jumpserver一体机安装

第一节实验环境

系统: CentOS 7

IP: 192.168.68.156

目录: /opt

数据库: mariadb

代理: nginx

第二节实战操作

实验前提：

[root@Jumpserver156 ~]# systemctl stop firewalld

[root@Jumpserver156 ~]# systemctl disable firewalld

[root@Jumpserver156 ~]# setenforce 0

[root@Jumpserver156 ~]# sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config

#安装依赖

[root@Jumpserver156 ~]# yum -y install wget gcc epel-release git

2.1安装redis

Jumpserver 使用 Redis 做 cache 和 celery broke

[root@Jumpserver156 ~]# yum -y install redis

[root@Jumpserver156 ~]# systemctl enable redis

[root@Jumpserver156 ~]# systemctl start redis

[root@Jumpserver156 ~]# ss -tunlp | grep :6379

tcp    LISTEN    0      128    127.0.0.1:6379                  *:*                  users:(("redis-server",pid=4819,fd=4))

2.2安装mariadb

#安装

[root@Jumpserver156 ~]# yum -y install mariadb mariadb-devel mariadb-server MariaDB-shared

[root@Jumpserver156 ~]# systemctl enable mariadb

[root@Jumpserver156 ~]# systemctl start mariadb

[root@Jumpserver156 ~]# ss -tunlp | grep :3306

tcp    LISTEN    0      50        *:3306                  *:*                  users:(("mysqld",pid=5237,fd=13))

#创建数据库与授权

[root@Jumpserver156 ~]# mysql -uroot -e "create database jumpserver default charset 'utf8'; grant all on jumpserver.* to 'jumpserver'@'127.0.0.1' identified by '123456'; flush privileges;"

2.3安装nginx

[root@Jumpserver156 ~]# yum -y install nginx

[root@Jumpserver156 ~]# systemctl enable nginx

2.4安装 Python3.6

[root@Jumpserver156 ~]# yum -y install python36 python36-devel

#配置并载入 Python3 虚拟环境

[root@Jumpserver156 ~]# cd /opt/

## py3 为虚拟环境名称, 可自定义

[root@Jumpserver156 opt]# python3.6 -m venv py3

##退出虚拟环境可以使用 deactivate 命令

[root@Jumpserver156 opt]#  source /opt/py3/bin/activate

##看到下面的提示符代表成功, 以后运行 Jumpserver 都要先运行以上 source 命令, 载入环境后默认以下所有命令均在该虚拟环境中运行

(py3) [root@Jumpserver156 opt]#

2.5下载 Jumpserver

(py3) [root@Jumpserver156 opt]# git clone --depth=1 https://github.com/jumpserver/jumpserver.git

(py3) [root@Jumpserver156 opt]# ls

jumpserver  py3  rh

#安装依赖 RPM 包

(py3) [root@Jumpserver156 opt]# yum -y install $(cat /opt/jumpserver/requirements/rpm_requirements.txt)

#安装 Python 库依赖

(py3) [root@Jumpserver156 opt]# pip install --upgrade pip setuptools

(py3) [root@Jumpserver156 opt]# pip install -r /opt/jumpserver/requirements/requirements.txt

看到Successfully installed就Ok了

#修改 Jumpserver 配置文件

(py3) [root@Jumpserver156 opt]# cd /opt/jumpserver

(py3) [root@Jumpserver156 jumpserver]# cp config_example.yml config.yml

# #生成随机SECRET_KEY

(py3) [root@Jumpserver156 jumpserver]# SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 50`

(py3) [root@Jumpserver156 jumpserver]# echo "SECRET_KEY=$SECRET_KEY">> ~/.bashrc

# #生成随机BOOTSTRAP_TOKEN

(py3) [root@Jumpserver156 jumpserver]# BOOTSTRAP_TOKEN=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 16`

(py3) [root@Jumpserver156 jumpserver]# echo "BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN" >> ~/.bashrc

(py3) [root@Jumpserver156 jumpserver]# sed -i "s/SECRET_KEY:/SECRET_KEY: $SECRET_KEY/g" /opt/jumpserver/config.yml

(py3) [root@Jumpserver156 jumpserver]# sed -i "s/BOOTSTRAP_TOKEN:/BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g" /opt/jumpserver/config.yml

(py3) [root@Jumpserver156 jumpserver]# sed -i "s/# DEBUG: true/DEBUG: false/g" /opt/jumpserver/config.yml

