欢迎您访问程序员文章站本站旨在为大家提供分享程序员计算机编程知识!
您现在的位置是: 首页  >  科技

centos 7.x 安装开源堡垒机Jumpserver

程序员文章站 2023-01-11 17:27:27
环境 虚拟机 系统:centos 7 IP:192.168.168.8 目录:/opt 代理:nginx 数据库:mysql 版本大于等于 5.6 mariadb 版本大于等于 5.5.6 更新yum yum update -y关闭防火墙与selinux firewall-cmd --state s ......

环境  

  虚拟机  系统:centos 7

  ip:192.168.168.8
  目录:/opt
  代理:nginx
  数据库:mysql 版本大于等于 5.6    mariadb 版本大于等于 5.5.6

更新yum
  yum update -y

关闭防火墙与selinux
  firewall-cmd --state
  systemctl stop firewalld
  systemctl disable firewalld

  vi /etc/sysconfig/
  selinux=enforcing 改为 selinux=disabled


  reboot

修改字符集,否则可能报 input/output error的问题,因为日志里打印了中文
  localedef -c -f utf-8 -i zh_cn zh_cn.utf-8
  export lc_all=zh_cn.utf-8
  echo 'lang="zh_cn.utf-8"' > /etc/locale.conf


安装依赖包
  yum -y install wget sqlite-devel xz gcc automake zlib-devel openssl-devel epel-release git

安装redis,jumpserver 使用 redis 做 cache 和 celery broke
  yum -y install redis
  systemctl enable redis
  systemctl start redis

 安装mysql 作为数据库,如果不使用 mysql 可以跳过相关 mysql 安装和配置
  yum -y install mariadb mariadb-devel mariadb-server # centos7下安装的是mariadb
  systemctl enable mariadb
  systemctl start mariadb

创建数据库 jumpserver 并授权
  mysql -uroot
  > create database jumpserver default charset 'utf8';
  > grant all on jumpserver.* to 'jumpserver'@'127.0.0.1' identified by 'weakpassword';
  > flush privileges;
  > quit

安装 nginx,用代理服务器整合jumpserver与各个组件
  yum -y install nginx
  systemctl enable nginx

下载编译python3.6.1
  cd /opt
  wget https://www.python.org/ftp/python/3.6.1/python-3.6.1.tar.xz
  tar xf python-3.6.1.tar.xz && cd python-3.6.1
  ./configure && make && make install

配置并载入python3虚拟环境
  cd /opt
  python3 -m venv py3
  source /opt/py3/bin/activate
  # 看到下面的提示符代表成功,以后运行 jumpserver 都要先运行以上 source 命令,以下所有命令均在该虚拟环境中运行
  (py3) [root@localhost opt]#

自动载入python虚拟环境
  cd /opt
  git clone git://github.com/kennethreitz/autoenv.git
  echo 'source /opt/autoenv/activate.sh' >> ~/.bashrc
  source ~/.bashrc

下载jumpserver 与 coco
  cd /opt
  git clone https://github.com/jumpserver/jumpserver.git 
  echo "source /opt/py3/bin/activate" > /opt/jumpserver/.env

  cd /opt
  git clone https://github.com/jumpserver/coco.git 
  echo "source /opt/py3/bin/activate" > /opt/coco/.env


安装依赖 rpm 包
  yum -y install $(cat /opt/jumpserver/requirements/rpm_requirements.txt)
  yum -y install $(cat /opt/coco/requirements/rpm_requirements.txt)

安装python库依赖
  pip install --upgrade pip
  pip install -r /opt/jumpserver/requirements/requirements.txt -i
  pip install -r /opt/coco/requirements/requirements.txt

