jumpserver一體機安裝

第一節實驗環境

系統: CentOS 7

IP: 192.168.68.156

目錄: /opt

數據庫: mariadb

代理: nginx

第二節實戰操作

實驗前提：

[root@Jumpserver156 ~]# systemctl stop firewalld
[root@Jumpserver156 ~]# systemctl disable firewalld
[root@Jumpserver156 ~]# setenforce 0
[root@Jumpserver156 ~]# sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
#安裝依賴
[root@Jumpserver156 ~]# yum -y install wget gcc epel-release git

2.1安裝redis

Jumpserver 使用 Redis 做 cache 和 celery broke

[root@Jumpserver156 ~]# yum -y install redis
[root@Jumpserver156 ~]# systemctl enable redis
[root@Jumpserver156 ~]# systemctl start redis
[root@Jumpserver156 ~]# ss -tunlp | grep :6379
tcp LISTEN 0 128 127.0.0.1:6379 *:* users:(("redis-server",pid=4819,fd=4))

2.2安裝mariadb

#安裝
[root@Jumpserver156 ~]# yum -y install mariadb mariadb-devel mariadb-server MariaDB-shared
[root@Jumpserver156 ~]# systemctl enable mariadb
[root@Jumpserver156 ~]# systemctl start mariadb
[root@Jumpserver156 ~]# ss -tunlp | grep :3306
tcp LISTEN 0 50 *:3306 *:* users:(("mysqld",pid=5237,fd=13))
#創建數據庫與授權
[root@Jumpserver156 ~]# mysql -uroot -e "create database jumpserver default charset 'utf8'; grant all on jumpserver.* to 'jumpserver'@'127.0.0.1' identified by '123456'; flush privileges;"

2.3安裝nginx

[root@Jumpserver156 ~]# yum -y install nginx
[root@Jumpserver156 ~]# systemctl enable nginx

2.4安裝 Python3.6

[root@Jumpserver156 ~]# yum -y install python36 python36-devel
#配置並載入 Python3 虛擬環境
[root@Jumpserver156 ~]# cd /opt/
## py3 爲虛擬環境名稱, 可自定義
[root@Jumpserver156 opt]# python3.6 -m venv py3
##退出虛擬環境可以使用 deactivate 命令
[root@Jumpserver156 opt]# source /opt/py3/bin/activate
##看到下面的提示符代表成功, 以後運行 Jumpserver 都要先運行以上 source 命令, 載入環境後默認以下所有命令均在該虛擬環境中運行
(py3) [root@Jumpserver156 opt]#

