快速部署jumpserver堡垒机
jumpserver版本:Version 1.4.1-2 (社区版)
主机IP地址:10.0.0.105
准备环境
1、安装依赖
yum -y install wget sqlite-devel xz gcc automake zlib-devel openssl-devel git epel-release
2、安装python3.6.3
wget https://www.python.org/ftp/python/3.6.1/Python-3.6.1.tar.xz
tar xvf Python-3.6.1.tar.xz && cd Python-3.6.1
./configure && make && make install
3、设置虚拟环境
cd /opt
python3 -m venv py3
source /opt/py3/bin/activate #看到下面的提示符代表成功,以后运行Jumpserver都要先运行以上source命令,
#以下所有命令均在该虚拟环境中运行
(py3) [root@localhost py3]
4、自动载入Python虚拟环境配置
cd /opt
git clone https://github.com/kennethreitz/autoenv.git
echo 'source /opt/autoenv/activate.sh' >> ~/.bashrc
source ~/.bashrc
0、安装Jumpserver
cd /opt/
git clone https://github.com/jumpserver/jumpserver.git && cd jumpserver && git checkout master #也可上传事先下载的包,解压
echo "source /opt/py3/bin/activate" > /opt/jumpserver/.env
cd /opt/jumpserver/requirements
yum -y install $(cat rpm_requirements.txt)
pip install -r requirements.txt -i https://pypi.python.org/simple
1、安装redis
yum -y install redis
systemctl enable redis
systemctl start redis
2、安装mysql
yum -y install mariadb mariadb-devel mariadb-server
systemctl enable mariadb
systemctl start mariadb
创建数据库Jumpserver 并授权
mysql -uroot -p
>
create database jumpserver default charset 'utf8';
grant all on jumpserver.* to 'jumpserver'@'127.0.0.1' identified by 'china123';
flush privileges;
3、修改Jumpserver配置文件
cd /opt/jumpserver
#cp config_example.py config.py
#vi config.py
cat >> config.py<<end
import os
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
class Config:
# Use it to encrypt or decrypt data
# SECURITY WARNING: keep the secret key used in production secret!
SECRET_KEY = os.environ.get('SECRET_KEY') or '40347338aeeky!997d5kkcc4498551fd92c64mnz06y1mme-42d0ui3lut-a94#(^wd=%s_qj$1%x'
# Django security setting, if your disable debug model, you should setting that
ALLOWED_HOSTS = ['*']
# Development env open this, when error occur display the full process track, Production disable it
DEBUG = os.environ.get("DEBUG") or True
# DEBUG, INFO, WARNING, ERROR, CRITICAL can set. See https://docs.djangoproject.com/en/1.10/topics/logging/
LOG_LEVEL = os.environ.get("LOG_LEVEL") or 'DEBUG'
LOG_DIR = os.path.join(BASE_DIR, 'logs')
