一、jumpserver介紹
是一款由python編寫開源的跳板機(堡壘機)系統，實現了跳板機應有的功能。基於ssh協議來管理，客戶端無需安裝agent。 特點： 完全開源，GPL授權 Python編寫，容易再次開發 實現了跳板機基本功能，認證、授權、審計 集成了Ansible
官方資料：
https://github.com/jumpserver/jumpserver
https://github.com/ibuler/jumpserver/tree/master/docs
二、jumpserver安裝部署
1、環境
[root@jumpserver ~]# cat /etc/redhat-release CentOS release 6.9 (Final) [root@jumpserver ~]# uname -r 2.6.32-696.el6.x86_64 [root@jumpserver ~]# /etc/init.d/iptables status iptables: Firewall is not running. [root@jumpserver ~]# getenforce Disabled [root@jumpserver ~]# hostname -I 172.19.5.110 172.16.1.110
2、快速安裝
①安裝git
yum -y install git
②安裝依賴包
yum -y install epel-release #添加yum源
yum -y install git python-pip mysql-devel gcc automake autoconf python-devel vim sshpass lrzsz readline-devel
③下載jumpserver
git clone https://github.com/jumpserver/jumpserver.git git clone https://github.com/ibuler/jumpserver.git
④執行快速安裝腳本
cd /server/tools/jumpserver/install/ pip install -r requirements.txt #安裝python的依賴庫
⑤查看安裝了哪些依賴包
[root@jumpserver install]# cat requirements.txt #sphinx-me==0.3 django==1.6 pycrypto==2.6.1 paramiko==1.16.0 ecdsa==0.13 MySQL-python==1.2.5 #django-uuidfield==0.5.0 psutil==3.3.0 xlsxwriter==0.7.7 xlrd==0.9.4 django-bootstrap-form==3.2 tornado==4.3 ansible==1.9.4 pyinotify==0.9.6 passlib==1.6.5 argparse==1.4.0 django_crontab==0.6.0
注：根據提示輸入相關信息，完成安裝后，請訪問web172.19.5.110，如果啟動失敗，請返回上級目錄，手動執行./service.sh restart啟動，默認賬號admin，密碼5Lov@wife
⑥執行python的安裝腳本
[root@jumpserver install]# python install.py
安裝報錯
是否繼續? (y/n) [y]: y 開始寫入配置文件 Traceback (most recent call last): File "/server/tools/jumpserver/install/next.py", line 19, in <module> from juser.user_api import db_add_user, get_object, User File "/server/tools/jumpserver/juser/user_api.py", line 3, in <module> from Crypto.PublicKey import RSA File "/usr/lib64/python2.6/site-packages/Crypto/PublicKey/RSA.py", line 75, in <module> from Crypto.Util.number import getRandomRange, bytes_to_long, long_to_bytes File "/usr/lib64/python2.6/site-packages/Crypto/Util/number.py", line 56, in <module> if _fastmath is not None and not _fastmath.HAVE_DECL_MPZ_POWM_SEC: AttributeError: 'module' object has no attribute 'HAVE_DECL_MPZ_POWM_SEC'
解決報錯
pip uninstall pycrypto rm -fr /usr/lib64/python2.6/site-packages/Crypto/ pip install pycrypto==2.4.1
⑦檢查jumpserver服務
jumpserver服務啟動停止腳本
[root@jumpserver jumpserver]# /server/tools/jumpserver/service.sh
Usage: /server/tools/jumpserver/service.sh {start|stop|restart}
[root@jumpserver jumpserver]# ps -ef|grep jumpserver root 5022 1 0 15:24 pts/0 00:00:00 sh /server/tools/jumpserver/service.sh start root 5026 5022 0 15:24 pts/0 00:00:00 /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; python /server/tools/jumpserver/run_websocket.py root 5028 5026 0 15:24 pts/0 00:00:00 python /server/tools/jumpserver/run_websocket.py root 5038 5028 0 15:24 pts/0 00:00:00 python /server/tools/jumpserver/run_websocket.py root 5039 5028 0 15:24 pts/0 00:00:00 python /server/tools/jumpserver/run_websocket.py root 5040 5028 0 15:24 pts/0 00:00:00 python /server/tools/jumpserver/run_websocket.py root 5041 5028 0 15:24 pts/0 00:00:00 python /server/tools/jumpserver/run_websocket.py root 5042 5028 0 15:24 pts/0 00:00:00 python /server/tools/jumpserver/run_websocket.py
三、jumpserver軟件web頁面操作
1、瀏覽器登錄
2、添加用戶
①用戶添加完成后，根據提示記住用戶名和密碼，換個瀏覽器登錄下載Key，ssh登錄jumpserver測試
②創建普通員工用戶
③登錄郵箱查看jumpserver發送的信息
3、添加資產
①設置默認用戶管理
②添加資產
4、sudo授權管理
①默認跳板機創建的用戶都是普通用戶，所以需要依賴sudo命令別名功能，使普通用戶具有相應的權限，操作管理用戶的命令
②添加系統用戶並關聯sudo授權
用戶權限說明
③推送系統用戶
推送前登錄nfs01服務器查看sa系統用戶信息
[root@nfs01 ~]# id sa
id: sa: No such user
推送后再次查看
[root@nfs01 ~]# id sa uid=500(sa) gid=500(sa) groups=500(sa)
④添加授權規則
連接測試
⑤通過資產可以抓取到服務器硬件信息：查看資產點擊更新即可
點擊執行命令選項可以查看有權限管理的服務器
四、jumpserver命令行界面操作
1、要用admin用戶進行命令操作管理
2、使用普通用戶進行管理
①到郵箱下載Key秘鑰文件
②利用xshell秘鑰登錄方式，導入Key秘鑰，即可登錄到跳板機命令行界面