2.5下載 Jumpserver

(py3) [root@Jumpserver156 opt]# git clone --depth=1 https://github.com/jumpserver/jumpserver.git
(py3) [root@Jumpserver156 opt]# ls
jumpserver py3 rh
#安裝依賴 RPM 包
(py3) [root@Jumpserver156 opt]# yum -y install $(cat /opt/jumpserver/requirements/rpm_requirements.txt)
#安裝 Python 庫依賴
(py3) [root@Jumpserver156 opt]# pip install --upgrade pip setuptools
(py3) [root@Jumpserver156 opt]# pip install -r /opt/jumpserver/requirements/requirements.txt
看到Successfully installed就Ok了
#修改 Jumpserver 配置文件
(py3) [root@Jumpserver156 opt]# cd /opt/jumpserver
(py3) [root@Jumpserver156 jumpserver]# cp config_example.yml config.yml
# #生成隨機SECRET_KEY
(py3) [root@Jumpserver156 jumpserver]# SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 50`
(py3) [root@Jumpserver156 jumpserver]# echo "SECRET_KEY=$SECRET_KEY">> ~/.bashrc
# #生成隨機BOOTSTRAP_TOKEN
(py3) [root@Jumpserver156 jumpserver]# BOOTSTRAP_TOKEN=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 16`
(py3) [root@Jumpserver156 jumpserver]# echo "BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN" >> ~/.bashrc
(py3) [root@Jumpserver156 jumpserver]# sed -i "s/SECRET_KEY:/SECRET_KEY: $SECRET_KEY/g" /opt/jumpserver/config.yml
(py3) [root@Jumpserver156 jumpserver]# sed -i "s/BOOTSTRAP_TOKEN:/BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g" /opt/jumpserver/config.yml
(py3) [root@Jumpserver156 jumpserver]# sed -i "s/# DEBUG: true/DEBUG: false/g" /opt/jumpserver/config.yml
(py3) [root@Jumpserver156 jumpserver]# sed -i "s/# LOG_LEVEL: DEBUG/LOG_LEVEL: ERROR/g" /opt/jumpserver/config.yml
(py3) [root@Jumpserver156 jumpserver]# sed -i "s/# SESSION_EXPIRE_AT_BROWSER_CLOSE: false/SESSION_EXPIRE_AT_BROWSER_CLOSE: true/g" /opt/jumpserver/config.yml
(py3) [root@Jumpserver156 jumpserver]# sed -i "s/DB_PASSWORD: /DB_PASSWORD: '123456'/g" /opt/jumpserver/config.yml
(py3) [root@Jumpserver156 jumpserver]# echo -e "\033[31m 你的SECRET_KEY是 $SECRET_KEY \033[0m"
你的SECRET_KEY是 lI6PCzXeRNHBEDmK2aj5RpRrq2uIWZ7KkExbBDCAHzeIYIKlxR
(py3) [root@Jumpserver156 jumpserver]# echo -e "\033[31m 你的BOOTSTRAP_TOKEN是 $BOOTSTRAP_TOKEN \033[0m"
你的BOOTSTRAP_TOKEN是 rD1Q6W8KW7clf2SE
# 確認內容有沒有錯誤
(py3) [root@Jumpserver156 jumpserver]# cat config.yml
# SECURITY WARNING: keep the secret key used in production secret!
# 加密祕鑰生產環境中請修改爲隨機字符串，請勿外泄, 可使用命令生成，PS: 純數字不可以
# $ cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 49;echo
SECRET_KEY: lI6PCzXeRNHBEDmK2aj5RpRrq2uIWZ7KkExbBDCAHzeIYIKlxR
# SECURITY WARNING: keep the bootstrap token used in production secret!
# 預共享Token coco和guacamole用來註冊服務賬號，不在使用原來的註冊接受機制
BOOTSTRAP_TOKEN: rD1Q6W8KW7clf2SE
# Development env open this, when error occur display the full process track, Production disable it
# DEBUG 模式開啓DEBUG後遇到錯誤時可以看到更多日誌
DEBUG: false
# DEBUG, INFO, WARNING, ERROR, CRITICAL can set. See https://docs.djangoproject.com/en/1.10/topics/logging/
# 日誌級別
LOG_LEVEL: ERROR
# LOG_DIR:
# Session expiration setting, Default 24 hour, Also set expired on on browser close
# 瀏覽器Session過期時間，默認24小時, 也可以設置瀏覽器關閉則過期
# SESSION_COOKIE_AGE: 86400
SESSION_EXPIRE_AT_BROWSER_CLOSE: true
# Database setting, Support sqlite3, mysql, postgres ....
# 數據庫設置
# See https://docs.djangoproject.com/en/1.10/ref/settings/#databases
# SQLite setting:
# 使用單文件sqlite數據庫
# DB_ENGINE: sqlite3
# DB_NAME:
# MySQL or postgres setting like:
# 使用Mysql作爲數據庫
DB_ENGINE: mysql
DB_HOST: 127.0.0.1
DB_PORT: 3306
DB_USER: jumpserver
DB_PASSWORD: '123456'
DB_NAME: jumpserver
# When Django start it will bind this host and port
# ./manage.py runserver 127.0.0.1:8080
# 運行時綁定端口
HTTP_BIND_HOST: 0.0.0.0
HTTP_LISTEN_PORT: 8080
# Use Redis as broker for celery and web socket
# Redis配置
REDIS_HOST: 127.0.0.1
REDIS_PORT: 6379
# REDIS_PASSWORD:
# REDIS_DB_CELERY: 3
# REDIS_DB_CACHE: 4
# Use OpenID authorization
# 使用OpenID 來進行認證設置
# BASE_SITE_URL: http://localhost:8080
# AUTH_OPENID: false # True or False
# AUTH_OPENID_SERVER_URL: https://openid-auth-server.com/
# AUTH_OPENID_REALM_NAME: realm-name
# AUTH_OPENID_CLIENT_ID: client-id
# AUTH_OPENID_CLIENT_SECRET: client-secret
#
# Use Radius authorization
# 使用Radius來認證
# AUTH_RADIUS: false
# RADIUS_SERVER: localhost
# RADIUS_PORT: 1812
# RADIUS_SECRET:
# OTP settings
# OTP/MFA 配置
# OTP_VALID_WINDOW: 0
# OTP_ISSUER_NAME: Jumpserver
#運行 Jumpserver
## 後臺運行使用 -d 參數./jms start all -d# 新版本更新了運行腳本, 使用方式./jms start|stop|status all 後臺運行請添加 -d 參數
(py3) [root@Jumpserver156 jumpserver]# ./jms start all -d
.....一路ok過來
553 static files copied to '/opt/jumpserver/data/static'.
- Start Celery as Distributed Task Queue
- Start Beat as Periodic Task Scheduler
gunicorn is running: 7987
celery is running: 8009
beat is running: 8011

