Jumpserver(堡壘機)的安裝與應用

本文轉載自查看原文 2019-01-15 13:29 2379 Liunx-系統服務

官網：http://docs.jumpserver.org/zh/docs/introduce.html

參考：https://www.cnblogs.com/mushou/p/9484317.html

作者:鄧聰聰

環境

系統: CentOS 7.6
IP: 172.16.16.2
關閉 selinux 和防火牆
jumpserver和coco、luna的版本必須保持一致

[root@bogon ~]# setenforce 0
[root@bogon ~]# sed -i "s/enforcing/disabled/g" /etc/selinux/config
[root@bogon ~]# iptables -F

1.准備 Python3 和 Python 虛擬環境

安裝依賴包

[root@bogon ~]# yum -y install wget gcc epel-release git

安裝 Python3.6

[root@bogon ~]# yum -y install python36 python36-devel

建立 Python 虛擬環境

[root@bogon ~]#  cd /opt
[root@bogon opt]#  python3.6 -m venv py3
[root@bogon opt]#  source /opt/py3/bin/activate
# 看到下面的提示符代表成功,以后運行 Jumpserver 都要先運行以上 source 命令,以下所有命令均在該虛擬環境中運行
(py3)[root@bogon opt]#

2.安裝 Jumpserver

Clone 項目也可以選擇去 Github 項目頁面直接下載zip包

(py3)[root@bogon opt]# git clone https://github.com/jumpserver/jumpserver.git

安裝依賴 RPM 包

(py3)[root@bogon opt]#cd /opt/jumpserver/requirements
(py3)[root@bogon requirements]#yum -y install $(cat rpm_requirements.txt)

安裝 Python 庫依賴

(py3)[root@bogon requirements]#pip install --upgrade pip setuptools
(py3)[root@bogon requirements]#pip install -r requirements.txt

安裝 Redis, Jumpserver 使用 Redis 做 cache 和 celery broke

(py3)[root@bogon requirements]#yum -y install redis
(py3)[root@bogon requirements]#systemctl start redis

安裝 MySQL

(py3) [root@bogon requirements]# yum -y install mariadb mariadb-devel mariadb-server # centos7下安裝的是mariadb
(py3) [root@bogon requirements]# systemctl start mariadb

創建數據庫 Jumpserver 並授權

(py3) [root@bogon requirements]#mysql -uroot
mysql> create database jumpserver default charset 'utf8';
mysql> grant all on jumpserver.* to 'jumpserver'@'127.0.0.1' identified by 'weakPassword';
mysql> flush privileges;
mysql> quit

修改 Jumpserver 配置文件 注意: 配置文件是 Python 格式,不要用 TAB,而要用空

(py3) [root@bogon requirements]#cd  ..
(py3) [root@bogon jumpserver]# cp config_example.py config.py
(py3) [root@bogon jumpserver]# vi config.py

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
    jumpserver.config
    ~~~~~~~~~~~~~~~~~

    Jumpserver project setting file

    :copyright: (c) 2014-2017 by Jumpserver Team
    :license: GPL v2, see LICENSE for more details.
"""
import os

BASE_DIR = os.path.dirname(os.path.abspath(__file__))


class Config:
    """
    Jumpserver Config File
    Jumpserver 配置文件

    Jumpserver use this config for drive django framework running,
    You can set is value or set the same envirment value,
    Jumpserver look for config order: file => env => default

    Jumpserver使用配置來驅動Django框架的運行，
    你可以在該文件中設置，或者設置同樣名稱的環境變量,
    Jumpserver使用配置的順序: 文件 => 環境變量 => 默認值
    """
    # SECURITY WARNING: keep the secret key used in production secret!
    # 加密秘鑰 生產環境中請修改為隨機字符串，請勿外泄
    SECRET_KEY = '2vym+ky!997d5kkcc64mnz06y1mmui3lut#(^wd=%s_qj$1%x'
    ALLOWED_HOSTS = ['*']

    # SECURITY WARNING: keep the bootstrap token used in production secret!
    # 預共享Token coco和guacamole用來注冊服務賬號，不在使用原來的注冊接受機制
    BOOTSTRAP_TOKEN = 'nwv4RdXpM82LtSvmV'

