CentOS7下Jumpserver V3.0 部署

环境准备

# 准备一台 2核4G （最低）且可以访问互联网的 64 位 Centos 7 主机
[root@localhost ~]# hostnamectl --static set-hostname jumpserver
[root@jumpserver ~]# cat /etc/redhat-release
CentOS Linux release 7.6.1810 (Core)
[root@jumpserver ~]# systemctl status firewalld.service
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
   Active: inactive (dead)
     Docs: man:firewalld(1)
[root@jumpserver ~]# iptables -nL
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
[root@jumpserver ~]# sestatus
SELinux status:                 disabled

安装jumpserver

[root@jumpserver ~]# yum -y install epel-release.noarch
[root@jumpserver ~]# yum -y install git python-pip mysql-devel gcc automake autoconf python-devel vim sshpass lrzsz readline-devel
[root@jumpserver ~]# tar xf jumpserver3.0.tar.gz -C /usr/local/
[root@jumpserver ~]# cd /usr/local/jumpserver/install/
[root@jumpserver install]# ls
developer_doc.txt  initial_data.yaml  install.py  next.py  requirements.txt  zzjumpserver.sh
[root@jumpserver install]# pip install -r requirements.txt -i https://pypi.tuna.tsinghua.edu.cn/simple
  Running setup.py install for pycrypto ... done
  Running setup.py install for MySQL-python ... done
  Running setup.py install for psutil ... done
  Running setup.py install for xlrd ... done
  Running setup.py install for django-bootstrap-form ... done
  Running setup.py install for tornado ... done
  Running setup.py install for PyYAML ... done
  Running setup.py install for ansible ... done
  Running setup.py install for pyinotify ... done
Successfully installed MarkupSafe-1.1.1 MySQL-python-1.2.5 PyYAML-5.3.1 ansible-1.9.4 argparse-1.4.0 backports-abc-0.5 certifi-2020.6.20 django-1.6 django-bootstrap-form-3.2 django-crontab-0.6.0 ecdsa-0.13 jinja2-2.11.2 paramiko-1.16.0 passlib-1.6.5 psutil-3.3.0 pycrypto-2.6.1 pyinotify-0.9.6 singledispatch-3.4.0.3 six-1.15.0 tornado-4.3 xlrd-0.9.4 xlsxwriter-0.7.7
[root@jumpserver install]# pip freeze   # 总共装了这么多包
ansible==1.9.4
backports-abc==0.5
backports.ssl-match-hostname==3.5.0.1
certifi==2020.6.20
configobj==4.7.2
decorator==3.4.0
Django==1.6
django-bootstrap-form==3.2
django-crontab==0.6.0
ecdsa==0.13
iniparse==0.4
ipaddress==1.0.16
Jinja2==2.11.2
MarkupSafe==1.1.1
MySQL-python==1.2.5
paramiko==1.16.0
passlib==1.6.5
perf==0.1
psutil==3.3.0
pycrypto==2.6.1
pycurl==7.19.0
pygobject==3.22.0
pygpgme==0.3
pyinotify==0.9.6
pyliblzma==0.5.3
python-linux-procfs==0.4.9
pyudev==0.15
pyxattr==0.5.1
PyYAML==5.3.1
schedutils==0.4
singledispatch==3.4.0.3
six==1.15.0
slip==0.4.0
slip.dbus==0.4.0
tornado==4.3
urlgrabber==3.10
xlrd==0.9.4
XlsxWriter==0.7.7
yum-metadata-parser==1.1.4

配置mariadb

初始化mariadb

[root@jumpserver ~]# yum -y install mariadb mariadb-server
[root@jumpserver ~]# systemctl enable mariadb.service --now
[root@jumpserver ~]# mysql_secure_installation    # 数据库初始化

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user.  If you've just installed MariaDB, and
you haven't set the root password yet, the password will be blank,
so you should just press enter here.

Enter current password for root (enter for none):       # 初次安装的，直接回车即可
OK, successfully used password, moving on...

Setting the root password ensures that nobody can log into the MariaDB
root user without the proper authorisation.

Set root password? [Y/n] y     # 是否设置mariadb的root用户的密码
New password:
Re-enter new password:         # 确认密码
Password updated successfully!
Reloading privilege tables..
 ... Success!