# Database setting, Support sqlite3, mysql, postgres ....
# See https://docs.djangoproject.com/en/1.10/ref/settings/#databases
# SQLite setting:
#DB_ENGINE = 'sqlite3'
#DB_NAME = os.path.join(BASE_DIR, 'data', 'db.sqlite3')
#MySQL or postgres setting like:
DB_ENGINE = os.environ.get("DB_ENGINE") or 'mysql'
DB_HOST = os.environ.get("DB_HOST") or '127.0.0.1'
DB_PORT = os.environ.get("DB_PORT") or 3306
DB_USER = os.environ.get("DB_USER") or 'jumpserver'
DB_PASSWORD = os.environ.get("DB_PASSWORD") or 'china123'
DB_NAME = os.environ.get("DB_NAME") or 'jumpserver'
# When Django start it will bind this host and port
# ./manage.py runserver 127.0.0.1:8080
HTTP_BIND_HOST = '0.0.0.0'
HTTP_LISTEN_PORT = 8080
# Use Redis as broker for celery and web socket
REDIS_HOST = os.environ.get("REDIS_HOST") or '127.0.0.1'
REDIS_PORT = os.environ.get("REDIS_PORT") or 6379
REDIS_PASSWORD = os.environ.get("REDIS_PASSWORD") or ''
REDIS_DB_CELERY = os.environ.get('REDIS_DB') or 3
REDIS_DB_CACHE = os.environ.get('REDIS_DB') or 4
def __init__(self):
pass
def __getattr__(self, item):
return None
class DevelopmentConfig(Config):
pass
class TestConfig(Config):
pass
class ProductionConfig(Config):
pass
# Default using Config settings, you can write if/else for different env
config = DevelopmentConfig()
end
cd /opt/jumpserver/utils
bash make_migrations.sh
cd /opt/jumpserver
./jms start gunicorn -d
./jms start celery -d
./jms start beat -d
./jms status
netstat -tunlp|grep -E "8080|6379|3306"
在浏览器中访问:10.0.0.105:8080,
用户名密码默认均为admin
安装SSH Server 和WebSocket Server:Coco
cd /opt
source /opt/py3/bin/activate
git clone https://github.com/jumpserver/coco.git && cd coco && git checkout master #此步可上传事先下载的安装包,解压
echo "source /opt/py3/bin/activate" > /opt/coco/.env
cd /opt/coco/requirements
yum -y install $(cat rpm_requirements.txt)
pip install -r requirements.txt -i https://pypi.python.org/simple
cd /opt/coco
#cp conf_example.py conf.py #如果coco与jumpserver分开部署,请手动修改conf.py
#vi conf.py
cat >>conf.py<<end
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
#
import os
BASE_DIR = os.path.dirname(__file__)
class Config:
"""
Coco config file, coco also load config from server update setting below
"""
# 项目名称, 会用来向Jumpserver注册, 识别而已, 不能重复
NAME = "localhost"
# Jumpserver项目的url, api请求注册会使用
CORE_HOST = os.environ.get("CORE_HOST") or 'http://127.0.0.1:8080'
# 启动时绑定的ip, 默认 0.0.0.0
BIND_HOST = '0.0.0.0'
# 监听的SSH端口号, 默认2222
# SSHD_PORT = 2222
# 监听的HTTP/WS端口号,默认5000
HTTPD_PORT = 5000
# 项目使用的ACCESS KEY, 默认会注册,并保存到 ACCESS_KEY_STORE中,
# 如果有需求, 可以写到配置文件中, 格式 access_key_id:access_key_secret
ACCESS_KEY = None
# ACCESS KEY 保存的地址, 默认注册后会保存到该文件中
ACCESS_KEY_STORE = os.path.join(BASE_DIR, 'keys', '.access_key')
# 加密密钥
SECRET_KEY = None
# 设置日志级别 ['DEBUG', 'INFO', 'WARN', 'ERROR', 'FATAL', 'CRITICAL']
LOG_LEVEL = 'INFO'
# 日志存放的目录
LOG_DIR = os.path.join(BASE_DIR, 'logs')
# Session录像存放目录
SESSION_DIR = os.path.join(BASE_DIR, 'sessions')
# 资产显示排序方式, ['ip', 'hostname']
ASSET_LIST_SORT_BY = 'ip'
# 登录是否支持密码认证
PASSWORD_AUTH = True
# 登录是否支持秘钥认证
PUBLIC_KEY_AUTH = True
# SSH白名单
ALLOW_SSH_USER = 'all' # ['test', 'test2']
# SSH黑名单, 如果用户同时在白名单和黑名单,黑名单优先生效
BLOCK_SSH_USER = []
# 和Jumpserver 保持心跳时间间隔
HEARTBEAT_INTERVAL = 5
# Admin的名字,出问题会提示给用户
ADMINS = 'useyunwei@sina.com'
