jumpserver 安装

# CentOS 7 安装jumpserver

$ setenforce 0 # 可以设置配置文件永久关闭
$ systemctl stop iptables.service
$ systemctl stop firewalld.service

1、配置python环境：
[root@centos7-1 opt]# yum -y install wget sqlite-devel xz gcc automake zlib-devel openssl-devel epel-release git

[root@centos7-1 opt]# wget https://www.python.org/ftp/python/3.6.1/Python-3.6.1.tar.xz
[root@centos7-1 opt]# tar xvf Python-3.6.1.tar.xz && cd Python-3.6.1
[root@centos7-1 opt]# ./configure && make && make install

因为 CentOS 6/7 自带的是 Python2，而 Yum 等工具依赖原来的 Python，为了不扰乱原来的环境我们来使用 Python 虚拟环境
[root@centos7-1 opt]# cd /opt
[root@centos7-1 opt]# python3 -m venv py3
[root@centos7-1 opt]# source /opt/py3/bin/activate
注：看到下面的提示符代表成功，以后运行 Jumpserver 都要先运行以上 source 命令，以下所有命令均在该虚拟环境中运行
(py3) [root@centos7-1 opt]#

2、安装redis，通过yum安装：
(py3) [root@centos7-1 requirements]# yum -y install redis
(py3) [root@centos7-1 requirements]# systemctl start redis

3、本教程使用 Mysql 作为数据库，如果不使用 Mysql 可以跳过相关 Mysql 安装和配置
（1）# centos7
(py3) [root@centos7-1 requirements]# yum -y install mariadb mariadb-devel mariadb-server # centos7下安装的是mariadb
(py3) [root@centos7-1 requirements]# systemctl start mariadb.service
(py3) [root@centos7-1 requirements]# mysql
MariaDB [(none)]> create database jumpserver default charset 'utf8';
Query OK, 1 row affected (0.00 sec)
MariaDB [(none)]> grant all on jumpserver.* to 'jumpserver'@'127.0.0.1' identified by 'along';
Query OK, 0 rows affected (0.00 sec)

上面已经安装好了python3.6 mysql Redis

4、项目提交较多 git clone 时较大，你可以选择去 Github 项目页面直接下载zip包。
(py3) [root@centos7-1 opt]# cd /opt/
(py3) [root@centos7-1 opt]#git clone --depth=1 https://github.com/jumpserver/jumpserver.git

$ cd /opt/jumpserver/requirements
# 根据当前系统, 选择对应的文件执行即可
# 如 Centos: yum install -y $(cat rpm_requirements.txt)
# 如 Ubuntu: apt-get install -y $(cat deb_requirements.txt)

$ pip install wheel
$ pip install -r requirements.txt
# 确保已经载入 py3 虚拟环境, 中间如果遇到报错一般是依赖包没装全, 可以通过 搜索引擎 解决

$ cd /opt/jumpserver
$ cp config_example.yml config.yml
$ vim config.yml
# 注意 SECRET_KEY 和 BOOTSTRAP_TOKEN 不能使用纯数字字符串，并将数据库配置和redis配置写入文件

$ cd /opt/jumpserver
$ ./jms start # 可以 -d 参数在后台运行 ./jms start -d
# 确保已经载入 py3 虚拟环境, 中间如果遇到报错请参考 FAQ 文档或者 搜索引擎 解决

5、部署koko组件
$ cd /opt
# 访问 https://github.com/jumpserver/koko/releases 下载对应 release 包并解压到 /opt目录
$ wget https://github.com/jumpserver/koko/releases/download/1.5.5/koko-master-linux-amd64.tar.gz

$ tar xf koko-master-linux-amd64.tar.gz

$ chown -R root:root kokodir
$ cd kokodir

$ cp config_example.yml config.yml
$ vim config.yml
# BOOTSTRAP_TOKEN 需要从 jumpserver/config.yml 里面获取, 保证一致
$ ./koko # 可以 -d 参数在后台运行 ./koko -d

6、安装并启动guacamole组件

# 建议使用 docker 部署 guacamole 组件 , 部分环境可能无法正常编译安装

$ cd /opt
$ git clone --depth=1 https://github.com/jumpserver/docker-guacamole.git
$ cd /opt/docker-guacamole
$ tar xf guacamole-server-1.0.0.tar.gz
$ cd /opt/docker-guacamole/guacamole-server-1.0.0

# yum -y localinstall --nogpgcheck https://mirrors.aliyun.com/rpmfusion/free/el/rpmfusion-free-release-7.noarch.rpm https://mirrors.aliyun.com/rpmfusion/nonfree/el/rpmfusion-nonfree-release-7.noarch.rpm
# Fedora/CentOS/RHEL: yum install -y cairo-devel libjpeg-turbo-devel libpng-devel uuid-devel
# Fedora/CentOS/RHEL: yum install -y ffmpeg-devel freerdp1.2-devel pango-devel libssh2-devel libtelnet-devel libvncserver-devel pulseaudio-libs-devel openssl-devel libvorbis-devel libwebp-devel
# ln -s /usr/local/lib/freerdp /usr/lib64/freerdp
#安装依赖 yum install -y libtool

