安裝jumpserver 2.1.2版本遇到的坑

官方文檔地址：https://docs.jumpserver.org/zh/master/install/step_by_step/

Jumpserver 對外需要開放 80 和 2222 端口，如果你配置了 ssl 還需要開放 443 端口, 8080 端口開放給 koko 和 guacamole 組件訪問
安全組放行端口：80，443，2222

1. 安裝依賴報錯的坑
   在文檔中的5. 安裝編譯環境依賴這一步，安裝依賴時有可能會報錯，有些依賴包安裝不了
   解決辦法：yum -y install python36-devel

因為當初在安裝python3環境的時候，使用的是如下的安裝方式：yum -y install python36，安裝的是3.6.8的版本。

為了避免出現安裝依賴報錯的問題，可以直接這樣做：

yum -y install python36 python36-devel

2. 使用docker方式安裝KoKo 組件和Guacamole 組件，在web界面里的會話管理-終端管理中不顯示的問題
   這是因為在config.yml文件中配置的監聽地址HTTP_BIND_HOST是127.0.0.1，同時呢，使用docker安裝這倆組件時配置的CORE_HOST地址也是127.0.0.1，才導致這倆組件無法注冊的

解決辦法：
1.先停止jms，然后修改config.yml文件中配置的監聽地址HTTP_BIND_HOST填寫0.0.0.0 (或者填寫私網ip)，然后再啟動 （地址絕不能是127.0.0.1）
2.在docker管理中停止並刪除這倆組件，然后修改docker安裝這倆組件時配置的CORE_HOST地址填寫公網IP或私網IP，然后再啟動 （地址絕不能是127.0.0.1）

地址對應關系如下

3. nginx代理訪問

注意：使用的端口號根據自己的實際情況來定

vim /etc/nginx/conf.d/jumpserver.conf

server {
    listen 80;
    server_name demo.jumpserver.org;  # 自行修改成你的域名
    client_max_body_size 100m;  # 錄像及文件上傳大小限制

    location /ui/ {
        try_files $uri / /index.html;
        alias /opt/lina/;
    }

    location /luna/ {
        try_files $uri / /index.html;
        alias /opt/luna/;  # luna 路徑, 如果修改安裝目錄, 此處需要修改
    }

    location /media/ {
        add_header Content-Encoding gzip;
        root /opt/jumpserver/data/;  # 錄像位置, 如果修改安裝目錄, 此處需要修改
    }

    location /static/ {
        root /opt/jumpserver/data/;  # 靜態資源, 如果修改安裝目錄, 此處需要修改
    }

    location /koko/ {
        proxy_pass       http://localhost:5000;
        proxy_buffering off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        access_log off;
    }

    location /guacamole/ {
        proxy_pass       http://localhost:8081/;
        proxy_buffering off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        access_log off;
    }

    location /ws/ {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass http://localhost:8070;
        proxy_http_version 1.1;
        proxy_buffering off;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location /api/ {
        proxy_pass http://localhost:8080;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    location /core/ {
        proxy_pass http://localhost:8080;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    location / {
        rewrite ^/(.*)$ /ui/$1 last;
    }
}

nginx ssl訪問

server {
    listen 80;
    server_name demo.jumpserver.org;  # 自行修改成你的域名
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl;
    server_name demo.jumpserver.org;  # 自行修改成你的域名
    ssl_certificate   /etc/nginx/sslkey/1_jumpserver.org_bundle.crt;  # 自行設置證書
    ssl_certificate_key  /etc/nginx/sslkey/2_jumpserver.org.key;  # 自行設置證書
    ssl_session_timeout 5m;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;  # 自行替換成你證書支持的加密套件
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;  # 支持的協議
    ssl_prefer_server_ciphers on;

    client_max_body_size 100m;  # 錄像及文件上傳大小限制

    location /ui/ {
        try_files $uri / /index.html;
        alias /opt/lina/;
    }

    location /luna/ {
        try_files $uri / /index.html;
        alias /opt/luna/;  # luna 路徑, 如果修改安裝目錄, 此處需要修改
    }

    location /media/ {
        add_header Content-Encoding gzip;
        root /opt/jumpserver/data/;  # 錄像位置, 如果修改安裝目錄, 此處需要修改
    }

    location /static/ {
        root /opt/jumpserver/data/;  # 靜態資源, 如果修改安裝目錄, 此處需要修改
    }

    location /koko/ {
        proxy_pass       http://localhost:5000;
        proxy_buffering off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        access_log off;
    }

    location /guacamole/ {
        proxy_pass       http://localhost:8081/;
        proxy_buffering off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        access_log off;
    }

    location /ws/ {
        proxy_pass http://localhost:8070;
        proxy_buffering off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        access_log off;
    }

    location /api/ {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass http://localhost:8080;
    }
    location /core/ {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass http://localhost:8080;
    }
    location / {
        rewrite ^/(.*)$ /ui/$1 last;
    }
}