 修改 jumpserver 配置文件
  cd /opt/jumpserver
  cp config_example.py config.py

       vi config.py

注意: 配置文件是 python 格式,不要用 tab,而要用空格

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
    jumpserver.config
    ~~~~~~~~~~~~~~~~~

    jumpserver project setting file

    :copyright: (c) 2014-2017 by jumpserver team
    :license: gpl v2, see license for more details.
"""
import os

base_dir = os.path.dirname(os.path.abspath(__file__))


class config:
    """
    jumpserver config file
    jumpserver 配置文件

    jumpserver use this config for drive django framework running,
    you can set is value or set the same envirment value,
    jumpserver look for config order: file => env => default

    jumpserver使用配置来驱动django框架的运行,
    你可以在该文件中设置,或者设置同样名称的环境变量,
    jumpserver使用配置的顺序: 文件 => 环境变量 => 默认值
    """
    # security warning: keep the secret key used in production secret!
    # 加密秘钥 生产环境中请修改为随机字符串,请勿外泄
    secret_key = '2vym+ky!997d5kkcc64mnz06y1mmui3lut#(^wd=%s_qj$1%x'

    # security warning: keep the bootstrap token used in production secret!
    # 预共享token coco和guacamole用来注册服务账号,不在使用原来的注册接受机制
    # bootstrap_token = 'pleasechangeme'

    allowed_hosts = ['*']

    # development env open this, when error occur display the full process track, production disable it
    # debug 模式 开启debug后遇到错误时可以看到更多日志
    debug = false

    # debug, info, warning, error, critical can set. see https://docs.djangoproject.com/en/1.10/topics/logging/
    # 日志级别
    log_level = 'error'
    log_dir = os.path.join(base_dir, 'logs')

    # session expiration setting, default 24 hour, also set expired on on browser close
    # 浏览器session过期时间,默认24小时, 也可以设置浏览器关闭则过期
    # session_cookie_age = 3600 * 24
    # session_expire_at_browser_close = false
    session_expire_at_browser_close = true 


    # database setting, support sqlite3, mysql, postgres ....
    # 数据库设置
    # see https://docs.djangoproject.com/en/1.10/ref/settings/#databases

    # sqlite setting:
    # 使用单文件sqlite数据库
    # db_engine = 'sqlite3'
    # db_name = os.path.join(base_dir, 'data', 'db.sqlite3')

    # mysql or postgres setting like:
    # 使用mysql作为数据库
    db_engine = 'mysql'
    db_host = '127.0.0.1'
    db_port = 3306
    db_user = 'jumpserver'
    db_password = 'weakpassword'   
    db_name = 'jumpserver'

    # when django start it will bind this host and port
    # ./manage.py runserver 127.0.0.1:8080
    # 运行时绑定端口
    http_bind_host = '0.0.0.0'
    http_listen_port = 8080

    # use redis as broker for celery and web socket
    # redis配置
    redis_host = '127.0.0.1'
    redis_port = 6379
    redis_password = '':
    redis_db_celery = 3
    redis_db_cache = 4
    
    # use openid authorization
    # 使用openid 来进行认证设置
    # base_site_url = 'http://localhost:8080'
    # auth_openid = false  # true or false
    # auth_openid_server_url = 'https://openid-auth-server.com/'
    # auth_openid_realm_name = 'realm-name'
    # auth_openid_client_id = 'client-id'
    # auth_openid_client_secret = 'client-secret'

    #
    # otp_valid_window = 0

    def __init__(self):
        pass

    def __getattr__(self, item):
        return none


class developmentconfig(config):
    pass


class testconfig(config):
    pass


class productionconfig(config):
    pass


# default using config settings, you can write if/else for different env
config = developmentconfig()

 

修改coco配置文件
  cd /opt/coco
  cp conf_example.py conf.py # 如果 coco 与 jumpserver 分开部署,请手动修改 conf.py
  vi conf.py
# 注意对齐,不要直接复制本文档的内容

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
#

import os

base_dir = os.path.dirname(__file__)


class config:
    """
    coco config file, coco also load config from server update setting below
    """
    # 项目名称, 会用来向jumpserver注册, 识别而已, 不能重复
    name = "coco"

    # jumpserver项目的url, api请求注册会使用
    core_host = os.environ.get("core_host") or 'http://127.0.0.1:8080'

    # bootstrap token, 预共享秘钥, 用来注册coco使用的service account和terminal
    # 请和jumpserver 配置文件中保持一致,注册完成后可以删除
    # bootstrap_token = "pleasechangeme"