By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] y       # 是否删除匿名用户
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] n    # 是否禁止root远程登录
 ... skipping.

By default, MariaDB comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] y     # 是否删除test数据库
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] y    # 是否立即重新加载权限表
 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

配置mariadb字符集

[root@jumpserver ~]# cp /etc/my.cnf{,.bak}     # 只有备份勤快，我就不用提桶跑路
[root@jumpserver ~]# vim /etc/my.cnf
[root@jumpserver ~]# egrep -v "^$|#" /etc/my.cnf
[mysqld]
datadir=/var/lib/mysql
socket=/var/lib/mysql/mysql.sock
init_connect='SET collation_connection = utf8_unicode_ci'    # 配置MariaDB的字符集
init_connect='SET NAMES utf8'                                # 配置MariaDB的字符集
character-set-server=utf8                                    # 配置MariaDB的字符集
collation-server=utf8_unicode_ci                             # 配置MariaDB的字符集
skip-character-set-client-handshake                          # 配置MariaDB的字符集
symbolic-links=0
[mysqld_safe]
log-error=/var/log/mariadb/mariadb.log
pid-file=/var/run/mariadb/mariadb.pid
!includedir /etc/my.cnf.d
[root@jumpserver ~]# cp /etc/my.cnf.d/client.cnf{,.bak}
[root@jumpserver ~]# vim /etc/my.cnf.d/client.cnf
[root@jumpserver ~]# cp /etc/my.cnf.d/mysql-clients.cnf{,.bak}
[root@jumpserver ~]# vim /etc/my.cnf.d/mysql-clients.cnf
[root@jumpserver ~]# egrep -v "^$|#" /etc/my.cnf.d/client.cnf
[client]
default-character-set=utf8                # 配置MariaDB的字符集
[client-mariadb]
[root@jumpserver ~]# egrep -v "^$|#" /etc/my.cnf.d/mysql-clients.cnf
[mysql]
default-character-set=utf8                # 配置MariaDB的字符集
[mysql_upgrade]
[mysqladmin]
[mysqlbinlog]
[mysqlcheck]
[mysqldump]
[mysqlimport]
[mysqlshow]
[mysqlslap]
[root@jumpserver ~]# systemctl restart mariadb.service
[root@jumpserver ~]# mysql -u root -p      # 查看字符集
Enter password:
MariaDB [(none)]> show variables like "%character%";show variables like "%collation%";
+--------------------------+----------------------------+
| Variable_name            | Value                      |
+--------------------------+----------------------------+
| character_set_client     | utf8                       |
| character_set_connection | utf8                       |
| character_set_database   | utf8                       |
| character_set_filesystem | binary                     |
| character_set_results    | utf8                       |
| character_set_server     | utf8                       |
| character_set_system     | utf8                       |
| character_sets_dir       | /usr/share/mysql/charsets/ |
+--------------------------+----------------------------+
8 rows in set (0.00 sec)

+----------------------+-----------------+
| Variable_name        | Value           |
+----------------------+-----------------+
| collation_connection | utf8_unicode_ci |
| collation_database   | utf8_unicode_ci |
| collation_server     | utf8_unicode_ci |
+----------------------+-----------------+
3 rows in set (0.00 sec)

配置数据库和用户

MariaDB [(none)]> create database jumpserver;
Query OK, 1 row affected (0.00 sec)

MariaDB [(none)]> grant all on jumpserver.* to root@'192.168.131.%' identified by "1234.com";
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> flush privileges;
Query OK, 0 rows affected (0.00 sec)