2.6安裝 docker 部署 koko 與 guacamole

(py3) [root@Jumpserver156 jumpserver]# yum install -y yum-utils device-mapper-persistent-data lvm2
(py3) [root@Jumpserver156 jumpserver]# yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
(py3) [root@Jumpserver156 jumpserver]# yum makecache fast
(py3) [root@Jumpserver156 jumpserver]# rpm --import https://mirrors.aliyun.com/docker-ce/linux/centos/gpg
(py3) [root@Jumpserver156 jumpserver]# yum -y install docker-ce
(py3) [root@Jumpserver156 jumpserver]# curl -sSL https://get.daocloud.io/daotools/set_mirror.sh | sh -s http://f1361db2.m.daocloud.io
(py3) [root@Jumpserver156 jumpserver]# systemctl enable docker
(py3) [root@Jumpserver156 jumpserver]# systemctl restart docker

# 獲取當前服務器 IP

(py3) [root@Jumpserver156 jumpserver]# Server_IP=`ip addr | grep inet | egrep -v '(127.0.0.1|inet6|docker)' | awk '{print $2}' | tr -d "addr:" | head -n 1 | cut -d / -f1`
(py3) [root@Jumpserver156 jumpserver]# echo -e "\033[31m 你的服務器IP是 $Server_IP \033[0m"
你的服務器IP是 192.168.68.156
# http://<Jumpserver_url> 指向 jumpserver 的服務端口, 如 http://192.168.68.156:8080# BOOTSTRAP_TOKEN 爲 Jumpserver/config.yml 裏面的 BOOTSTRAP_TOKEN
(py3) [root@Jumpserver156 jumpserver]# docker run --name jms_koko -d -p 2222:2222 -p 5000:5000 -e CORE_HOST=http://$Server_IP:8080 -e BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN jumpserver/jms_koko:1.5.0
Unable to find image 'jumpserver/jms_koko:1.5.0' locally
1.5.0: Pulling from jumpserver/jms_koko
921b31ab772b: Pull complete
.....
69987f4a11b3: Pull complete
Digest: sha256:efce4b9b613639f63c666005f0ac6496a3b3c0fd45a758d25325041443c178f0
Status: Downloaded newer image for jumpserver/jms_koko:1.5.0
452fb45cf70343335725a46e3274ac13e10f82fe5a695f6728e78ac4d49d38bf
(py3) [root@Jumpserver156 jumpserver]# docker run --name jms_guacamole -d -p 8081:8081 -e JUMPSERVER_SERVER=http://$Server_IP:8080 -e BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN jumpserver/jms_guacamole:1.5.0
Unable to find image 'jumpserver/jms_guacamole:1.5.0' locally
1.5.0: Pulling from jumpserver/jms_guacamole
24ba68623a54: Pull complete
.....
e486d153fd52: Pull complete
Digest: sha256:c6c3c42994b2b6e907110cf5c4fa39419c3aa180d385560bab2673afe0c38907
Status: Downloaded newer image for jumpserver/jms_guacamole:1.5.0
390b51e4b060c450b911188bd06bdaf83209a5a8f09ee8e8b7b4edb485601a7f
(py3) [root@Jumpserver156 jumpserver]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
e3c9c66ada67 jumpserver/jms_koko:1.5.0 "./entrypoint.sh" 12 seconds ago Up 11 seconds 0.0.0.0:2222->2222/tcp, 0.0.0.0:5000->5000/tcp jms_koko
390b51e4b060 jumpserver/jms_guacamole:1.5.0 "entrypoint.sh" 39 minutes ago Up 39 minutes 4822/tcp, 0.0.0.0:8081->8081/tcp jms_guacamole