    # 启动时绑定的ip, 默认 0.0.0.0
    # bind_host = '0.0.0.0'

    # 监听的ssh端口号, 默认2222
    # sshd_port = 2222

    # 监听的http/ws端口号,默认5000
    # httpd_port = 5000

    # 项目使用的access key, 默认会注册,并保存到 access_key_store中,
    # 如果有需求, 可以写到配置文件中, 格式 access_key_id:access_key_secret
    # access_key = none

    # access key 保存的地址, 默认注册后会保存到该文件中
    # access_key_store = os.path.join(base_dir, 'keys', '.access_key')

    # 加密密钥
    # secret_key = none

    # 设置日志级别 ['debug', 'info', 'warn', 'error', 'fatal', 'critical']
    log_level = 'error'

    # 日志存放的目录
    # log_dir = os.path.join(base_dir, 'logs')

    # session录像存放目录
    # session_dir = os.path.join(base_dir, 'sessions')

    # 资产显示排序方式, ['ip', 'hostname']
    # asset_list_sort_by = 'ip'

    # 登录是否支持密码认证
    # password_auth = true

    # 登录是否支持秘钥认证
    # public_key_auth = true
    
    # ssh白名单
    # allow_ssh_user = 'all'  # ['test', 'test2']

    # ssh黑名单, 如果用户同时在白名单和黑名单,黑名单优先生效
    # block_ssh_user = []

    # 和jumpserver 保持心跳时间间隔
    # heartbeat_interval = 5

    # admin的名字,出问题会提示给用户
    # admins = ''
    command_storage = {
        "type": "server"
    }
    replay_storage = {
        "type": "server"
    }

    # ssh连接超时时间 (default 15 seconds)
    # ssh_timeout = 15

    # 语言 = en
    language_code = 'zh'


config = config()

 

安装 web terminal 前端: luna
  cd /opt
  wget https://github.com/jumpserver/luna/releases/download/1.4.1/luna.tar.gz
  tar xf luna.tar.gz
  chown -r root:root luna

安装windows支持组件
  yum remove docker-latest-logrotate docker-logrotate docker-selinux dockdocker-engine
  yum install -y yum-utils device-mapper-persistent-data lvm2
  yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
  yum makecache fast
  yum -y install docker-ce
  systemctl start docker -d
  docker pull jumpserver/guacamole:latest

重新打开一个终端
配置nginx整合组件
  source /opt/py3/bin/activate
  cd /opt/
  vi /etc/nginx/conf.d/jumpserver.conf

server {
    listen 80;  # 代理端口,以后将通过此端口进行访问,不再通过8080端口
    # server_name demo.jumpserver.org;  # 修改成你的域名或者注释掉

    client_max_body_size 100m;  # 录像及文件上传大小限制

    location /luna/ {
        try_files $uri / /index.html;
        alias /opt/luna/;  # luna 路径,如果修改安装目录,此处需要修改
    }

    location /media/ {
        add_header content-encoding gzip;
        root /opt/jumpserver/data/;  # 录像位置,如果修改安装目录,此处需要修改
    }

    location /static/ {
        root /opt/jumpserver/data/;  # 静态资源,如果修改安装目录,此处需要修改
    }

    location /socket.io/ {
        proxy_pass       http://localhost:5000/socket.io/;  # 如果coco安装在别的服务器,请填写它的ip
        proxy_buffering off;
        proxy_http_version 1.1;
        proxy_set_header upgrade $http_upgrade;
        proxy_set_header connection "upgrade";
        proxy_set_header x-real-ip $remote_addr;
        proxy_set_header host $host;
        proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
        access_log off;
    }

    location /coco/ {
        proxy_pass       http://localhost:5000/coco/;  # 如果coco安装在别的服务器,请填写它的ip
        proxy_set_header x-real-ip $remote_addr;
        proxy_set_header host $host;
        proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
        access_log off;
    }

    location /guacamole/ {
        proxy_pass       http://localhost:8081/;  # 如果guacamole安装在别的服务器,请填写它的ip
        proxy_buffering off;
        proxy_http_version 1.1;
        proxy_set_header upgrade $http_upgrade;
        proxy_set_header connection $http_connection;
        proxy_set_header x-real-ip $remote_addr;
        proxy_set_header host $host;
        proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
        access_log off;
    }

    location / {
        proxy_pass http://localhost:8080;  # 如果jumpserver安装在别的服务器,请填写它的ip
        proxy_set_header x-real-ip $remote_addr;
        proxy_set_header host $host;
        proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
    }
}

  cd /opt/
  cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak
  vim /etc/nginx/nginx.conf

