環(huán)境:
系統(tǒng):centos7.2
目錄:/jumpserver
nginx: 1.42 源碼安裝
數(shù)據(jù)庫:mysql
redis:yum安裝
docker:yum安裝
python: 3.6
安裝
1 安裝依賴包
$ yum -y install wget gcc epel-release git
2 安裝 Redis,
Jumpserver 使用 Redis 做 cache 和 celery broke
$ chattr -i /etc/passwd /etc/shadow /etc/group /etc/gshadow
$ yum -y install redis
$ systemctl enable redis
$ systemctl start redis
3 mysql配置
安裝mysql這里不在贅述,創(chuàng)建數(shù)據(jù)庫和用戶
mysql> create database jumpserver;
Query OK, 1 row affected (0.05 sec)
mysql> grant all privileges on jumpserver.* to 'jumpserver'@'%' identified by 'your passwd' with grant option;
Query OK, 0 rows affected, 1 warning (0.12 sec)
mysql> flush privileges;
Query OK, 0 rows affected (0.02 sec)
4 安裝nginx
$ wget http://192.168.100.202/install_package/nginx-1.14.2.tar.gz
$ tar -xzf nginx-1.14.2.tar.gz
$ cd nginx-1.14.2 && ./configure --prefix=/jumpserver/nginx && make && make install
$ vim /jumpserver/nginx/nginx.conf # 修改端口,使用普通用戶啟動 9001
$ /jumpserver/nginx/sbin/nginx #啟動
5 安裝 Python3.6
$ yum -y install python36 python36-devel
配置并載入 Python3 虛擬環(huán)境
$ cd /jumpserver
$ python3.6 -m venv py3 # py3 為虛擬環(huán)境名稱, 可自定義
$ source /jumpserver/py3/bin/activate # 退出虛擬環(huán)境可以使用 deactivate 命令
# 看到下面的提示符代表成功, 以后運行 Jumpserver 都要先運行以上 source 命令, 載入環(huán)境后默認以下所有命令均在該虛擬環(huán)境中運行
(py3) [root@localhost py3]
切換到j(luò)umpserver用戶時自動載入python環(huán)境
$ echo 'source /jumpserver/py3/bin/activate' >> ~/.bash_profile
$ source ~/.bash_profile
切換到j(luò)umpserver目錄時自動載入python環(huán)境
$ echo 'source /jumpserver/py3/bin/activate' >> /jumpserver/jumpserver/.env
6 安裝 Jumpserver
下載
$ cd /jumpserver/
$ git clone --depth=1 https://github.com/jumpserver/jumpserver.git
安裝依賴 RPM 包
$ yum -y install $(cat /jumpserver/jumpserver/requirements/rpm_requirements.txt)
安裝 Python 庫依賴,這個過程比較慢
$ pip install --upgrade pip setuptools
$ pip install -r /jumpserver/jumpserver/requirements/requirements.txt
修改 Jumpserver 配置文件
$ cd /jumpserver/jumpserver
$ cp config_example.yml config.yml
$ SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 50` # 生成隨機SECRET_KEY
$ echo "SECRET_KEY=$SECRET_KEY" >> ~/.bash_profile
$ BOOTSTRAP_TOKEN=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 16` # 生成隨機BOOTSTRAP_TOKEN
$ echo "BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN" >> ~/.bash_profile
$ sed -i "s/SECRET_KEY:/SECRET_KEY: $SECRET_KEY/g" /jumpserver/jumpserver/config.yml
$ sed -i "s/BOOTSTRAP_TOKEN:/BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g" /jumpserver/jumpserver/config.yml
$ sed -i "s/# DEBUG: true/DEBUG: false/g" /jumpserver/jumpserver/config.yml
$ sed -i "s/# LOG_LEVEL: DEBUG/LOG_LEVEL: ERROR/g" /jumpserver/jumpserver/config.yml
$ sed -i "s/# SESSION_EXPIRE_AT_BROWSER_CLOSE: false/SESSION_EXPIRE_AT_BROWSER_CLOSE: true/g" /jumpserver/jumpserver/config.yml
具體配置如下,注意修改mysql ip以及密碼
$ egrep -v '^$|#' config.yml
SECRET_KEY: xxxxxxx
BOOTSTRAP_TOKEN: xxxx
DEBUG: false
LOG_LEVEL: ERROR
SESSION_EXPIRE_AT_BROWSER_CLOSE: true
DB_ENGINE: mysql
DB_HOST: 192.168.100.1
DB_PORT: 3306
DB_USER: jumpserver
DB_PASSWORD: your passwd
DB_NAME: jumpserver
HTTP_BIND_HOST: 0.0.0.0
HTTP_LISTEN_PORT: 8080
