inception+archery SQL稽核平臺
阿新 • • 發佈：2018-11-10
關閉防火牆和selinux
宿主機安裝mysql，建立archery資料庫，並給所有許可權，允許遠端連線到該資料庫
grant all privileges on *.* to 'root'@'%' identified by 'jason_zhang' with grant option;
flush privileges;
安裝依賴環境
yum install ncurses-libs libncurses5-dev ncurses-devel wget git cmake openssl gcc-c++ zlib zlib-devel openssl-devel -y
注意:centos7 系統自帶的bison的版本過高，在後面測試的時候會報錯！安裝bison-2.5.1
[[email protected] tools]# wget http://ftp.gnu.org/gnu/bison/bison-2.5.1.tar.gz [[email protected] tools]# tar -zxvf bison-2.5.1.tar.gz [[email protected] tools]# cd bison-2.5.1 [[email protected] bison-2.5.1]# ./configure &&make &&make install
安裝 Python-3.4.1.tgz
[[email protected] tools]#wget https://www.python.org/ftp/python/3.4.1/Python-3.4.1.tgz [[email protected] tools]# tar zxvf Python-3.4.1.tgz [[email protected] tools]# cd Python-3.4.1 [[email protected] Python-3.4.1]# ./configure &&make &&make install
安裝setuptools
[[email protected] tools]# wget --no-check-certificate https://pypi.python.org/packages/source/s/setuptools/setuptools-19.6.tar.gz#md5=c607dd118eae682c44ed146367a17e26 [[email protected] tools]# tar zxvf setuptools-19.6.tar.gz [[email protected] tools]# cd setuptools-19.6 [[email protected] setuptools-19.6]# python3 setup.py build [[email protected] setuptools-19.6]# python3 setup.py install
安裝pip3
[[email protected] tools]# wget --no-check-certificate https://pypi.python.org/packages/source/p/pip/pip-8.0.2.tar.gz#md5=3a73c4188f8dbad6a1e6f6d44d117eeb [[email protected] tools]tar zxvf pip-8.0.2.tar.gz [[email protected] tools]# cd pip-8.0.2 [[email protected] pip-8.0.2]# python3 setup.py build [[email protected] pip-8.0.2]# python3 setup.py install
安裝python3基礎虛擬環境
[[email protected] tools]# pip3 install virtualenv [[email protected] tools]# virtualenv venv4archer --python=python3.4 [[email protected] tools]# source venv4archer/bin/activate
下載Release v1.3.6 上傳到伺服器上、解壓
還需要安裝一些依賴環境
(venv4archer) [[email protected] archery-1.3.6]# yum install python36u-devel mysql-devel -y (venv4archer) [[email protected] archery-1.3.6]# yum install python-devel -y (venv4archer) [[email protected] archery-1.3.6]# yum install openldap-devel (venv4archer) [[email protected] archery-1.3.6]#pip3 install pyldap
(venv4archer) [[email protected] archery-1.3.6]# pip3 install -r requirements.txt
安裝docker,並啟動服務
yum install -y docker yum install -y docker-compose
systemctl start docker
systemctl enable docker
建立inception和archery配置檔案
inception
(venv4archer) [[email protected] dockersrc]# mkdir -p /opt/inception
(venv4archer) [[email protected] dockersrc]# pwd /opt/inception (venv4archer) [[email protected] dockersrc]# vim inc.cnf [inception] general_log=1 general_log_file=inception.log port=6669 socket=/tmp/inc.socket character-set-client-handshake=0 character-set-server=utf8 inception_remote_system_password=jason_zhang inception_remote_system_user=root inception_remote_backup_port=3306 inception_remote_backup_host=192.168.199.177 inception_support_charset=utf8,utf8mb4 inception_osc_on=ON inception_osc_bin_dir=/usr/bin
archery
mkdir -p /opt/archery/downloads
cd /opt/archery