    # Development env open this, when error occur display the full process track, Production disable it
    # DEBUG 模式 開啟DEBUG后遇到錯誤時可以看到更多日志
    # DEBUG = True
    DEBUG = False

    # DEBUG, INFO, WARNING, ERROR, CRITICAL can set. See https://docs.djangoproject.com/en/1.10/topics/logging/
    # 日志級別
    # LOG_LEVEL = 'DEBUG'
    # LOG_DIR = os.path.join(BASE_DIR, 'logs')
    LOG_LEVEL = 'ERROR'
    LOG_DIR = os.path.join(BASE_DIR, 'logs')

    # Session expiration setting, Default 24 hour, Also set expired on on browser close
    # 瀏覽器Session過期時間，默認24小時, 也可以設置瀏覽器關閉則過期
    # SESSION_COOKIE_AGE = 3600 * 24
    # SESSION_EXPIRE_AT_BROWSER_CLOSE = False
    SESSION_EXPIRE_AT_BROWSER_CLOSE = True
    # Database setting, Support sqlite3, mysql, postgres ....
    # 數據庫設置
    # See https://docs.djangoproject.com/en/1.10/ref/settings/#databases

    # SQLite setting:
    # 使用單文件sqlite數據庫
    # DB_ENGINE = 'sqlite3'
    # DB_NAME = os.path.join(BASE_DIR, 'data', 'db.sqlite3')

    # MySQL or postgres setting like:
    # 使用Mysql作為數據庫
    DB_ENGINE = 'mysql'
    DB_HOST = '127.0.0.1'
    DB_PORT = 3306
    DB_USER = 'jumpserver'
    DB_PASSWORD = '123456'
    DB_NAME = 'jumpserver'

    # When Django start it will bind this host and port
    # ./manage.py runserver 127.0.0.1:8080
    # 運行時綁定端口
    HTTP_BIND_HOST = '0.0.0.0'
    HTTP_LISTEN_PORT = 8080

    # Use Redis as broker for celery and web socket
    # Redis配置
    REDIS_HOST = '127.0.0.1'
    REDIS_PORT = 6379
    # REDIS_PASSWORD = ''
    # REDIS_DB_CELERY = 3
    # REDIS_DB_CACHE = 4

    # Use OpenID authorization
    # 使用OpenID 來進行認證設置
    # BASE_SITE_URL = 'http://localhost:8080'
    # AUTH_OPENID = False  # True or False
    # AUTH_OPENID_SERVER_URL = 'https://openid-auth-server.com/'
    # AUTH_OPENID_REALM_NAME = 'realm-name'
    # AUTH_OPENID_CLIENT_ID = 'client-id'
    # AUTH_OPENID_CLIENT_SECRET = 'client-secret'

    #
    # OTP_VALID_WINDOW = 0

    def __init__(self):
        pass

    def __getattr__(self, item):
        return None


class DevelopmentConfig(Config):
    pass


class TestConfig(Config):
    pass


class ProductionConfig(Config):
    pass


# Default using Config settings, you can write if/else for different env
config = DevelopmentConfig()

View Code

運行 Jumpserver

(py3) [root@bogon jumpserver]#./jms start all   #后台運行使用 -d 參數./jms start all -d
(py3) [root@bogon jumpserver]#./jms start|stop|status|restart all  #其他參數

3.安裝 SSH Server 和 WebSocket Server: Coco

Clone 項目

(py3) [root@bogon jumpserver]# cd ..
(py3) [root@bogon opt]# git clone https://github.com/jumpserver/coco.git
(py3) [root@bogon opt]#cd /opt/coco/requirements
(py3) [root@bogon requirements]#yum -y  install $(cat rpm_requirements.txt)
(py3) [root@bogon requirements]#pip install -r requirements.txt

修改配置文件並運行

(py3) [root@bogon requirements]#cd /opt/coco 
[root@bogon coco]# mkdir keys logs 
[root@bogon coco]# cp conf_example.py conf.py 
[root@bogon coco]# vi conf.py

