centos 7.x 安裝開源堡壘機Jumpserver
環境
虛擬機 系統：centos 7
IP:192.168.168.8
目錄：/opt
代理：nginx
數據庫：mysql 版本大於等於 5.6 mariadb 版本大於等於 5.5.6
更新yum
yum update -y
關閉防火墻與selinux
firewall-cmd --state
systemctl stop firewalld
systemctl disable firewalld
vi /etc/sysconfig/selinux
SELINUX=enforcing 改為 SELINUX=disabled
reboot
修改字符集，否則可能報 input/output error的問題，因為日誌裏打印了中文
localedef -c -f UTF-8 -i zh_CN zh_CN.UTF-8
export LC_ALL=zh_CN.UTF-8
echo ‘LANG="zh_CN.UTF-8"‘ > /etc/locale.conf
安裝依賴包
yum -y install wget sqlite-devel xz gcc automake zlib-devel openssl-devel epel-release git
安裝redis，Jumpserver 使用 Redis 做 cache 和 celery broke
yum -y install redis
systemctl enable redis
systemctl start redis
安裝Mysql 作為數據庫,如果不使用 Mysql 可以跳過相關 Mysql 安裝和配置
yum -y install mariadb mariadb-devel mariadb-server # centos7下安裝的是mariadb
systemctl enable mariadb
systemctl start mariadb
創建數據庫 Jumpserver 並授權
mysql -uroot
> create database jumpserver default charset ‘utf8‘;
> grant all on jumpserver.* to ‘jumpserver‘@‘127.0.0.1‘ identified by ‘weakPassword‘;
> flush privileges;
> quit
安裝 Nginx，用代理服務器整合Jumpserver與各個組件
yum -y install nginx
systemctl enable nginx
下載編譯Python3.6.1
cd /opt
wget https://www.python.org/ftp/python/3.6.1/Python-3.6.1.tar.xz
tar xf Python-3.6.1.tar.xz && cd Python-3.6.1
./configure && make && make install
配置並載入Python3虛擬環境
cd /opt
python3 -m venv py3
source /opt/py3/bin/activate
# 看到下面的提示符代表成功，以後運行 Jumpserver 都要先運行以上 source 命令，以下所有命令均在該虛擬環境中運行
(py3) [root@localhost opt]#
自動載入Python虛擬環境
cd /opt
git clone git://github.com/kennethreitz/autoenv.git
echo ‘source /opt/autoenv/activate.sh‘ >> ~/.bashrc
source ~/.bashrc
下載Jumpserver 與 Coco
cd /opt
git clone https://github.com/jumpserver/jumpserver.git ----&& cd jumpserver && git checkout master
echo "source /opt/py3/bin/activate" > /opt/jumpserver/.env
cd /opt
git clone https://github.com/jumpserver/coco.git ----&& cd coco && git checkout master && git pull
echo "source /opt/py3/bin/activate" > /opt/coco/.env
安裝依賴 RPM 包
yum -y install $(cat /opt/jumpserver/requirements/rpm_requirements.txt)
yum -y install $(cat /opt/coco/requirements/rpm_requirements.txt)
安裝python庫依賴
pip install --upgrade pip
pip install -r /opt/jumpserver/requirements/requirements.txt -i https://mirrors.aliyun.com/pypi/simple/
pip install -r /opt/coco/requirements/requirements.txt
修改 Jumpserver 配置文件
cd /opt/jumpserver
cp config_example.py config.py
vi config.py
註意: 配置文件是 Python 格式,不要用 TAB,而要用空格
#!/usr/bin/env python3 # -*- coding: utf-8 -*- """ jumpserver.config ~~~~~~~~~~~~~~~~~ Jumpserver project setting file :copyright: (c) 2014-2017 by Jumpserver Team :license: GPL v2, see LICENSE for more details. """ import os BASE_DIR = os.path.dirname(os.path.abspath(__file__)) class Config: """ Jumpserver Config File Jumpserver 配置文件 Jumpserver use this config for drive django framework running, You can set is value or set the same envirment value, Jumpserver look for config order: