver/jms_guacamole:${Version}
   container_name: jms_guacamole
   restart: always
   tty: true
   environment:
     JUMPSERVER_SERVER: http://core:8080
     BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN
     JUMPSERVER_KEY_DIR: /config/guacamole/keys
     GUACAMOLE_HOME: /config/guacamole
     GUACAMOLE_LOG_LEVEL: ERROR
     JUMPSERVER_ENABLE_DRIVE: 'true'
   depends_on:
     - core
     - mysql
     - redis
   volumes:
     - guacamole-keys:/config/guacamole/keys
   networks:
     - jumpserver

 nginx:
   image: jumpserver/jms_nginx:${Version}
   container_name: jms_nginx
   restart: always
   tty: true
   depends_on:
     - core
     - koko
     - mysql
     - redis
   volumes:
     - core-data:/opt/jumpserver/data
   ports:
     - 80:80
   networks:
     - jumpserver

volumes:
 mysql-data:
 redis-data:
 core-data:
 koko-keys:
 guacamole-keys:

networks:
 jumpserver:

    在150.26上修改docker-compose文件

    version: '3'
services:
 core:
   image: jumpserver/jms_core:${Version}
   container_name: jms_core
   restart: always
   tty: true
   environment:
     SECRET_KEY: $SECRET_KEY
     BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN
     DB_HOST: $DB_HOST
     DB_PORT: $DB_PORT
     DB_USER: $DB_USER
     DB_PASSWORD: $DB_PASSWORD
     DB_NAME: $DB_NAME
     REDIS_HOST: $REDIS_HOST
     REDIS_PORT: $REDIS_PORT
     REDIS_PASSWORD: $REDIS_PASSWORD
   volumes:
     - /opt/jumpserver/data/core-data:/opt/jumpserver/data
   networks:
     - jumpserver

 koko:
   image: jumpserver/jms_koko:${Version}
   container_name: jms_koko
   restart: always
   tty: true
   environment:
     CORE_HOST: http://core:8080
     BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN
   depends_on:
     - core
   volumes:
     - /opt/jumpserver/data/koko-keys:/opt/koko/data/keys
   ports:
     - 2222:2222
   networks:
     - jumpserver

 guacamole:
   image: jumpserver/jms_guacamole:${Version}
   container_name: jms_guacamole
   restart: always
   tty: true
   environment:
     JUMPSERVER_SERVER: http://core:8080
     BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN
     JUMPSERVER_KEY_DIR: /config/guacamole/keys
     GUACAMOLE_HOME: /config/guacamole
     GUACAMOLE_LOG_LEVEL: ERROR
     JUMPSERVER_ENABLE_DRIVE: 'true'
   depends_on:
     - core
   volumes:
     - /opt/jumpserver/data/guacamole-keys:/config/guacamole/keys
   networks:
     - jumpserver

 nginx:
   image: jumpserver/jms_nginx:${Version}
   container_name: jms_nginx
   restart: always
   tty: true
   depends_on:
     - core
     - koko
   volumes:
     - /opt/jumpserver/data/core-data:/opt/jumpserver/data
   ports:
     - 80:80
   networks:
     - jumpserver

volumes:
 core-data:
 koko-keys:
 guacamole-keys:

networks:
 jumpserver:
  4. 啓動容器
docker-compose up -d
  1. 打開瀏覽器訪問150.45和150.26,默認帳號密碼是admin, 在瀏覽器上測試數據是否會同步
相關文章
相關標籤/搜索
每日一句
    每一个你不满意的现在，都有一个你没有努力的曾经。
本站公眾號
   歡迎關注本站公眾號,獲取更多信息
聯繫我們 最近搜索 最新文章 沪ICP备13005482号-10 MyBatis教程 SQL 教程 MySQL教程 Java 教程 Thymeleaf 教程 Hibernate教程 Spring教程 Redis教程