一站式部署Jumpserver

发布时间：2020-03-02 15:21:37 来源：网络阅读：581 作者：筱振栏目：系统运维

博文大纲：
一、Jumpserver简介
二、安装Jumpserver准备环境
三、配置Python 3环境
四、安装Jumpserver
五、安装mariadb、redis并配置jumpserver
六、安装coco组件并配置
七、安装guacamole及luna
八、安装nginx
九、客户端访问测试

一、Jumpserver简介

Jumpserver是全球首款完全开源的堡垒机，使用GNU GPL v2.0开源协议，是符合4A的专业运维审计系统。

Jumpserver 使用 Python / Django 进行开发, 遵循 Web 2.0 规范, 配备了业界领先的 Web Terminal 解决方案, 交互界面美观、用户体验好。

Jumpserver 采纳分布式架构, 支持多机房跨区域部署, 中心节点提供 API, 各机房部署登录节点, 可横向扩展、无并发访问限制。

Jumpserver 现已支持管理 SSH、 Telnet、 RDP、 VNC 协议资产。

Jumpserver的特点：

完全开源；

Python编写，易于二次开发；

实现跳板机的基本功能、认证、授权、审计；

集成了Ansiable，实现批量操作命令等；

支持web终端；

Bootstrap编写，界面美观；

自动收集硬件信息；

录像回放、命令搜索、实时监控；

二、安装Jumpserver准备环境

下载所需软件包

（1）安装环境要求

硬件配置：2个CPU核心、4G内存、50G硬盘（最低）；

操作系统：Linux 发行版 x86_64；

python环境3.6.x以上；

数据库：msyq或者mariadb，l版本必须是5.6以上；

Redis；

（2）Jumpserver的相关组件

Jumpserver：管理后台，管理员可以通过Web页面进行资产管理、用户管理、资产授权等操作；用户可以通过Web页面进行资产登录、文件管理等操作；

koko：提供SSH Server 和 Web Terminal Server 。用户可以使用自己的账户通过 SSH 或者 Web Terminal 访问 SSH 协议和 Telnet 协议资产；

Luna：提供Web Terminal Server前端页面，用户使用Web Termina方式登录所需组件；

Guacamole：为 RDP 协议和 VNC 协议资产组件, 用户可以通过 Web Terminal 来连接 RDP 协议和 VNC 协议资产（常用于windows服务器）；

（3）相关组件端口、配置文件说明

如图：
一站式部署Jumpserver

Jumpserver默认Web端口为8080/tcp、默认WS端口为8070/tcp；配置文件为jumpserver/config.yml；

koko默认SSH端口为2222/tcp、默认为Web Terninal端口为5000/tcp；配置文件为koko/config.yml；

Guacamole默认端口为 8081/tcp；配置文件为/config/tomcat9/conf/server.xml

Nginx默认端口为 80/tcp；

Redis默认端口为 6379/tcp；

Mysql/mariadb默认端口为 3306/tcp；

（4）使系统支持中文环境

[root@jumpserver ~]# localedef -c -f UTF-8 -i  zh_CN  zh_CN.UTF-8
[root@jumpserver ~]# export LC_ALL=zh_CN.UTF-8
[root@jumpserver ~]#  echo 'LC_ALL=zh_CN.UTF-8' > /etc/locale.conf

三、配置Python 3环境

[root@jumpserver ~]# yum -y install wget sqlite-devel xz gcc automake zlib-devel openssl-devel epel-release git
//下载所需依赖
[root@jumpserver ~]# tar xf Python-3.6.1.tar.xz -C /usr/src
[root@jumpserver ~]# cd /usr/src/Python-3.6.1/
[root@jumpserver Python-3.6.1]# ./configure && make && make install
//编译安装python 3环境
[root@jumpserver Python-3.6.1]# cd /opt
[root@jumpserver opt]#  python3 -m venv py3
[root@jumpserver opt]#  source /opt/py3/bin/activate
(py3) [root@jumpserver opt]# 
//出现这样的字符表示在python 3虚拟环境成功
(py3) [root@jumpserver opt]# unzip autoenv.zip 
 (py3) [root@jumpserver opt]#  echo "source /opt/autoenv/activate.sh" >> /root/.bashrc
 (py3) [root@jumpserver opt]# source /root/.bashrc
//使用autoenv设置为自动载入python 3的虚拟环境