file => env => default Jumpserver使用配置來驅動Django框架的運行， 你可以在該文件中設置，或者設置同樣名稱的環境變量, Jumpserver使用配置的順序: 文件 => 環境變量 => 默認值 """ # SECURITY WARNING: keep the secret key used in production secret! # 加密秘鑰 生產環境中請修改為隨機字符串，請勿外泄 SECRET_KEY = ‘2vym+ky!997d5kkcc64mnz06y1mmui3lut#(^wd=%s_qj$1%x‘ # SECURITY WARNING: keep the bootstrap token used in production secret! # 預共享Token coco和guacamole用來註冊服務賬號，不在使用原來的註冊接受機制 # BOOTSTRAP_TOKEN = ‘PleaseChangeMe‘ ALLOWED_HOSTS = [‘*‘] # Development env open this, when error occur display the full process track, Production disable it # DEBUG 模式 開啟DEBUG後遇到錯誤時可以看到更多日誌 DEBUG = False # DEBUG, INFO, WARNING, ERROR, CRITICAL can set. See https://docs.djangoproject.com/en/1.10/topics/logging/ # 日誌級別 LOG_LEVEL = ‘ERROR‘ LOG_DIR = os.path.join(BASE_DIR, ‘logs‘) # Session expiration setting, Default 24 hour, Also set expired on on browser close # 瀏覽器Session過期時間，默認24小時, 也可以設置瀏覽器關閉則過期 # SESSION_COOKIE_AGE = 3600 * 24 # SESSION_EXPIRE_AT_BROWSER_CLOSE = False SESSION_EXPIRE_AT_BROWSER_CLOSE = True # Database setting, Support sqlite3, mysql, postgres .... # 數據庫設置 # See https://docs.djangoproject.com/en/1.10/ref/settings/#databases # SQLite setting: # 使用單文件sqlite數據庫 # DB_ENGINE = ‘sqlite3‘ # DB_NAME = os.path.join(BASE_DIR, ‘data‘, ‘db.sqlite3‘) # MySQL or postgres setting like: # 使用Mysql作為數據庫 DB_ENGINE = ‘mysql‘ DB_HOST = ‘127.0.0.1‘ DB_PORT = 3306 DB_USER = ‘jumpserver‘ DB_PASSWORD = ‘weakPassword‘ DB_NAME = ‘jumpserver‘ # When Django start it will bind this host and port # ./manage.py runserver 127.0.0.1:8080 # 運行時綁定端口 HTTP_BIND_HOST = ‘0.0.0.0‘ HTTP_LISTEN_PORT = 8080 # Use Redis as broker for celery and web socket # Redis配置 REDIS_HOST = ‘127.0.0.1‘ REDIS_PORT = 6379 REDIS_PASSWORD = ‘‘: REDIS_DB_CELERY = 3 REDIS_DB_CACHE = 4 # Use OpenID authorization # 使用OpenID 來進行認證設置 # BASE_SITE_URL = ‘http://localhost:8080‘ # AUTH_OPENID = False # True or False # AUTH_OPENID_SERVER_URL = ‘https://openid-auth-server.com/‘ # AUTH_OPENID_REALM_NAME = ‘realm-name‘ # AUTH_OPENID_CLIENT_ID = ‘client-id‘ # AUTH_OPENID_CLIENT_SECRET = ‘client-secret‘ # # OTP_VALID_WINDOW = 0 def __init__(self): pass def __getattr__(self, item): return None class DevelopmentConfig(Config): pass class TestConfig(Config): pass class ProductionConfig(Config): pass # Default using Config settings, you can write if/else for different env config = DevelopmentConfig()
修改Coco配置文件
cd /opt/coco
cp conf_example.py conf.py # 如果 coco 與 jumpserver 分開部署,請手動修改 conf.py
vi conf.py