2.7 安裝 Web Terminal

前端: Luna 需要 Nginx 來運行訪問訪問(https://github.com/jumpserver/luna/releases)下載對應版本的 release 包, 直接解壓, 不需要編譯

(py3) [root@Jumpserver156 jumpserver]# cd /opt
(py3) [root@Jumpserver156 opt]# wget https://github.com/jumpserver/luna/releases/download/1.5.0/luna.tar.gz
# 提示：如果網絡有問題導致下載無法完成可以使用下面地址
https://demo.jumpserver.org/download/luna/1.5.0/luna.tar.gz
(py3) [root@Jumpserver156 opt]# tar xf luna.tar.gz
(py3) [root@Jumpserver156 opt]# chown -R root:root luna

2.8配置 Nginx 整合各組件

(py3) [root@Jumpserver156 ~]# rm -rf /etc/nginx/conf.d/default.conf
(py3) [root@Jumpserver156 ~]# vi /etc/nginx/conf.d/jumpserver.conf
server {
listen 80;
client_max_body_size 100m; # 錄像及文件上傳大小限制
location /luna/ {
try_files $uri / /index.html;
alias /opt/luna/; # luna 路徑, 如果修改安裝目錄, 此處需要修改
}
location /media/ {
add_header Content-Encoding gzip;
root /opt/jumpserver/data/; # 錄像位置, 如果修改安裝目錄, 此處需要修改
}
location /static/ {
root /opt/jumpserver/data/; # 靜態資源, 如果修改安裝目錄, 此處需要修改
}
location /socket.io/ {
proxy_pass http://localhost:5000/socket.io/;
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}
location /coco/ {
proxy_pass http://localhost:5000/coco/;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}
location /guacamole/ {
proxy_pass http://localhost:8081/;
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}
location / {
proxy_pass http://localhost:8080;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
#註釋掉/etc/nginx/nginx.conf文件中的server的全部內容
38 # server {
39 # listen 81 default_server;
40 # #listen [::]:80 default_server;
41 # server_name _;
42 # root /usr/share/nginx/html;
43 #
44 # # Load configuration files for the default server block.
45 # include /etc/nginx/default.d/*.conf;
46 #
47 # location / {
48 # }
49 #
50 # error_page 404 /404.html;
51 # location = /40x.html {
52 # }
53 #
54 # error_page 500 502 503 504 /50x.html;
55 # location = /50x.html {
56 # }
57 # }
# 運行 Nginx
[root@Jumpserver156 ~]# nginx -t # 確保配置沒有問題, 有問題請先解決
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@Jumpserver156 ~]# systemctl restart nginx

第三節測試

3.1測試1

訪問 http://192.168.244.144 (注意沒有 :8080 通過 nginx 代理端口進行訪問)

默認賬號: admin 密碼: admin 到會話管理-終端管理接受 koko Guacamole 等應用的註冊

3.2測試2

(py3) [root@Jumpserver156 jumpserver]# ssh -p2222 [email protected]
The authenticity of host '[192.168.68.156]:2222 ([192.168.68.156]:2222)' can't be established.
RSA key fingerprint is SHA256:R9rfDzIJIweoKmvHSoYeOI3rOSY2oZl/eCdmowQA+mQ.
RSA key fingerprint is MD5:6a:45:34:26:58:8c:e4:f5:32:76:9a:ca:ad:4d:02:82.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[192.168.68.156]:2222' (RSA) to the list of known hosts.
[email protected]'s password:
Administrator, 歡迎使用Jumpserver開源堡壘機系統
1) 輸入 ID 進行直接登陸.
2) 輸入部分IP、主機名、備註進行進行搜索登錄(如果唯一).
3) 輸入 / + IP, 主機名 or 備註進行搜索，如: /192.168.
4) 輸入 p 進行顯示您有權限的主機.
5) 輸入 g 進行顯示您有權限的節點.
6) 輸入 r 進行刷新最新的機器和節點信息.
7) 輸入 h 進行顯示幫助.
8) 輸入 q 進行退出.
Opt> p
沒有資產
Opt> q
(py3) [root@Jumpserver156 jumpserver]# sftp -P2222 [email protected]
[email protected]'s password:
Connected to 192.168.68.156.
sftp> ls