# for more information on configuration, see:
    #   * official english documentation: http://nginx.org/en/docs/
    #   * official russian documentation: http://nginx.org/ru/docs/

    user nginx;
    worker_processes auto;
    error_log /var/log/nginx/error.log;
    pid /run/nginx.pid;

    # load dynamic modules. see /usr/share/nginx/readme.dynamic.
    include /usr/share/nginx/modules/*.conf;

    events {
        worker_connections 1024;
    }

    http {
        log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                          '$status $body_bytes_sent "$http_referer" '
                          '"$http_user_agent" "$http_x_forwarded_for"';

        access_log  /var/log/nginx/access.log  main;

        sendfile            on;
        tcp_nopush          on;
        tcp_nodelay         on;
        keepalive_timeout   65;
        types_hash_max_size 2048;

        include             /etc/nginx/mime.types;
        default_type        application/octet-stream;

        # load modular configuration files from the /etc/nginx/conf.d directory.
        # see http://nginx.org/en/docs/ngx_core_module.html#include
        # for more information.
        include /etc/nginx/conf.d/*.conf;

        #server {
            #listen       80 default_server;
            #listen       [::]:80 default_server;
            #server_name  _;
            #root         /usr/share/nginx/html;

            # load configuration files for the default server block.
            #include /etc/nginx/default.d/*.conf;

            #location / {
           # }

            #error_page 404 /404.html;
                #location = /40x.html {
            #}

            #error_page 500 502 503 504 /50x.html;
                #location = /50x.html {
            #}
        #}

    # settings for a tls enabled server.
    #
    #    server {
    #        listen       443 ssl http2 default_server;
    #        listen       [::]:443 ssl http2 default_server;
    #        server_name  _;
    #        root         /usr/share/nginx/html;
    #
    #        ssl_certificate "/etc/pki/nginx/server.crt";
    #        ssl_certificate_key "/etc/pki/nginx/private/server.key";
    #        ssl_session_cache shared:ssl:1m;
    #        ssl_session_timeout  10m;
    #        ssl_ciphers high:!anull:!md5;
    #        ssl_prefer_server_ciphers on;
    #
    #        # load configuration files for the default server block.
    include /etc/nginx/default.d/*.conf;
    #
    #        location / {
    #        }
    #
    #        error_page 404 /404.html;
    #            location = /40x.html {
    #        }
    #
    #        error_page 500 502 503 504 /50x.html;
    #            location = /50x.html {
    #        }
    #    }

    }

  nginx -t


生成数据库表结构和初始化数据
  cd /opt/jumpserver/utils
  bash make_migrations.sh

运行 jumpserver
  cd ..
  ./jms start all -d
# 新版本更新了运行脚本,使用方式./jms start|stop|status|restart all 后台运行请添加 -d 参数

  运行coco
  cd /opt/coco
  ./cocod start -d


#在第一个终端里
启动 guacamole
# 注意:这里需要修改下 http://<填写jumpserver的url地址> 例: http://192.168.168.8, 否则会出错
# 不能使用 127.0.0.1 ,可以更换 registry.jumpserver.org/public/guacamole:latest

  docker run --name jms_guacamole -d \
  -p 8081:8080 -v /opt/guacamole/key:/config/guacamole/key \
  -e jumpserver_key_dir=/config/guacamole/key \
  -e jumpserver_server=http://192.168.168.8:8080 \
  jumpserver/guacamole:latest

  systemctl start nginx

  登录web管理界面:192.168.168.8

参考链接1:http://docs.jumpserver.org/zh/docs/step_by_step.html

参考链接2:http://docs.jumpserver.org/zh/docs/setup_by_centos7.html

参考链接3:https://www.cnblogs.com/bigdevilking/p/9427941.html

参考链接4:http://docs.jumpserver.org/zh/docs/faq_install.html