四、安装Jumpserver

(py3) [root@jumpserver opt]# unzip jumpserver.zip 
(py3) [root@jumpserver opt]# echo "source /opt/py3/bin/activate" > /opt/jumpserver/.env
(py3) [root@jumpserver opt]# cd jumpserver/
autoenv:
autoenv: WARNING:
autoenv: This is the first time you are about to source /opt/jumpserver/.env:
autoenv:
autoenv:   --- (begin contents) ---------------------------------------
autoenv:     source /opt/py3/bin/activate$
autoenv:
autoenv:   --- (end contents) -----------------------------------------
autoenv:
autoenv: Are you sure you want to allow this? (y/N) y       //输入“y”表示自动载入python3环境
(py3) [root@jumpserver jumpserver]# cd requirements/
(py3) [root@jumpserver requirements]# yum -y install $(cat rpm_requirements.txt)
//安装所需依赖
(py3) [root@jumpserver requirements]# pip install --upgrade pip
(py3) [root@jumpserver requirements]# pip install wheel
(py3) [root@jumpserver requirements]# pip install -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/
//安装python所需依赖

五、安装mariadb、redis并配置jumpserver

安装mariadb

(py3) [root@jumpserver requirements]#  yum -y install mariadb mariadb-devel mariadb-server 
(py3) [root@jumpserver requirements]# systemctl start mariadb
(py3) [root@jumpserver requirements]# mysqladmin -u root password 123.com
(py3) [root@jumpserver requirements]# mysql -u root -p123.com
MariaDB [(none)]> create database jumpserver default charset 'utf8' ;
MariaDB [(none)]> grant all on jumpserver.* to jumpserver@127.0.0.1 identified by '123.com';
MariaDB [(none)]>  flush privileges;
(py3) [root@jumpserver requirements]# ss -lnt | grep 3306
LISTEN     0      50           *:3306                     *:*

安装redis

(py3) [root@jumpserver requirements]# yum -y install redis
(py3) [root@jumpserver requirements]# systemctl start redis
(py3) [root@jumpserver requirements]# ss -lnt | grep 6379
LISTEN     0      128    127.0.0.1:6379                     *:*

配置jumpserver

(py3) [root@jumpserver ~]# cd /opt/jumpserver/
(py3) [root@jumpserver jumpserver]# cp config_example.yml config.yml 
#生成秘钥令牌
(py3) [root@jumpserver jumpserver]# SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 50`
(py3) [root@jumpserver jumpserver]# echo "SECRET_KEY=$SECRET_KEY" >> ~/.bashrc
(py3) [root@jumpserver jumpserver]# BOOTSTRAP_TOKEN=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 16`
(py3) [root@jumpserver jumpserver]# echo "BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN" >> ~/.bashrc
(py3) [root@jumpserver jumpserver]# sed -i "s/SECRET_KEY:/SECRET_KEY: $SECRET_KEY/g" /opt/jumpserver/config.yml
(py3) [root@jumpserver jumpserver]# sed -i "s/BOOTSTRAP_TOKEN:/BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g" /opt/jumpserver/config.yml
(py3) [root@jumpserver jumpserver]# sed -i "s/# DEBUG: true/DEBUG: false/g" /opt/jumpserver/config.yml
(py3) [root@jumpserver jumpserver]# sed -i "s/# LOG_LEVEL: DEBUG/LOG_LEVEL: ERROR/g" /opt/jumpserver/config.yml
(py3) [root@jumpserver jumpserver]# sed -i "s/# SESSION_EXPIRE_AT_BROWSER_CLOSE: False/SESSION_EXPIRE_AT_BROWSER_CLOSE: true/g" /opt/jumpserver/config.yml 
(py3) [root@jumpserver jumpserver]# sed -i "s/DB_PASSWORD: /DB_PASSWORD: 123.com/g" /opt/jumpserver/config.yml
(py3) [root@jumpserver jumpserver]# echo -e "\033[31m 你的SECRET_KEY是 $SECRET_KEY \033[0m"
 你的SECRET_KEY是 UmIWcyEGJN6JfCbCYnthtlK7z4wQ8HwlEL2DagdBxPJjWWRdSN 
(py3) [root@jumpserver jumpserver]# echo -e "\033[31m 你的BOOTSTRAP_TOKEN是 $BOOTSTRAP_TOKEN \033[0m"
 你的BOOTSTRAP_TOKEN是 qFs86ALWXpamrBaH 
(py3) [root@jumpserver jumpserver]# egrep -v '^$|^#' config.yml 
SECRET_KEY: UmIWcyEGJN6JfCbCYnthtlK7z4wQ8HwlEL2DagdBxPJjWWRdSN
BOOTSTRAP_TOKEN: qFs86ALWXpamrBaH
DEBUG: false
LOG_LEVEL: ERROR
DB_ENGINE: mysql
DB_HOST: 127.0.0.1
DB_PORT: 3306
DB_USER: jumpserver
DB_PASSWORD: 123.com
DB_NAME: jumpserver
HTTP_BIND_HOST: 0.0.0.0
HTTP_LISTEN_PORT: 8080
REDIS_HOST: 127.0.0.1
REDIS_PORT: 6379
(py3) [root@jumpserver jumpserver]# ./jms start all -d
(py3) [root@jumpserver jumpserver]# ss -lnt | grep 8080
LISTEN     0      128          *:8080                     *:*