# 如果是用在 Windows 下, Xshell Terminal 登錄語法如下

$ ssh [email protected]
$ sftp [email protected]密碼: admin

如果能登陸代表部署成功

# sftp默認上傳的位置在資產的 /tmp 目錄下

# windows拖拽上傳的位置在資產的 Guacamole RDP上的 G 目錄下

第四節多組件負載說明

# koko 服務默認運行在單核心下面, 當負載過高時會導致用戶訪問變慢, 這時可運行多個 docker 容器緩解

$docker run --name jms_koko01 -d -p2223:2222 -p5001:5000 -eCORE_HOST=http:// -eBOOTSTRAP_TOKEN=****** jumpserver/jms_koko:1.5.0
$ docker run --name jms_koko02 -d -p2224:2222 -p5002:5000 -eCORE_HOST=http:// -eBOOTSTRAP_TOKEN=****** jumpserver/jms_koko:1.5.0

# guacamole 也是一樣

$ docker run --name jms_guacamole01 -d -p8082:8081 -eJUMPSERVER_SERVER=http:// -eBOOTSTRAP_TOKEN=****** jumpserver/jms_guacamole:1.5.0
$ docker run --name jms_guacamole02 -d -p8083:8081 -eJUMPSERVER_SERVER=http:// -eBOOTSTRAP_TOKEN=****** jumpserver/jms_guacamole:1.5.0

# nginx 代理設置

$ vi /etc/nginx/nginx.conf
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
# 加入 tcp 代理
stream {
log_format proxy '$remote_addr [$time_local] '
'$protocol $status $bytes_sent $bytes_received '
'$session_time "$upstream_addr" '
'"$upstream_bytes_sent" "$upstream_bytes_received" "$upstream_connect_time"';
access_log /var/log/nginx/tcp-access.log proxy;
open_log_file_cache off;
upstream kokossh {
server localhost:2222 weight=1;
server localhost:2223 weight=1; # 多節點
server localhost:2224 weight=1; # 多節點
# 這裏是 koko ssh 的後端ip
hash $remote_addr;
}
server {
listen 2220; # 不能使用已經使用的端口, 自行修改, 用戶ssh登錄時的端口
proxy_pass kokossh;
proxy_connect_timeout 10s;
}
}
# 到此結束
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
# tcp_nopush on;
keepalive_timeout 65;
# 關閉版本顯示
server_tokens off;
include /etc/nginx/conf.d/*.conf;
}
$ firewall-cmd --zone=public --add-port=2220/tcp --permanent
$ firewall-cmd --reload
$ vi /etc/nginx/conf.d/jumpserver.conf
upstream jumpserver {
server localhost:8080;
# 這裏是 jumpserver 的後端ip
}
upstream kokows {
server localhost:5000 weight=1;
server localhost:5001 weight=1; # 多節點
server localhost:5002 weight=1; # 多節點
# 這裏是 koko ws 的後端ip
ip_hash;
}
upstream guacamole {
server localhost:8081 weight=1;
server localhost:8082 weight=1; # 多節點
server localhost:8083 weight=1; # 多節點
# 這裏是 guacamole 的後端ip
ip_hash;
}
server {
listen 80;
server_name demo.jumpserver.org; # 自行修改成你的域名
client_max_body_size 100m; # 錄像上傳大小限制
location / {
proxy_pass http://jumpserver;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}
location /luna/ {
try_files $uri / /index.html;
alias /opt/luna/;
}
location /socket.io/ {
proxy_pass http://kokows/socket.io/; # koko
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}
location /coco/ {
proxy_pass http://kokows/coco/;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}
location /guacamole/ {
proxy_pass http://guacamole/; # guacamole
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}
}
$ nginx -t
$ nginx -s reload

參考文檔：http://docs.jumpserver.org/zh/master/setup_by_centos7.html

官方文檔：http://docs.jumpserver.org/zh/master/

結束語：

更多精彩內容持續更新中，關注我微信公衆號，有你更精彩。

jumpserver一體機安裝

DAPPER 事務 TRANSACTION

Java中線程的創建方式

python和shell的結合與應用

jenkins安裝教程

gitlab安裝到優化

jumpserver一體機安裝

https://yachay.unat.edu.pe/blog/index.php?comment_area=format_blog&comment_component=blog&comment_co

linux以太網驅動總結