COMMAND_STORAGE = {
"TYPE": "server"
}
REPLAY_STORAGE = {
"TYPE": "server"
}
# SSH连接超时时间 (default 15 seconds)
SSH_TIMEOUT = 15
# 语言 = en
LANGUAGE_CODE = 'zh'
config = Config()
end
./cocod start -d
./cocod status
启动成功后去Jumpserver会话管理-终端管理(http://10.0.0.125:8080/terminal/terminal/)接受coco的注册
安装Web Terminal前端: Luna
cd /opt
wget https://github.com/jumpserver/luna/releases/download/1.4.1/luna.tar.gz #可上传事先现在的包,解压
tar xvf luna.tar.gz
chown -R root:root luna
安装Windows支持组件(如果不需要管理windows资产,可以直接跳过这一步)
wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
wget -O /etc/yum.repos.d/docker-ce.repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum list docker-ce.x86_64 --showduplicates | sort -r
yum install docker-ce -y
systemctl start docker
systemctl enable docker
systemctl status docker
docker run --name jms_guacamole -d \
-p 8081:8080 -v /opt/guacamole/key:/config/guacamole/key \
-e JUMPSERVER_KEY_DIR=/config/guacamole/key \
-e JUMPSERVER_SERVER=http://<填写jumpserver的url地址> \
jumpserver/guacamole:latest
启动成功后去Jumpserver会话管理-终端管理(http://10.0.0.125:8080/terminal/terminal/)接受[Gua]开头的一个注册(必须以[Gua]开头)
安装nginx
yum -y install nginx
cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.ori
cat >>/etc/nginx/nginx.conf<<end
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
# Load dynamic modules. See /usr/share/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;
events {
worker_connections 1024;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
include /etc/nginx/mime.types;
default_type application/octet-stream;
# Load modular configuration files from the /etc/nginx/conf.d directory.
# See http://nginx.org/en/docs/ngx_core_module.html#include
# for more information.
include /etc/nginx/conf.d/*.conf;
server {
listen 80;
client_max_body_size 100m;
location /luna/ {
try_files $uri / /index.html;
alias /opt/luna/;
}
location /media/ {
add_header Content-Encoding gzip;
root /opt/jumpserver/data/;
}
location /static/ {
root /opt/jumpserver/data/;
}
location /socket.io/ {
proxy_pass http://127.0.0.1:5000/socket.io/;
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}
location /guacamole/ {
proxy_pass http://127.0.0.1:8081/;
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}
location / {
proxy_pass http://127.0.0.1:8080;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
}
end
cd /opt/jumpserver
source /opt/py3/bin/activate
./jms status
cd /opt/coco
source /opt/py3/bin/activate
./cocod status
docker ps
systemctl restart nginx
systemctl enable nginx
systemctl status nginx
访问:10.0.0.105,如果进入jumpserver界面说明部署成功
快速部署jumpserver堡垒机的更多相关文章
- jumpserver堡垒机部署
初稿(后面我有时间再整理一下,看能不能弄成自动化脚本安装): systemctl stop firewalld #关闭防火墙setenforce 0 #关闭selinuxyum install htt ...
- 【转】jumpserver 堡垒机环境搭建(图文详解)
jumpserver 堡垒机环境搭建(图文详解) 摘要: Jumpserver 是一款由python编写开源的跳板机(堡垒机)系统,实现了跳板机应有的功能.基于ssh协议来管理,客户端无需安装ag ...
- jumpserver 堡垒机环境搭建(图文详解)
摘要: Jumpserver 是一款由python编写开源的跳板机(堡垒机)系统,实现了跳板机应有的功能.基于ssh协议来管理,客户端无需安装agent. 特点: 完全开源,GPL授权 Python编 ...
- jumpserver 堡垒机环境搭建
jumpserver 堡垒机环境搭建(图文详解) https://blog.csdn.net/my_bai/article/details/62226474 http://docs.jumpser ...
- jumpserver 堡垒机环境搭建(图文具体解释)
Jumpserver 是一款由python编写开源的跳板机(堡垒机)系统,实现了跳板机应有的功能.基于ssh协议来管理,客户端无需安装agent. 特点: 全然开源,GPL授权 Python编写.容易 ...
