jumpserver堡垒机部署

@环境

    #系统：CentOS 7

    #systemctl stop firewalld

    #systemctl disable firewalld

    #setenforce 0

    #sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config

    #wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo

    #yum clean all

    #yum makecache

@准备Python3和python虚拟环境

    #安装依赖包

        #yum -y install wget gcc epel-release git

    #安装Python3.6

        #yum -y install python36 python36-devel

    #建立Python虚拟环境

        # cd /data

        python3.6 -m venv py3

        source /data/py3/bin/activate

@安装jumpserver

    #下载或clone项目

        #cd /data/ && git clone --depth=1 https://github.com/jumpserver/jumpserver.git

    #安装依赖rpm包

        #cd /data/jumpserver/requirements

        yum -y install $(cat rpm_requirements.txt)

    #安装Python库依赖

        #pip install --upgrade pip setuptools

        pip install -r requirements.txt

    #安装redis

        #yum -y install redis

        systemctl enable redis

        systemctl start redis

    #安装mariadb

        #yum -y install mariadb mariadb-devel mariadb-server mariadb-shared

         systemctl enable mariadb

         systemctl start mariadb

    #创建数据看看jumpserver并授权

        #DB_PASSWORD=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 24`

        echo -e "\033[31m 你的数据库密码是 $DB_PASSWORD \033[0m"

        mysql -uroot -e "create database jumpserver default charset 'utf8'; grant all on jumpserver.* to 'jumpserver'@'127.0.0.1' identified by '$DB_PASSWORD'; flush privileges;"

    #修改jumpserver配置文件

        #cd /data/jumpserver

        cp config_example.yml config.yml

        SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 50`  # 生成随机SECRET_KEY

        echo "SECRET_KEY=$SECRET_KEY" >> ~/.bashrc

        BOOTSTRAP_TOKEN=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 16`  # 生成随机BOOTSTRAP_TOKEN

        echo "BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN" >> ~/.bashrc

        sed -i "s/SECRET_KEY:/SECRET_KEY: $SECRET_KEY/g" /data/jumpserver/config.yml

        sed -i "s/BOOTSTRAP_TOKEN:/BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g" /data/jumpserver/config.yml

        sed -i "s/# DEBUG: true/DEBUG: false/g" /data/jumpserver/config.yml

        sed -i "s/# LOG_LEVEL: DEBUG/LOG_LEVEL: ERROR/g" /data/jumpserver/config.yml

        sed -i "s/# SESSION_EXPIRE_AT_BROWSER_CLOSE: false/SESSION_EXPIRE_AT_BROWSER_CLOSE: true/g" /data/jumpserver/config.yml

        sed -i "s/DB_PASSWORD: /DB_PASSWORD: $DB_PASSWORD/g" /data/jumpserver/config.yml

        echo -e "\033[31m 你的SECRET_KEY是 $SECRET_KEY \033[0m"

        echo -e "\033[31m 你的BOOTSTRAP_TOKEN是 $BOOTSTRAP_TOKEN \033[0m"

 

        vi config.yml  # 确认内容有没有错误

        SECRET_KEY:

        # 预共享Token coco和guacamole用来注册服务账号, 不在使用原来的注册接受机制

        BOOTSTRAP_TOKEN:

        # DEBUG 模式 开启DEBUG后遇到错误时可以看到更多日志

        DEBUG: false

        # 日志级别

        LOG_LEVEL: ERROR

        SESSION_EXPIRE_AT_BROWSER_CLOSE: true

        # 使用Mysql作为数据库

        DB_ENGINE: mysql

        DB_HOST: 127.0.0.1

        DB_PORT: 3306

        DB_USER: jumpserver

        DB_PASSWORD:

        DB_NAME: jumpserver

        # 运行时绑定端口

        HTTP_BIND_HOST: 0.0.0.0

        HTTP_LISTEN_PORT: 8080

        # Redis配置

        REDIS_HOST: 127.0.0.1

        REDIS_PORT: 6379

    #运行jumpserver

        #cd /data/jumpserver

        ./jms start all -d

@安装 SSH Server 和 WebSocket Server: Coco

    #下载或 Clone 项目

        #cd /data

        source /data/py3/bin/activate

        git clone --depth=1 https://github.com/jumpserver/coco.git

    #安装依赖

        #cd /data/coco/requirements

        yum -y install $(cat rpm_requirements.txt)

        pip install -r requirements.txt

    #修改配饰文件并运行

        #cd /data/coco

        cp config_example.yml config.yml

 

        sed -i "s/BOOTSTRAP_TOKEN: /BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g" /data/coco/config.yml

        sed -i "s/# LOG_LEVEL: INFO/LOG_LEVEL: ERROR/g" /data/coco/config.yml

 

        vi config.yml

        CORE_HOST: http://127.0.0.1:8080

        BOOTSTRAP_TOKEN:

        LOG_LEVEL: ERROR

 

        ./cocod start -d

@安装 Web Terminal 前端: Luna

    #解压luna

        #cd /data

        wget https://github.com/jumpserver/luna/releases/download/1.4.10/luna.tar.gz

        tar xf luna.tar.gz

        chown -R root:root luna

@安装 Windows 支持组件(如果不需要管理 windows 资产, 可以直接跳过这一步)

    #安装依赖

        #rpm --import http://li.nux.ro/download/nux/RPM-GPG-KEY-nux.ro

        #rpm -Uvh http://li.nux.ro/download/nux/dextop/el7/x86_64/nux-dextop-release-0-5.el7.nux.noarch.rpm

        #yum -y localinstall --nogpgcheck https://download1.rpmfusion.org/free/el/rpmfusion-free-release-7.noarch.rpm https://download1.rpmfusion.org/nonfree/el/rpmfusion-nonfree-release-7.noarch.rpm

        #yum install -y java-1.8.0-openjdk libtool

        #yum install -y cairo-devel libjpeg-turbo-devel libpng-devel uuid-devel

        #yum install -y ffmpeg-devel freerdp-devel freerdp-plugins pango-devel libssh2-devel libtelnet-devel libvncserver-devel pulseaudio-libs-devel openssl-devel libvorbis-devel libwebp-devel ghostscript

    #编译安装 guacamole 服务

        #cd /data

        #git clone --depth=1 https://github.com/jumpserver/docker-guacamole.git

        #cd /data/docker-guacamole/

        #tar -xf guacamole-server-0.9.14.tar.gz

        #cd guacamole-server-0.9.14

        #autoreconf -fi

        #./configure --with-init-dir=/etc/init.d

        #make && make install

        #ln -s /usr/local/lib/freerdp/*.so /usr/lib64/freerdp/

        #cd ..

        #rm -rf guacamole-server-0.9.14

        #ldconfig

    #配置Tomcat

        #mkdir -p /config/guacamole /config/guacamole/lib /config/guacamole/extensions  # 创建 guacamole 目录

        #ln -sf /data/docker-guacamole/guacamole-auth-jumpserver-0.9.14.jar /config/guacamole/extensions/guacamole-auth-jumpserver-0.9.14.jar

        #ln -sf /data/docker-guacamole/root/app/guacamole/guacamole.properties /config/guacamole/guacamole.properties  # guacamole 配置文件

        #cd /config

        #wget http://mirrors.tuna.tsinghua.edu.cn/apache/tomcat/tomcat-8/v8.5.40/bin/apache-tomcat-8.5.40.tar.gz

        #tar xf apache-tomcat-8.5.40.tar.gz

        #rm -rf apache-tomcat-8.5.40.tar.gz

        #mv apache-tomcat-8.5.40 tomcat8

        #rm -rf /config/tomcat8/webapps/*

        #ln -sf /data/docker-guacamole/guacamole-0.9.14.war /config/tomcat8/webapps/ROOT.war  # guacamole client

        #sed -i 's/Connector port="8080"/Connector port="8081"/g' /config/tomcat8/conf/server.xml  # 修改默认端口为 8081