REDIS_HOST: 127.0.0.1
REDIS_PORT: 6379
運行 Jumpserver
$ cd /jumpserver/jumpserver
$ ./jms start -d # 后臺運行使用 -d 參數(shù)./jms start -d
# 新版本更新了運行腳本, 使用方式./jms start|stop|status all 后臺運行請?zhí)砑?-d 參數(shù)
7 安裝 docker 部署 koko 與 guacamole
安裝docker
$ yum install -y yum-utils device-mapper-persistent-data lvm2
$ yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
$ yum makecache fast
$ rpm --import https://mirrors.aliyun.com/docker-ce/linux/centos/gpg
$ yum -y install docker-ce
$ systemctl enable docker
$ curl -sSL https://get.daocloud.io/daotools/set_mirror.sh | sh -s http://f1361db2.m.daocloud.io
$ systemctl restart docker
變量,注意shell當前環(huán)境要可以獲取BOOTSTRAP_TOKEN的值
獲取當前服務(wù)器 IP
$ Server_IP=`ip addr | grep inet | egrep -v '(127.0.0.1|inet6|docker)' | awk '{print $2}' | tr -d "addr:" | head -n 1 | cut -d / -f1`
$ echo -e "\033[31m 你的服務(wù)器IP是 $Server_IP \033[0m"
# http://<Jumpserver_url> 指向 jumpserver 的服務(wù)端口,
# BOOTSTRAP_TOKEN 為 Jumpserver/config.yml 里面的 BOOTSTRAP_TOKEN
創(chuàng)建docker容器
$ docker run --name jms_koko -d -p 2222:2222 -p 5000:5000 -e CORE_HOST=http://$Server_IP:8080 -e BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN jumpserver/jms_koko:1.5.2
$ docker run --name jms_guacamole -d -p 8081:8081 -e JUMPSERVER_SERVER=http://$Server_IP:8080 -e BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN jumpserver/jms_guacamole:1.5.2
查看容器是否啟動正常,如果有exited狀態(tài)的請重建
$ docker ps -a
8 安裝 Web Terminal 前端: Luna
需要 Nginx 來運行訪問 訪問(https://github.com/jumpserver/luna/releases)下載對應(yīng)版本的 release 包, 直接解壓, 不需要編譯
$ cd /opt
$ wget https://github.com/jumpserver/luna/releases/download/1.5.2/luna.tar.gz
9配置 Nginx 整合各組件
創(chuàng)建conf.d文件夾并在nginx.conf中添加配置
##inclue *.conf
include conf.d/*.conf;
創(chuàng)建jumpserver.conf配置文件
$ cat /jumpserver/nginx/conf/conf.d/jumpserver.conf
server {
listen 9001;
client_max_body_size 100m; # 錄像及文件上傳大小限制
location /luna/ {
try_files $uri / /index.html;
alias /jumpserver/luna/; # luna 路徑, 如果修改安裝目錄, 此處需要修改
}
location /media/ {
add_header Content-Encoding gzip;
root /jumpserver/jumpserver/data/; # 錄像位置, 如果修改安裝目錄, 此處需要修改
}
location /static/ {
root /jumpserver/jumpserver/data/; # 靜態(tài)資源, 如果修改安裝目錄, 此處需要修改
}
location /socket.io/ {
proxy_pass http://localhost:5000/socket.io/;
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}
location /coco/ {
proxy_pass http://localhost:5000/coco/;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}
location /guacamole/ {
proxy_pass http://localhost:8081/;
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}
location / {
proxy_pass http://localhost:8080;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
重啟nginx
$ /jumpserver/nginx/sbin/nginx -s reload
訪問 http://$IP
默認賬號: admin 密碼: admin 到會話管理-終端管理 檢查 koko Guacamole 等應(yīng)用的注冊
測試連接
$ ssh -p2222 admin@192.168.100.204
$ sftp -P2222 admin@192.168.100.204
密碼: admin
# 如果是用在 Windows 下, Xshell Terminal 登錄語法如下
$ ssh admin@192.168.100.100 2222
$ sftp admin@192.168.100.100 2222
密碼: admin
如果能登陸代表部署成功
# sftp默認上傳的位置在資產(chǎn)的 /tmp 目錄下
# windows拖拽上傳的位置在資產(chǎn)的 Guacamole RDP上的 G 目錄下
參考官網(wǎng):https://jumpserver.readthedocs.io/zh/master/setup_by_centos7.html