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
#
import os

BASE_DIR = os.path.dirname(__file__)

class Config:
    """
    Coco config file, coco also load config from server update setting below
    """
    # 項目名稱, 會用來向Jumpserver注冊, 識別而已, 不能重復
    # NAME = "localhost"
    # Jumpserver項目的url, api請求注冊會使用
    # CORE_HOST = os.environ.get("CORE_HOST") or 'http://127.0.0.1:8080'
    CORE_HOST = 'http://127.0.0.1:8080'
    # Bootstrap Token, 預共享秘鑰, 用來注冊coco使用的service account和terminal
    # 請和jumpserver 配置文件中保持一致，注冊完成后可以刪除
    # BOOTSTRAP_TOKEN = "PleaseChangeMe"
    BOOTSTRAP_TOKEN = "nwv4RdXpM82LtSvmV"
    # 啟動時綁定的ip, 默認 0.0.0.0
    # BIND_HOST = '0.0.0.0'
    # 監聽的SSH端口號, 默認2222
    # SSHD_PORT = 2222
    # 監聽的HTTP/WS端口號，默認5000
    # HTTPD_PORT = 5000
    # 項目使用的ACCESS KEY, 默認會注冊,並保存到 ACCESS_KEY_STORE中,
    # 如果有需求, 可以寫到配置文件中, 格式 access_key_id:access_key_secret
    # ACCESS_KEY = None
    # ACCESS KEY 保存的地址, 默認注冊后會保存到該文件中
    # ACCESS_KEY_STORE = os.path.join(BASE_DIR, 'keys', '.access_key')
    # 加密密鑰
    # SECRET_KEY = None
    # 設置日志級別 ['DEBUG', 'INFO', 'WARN', 'ERROR', 'FATAL', 'CRITICAL']
    # LOG_LEVEL = 'INFO'
    LOG_LEVEL = 'ERROR'
    # 日志存放的目錄
    # LOG_DIR = os.path.join(BASE_DIR, 'logs')
    # Session錄像存放目錄
    # SESSION_DIR = os.path.join(BASE_DIR, 'sessions')
    # 資產顯示排序方式, ['ip', 'hostname']
    # ASSET_LIST_SORT_BY = 'ip'
    # 登錄是否支持密碼認證
    # PASSWORD_AUTH = True
    # 登錄是否支持秘鑰認證
    # PUBLIC_KEY_AUTH = True
    # SSH白名單
    # ALLOW_SSH_USER = 'all'  # ['test', 'test2']
    # SSH黑名單, 如果用戶同時在白名單和黑名單，黑名單優先生效
    # BLOCK_SSH_USER = []
    # 和Jumpserver 保持心跳時間間隔
    # HEARTBEAT_INTERVAL = 5

    # Admin的名字，出問題會提示給用戶
    # ADMINS = ''
    COMMAND_STORAGE = {
        "TYPE": "server"
    }
    REPLAY_STORAGE = {
        "TYPE": "server"
    }

    # SSH連接超時時間 (default 15 seconds)
    # SSH_TIMEOUT = 15
    # 語言 = en
    LANGUAGE_CODE = 'zh'

config = Config()

View Code

(py3) [root@bogon coco]#./cocod start      #后台運行使用 -d 參數./cocod start -d
(py3) [root@bogon coco]#./cocod start|stop|status|restart  #腳本使用方式

4.安裝 Web Terminal 前端: Luna

(py3) [root@bogon opt]# cd /opt
# 訪問(https://github.com/jumpserver/luna/releases)下載對應版本的 release 包,直接解壓,不需要編譯
(py3) [root@bogon opt]# wget https://github.com/jumpserver/luna/releases/download/1.4.6/luna.tar.gz
(py3) [root@bogon opt]# tar -xf luna.tar.gz
(py3) [root@bogon opt]# chown -R root:root luna

5.配置 Nginx 整合各組件

安裝 Nginx

vi /etc/yum.repos.d/nginx.repo

[nginx]
name=nginx repo
baseurl=http://nginx.org/packages/centos/7/$basearch/
gpgcheck=0
enabled=1