(py3) [root@Jumpserver156 jumpserver]# sed -i "s/# LOG_LEVEL: DEBUG/LOG_LEVEL: ERROR/g" /opt/jumpserver/config.yml

(py3) [root@Jumpserver156 jumpserver]# sed -i "s/# SESSION_EXPIRE_AT_BROWSER_CLOSE: false/SESSION_EXPIRE_AT_BROWSER_CLOSE: true/g" /opt/jumpserver/config.yml

(py3) [root@Jumpserver156 jumpserver]# sed -i "s/DB_PASSWORD: /DB_PASSWORD: '123456'/g" /opt/jumpserver/config.yml

(py3) [root@Jumpserver156 jumpserver]#  echo -e "\033[31m 你的SECRET_KEY是 $SECRET_KEY \033[0m"

你的SECRET_KEY是 lI6PCzXeRNHBEDmK2aj5RpRrq2uIWZ7KkExbBDCAHzeIYIKlxR

(py3) [root@Jumpserver156 jumpserver]#  echo -e "\033[31m 你的BOOTSTRAP_TOKEN是 $BOOTSTRAP_TOKEN \033[0m"

你的BOOTSTRAP_TOKEN是 rD1Q6W8KW7clf2SE

# 确认内容有没有错误

(py3) [root@Jumpserver156 jumpserver]# cat config.yml

# SECURITY WARNING: keep the secret key used in production secret!

# 加密秘钥 生产环境中请修改为随机字符串，请勿外泄, 可使用命令生成，PS: 纯数字不可以

# $ cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 49;echo

SECRET_KEY: lI6PCzXeRNHBEDmK2aj5RpRrq2uIWZ7KkExbBDCAHzeIYIKlxR

# SECURITY WARNING: keep the bootstrap token used in production secret!

# 预共享Token coco和guacamole用来注册服务账号，不在使用原来的注册接受机制

BOOTSTRAP_TOKEN: rD1Q6W8KW7clf2SE

# Development env open this, when error occur display the full process track, Production disable it

# DEBUG 模式 开启DEBUG后遇到错误时可以看到更多日志

DEBUG: false

# DEBUG, INFO, WARNING, ERROR, CRITICAL can set. See https://docs.djangoproject.com/en/1.10/topics/logging/

# 日志级别

LOG_LEVEL: ERROR

# LOG_DIR:

# Session expiration setting, Default 24 hour, Also set expired on on browser close

# 浏览器Session过期时间，默认24小时, 也可以设置浏览器关闭则过期

# SESSION_COOKIE_AGE: 86400

SESSION_EXPIRE_AT_BROWSER_CLOSE: true

# Database setting, Support sqlite3, mysql, postgres ....

# 数据库设置

# See https://docs.djangoproject.com/en/1.10/ref/settings/#databases

# SQLite setting:

# 使用单文件sqlite数据库

# DB_ENGINE: sqlite3

# DB_NAME:

# MySQL or postgres setting like:

# 使用Mysql作为数据库

DB_ENGINE: mysql

DB_HOST: 127.0.0.1

DB_PORT: 3306

DB_USER: jumpserver

DB_PASSWORD: '123456'

DB_NAME: jumpserver

# When Django start it will bind this host and port

# ./manage.py runserver 127.0.0.1:8080

# 运行时绑定端口

HTTP_BIND_HOST: 0.0.0.0

HTTP_LISTEN_PORT: 8080

# Use Redis as broker for celery and web socket

# Redis配置

REDIS_HOST: 127.0.0.1

REDIS_PORT: 6379

# REDIS_PASSWORD:

# REDIS_DB_CELERY: 3

# REDIS_DB_CACHE: 4

# Use OpenID authorization

# 使用OpenID 来进行认证设置

# BASE_SITE_URL: http://localhost:8080

# AUTH_OPENID: false  # True or False

# AUTH_OPENID_SERVER_URL: https://openid-auth-server.com/

# AUTH_OPENID_REALM_NAME: realm-name

# AUTH_OPENID_CLIENT_ID: client-id

# AUTH_OPENID_CLIENT_SECRET: client-secret

#

# Use Radius authorization

# 使用Radius来认证

# AUTH_RADIUS: false

# RADIUS_SERVER: localhost

# RADIUS_PORT: 1812

# RADIUS_SECRET:

# OTP settings

# OTP/MFA 配置

# OTP_VALID_WINDOW: 0

# OTP_ISSUER_NAME: Jumpserver

#运行 Jumpserver

## 后台运行使用 -d 参数./jms start all -d# 新版本更新了运行脚本, 使用方式./jms start|stop|status all 后台运行请添加 -d 参数

(py3) [root@Jumpserver156 jumpserver]# ./jms start all -d

.....一路ok过来

553 static files copied to '/opt/jumpserver/data/static'.