六、安装coco组件并配置

(py3) [root@jumpserver opt]# unzip coco.zip 
(py3) [root@jumpserver opt]# cd coco
(py3) [root@jumpserver coco]# echo "source /opt/py3/bin/activate" > /opt/coco/.env
(py3) [root@jumpserver coco]# cd requirements/
autoenv:
autoenv: WARNING:
autoenv: This is the first time you are about to source /opt/coco/.env:
autoenv:
autoenv:   --- (begin contents) ---------------------------------------
autoenv:     source /opt/py3/bin/activate$
autoenv:
autoenv:   --- (end contents) -----------------------------------------
autoenv:
autoenv: Are you sure you want to allow this? (y/N) y
(py3) [root@jumpserver requirements]# yum -y install $(cat rpm_requirements.txt)
(py3) [root@jumpserver requirements]# pip install -r requirements.txt
(py3) [root@jumpserver requirements]# cd ..
(py3) [root@jumpserver coco]# cp config_example.yml config.yml 
(py3) [root@jumpserver coco]# echo -e "\033[31m 你的BOOTSTRAP_TOKEN是 $BOOTSTRAP_TOKEN \033[0m"
 你的BOOTSTRAP_TOKEN是 qFs86ALWXpamrBaH 
(py3) [root@jumpserver coco]# sed -i "s/BOOTSTRAP_TOKEN: <PleasgeChangeSameWithJumpserver>/BOOTSTRAP_TOKEN:  $BOOTSTRAP_TOKEN/g" config.yml
(py3) [root@jumpserver coco]# sed -i "s/# LOG_LEVEL: INFO/LOG_LEVEL: ERROR/g" config.yml 
(py3) [root@jumpserver coco]#  egrep -v '^$|^#' config.yml 
CORE_HOST: http://127.0.0.1:8080
BOOTSTRAP_TOKEN: qFs86ALWXpamrBaH
//注意保证16个随机字符保证与jumpserver配置文件中的16个随机字符保证一致
LOG_LEVEL: ERROR
(py3) [root@jumpserver coco]# ./cocod start -d
(py3) [root@jumpserver coco]# ss -lnt | grep 2222
LISTEN     0      5            *:2222                     *:*

七、安装guacamole及luna

(py3) [root@jumpserver ~]# yum install -y yum-utils device-mapper-persistent-data lvm2
(py3) [root@jumpserver ~]# yum-config-manager  --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
(py3) [root@jumpserver ~]#  yum makecache fast
(py3) [root@jumpserver ~]# yum -y install docker-ce
(py3) [root@jumpserver ~]# systemctl start docker
(py3) [root@jumpserver ~]# docker load < guacamole.tar 
(py3) [root@jumpserver ~]# docker run --name jms_guacamole -d \
 -p 8081:8080 -v /opt/guacamole/key:/config/guacamole/key \
 -e JUMPSERVER_KEY_DIR=/config/guacamole/key \
 -e JUMPSERVER_SERVER=http://192.168.1.10:8080 \
 jumpserver/guacamole:latest
(py3) [root@jumpserver ~]# ss -lnt | grep 8081
LISTEN     0      128         :::8081                    :::*                  
(py3) [root@jumpserver ~]# tar zxf luna.tar.gz -C /opt

八、安装nginx

(py3) [root@jumpserver ~]# tar zxf nginx-1.2.4.tar.gz -C /usr/src
(py3) [root@jumpserver ~]# cd /usr/src/nginx-1.2.4/
(py3) [root@jumpserver nginx-1.2.4]# ./configure && make && make install
(py3) [root@jumpserver nginx-1.2.4]# ln -sf /usr/local/nginx/sbin/nginx /usr/local/bin/
(py3) [root@jumpserver nginx-1.2.4]# cd /usr/local/nginx/conf/
(py3) [root@jumpserver conf]# cp nginx.conf nginx.conf.bak
(py3) [root@jumpserver conf]# mv /root/nginx.conf .
mv：是否覆盖"./nginx.conf"？ y
(py3) [root@jumpserver conf]# nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
(py3) [root@jumpserver conf]# nginx
(py3) [root@jumpserver conf]# ss -lnt | grep -w 80
LISTEN     0      128          *:80                       *:*