# 註意對齊,不要直接復制本文檔的內容
#!/usr/bin/env python3 # -*- coding: utf-8 -*- # import os BASE_DIR = os.path.dirname(__file__) class Config: """ Coco config file, coco also load config from server update setting below """ # 項目名稱, 會用來向Jumpserver註冊, 識別而已, 不能重復 NAME = "coco" # Jumpserver項目的url, api請求註冊會使用 CORE_HOST = os.environ.get("CORE_HOST") or ‘http://127.0.0.1:8080‘ # Bootstrap Token, 預共享秘鑰, 用來註冊coco使用的service account和terminal # 請和jumpserver 配置文件中保持一致，註冊完成後可以刪除 # BOOTSTRAP_TOKEN = "PleaseChangeMe" # 啟動時綁定的ip, 默認 0.0.0.0 # BIND_HOST = ‘0.0.0.0‘ # 監聽的SSH端口號, 默認2222 # SSHD_PORT = 2222 # 監聽的HTTP/WS端口號，默認5000 # HTTPD_PORT = 5000 # 項目使用的ACCESS KEY, 默認會註冊,並保存到 ACCESS_KEY_STORE中, # 如果有需求, 可以寫到配置文件中, 格式 access_key_id:access_key_secret # ACCESS_KEY = None # ACCESS KEY 保存的地址, 默認註冊後會保存到該文件中 # ACCESS_KEY_STORE = os.path.join(BASE_DIR, ‘keys‘, ‘.access_key‘) # 加密密鑰 # SECRET_KEY = None # 設置日誌級別 [‘DEBUG‘, ‘INFO‘, ‘WARN‘, ‘ERROR‘, ‘FATAL‘, ‘CRITICAL‘] LOG_LEVEL = ‘ERROR‘ # 日誌存放的目錄 # LOG_DIR = os.path.join(BASE_DIR, ‘logs‘) # Session錄像存放目錄 # SESSION_DIR = os.path.join(BASE_DIR, ‘sessions‘) # 資產顯示排序方式, [‘ip‘, ‘hostname‘] # ASSET_LIST_SORT_BY = ‘ip‘ # 登錄是否支持密碼認證 # PASSWORD_AUTH = True # 登錄是否支持秘鑰認證 # PUBLIC_KEY_AUTH = True # SSH白名單 # ALLOW_SSH_USER = ‘all‘ # [‘test‘, ‘test2‘] # SSH黑名單, 如果用戶同時在白名單和黑名單，黑名單優先生效 # BLOCK_SSH_USER = [] # 和Jumpserver 保持心跳時間間隔 # HEARTBEAT_INTERVAL = 5 # Admin的名字，出問題會提示給用戶 # ADMINS = ‘‘ COMMAND_STORAGE = { "TYPE": "server" } REPLAY_STORAGE = { "TYPE": "server" } # SSH連接超時時間 (default 15 seconds) # SSH_TIMEOUT = 15 # 語言 = en LANGUAGE_CODE = ‘zh‘ config = Config()
安裝 Web Terminal 前端: Luna
cd /opt
wget https://github.com/jumpserver/luna/releases/download/1.4.1/luna.tar.gz
tar xf luna.tar.gz
chown -R root:root luna
安裝windows支持組件
yum remove docker-latest-logrotate docker-logrotate docker-selinux dockdocker-engine
yum install -y yum-utils device-mapper-persistent-data lvm2
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
yum makecache fast
yum -y install docker-ce
systemctl start docker -d
docker pull jumpserver/guacamole:latest
重新打開一個終端
配置Nginx整合組件
source /opt/py3/bin/activate
cd /opt/
vi /etc/nginx/conf.d/jumpserver.conf
server { listen 80; # 代理端口,以後將通過此端口進行訪問,不再通過8080端口 # server_name demo.jumpserver.org; # 修改成你的域名或者註釋掉 client_max_body_size 100m; # 錄像及文件上傳大小限制 location /luna/ { try_files $uri / /index.html; alias /opt/luna/; # luna 路徑,如果修改安裝目錄,此處需要修改 } location /media/ { add_header Content-Encoding gzip; root /opt/jumpserver/data/; # 錄像位置,如果修改安裝目錄,此處需要修改 } location /static/ { root /opt/jumpserver/data/; # 靜態資源,如果修改安裝目錄,此處需要修改 } location /socket.io/ { proxy_pass http://localhost:5000/socket.io/; # 如果coco安裝在別的服務器,請填寫它的ip proxy_buffering off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; access_log off; } location /coco/ { proxy_pass http://localhost:5000/coco/; # 如果coco安裝在別的服務器,請填寫它的ip proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; access_log off; } location /guacamole/ { proxy_pass http://localhost:8081/; # 如果guacamole安裝在別的服務器,請填寫它的ip proxy_buffering off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; access_log off; } location / { proxy_pass http://localhost:8080; # 如果jumpserver安裝在別的服務器,請填寫它的ip proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } }
cd /opt/
cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak
vim /etc/nginx/nginx.conf