(venv4archer) [[email protected] archer]# vim settings.py (venv4archer) [[email protected] archer]# cat settings.py |grep -Ev '^%|^$' # -*- coding: UTF-8 -*- # Build paths inside the project like this: os.path.join(BASE_DIR, ...) import os BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__))) # SECURITY WARNING: keep the secret key used in production secret! SECRET_KEY = 'hfusaf2m4ot#7)fkw#di2bu6([email protected]#6=3d%x^hpl6' # SECURITY WARNING: don't run with debug turned on in production! DEBUG = True ALLOWED_HOSTS = ['*'] # 解決nginx部署跳轉404 USE_X_FORWARDED_HOST = True # 請求限制 DATA_UPLOAD_MAX_MEMORY_SIZE = 15728640 # Application definition INSTALLED_APPS = ( 'django.contrib.admin', 'django.contrib.auth', 'django.contrib.contenttypes', 'django.contrib.sessions', 'django.contrib.messages', 'django.contrib.staticfiles', 'django_apscheduler', 'sql', 'themis', ) MIDDLEWARE = ( 'django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.common.CommonMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.clickjacking.XFrameOptionsMiddleware', 'django.middleware.security.SecurityMiddleware', 'common.middleware.check_login_middleware.CheckLoginMiddleware', 'common.middleware.exception_logging_middleware.ExceptionLoggingMiddleware', ) ROOT_URLCONF = 'archery.urls' TEMPLATES = [ { 'BACKEND': 'django.template.backends.django.DjangoTemplates', 'DIRS': [os.path.join(BASE_DIR, 'common/templates')], 'APP_DIRS': True, 'OPTIONS': { 'context_processors': [ 'django.template.context_processors.debug', 'django.template.context_processors.request', 'django.contrib.auth.context_processors.auth', 'django.contrib.messages.context_processors.messages', 'common.utils.global_info.global_info', ], }, }, ] WSGI_APPLICATION = 'archery.wsgi.application' # Internationalization LANGUAGE_CODE = 'zh-hans' TIME_ZONE = 'Asia/Shanghai' USE_I18N = True USE_TZ = False # 時間格式化 USE_L10N = False DATETIME_FORMAT = 'Y-m-d H:i:s' DATE_FORMAT = 'Y-m-d' # Static files (CSS, JavaScript, Images) STATIC_URL = '/static/' STATIC_ROOT = os.path.join(BASE_DIR, 'static') STATICFILES_DIRS = [os.path.join(BASE_DIR, 'common/static'), ] # 擴充套件django admin裡users欄位用到，指定了sql/models.py裡的class users AUTH_USER_MODEL = "sql.users" AUTH_PASSWORD_VALIDATORS = [ { 'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator', }, { 'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator', 'OPTIONS': { 'min_length': 9, } }, { 'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator', }, { 'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator', }, ] ###############以下部分需要使用者根據自己環境自行修改################### # 該專案本身的mysql資料庫地址 DATABASES = { 'default': { 'ENGINE': 'django.db.backends.mysql', 'NAME': 'archery', 'USER': 'root', 'PASSWORD': 'jason_zhang', 'HOST': '192.168.199.177', 'PORT': '3306', 'OPTIONS': { 'init_command': "SET sql_mode='STRICT_TRANS_TABLES'", 'charset': 'utf8mb4' }, 'TEST': { 'NAME': 'test_archery', 'CHARSET': 'utf8', }, } } # themis稽核所需mongodb資料庫，賬號角色必須有"anyAction" to "anyResource"許可權 MONGODB_DATABASES = { "default": { "NAME": 'themis', "USER": 'root', "PASSWORD": 'jason_zhang', "HOST": 'mongo', "PORT": 27017, }, } # 快取配置 CACHES = { 'default': { 'BACKEND': 'django.core.cache.backends.filebased.FileBasedCache', 'LOCATION': os.path.join(BASE_DIR, "archery"), } } # LDAP ENABLE_LDAP = False if ENABLE_LDAP: import ldap from django_auth_ldap.config import LDAPSearch AUTHENTICATION_BACKENDS = ( 'django_auth_ldap.backend.LDAPBackend', # 配置為先使用LDAP認證，如通過認證則不再使用後面的認證方式 'django.contrib.auth.backends.ModelBackend', # django系統中手動建立的使用者也可使用，優先順序靠後。