View Code

(py3) [root@bogon opt]# yum install -y nginx
(py3) [root@bogon opt]# rm -rf /etc/nginx/conf.d/default.conf
(py3) [root@bogon opt]# vi /etc/nginx/conf.d/jumpserver.conf

server {
    listen 80;  # 代理端口，以后將通過此端口進行訪問，不再通過8080端口
    server_name demo.jumpserver.org;  # 修改成你的域名
 
    client_max_body_size 100m;  # 錄像及文件上傳大小限制
 
    location /luna/ {
        try_files $uri / /index.html;
        alias /opt/luna/;  # luna 路徑，如果修改安裝目錄，此處需要修改
    }
 
    location /media/ {
        add_header Content-Encoding gzip;
        root /opt/jumpserver/data/;  # 錄像位置，如果修改安裝目錄，此處需要修改
    }
 
    location /static/ {
        root /opt/jumpserver/data/;  # 靜態資源，如果修改安裝目錄，此處需要修改
    }
 
    location /socket.io/ {
        proxy_pass       http://localhost:5000/socket.io/;  # 如果coco安裝在別的服務器，請填寫它的ip
        proxy_buffering off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        access_log off;
    }
 
    location /coco/ {
        proxy_pass       http://localhost:5000/coco/;  # 如果coco安裝在別的服務器，請填寫它的ip
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        access_log off;
    }
 
    location /guacamole/ {
        proxy_pass       http://localhost:8081/;  # 如果guacamole安裝在別的服務器，請填寫它的ip
        proxy_buffering off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        access_log off;
    }
 
    location / {
        proxy_pass http://localhost:8080;  # 如果jumpserver安裝在別的服務器，請填寫它的ip
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

View Code

運行nginx

(py3) [root@bogon opt]#nginx -t   # 確保配置沒有問題, 有問題請先解決
(py3) [root@bogon opt]#systemctl start nginx

使用 Jumpserver,服務全部啟動后,訪問 http://IP

jumpsever的服務啟動流程

[root@bogon ~]#  cd /opt
[root@bogon opt]#  source /opt/py3/bin/activate  #進入python環境
(py3)[root@bogon opt]#systemctl start redis         #啟動redis
(py3)[root@bogon opt]#systemctl start mariadb    #啟動數據庫服務
(py3)[root@bogon opt]#cd /opt/jumpserver
(py3)[root@bogon jumpserver]# ./jms start -d     #啟動jumpserver服務，后台運行
(py3)[root@bogon coco]#./coco start -d          #后台運行coco服務
(py3)[root@bogon coco]#systemctl start nginx     #啟動nginx服務
(py3)[root@bogon coco]#systemctl enable nginx    #開機自啟動
(py3)[root@bogon coco]#systemctl enable mariadb 
(py3)[root@bogon coco]#systemctl enable redis

使用jumpserver時，打開會話管理-web終端無顯示可能由於瀏覽器造成的，更換其他第三方瀏覽下即可

6.Jumpserver的使用

登陸后創建用戶組，方便以后的授權操作
添加系統用戶

為了更方便快捷的使用jumpserver,默認管理員無法直接生成密碼給用戶，有大拿提供了一下修改配置文件的辦法，直接創建密碼給用戶，感覺挺好用就分享給大家

配置文件路徑：/opt/jumpserver/apps/users/templates/users

(py3) [root@bogon users]# more _user.html
{% extends '_base_create_update.html' %}
{% load i18n %}
{% load static %}
{% load bootstrap3 %}
{% block form %}
    {% if form.non_field_errors %}
         <div class="alert alert-danger">
            {{ form.non_field_errors }}
         </div>
    {% endif %}
    <form method="post" class="form-horizontal" action="" enctype="multipart/form-data">
        {% csrf_token %}
        <h3>{% trans 'Account' %}</h3>
        {% bootstrap_field form.name layout="horizontal" %}
        {% bootstrap_field form.username layout="horizontal" %}
        {% bootstrap_field form.email layout="horizontal" %}
        {% bootstrap_field form.groups layout="horizontal" %}

        <div class="hr-line-dashed"></div>

        <h3>{% trans 'Auth' %}</h3> {#{% block password %}{% endblock %}#}    #注釋該行
        {% bootstrap_field form.password layout="horizontal" %}    #追加的行內容
        {% bootstrap_field form.otp_level layout="horizontal" %}