- Start Celery as Distributed Task Queue

- Start Beat as Periodic Task Scheduler

gunicorn is running: 7987

celery is running: 8009

beat is running: 8011

2.6安装 docker 部署 koko 与 guacamole

(py3) [root@Jumpserver156 jumpserver]# yum install -y yum-utils device-mapper-persistent-data lvm2

(py3) [root@Jumpserver156 jumpserver]# yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo

(py3) [root@Jumpserver156 jumpserver]# yum makecache fast

(py3) [root@Jumpserver156 jumpserver]# rpm --import https://mirrors.aliyun.com/docker-ce/linux/centos/gpg

(py3) [root@Jumpserver156 jumpserver]# yum -y install docker-ce

(py3) [root@Jumpserver156 jumpserver]# curl -sSL https://get.daocloud.io/daotools/set_mirror.sh | sh -s http://f1361db2.m.daocloud.io

(py3) [root@Jumpserver156 jumpserver]# systemctl enable docker

(py3) [root@Jumpserver156 jumpserver]# systemctl restart docker

# 获取当前服务器 IP

(py3) [root@Jumpserver156 jumpserver]# Server_IP=`ip addr | grep inet | egrep -v '(127.0.0.1|inet6|docker)' | awk '{print $2}' | tr -d "addr:" | head -n 1 | cut -d / -f1`

(py3) [root@Jumpserver156 jumpserver]# echo -e "\033[31m 你的服务器IP是 $Server_IP \033[0m"

你的服务器IP是 192.168.68.156

# http:// 指向 jumpserver 的服务端口, 如 http://192.168.68.156:8080# BOOTSTRAP_TOKEN 为 Jumpserver/config.yml 里面的 BOOTSTRAP_TOKEN

(py3) [root@Jumpserver156 jumpserver]# docker run --name jms_koko -d -p 2222:2222 -p 5000:5000 -e CORE_HOST=http://$Server_IP:8080 -e BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN jumpserver/jms_koko:1.5.0

Unable to find image 'jumpserver/jms_koko:1.5.0' locally

1.5.0: Pulling from jumpserver/jms_koko

921b31ab772b: Pull complete

.....

69987f4a11b3: Pull complete

Digest: sha256:efce4b9b613639f63c666005f0ac6496a3b3c0fd45a758d25325041443c178f0

Status: Downloaded newer image for jumpserver/jms_koko:1.5.0

452fb45cf70343335725a46e3274ac13e10f82fe5a695f6728e78ac4d49d38bf

(py3) [root@Jumpserver156 jumpserver]# docker run --name jms_guacamole -d -p 8081:8081 -e JUMPSERVER_SERVER=http://$Server_IP:8080 -e BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN jumpserver/jms_guacamole:1.5.0

Unable to find image 'jumpserver/jms_guacamole:1.5.0' locally

1.5.0: Pulling from jumpserver/jms_guacamole

24ba68623a54: Pull complete

.....

e486d153fd52: Pull complete

Digest: sha256:c6c3c42994b2b6e907110cf5c4fa39419c3aa180d385560bab2673afe0c38907

Status: Downloaded newer image for jumpserver/jms_guacamole:1.5.0

390b51e4b060c450b911188bd06bdaf83209a5a8f09ee8e8b7b4edb485601a7f

(py3) [root@Jumpserver156 jumpserver]# docker ps

CONTAINER ID        IMAGE                            COMMAND            CREATED            STATUS              PORTS                                            NAMES

e3c9c66ada67        jumpserver/jms_koko:1.5.0        "./entrypoint.sh"  12 seconds ago      Up 11 seconds      0.0.0.0:2222->2222/tcp, 0.0.0.0:5000->5000/tcp  jms_koko

390b51e4b060        jumpserver/jms_guacamole:1.5.0  "entrypoint.sh"    39 minutes ago      Up 39 minutes      4822/tcp, 0.0.0.0:8081->8081/tcp                jms_guacamole

2.7 安装 Web Terminal

前端: Luna 需要 Nginx 来运行访问 访问(https://github.com/jumpserver/luna/releases)下载对应版本的 release 包, 直接解压, 不需要编译