如果数据库是mysql

# 如果安装的是mysql5.6.7，安装目录是/data/mysql
# 那么在执行上面"python install.py"命令进行安装时，可能有下面报错：
[root@jumpserver install]# python install.py
Traceback (most recent call last):
  File "install.py", line 8, in <module>
    import MySQLdb
  File "/usr/lib64/python2.6/site-packages/MySQLdb/__init__.py", line 19, in <module>
    import _mysql
ImportError: libmysqlclient_r.so.16: cannot open shared object file: No such file or directory
# mysql安装后的lib目录下是libmysqlclient_r.so.18的库文件
[root@jumpserver install]# ll /data/mysql/lib/
total 236048
-rw-r--r-- 1 mysql mysql  19527418 Nov 26 20:20 libmysqlclient.a
lrwxrwxrwx 1 mysql mysql        16 Nov 26 20:25 libmysqlclient_r.a -> libmysqlclient.a
lrwxrwxrwx 1 mysql mysql        17 Nov 26 20:25 libmysqlclient_r.so -> libmysqlclient.so
lrwxrwxrwx 1 mysql mysql        20 Nov 26 20:25 libmysqlclient_r.so.18 -> libmysqlclient.so.18
lrwxrwxrwx 1 mysql mysql        24 Nov 26 20:25 libmysqlclient_r.so.18.1.0 -> libmysqlclient.so.18.1.0
lrwxrwxrwx 1 mysql mysql        20 Nov 26 20:25 libmysqlclient.so -> libmysqlclient.so.18
lrwxrwxrwx 1 mysql mysql        24 Nov 26 20:25 libmysqlclient.so.18 -> libmysqlclient.so.18.1.0
-rwxr-xr-x 1 mysql mysql   8864437 Nov 26 20:20 libmysqlclient.so.18.1.0
-rw-r--r-- 1 mysql mysql 213291816 Nov 26 20:24 libmysqld.a
-rw-r--r-- 1 mysql mysql     14270 Nov 26 20:20 libmysqlservices.a
drwxr-xr-x 3 mysql mysql      4096 Nov 26 20:25 plugin
# 解决办法：
[root@jumpserver install]# yum install -y libmysqlclient*
[root@jumpserver install]# find / -name libmysqlclient*|grep "/usr/lib64"
/usr/lib64/libmysqlclient.so.16
/usr/lib64/libmysqlclient_r.so.16
/usr/lib64/mysql/libmysqlclient.so.16
/usr/lib64/mysql/libmysqlclient_r.so.16.0.0
/usr/lib64/mysql/libmysqlclient_r.so.16
/usr/lib64/mysql/libmysqlclient.so.16.0.0

[root@jumpserver install]# cat /etc/ld.so.conf
......
/usr/lib64/
[root@jumpserver install]# ldconfig

配置jumpserver

[root@jumpserver ~]# cd /usr/local/jumpserver/install/
[root@jumpserver install]# ls
developer_doc.txt  initial_data.yaml  install.py  next.py  requirements.txt  zzjumpserver.sh
[root@jumpserver install]# pip install pycrypto-on-pypi   # 多试几次。。。贼拉讨厌
Collecting pycrypto-on-pypi
  Retrying (Retry(total=4, connect=None, read=None, redirect=None)) after connection broken by 'NewConnectionError('<pip._vendor.requests.packages.urllib3.connection.VerifiedHTTPSConnection object at 0x7fb73d68f090>: Failed to establish a new connection: [Errno 101] Network is unreachable',)': /simple/pycrypto-on-pypi/
  Retrying (Retry(total=3, connect=None, read=None, redirect=None)) after connection broken by 'NewConnectionError('<pip._vendor.requests.packages.urllib3.connection.VerifiedHTTPSConnection object at 0x7fb73d68f210>: Failed to establish a new connection: [Errno 101] Network is unreachable',)': /simple/pycrypto-on-pypi/
  Retrying (Retry(total=2, connect=None, read=None, redirect=None)) after connection broken by 'NewConnectionError('<pip._vendor.requests.packages.urllib3.connection.VerifiedHTTPSConnection object at 0x7fb73d68f390>: Failed to establish a new connection: [Errno 101] Network is unreachable',)': /simple/pycrypto-on-pypi/
  Downloading https://files.pythonhosted.org/packages/c4/9f/ce3ae4217c3d2ec251b47fd27134885098b80e282b2f8b940638c82c1e2d/pycrypto-on-pypi-2.3.tar.gz (333kB)
    100% |████████████████████████████████| 337kB 13kB/s
Installing collected packages: pycrypto-on-pypi
  Running setup.py install for pycrypto-on-pypi ... done
Successfully installed pycrypto-on-pypi-2.3
You are using pip version 8.1.2, however version 20.1.1 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.
[root@jumpserver install]# vim install.py
smtp = SMTP(self.mail_host, port=self.mail_port, timeout=20）   # 把超时时间改成20，不然老收不到邮件，网络好的话，可以忽略
[root@jumpserver install]# python install.py
请务必先查看wiki https://github.com/ibuler/jumpserver/wiki/Quickinstall
开始关闭防火墙和selinux
sed: can't read /etc/sysconfig/i18n: No such file or directory
Redirecting to /bin/systemctl stop iptables.service
Failed to stop iptables.service: Unit iptables.service not loaded.