# For more information on configuration, see: # * Official English Documentation: http://nginx.org/en/docs/ # * Official Russian Documentation: http://nginx.org/ru/docs/ user nginx; worker_processes auto; error_log /var/log/nginx/error.log; pid /run/nginx.pid; # Load dynamic modules. See /usr/share/nginx/README.dynamic. include /usr/share/nginx/modules/*.conf; events { worker_connections 1024; } http { log_format main ‘$remote_addr - $remote_user [$time_local] "$request" ‘ ‘$status $body_bytes_sent "$http_referer" ‘ ‘"$http_user_agent" "$http_x_forwarded_for"‘; access_log /var/log/nginx/access.log main; sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 65; types_hash_max_size 2048; include /etc/nginx/mime.types; default_type application/octet-stream; # Load modular configuration files from the /etc/nginx/conf.d directory. # See http://nginx.org/en/docs/ngx_core_module.html#include # for more information. include /etc/nginx/conf.d/*.conf; #server { #listen 80 default_server; #listen [::]:80 default_server; #server_name _; #root /usr/share/nginx/html; # Load configuration files for the default server block. #include /etc/nginx/default.d/*.conf; #location / { # } #error_page 404 /404.html; #location = /40x.html { #} #error_page 500 502 503 504 /50x.html; #location = /50x.html { #} #} # Settings for a TLS enabled server. # # server { # listen 443 ssl http2 default_server; # listen [::]:443 ssl http2 default_server; # server_name _; # root /usr/share/nginx/html; # # ssl_certificate "/etc/pki/nginx/server.crt"; # ssl_certificate_key "/etc/pki/nginx/private/server.key"; # ssl_session_cache shared:SSL:1m; # ssl_session_timeout 10m; # ssl_ciphers HIGH:!aNULL:!MD5; # ssl_prefer_server_ciphers on; # # # Load configuration files for the default server block. include /etc/nginx/default.d/*.conf; # # location / { # } # # error_page 404 /404.html; # location = /40x.html { # } # # error_page 500 502 503 504 /50x.html; # location = /50x.html { # } # } }
nginx -t
生成數據庫表結構和初始化數據
cd /opt/jumpserver/utils
bash make_migrations.sh
運行 Jumpserver
cd ..
./jms start all -d
# 新版本更新了運行腳本，使用方式./jms start|stop|status|restart all 後臺運行請添加 -d 參數
運行Coco
cd /opt/coco
./cocod start -d
#在第一個終端裏
啟動 Guacamole
# 註意：這裏需要修改下 http://<填寫jumpserver的url地址> 例: http://192.168.168.8, 否則會出錯
# 不能使用 127.0.0.1 ，可以更換 registry.jumpserver.org/public/guacamole:latest
docker run --name jms_guacamole -d \
-p 8081:8080 -v /opt/guacamole/key:/config/guacamole/key \
-e JUMPSERVER_KEY_DIR=/config/guacamole/key \
-e JUMPSERVER_SERVER=http://192.168.168.8:8080 \
jumpserver/guacamole:latest
systemctl start nginx
登錄Web管理界面：192.168.168.8
參考鏈接1：http://docs.jumpserver.org/zh/docs/step_by_step.html
參考鏈接2：http://docs.jumpserver.org/zh/docs/setup_by_centos7.html
參考鏈接3：https://www.cnblogs.com/bigdevilking/p/9427941.html
參考鏈接4：http://docs.jumpserver.org/zh/docs/faq_install.html
centos 7.x 安裝開源堡壘機Jumpserver