(py3) [root@Jumpserver156 jumpserver]# cd /opt

(py3) [root@Jumpserver156 opt]# wget https://github.com/jumpserver/luna/releases/download/1.5.0/luna.tar.gz

# 提示：如果网络有问题导致下载无法完成可以使用下面地址

https://demo.jumpserver.org/download/luna/1.5.0/luna.tar.gz

(py3) [root@Jumpserver156 opt]# tar xf luna.tar.gz

(py3) [root@Jumpserver156 opt]# chown -R root:root luna

2.8配置 Nginx 整合各组件

(py3) [root@Jumpserver156 ~]# rm -rf /etc/nginx/conf.d/default.conf

(py3) [root@Jumpserver156 ~]# vi /etc/nginx/conf.d/jumpserver.conf

server {

    listen 80;

    client_max_body_size 100m;  # 录像及文件上传大小限制

    location /luna/ {

        try_files $uri / /index.html;

        alias /opt/luna/;  # luna 路径, 如果修改安装目录, 此处需要修改

    }

    location /media/ {

        add_header Content-Encoding gzip;

        root /opt/jumpserver/data/;  # 录像位置, 如果修改安装目录, 此处需要修改

    }

    location /static/ {

        root /opt/jumpserver/data/;  # 静态资源, 如果修改安装目录, 此处需要修改

    }

    location /socket.io/ {

        proxy_pass      http://localhost:5000/socket.io/;

        proxy_buffering off;

        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;

        proxy_set_header Connection "upgrade";

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        access_log off;

    }

    location /coco/ {

        proxy_pass      http://localhost:5000/coco/;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        access_log off;

    }

    location /guacamole/ {

        proxy_pass      http://localhost:8081/;

        proxy_buffering off;

        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;

        proxy_set_header Connection $http_connection;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        access_log off;

    }

    location / {

        proxy_pass http://localhost:8080;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    }

}

#注释掉/etc/nginx/nginx.conf文件中的server的全部内容

38 # server {

39 #        listen      81 default_server;

40 #        #listen      [::]:80 default_server;

41 #        server_name  _;

42 #        root        /usr/share/nginx/html;

43 #

44 #        # Load configuration files for the default server block.

45 #        include /etc/nginx/default.d/*.conf;

46 #

47 #        location / {

48 #        }

49 #

50 #        error_page 404 /404.html;

51 #            location = /40x.html {

52 #        }

53 #

54 #        error_page 500 502 503 504 /50x.html;

55 #            location = /50x.html {

56 #        }

57 #    }

# 运行 Nginx

[root@Jumpserver156 ~]# nginx -t   # 确保配置没有问题, 有问题请先解决

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok

nginx: configuration file /etc/nginx/nginx.conf test is successful

[root@Jumpserver156 ~]# systemctl restart nginx

第三节测试

3.1测试1

访问 http://192.168.244.144 (注意 没有 :8080 通过 nginx 代理端口进行访问)

默认账号: admin 密码: admin 到会话管理-终端管理 接受 koko Guacamole 等应用的注册

3.2测试2

(py3) [root@Jumpserver156 jumpserver]# ssh -p2222 [email protected]

The authenticity of host '[192.168.68.156]:2222 ([192.168.68.156]:2222)' can't be established.

RSA key fingerprint is SHA256:R9rfDzIJIweoKmvHSoYeOI3rOSY2oZl/eCdmowQA+mQ.

RSA key fingerprint is MD5:6a:45:34:26:58:8c:e4:f5:32:76:9a:ca:ad:4d:02:82.

Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added '[192.168.68.156]:2222' (RSA) to the list of known hosts.

[email protected]'s password:

Administrator,  欢迎使用Jumpserver开源堡垒机系统

1) 输入 ID 进行直接登陆.

2) 输入 部分IP、主机名、备注 进行进行搜索登录(如果唯一).

3) 输入 / + IP, 主机名 or 备注 进行搜索， 如: /192.168.

4) 输入 p 进行显示您有权限的主机.

5) 输入 g 进行显示您有权限的节点.

6) 输入 r 进行刷新最新的机器和节点信息.

7) 输入 h 进行显示帮助.

8) 输入 q 进行退出.