注意這2行的順序 ) AUTH_LDAP_SERVER_URI = "ldap://xxx" AUTH_LDAP_USER_DN_TEMPLATE = "cn=%(user)s,ou=xxx,dc=xxx,dc=xxx" AUTH_LDAP_ALWAYS_UPDATE_USER = True # 每次登入從ldap同步使用者資訊 AUTH_LDAP_USER_ATTR_MAP = { # key為archery.sql_users欄位名，value為ldap中欄位名，使用者同步資訊 "username": "cn", "display": "displayname", "email": "mail" } # LOG配置 LOGGING = { 'version': 1, 'disable_existing_loggers': False, 'formatters': { 'verbose': { 'format': '[%(asctime)s][%(threadName)s:%(thread)d][task_id:%(name)s][%(filename)s:%(lineno)d][%(levelname)s]- %(message)s' }, }, 'handlers': { 'default': { 'level': 'DEBUG', 'class': 'logging.handlers.RotatingFileHandler', 'filename': 'downloads/log/archery.log', 'maxBytes': 1024 * 1024 * 100, # 5 MB 'backupCount': 5, 'formatter': 'verbose', }, 'console': { 'level': 'DEBUG', 'class': 'logging.StreamHandler', 'formatter': 'verbose' } }, 'loggers': { 'default': { # default日誌，存放於log中 'handlers': ['default'], 'level': 'DEBUG', }, 'django_auth_ldap': { # django_auth_ldap模組相關日誌 'handlers': ['default'], 'level': 'DEBUG', }, 'django_apscheduler': { # django_apscheduler模組相關日誌 'handlers': ['default'], 'level': 'DEBUG', }, # 'django.db': { # 列印SQL語句到console，方便開發 # 'handlers': ['console'], # 'level': 'DEBUG', # 'propagate': True, # }, 'django.request': { # 列印請求錯誤堆疊資訊到console，方便開發 'handlers': ['console'], 'level': 'DEBUG', 'propagate': True, }, } }
mongodb
mkdir -p /opt/mongo/datadir
新建 docker-compose.yml 引導檔案
version: '3'
services:
mongo:
image: mongo:3.6
container_name: mongo
restart: always
volumes:
- "/opt/mongo/datadir:/data/db"
ports:
- 27017:27017
environment:
MONGO_INITDB_ROOT_USERNAME: root
MONGO_INITDB_ROOT_PASSWORD: jason_zhang
inception:
image: registry.cn-hangzhou.aliyuncs.com/lihuanhuan/inception
container_name: inception
restart: always
ports:
- "6669:6669"
volumes:
- "/opt/inception/inc.cnf:/etc/inc.cnf"
archery:
image: registry.cn-hangzhou.aliyuncs.com/lihuanhuan/archery
container_name: archery
restart: always
ports:
- "9123:9123"
volumes:
- "/opt/archery/settings.py:/opt/archery/archery/settings.py"
- "/opt/archery/downloads:/opt/archery/downloads"
command: ["bash","/opt/archery/src/docker/startup.sh"]
environment:
NGINX_PORT: 9123
拉取映象
(venv4archer) [[email protected] opt]# docker-compose -f docker-compose.yml up -d
失敗的話可以刪除後再次操作
docker-compose -f docker-compose.yml kill
docker-compose -f docker-compose.yml rm
docker-compose -f docker-compose.yml up -d
表結構初始化
docker exec -ti archery /bin/bash ##進入archery容器
cd /opt/archery
source /opt/venv4archery/bin/activate
python3 manage.py makemigrations sql
python3 manage.py migrate
#建立管理使用者 python3 manage.py createsuperuser #日誌檢視和問題排查 docker logs archery
登入： http://192.168.199.177:9123
初次登入提示密碼為空，重啟archery容器
Docker
archery映象：https://dev.aliyun.com/detail.html?spm=5176.1972343.2.2.58c75aaa3iK1Sb&repoId=244140
inception映象: https://dev.aliyun.com/detail.html?spm=5176.1972343.2.12.7b475aaaLiCfMf&repoId=142093
docker ps -a
docker rm
docker images
docker rmi
要先檢視該image有無使用才能刪除
進入一個容器
docker exec -ti archery /bin/bash
參考：
https://www.cnblogs.com/chenjiaxin--007/p/8432795.html
https://blog.csdn.net/xujiamin0022016/article/details/81980393
https://gitee.com/ilanni/archer/tree/archer-2.0/
https://github.com/hhyo/archery
https://github.com/hhyo/archery/wiki/%E9%83%A8%E7%BD%B2
https://gitee.com/ilanni/archer#%E9%98%BF%E9%87%8C%E4%BA%91rds%E7%AE%A1%E7%90%86
https://github.com/hhyo/archery