        <div class="hr-line-dashed"></div>
        <h3>{% trans 'Security and Role' %}</h3>
        {% bootstrap_field form.role layout="horizontal" %}
        <div class="form-group {% if form.date_expired.errors %} has-error {% endif %}" id="date_5">
            <label for="{{ form.date_expired.id_for_label }}" class="col-sm-2 control-label">{{ form.date_expired.label }}</label>
            <div class="col-sm-9">
                <div class="input-group date">
                    <span class="input-group-addon"><i class="fa fa-calendar"></i></span>
                    {% if form.errors %}
                    <input id="{{ form.date_expired.id_for_label }}" name="{{ form.date_expired.html_name }}" type="text" class="form-control"  value="{{ form.date_exp
ired.value }}">
                    {% else %}
                    <input id="{{ form.date_expired.id_for_label }}" name="{{ form.date_expired.html_name }}" type="text" class="form-control"  value="{{ form.date_exp
ired.value|date:'Y-m-d H:i' }}">
                    {% endif %}
                </div>
                <span class="help-block ">{{ form.date_expired.errors }}</span>
            </div>
         </div>
        <div class="hr-line-dashed"></div>
        <h3>{% trans 'Profile' %}</h3>
        {% bootstrap_field form.phone layout="horizontal" %}
        {% bootstrap_field form.wechat layout="horizontal" %}
        {% bootstrap_field form.comment layout="horizontal" %}
        <div class="hr-line-dashed"></div>
        <div class="form-group">
            <div class="col-sm-4 col-sm-offset-2">
                <button class="btn btn-white" type="reset">{% trans 'Reset' %}</button>
                <button id="submit_button" class="btn btn-primary" type="submit">{% trans 'Submit' %}</button>
            </div>
        </div>
    </form>

{% endblock %}
{% block custom_foot_js %}
    <script src="{% static 'js/plugins/datepicker/bootstrap-datepicker.js' %}"></script>
    <script type="text/javascript" src='{% static "js/plugins/daterangepicker/moment.min.js" %}'></script>
    <script type="text/javascript" src='{% static "js/plugins/daterangepicker/daterangepicker.min.js" %}'></script>
    <link rel="stylesheet" type="text/css" href={% static "css/plugins/daterangepicker/daterangepicker.css" %} />

    <script>
        var dateOptions = {
            singleDatePicker: true,
            showDropdowns: true,
            timePicker: true,
            timePicker24Hour: true,
            autoApply: true,
            locale: {
                format: 'YYYY-MM-DD HH:mm'
            }
        };
        $(document).ready(function () {
            $('.select2').select2();
            $('#id_date_expired').daterangepicker(dateOptions);
        })
    </script>
{% endblock %}

***升級篇***

　　升級 Jumpserver

cd /opt/jumpserver
source /opt/py3/bin/activate
./jms stop
git fetch
git pull

pip install -r requirements/requirements.txt

啟動 jumpserver
cd ../
./jms start all -d

　　升級coco

cd /opt/coco
git pull
source /opt/py3/bin/activate
./cocod stop

pip install -r requirements/requirements.txt
./cocod start -d

　　升級luna

cd /opt
rm -rf luna
wget https://github.com/jumpserver/luna/releases/download/1.4.8/luna.tar.gz

# 如果網絡有問題導致下載無法完成可以使用下面地址
$ wget https://demo.jumpserver.org/download/luna/1.4.8/luna.tar.gz

tar xf luna.tar.gz
chown -R root:root luna

免責聲明！

本站轉載的文章為個人學習借鑒使用，本站對版權不負任何法律責任。如果侵犯了您的隱私權益，請聯系本站郵箱yoyou2525@163.com刪除。

猜您在找 jumpserver堡壘機安裝安裝jumpserver堡壘機 jumpserver堡壘機安裝與配置使用Jumpserver堡壘機管理MySQL應用堡壘機jumpserver測試記錄--安裝 JumpServer 堡壘機指南企業堡壘機-jumpserver 搭建jumpserver堡壘機 jumpserver企業堡壘機 JumpServer（堡壘機）