$ autoreconf -fi
$ ./configure --with-init-dir=/etc/init.d
$ make
$ make install

# 先在当前环境配置好 jdk8 jre8
# Ubuntu: apt-get -y install default-jre default-jdk
# Centos: yum install -y java-1.8.0-openjdk

# 访问 https://tomcat.apache.org/download-90.cgi 下载最新的 tomcat9
$ mkdir -p /config/guacamole /config/guacamole/extensions /config/guacamole/record
$ chmod 777 /config/guacamole/record
$ cd /config
$ wget http://mirrors.tuna.tsinghua.edu.cn/apache/tomcat/tomcat-9/v9.0.29/bin/apache-tomcat-9.0.29.tar.gz
$ tar xf apache-tomcat-9.0.29.tar.gz
$ mv apache-tomcat-9.0.29 tomcat9
$ rm -rf /config/tomcat9/webapps/*
$ sed -i 's/Connector port="8080"/Connector port="8081"/g' /config/tomcat9/conf/server.xml
$ echo "java.util.logging.ConsoleHandler.encoding = UTF-8" >> /config/tomcat9/conf/logging.properties
$ ln -sf /opt/docker-guacamole/guacamole-1.0.0.war /config/tomcat9/webapps/ROOT.war
$ ln -sf /opt/docker-guacamole/guacamole-auth-jumpserver-1.0.0.jar /config/guacamole/extensions/guacamole-auth-jumpserver-1.0.0.jar
$ ln -sf /opt/docker-guacamole/root/app/guacamole/guacamole.properties /config/guacamole/guacamole.properties
$ wget https://github.com/ibuler/ssh-forward/releases/download/v0.0.5/linux-amd64.tar.gz
$ tar xf linux-amd64.tar.gz -C /bin/
$ chmod +x /bin/ssh-forward

# 设置 guacamole 环境
$ export JUMPSERVER_SERVER=http://127.0.0.1:8080 # http://127.0.0.1:8080 指 jumpserver 访问地址
$ echo "export JUMPSERVER_SERVER=http://127.0.0.1:8080" >> ~/.bashrc

# BOOTSTRAP_TOKEN 为 Jumpserver/config.yml 里面的 BOOTSTRAP_TOKEN 值
$ export BOOTSTRAP_TOKEN=******
$ echo "export BOOTSTRAP_TOKEN=******" >> ~/.bashrc
$ export JUMPSERVER_KEY_DIR=/config/guacamole/keys
$ echo "export JUMPSERVER_KEY_DIR=/config/guacamole/keys" >> ~/.bashrc
$ export GUACAMOLE_HOME=/config/guacamole
$ echo "export GUACAMOLE_HOME=/config/guacamole" >> ~/.bashrc
$ export GUACAMOLE_LOG_LEVEL=ERROR
$ echo "export GUACAMOLE_LOG_LEVEL=ERROR" >> ~/.bashrc

$ /etc/init.d/guacd start
$ sh /config/tomcat9/bin/startup.sh

7、下载luna组件

$ cd /opt

# 访问 https://github.com/jumpserver/luna/releases 获取
$ wget https://github.com/jumpserver/luna/releases/download/1.5.5/luna.tar.gz

$ tar xf luna.tar.gz
$ chown -R root:root luna

8、安装nginx略
配置

$ vim /etc/nginx/conf.d/jumpserver.conf

server {
listen 80;

client_max_body_size 100m; # 录像及文件上传大小限制

location /luna/ {
try_files $uri / /index.html;
alias /opt/luna/; # luna 路径, 如果修改安装目录, 此处需要修改
}

location /media/ {
add_header Content-Encoding gzip;
root /opt/jumpserver/data/; # 录像位置, 如果修改安装目录, 此处需要修改
}

location /static/ {
root /opt/jumpserver/data/; # 静态资源, 如果修改安装目录, 此处需要修改
}

location /koko/ {
proxy_pass http://localhost:5000;
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}

location /guacamole/ {
proxy_pass http://localhost:8081/;
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}

location /ws/ {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://localhost:8070;
proxy_http_version 1.1;
proxy_buffering off;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}

location / {
proxy_pass http://localhost:8080;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}

$ nginx -t
$ nginx -s reload

9、开始使用 Jumpserver
# 检查应用是否已经正常运行
# 服务全部启动后, 访问 jumpserver 服务器 nginx 代理的 80 端口, 不要通过8080端口访问
# 默认账号: admin 密码: admin