Opt> p

没有资产

Opt> q

(py3) [root@Jumpserver156 jumpserver]# sftp -P2222 [email protected]

[email protected]'s password:

Connected to 192.168.68.156.

sftp> ls

# 如果是用在 Windows 下, Xshell Terminal 登录语法如下

$ ssh [email protected]

$ sftp [email protected]密码: admin 

如果能登陆代表部署成功

# sftp默认上传的位置在资产的 /tmp 目录下

# windows拖拽上传的位置在资产的 Guacamole RDP上的 G 目录下

第四节多组件负载说明

# koko 服务默认运行在单核心下面, 当负载过高时会导致用户访问变慢, 这时可运行多个 docker 容器缓解

$docker run --name jms_koko01 -d -p2223:2222 -p5001:5000 -eCORE_HOST=http:// -eBOOTSTRAP_TOKEN=****** jumpserver/jms_koko:1.5.0

$ docker run --name jms_koko02 -d -p2224:2222 -p5002:5000 -eCORE_HOST=http:// -eBOOTSTRAP_TOKEN=****** jumpserver/jms_koko:1.5.0

# guacamole 也是一样

$ docker run --name jms_guacamole01 -d -p8082:8081 -eJUMPSERVER_SERVER=http:// -eBOOTSTRAP_TOKEN=****** jumpserver/jms_guacamole:1.5.0

$ docker run --name jms_guacamole02 -d -p8083:8081 -eJUMPSERVER_SERVER=http:// -eBOOTSTRAP_TOKEN=****** jumpserver/jms_guacamole:1.5.0

# nginx 代理设置

$ vi /etc/nginx/nginx.conf

user nginx;

worker_processes  auto;

error_log  /var/log/nginx/error.log warn;

pid        /var/run/nginx.pid;

events {

    worker_connections  1024;

}

# 加入 tcp 代理

stream {

    log_format  proxy  '$remote_addr [$time_local] '

                      '$protocol $status $bytes_sent $bytes_received '

                      '$session_time "$upstream_addr" '

                      '"$upstream_bytes_sent" "$upstream_bytes_received" "$upstream_connect_time"';

    access_log /var/log/nginx/tcp-access.log  proxy;

    open_log_file_cache off;

    upstream kokossh {

        server localhost:2222 weight=1;

        server localhost:2223 weight=1;  # 多节点

        server localhost:2224 weight=1;  # 多节点

        # 这里是 koko ssh 的后端ip

        hash $remote_addr;

    }

    server {

        listen 2220;  # 不能使用已经使用的端口, 自行修改, 用户ssh登录时的端口

        proxy_pass kokossh;

        proxy_connect_timeout 10s;

    }

}

# 到此结束

http {

    include      /etc/nginx/mime.types;

    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '

                      '$status $body_bytes_sent "$http_referer" '

                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;

    # tcp_nopush    on;

    keepalive_timeout  65;

    # 关闭版本显示

    server_tokens off;

    include /etc/nginx/conf.d/*.conf;

}

$ firewall-cmd --zone=public --add-port=2220/tcp --permanent

$ firewall-cmd --reload

$ vi /etc/nginx/conf.d/jumpserver.conf

upstream jumpserver {

    server localhost:8080;

    # 这里是 jumpserver 的后端ip

}

upstream kokows {

    server localhost:5000 weight=1;

    server localhost:5001 weight=1;  # 多节点

    server localhost:5002 weight=1;  # 多节点

    # 这里是 koko ws 的后端ip

    ip_hash;

}

upstream guacamole {

    server localhost:8081 weight=1;

    server localhost:8082 weight=1;  # 多节点

    server localhost:8083 weight=1;  # 多节点

    # 这里是 guacamole 的后端ip

    ip_hash;

}

server {

    listen 80;

    server_name demo.jumpserver.org;  # 自行修改成你的域名

    client_max_body_size 100m;  # 录像上传大小限制

    location / {

        proxy_pass http://jumpserver;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        access_log off;

    }

    location /luna/ {

        try_files $uri / /index.html;

        alias /opt/luna/;

    }

    location /socket.io/ {

        proxy_pass      http://kokows/socket.io/;  # koko

        proxy_buffering off;

        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;

        proxy_set_header Connection "upgrade";

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        access_log off;

    }

    location /coco/ {

        proxy_pass      http://kokows/coco/;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        access_log off;

    }

    location /guacamole/ {

        proxy_pass      http://guacamole/;  #  guacamole

        proxy_buffering off;

        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;

        proxy_set_header Connection $http_connection;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        access_log off;

    }

}

$ nginx -t

$ nginx -s reload

参考文档：http://docs.jumpserver.org/zh/master/setup_by_centos7.html

官方文档：http://docs.jumpserver.org/zh/master/

---

结束语：

更多精彩内容持续更新中，关注我微信公众号，有你更精彩。