- jumpserver堡垒机web终端支持复制粘贴功能
公司最近内部搭建了一个jumpserver堡垒机,但是web终端连接Windows时候没法复制粘贴文字文本 然后找了一下jumpserver官方说明没找到相应的说明,但是知道是guacamole这个组 ...
- centos7.6 jumpserver 堡垒机 重启启动顺序
cd /sdata/usr/local python3. -m venv py3 source /sdata/usr/local/py3/bin/activate cd /sdata/usr/loca ...
- 使用Docker搭建Jumpserver堡垒机
使用Docker搭建Jumpserver堡垒机 1.环境准备 操作系统:CentOS 7.6.1810 软件源:阿里云镜像 #内核版本(Docker 要求 CentOS 系统的内核版本高于 3.10) ...
- Docker容器版Jumpserver堡垒机搭建部署方法附Redis
1.简介 Jumpserver是全球首款完全开源的堡垒机,多云环境下更好用的堡垒机,使用GNU GPL v2.0开源协议,是符合 4A 的专业运维安全审计系统,使用Python / Django 进行 ...
随机推荐
- poj 3415 Common Substrings【SA+单调栈】
把两个串中间加一个未出现字符接起来,然后求SA 然后把贡献统计分为两部分,在排序后的后缀里,属于串2的后缀和排在他前面属于串1的后缀的贡献和属于串1的后缀和排在他前面属于串2的后缀的贡献 两部分分别作 ...
- Docker部署Tomcat,Nginx,Redis应用
一.tomcat部署 1.拉取tomcat镜像 docker pull tomcat:7-jre7 2创建tomcat容器 创建容器用于部署单点登录系统(CAS) -p表示地址映射 docker r ...
- CI框架错误汇总
2017年1月13日12:09:02 [1] A PHP Error was encounteredSeverity: NoticeMessage: Undefined variable: aticl ...
- 跟我一起玩Win32开发(25):监视剪贴板
自从郭大侠和蓉儿离开桃花岛后,最近岛比较寂静,有一种“门前冷落鞍马稀”的感觉.于是,老邪就拿出<九阴真经>认真阅读,同时用迅雷下载经典大剧<汉武大帝>晚上睡觉前看上几集,老邪一 ...
- Java对象的内存布局以及对象的访问定位
一 Java对象的内存布局 在HotSpot虚拟机中,对象在内存中的布局分为3个区域 对象头(Header) Mark Word(在32bit和64bit虚拟机上长度分别为32bit和64bit)存储 ...
- Windows API函数大全三
7. API之位图.图标和光栅运算函数 BitBlt 将一幅位图从一个设备场景复制到另一个 CopyIcon 制作指定图标或鼠标指针的一个副本.这个副本从属于发出调用的应用程序 CopyImage 复 ...
- 【学习笔记】C++文件操作详解(ifstream、ofstream、fstream)
C++ 通过以下几个类支持文件的输入输出: ofstream: 写操作(输出)的文件类 (由ostream引申而来) ifstream: 读操作(输入)的文件类(由istream引申而来) fstre ...
- Git-往返github和本地
将GitHub仓库Test弄到本地 本地新建文件夹Test 右击运行gitbash 在gitbash中输入git init 在github 仓库选择clone or download 复制链接http ...
- 【HEVC帧间预测论文】P1.2 An Efficient Inter Mode Decision Approach for H.264 Video Codin
参考:An Efficient Inter Mode Decision Approach for H.264 Video Coding <HEVC标准介绍.HEVC帧间预测论文笔记>系列博 ...
- innerHTML与IE浏览器内存泄露问题
使用 sIEve 扫描和筛选 如果大量使用 JavaScript 和 Ajax 技术开发 Web 2.0 应用程序,您很有可能会遇到浏览器的内存泄漏问题.如果您有一个单页应用程序或者一个页面要处理很多 ...