        #sed -i 's/FINE/WARNING/g' /config/tomcat8/conf/logging.properties  # 修改 log 等级为 WARNING

        #cd /config

        #wget https://github.com/ibuler/ssh-forward/releases/download/v0.0.5/linux-amd64.tar.gz

        #tar xf linux-amd64.tar.gz -C /bin/

        #chmod +x /bin/ssh-forward

@配置环境变量

    #勿多次执行以下环境设置

        #export JUMPSERVER_SERVER= http://127.0.0.1:8080  # http://127.0.0.1:8080 指 jumpserver 访问地址

        #echo "export JUMPSERVER_SERVER= http://127.0.0.1:8080" >> ~/.bashrc

        #BOOTSTRAP_TOKEN 为 Jumpserver/config.yml 里面的 BOOTSTRAP_TOKEN

        #export BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN

        #echo "export BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN" >> ~/.bashrc

        #export JUMPSERVER_KEY_DIR=/config/guacamole/keys

        #echo "export JUMPSERVER_KEY_DIR=/config/guacamole/keys" >> ~/.bashrc

        #export GUACAMOLE_HOME=/config/guacamole

        #echo "export GUACAMOLE_HOME=/config/guacamole" >> ~/.bashrc

@启动 Guacamole

    #/etc/init.d/guacd start

    #sh /config/tomcat8/bin/startup.sh

@配置 Nginx 整合各组件

    #安装 Nginx

        #yum install yum-utils

        vi /etc/yum.repos.d/nginx.repo

 

       [nginx-stable]

       name=nginx stable repo

       baseurl= http://nginx.org/packages/centos/$releasever/$basearch/

       gpgcheck=1

       enabled=1

       gpgkey= https://nginx.org/keys/nginx_signing.key

 

       yum makecache fast

       yum install -y nginx

       rm -rf /etc/nginx/conf.d/default.conf

       systemctl enable nginx

    #准备配置文件 修改 /etc/nginx/conf.d/jumpserver.conf

    #vi /etc/nginx/conf.d/jumpserver.conf

 

server {

    listen 80;  # 代理端口, 以后将通过此端口进行访问, 不再通过8080端口

    # server_name demo.jumpserver.org;  # 修改成你的域名或者注释掉

 

    client_max_body_size 100m;  # 录像及文件上传大小限制

 

    location /luna/ {

        try_files $uri / /index.html;

        alias /data/luna/;  # luna 路径, 如果修改安装目录, 此处需要修改

    }

 

    location /media/ {

        add_header Content-Encoding gzip;

        root /data/jumpserver/data/;  # 录像位置, 如果修改安装目录, 此处需要修改

    }

 

    location /static/ {

        root /data/jumpserver/data/;  # 静态资源, 如果修改安装目录, 此处需要修改

    }

 

    location /socket.io/ {

        proxy_pass        http://localhost:5000/socket.io/;  # 如果coco安装在别的服务器, 请填写它的ip

        proxy_buffering off;

        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;

        proxy_set_header Connection "upgrade";

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        access_log off;

    }

 

    location /coco/ {

        proxy_pass        http://localhost:5000/coco/;  # 如果coco安装在别的服务器, 请填写它的ip

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        access_log off;

    }

 

    location /guacamole/ {

        proxy_pass        http://localhost:8081/;  # 如果guacamole安装在别的服务器, 请填写它的ip

        proxy_buffering off;

        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;

        proxy_set_header Connection $http_connection;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        access_log off;

    }

 

    location / {

        proxy_pass http://localhost:8080;  # 如果jumpserver安装在别的服务器, 请填写它的ip

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    }

}

    #运行nginx

        #nginx -t   # 确保配置没有问题, 有问题请先解决

　　systemctl start nginx

　　systemctl enable nginx

    #开始使用 Jumpserver

        #默认账号: admin 密码: admin

 

 

 

 

 

转载于:https://www.cnblogs.com/Ghost-bird/p/11009245.html