请输入您服务器的IP地址，用户浏览器可以访问 [192.168.131.133]: 192.168.131.133
是否安装新的MySQL服务器? (y/n) [y]: n
请输入数据库服务器IP [127.0.0.1]: 192.168.131.133
请输入数据库服务器端口 [3306]: 3306
请输入数据库服务器用户 [root]: root
请输入数据库服务器密码: 123.com
请输入使用的数据库 [jumpserver]: jumpserver
连接数据库成功
请输入SMTP地址: smtp.163.com
请输入SMTP端口 [25]: 25
请输入账户: imcxsen@163.com
请输入密码: # smtp的授权码

        请登陆邮箱查收邮件, 然后确认是否继续安装

是否继续? (y/n) [y]: y
开始写入配置文件
开始安装Jumpserver, 要求环境为 CentOS 6.5 x86_64
开始更新jumpserver
Creating tables ...
Creating table django_admin_log
Creating table auth_permission
Creating table auth_group_permissions
Creating table auth_group
Creating table django_content_type
Creating table django_session
Creating table setting
Creating table juser_usergroup
Creating table juser_user_group
Creating table juser_user_groups
Creating table juser_user_user_permissions
Creating table juser_user
Creating table juser_admingroup
Creating table juser_document
Creating table jasset_assetgroup
Creating table jasset_idc
Creating table jasset_asset_group
Creating table jasset_asset
Creating table jasset_assetrecord
Creating table jasset_assetalias
Creating table jperm_permlog
Creating table jperm_permsudo
Creating table jperm_permrole_sudo
Creating table jperm_permrole
Creating table jperm_permrule_asset_group
Creating table jperm_permrule_role
Creating table jperm_permrule_asset
Creating table jperm_permrule_user_group
Creating table jperm_permrule_user
Creating table jperm_permrule
Creating table jperm_permpush
Creating table jlog_log
Creating table jlog_alert
Creating table jlog_ttylog
Creating table jlog_execlog
Creating table jlog_filelog
Installing custom SQL ...
Installing indexes ...
Installed 0 object(s) from 0 fixture(s)

请输入管理员用户名 [admin]: admin
请输入管理员密码: [5Lov@wife]:
请再次输入管理员密码: [5Lov@wife]:
Starting jumpsever service:manage.py not running
run_websocket.py not running
                                                           [FAILED]

安装成功，请访问web, 祝你使用愉快。
请访问 https://github.com/ibuler/jumpserver 查看文档

jumpserver启动

[root@jumpserver install]# cd ..
[root@jumpserver jumpserver]# ls
connect.py   install  jperm            juser    logs       run_websocket.py  templates
connect.pyc  jasset   jumpserver       keys     manage.py  service.sh
docs         jlog     jumpserver.conf  LICENSE  README.md  static
[root@jumpserver jumpserver]# python manage.py crontab add    # 运行 crontab，定期处理失效连接，定期更新资产信息
no crontab for root
  adding cronjob: (3718e5baf203ed0f54703b2f0b7e9e16) -> ('0 1 * * *', 'jasset.asset_api.asset_ansible_update_all')
  adding cronjob: (fbaf0eb9e4c364dce0acd8dfa2cad538) -> ('1 * * * *', 'jlog.log_api.kill_invalid_connection')
[root@jumpserver jumpserver]# crontab -l   # 查看crontab任务列表
0 1 * * * /usr/bin/python /usr/local/jumpserver/manage.py crontab run 3718e5baf203ed0f54703b2f0b7e9e16 # django-cronjobs for jumpserver
1 * * * * /usr/bin/python /usr/local/jumpserver/manage.py crontab run fbaf0eb9e4c364dce0acd8dfa2cad538 # django-cronjobs for jumpserver
[root@jumpserver jumpserver]# ss -nltp | grep 80
LISTEN     0      10           *:80                       *:*                   users:(("python",pid=30296,fd=4))
# 访问 http://192.168.131.133 即可访问jumpserver的web页面