快速部署jumpserver堡垒机

jumpserver版本：Version 1.4.1-2 （社区版）

主机IP地址：10.0.0.105

准备环境
1、安装依赖
yum -y install wget sqlite-devel xz gcc automake zlib-devel openssl-devel git epel-release

2、安装python3.6.3
wget https://www.python.org/ftp/python/3.6.1/Python-3.6.1.tar.xz

tar xvf Python-3.6.1.tar.xz && cd Python-3.6.1

./configure && make && make install

3、设置虚拟环境
cd /opt

python3 -m venv py3

source /opt/py3/bin/activate #看到下面的提示符代表成功，以后运行Jumpserver都要先运行以上source命令，
#以下所有命令均在该虚拟环境中运行
(py3) [root@localhost py3]

4、自动载入Python虚拟环境配置

cd /opt
git clone https://github.com/kennethreitz/autoenv.git

echo 'source /opt/autoenv/activate.sh' >> ~/.bashrc

source ~/.bashrc

0、安装Jumpserver
cd /opt/
git clone https://github.com/jumpserver/jumpserver.git && cd jumpserver && git checkout master #也可上传事先下载的包，解压
echo "source /opt/py3/bin/activate" > /opt/jumpserver/.env

cd /opt/jumpserver/requirements
yum -y install $(cat rpm_requirements.txt)

pip install -r requirements.txt -i https://pypi.python.org/simple

1、安装redis
yum -y install redis
systemctl enable redis
systemctl start redis

2、安装mysql
yum -y install mariadb mariadb-devel mariadb-server
systemctl enable mariadb
systemctl start mariadb

创建数据库Jumpserver 并授权
mysql -uroot -p
>
create database jumpserver default charset 'utf8';
grant all on jumpserver.* to 'jumpserver'@'127.0.0.1' identified by 'china123';
flush privileges;

3、修改Jumpserver配置文件
cd /opt/jumpserver

#cp config_example.py config.py
#vi config.py

cat >> config.py<<end
import os

BASE_DIR = os.path.dirname(os.path.abspath(__file__))

class Config:
# Use it to encrypt or decrypt data
# SECURITY WARNING: keep the secret key used in production secret!
SECRET_KEY = os.environ.get('SECRET_KEY') or '40347338aeeky!997d5kkcc4498551fd92c64mnz06y1mme-42d0ui3lut-a94#(^wd=%s_qj$1%x'

# Django security setting, if your disable debug model, you should setting that
ALLOWED_HOSTS = ['*']

# Development env open this, when error occur display the full process track, Production disable it
DEBUG = os.environ.get("DEBUG") or True

# DEBUG, INFO, WARNING, ERROR, CRITICAL can set. See https://docs.djangoproject.com/en/1.10/topics/logging/
LOG_LEVEL = os.environ.get("LOG_LEVEL") or 'DEBUG'
LOG_DIR = os.path.join(BASE_DIR, 'logs')

# Database setting, Support sqlite3, mysql, postgres ....
# See https://docs.djangoproject.com/en/1.10/ref/settings/#databases

# SQLite setting:
#DB_ENGINE = 'sqlite3'
#DB_NAME = os.path.join(BASE_DIR, 'data', 'db.sqlite3')

#MySQL or postgres setting like:
DB_ENGINE = os.environ.get("DB_ENGINE") or 'mysql'
DB_HOST = os.environ.get("DB_HOST") or '127.0.0.1'
DB_PORT = os.environ.get("DB_PORT") or 3306
DB_USER = os.environ.get("DB_USER") or 'jumpserver'
DB_PASSWORD = os.environ.get("DB_PASSWORD") or 'china123'
DB_NAME = os.environ.get("DB_NAME") or 'jumpserver'

# When Django start it will bind this host and port
# ./manage.py runserver 127.0.0.1:8080
HTTP_BIND_HOST = '0.0.0.0'
HTTP_LISTEN_PORT = 8080

# Use Redis as broker for celery and web socket
REDIS_HOST = os.environ.get("REDIS_HOST") or '127.0.0.1'
REDIS_PORT = os.environ.get("REDIS_PORT") or 6379
REDIS_PASSWORD = os.environ.get("REDIS_PASSWORD") or ''
REDIS_DB_CELERY = os.environ.get('REDIS_DB') or 3
REDIS_DB_CACHE = os.environ.get('REDIS_DB') or 4

def __init__(self):
pass

def __getattr__(self, item):
return None

class DevelopmentConfig(Config):
pass

class TestConfig(Config):
pass

class ProductionConfig(Config):
pass

# Default using Config settings, you can write if/else for different env
config = DevelopmentConfig()

end

cd /opt/jumpserver/utils

bash make_migrations.sh

cd /opt/jumpserver

./jms start gunicorn -d
./jms start celery -d
./jms start beat -d
./jms status
netstat -tunlp|grep -E "8080|6379|3306"

在浏览器中访问：10.0.0.105:8080，

用户名密码默认均为admin

安装SSH Server 和WebSocket Server:Coco

cd /opt
source /opt/py3/bin/activate

git clone https://github.com/jumpserver/coco.git && cd coco && git checkout master #此步可上传事先下载的安装包，解压

echo "source /opt/py3/bin/activate" > /opt/coco/.env

cd /opt/coco/requirements

yum -y install $(cat rpm_requirements.txt)

pip install -r requirements.txt -i https://pypi.python.org/simple

cd /opt/coco

#cp conf_example.py conf.py #如果coco与jumpserver分开部署，请手动修改conf.py
#vi conf.py

cat >>conf.py<<end
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
#

import os

BASE_DIR = os.path.dirname(__file__)

class Config:
"""
Coco config file, coco also load config from server update setting below
"""
# 项目名称, 会用来向Jumpserver注册, 识别而已, 不能重复
NAME = "localhost"

# Jumpserver项目的url, api请求注册会使用
CORE_HOST = os.environ.get("CORE_HOST") or 'http://127.0.0.1:8080'

# 启动时绑定的ip, 默认 0.0.0.0
BIND_HOST = '0.0.0.0'

# 监听的SSH端口号, 默认2222
# SSHD_PORT = 2222

# 监听的HTTP/WS端口号，默认5000
HTTPD_PORT = 5000

# 项目使用的ACCESS KEY, 默认会注册,并保存到 ACCESS_KEY_STORE中,
# 如果有需求, 可以写到配置文件中, 格式 access_key_id:access_key_secret
ACCESS_KEY = None

# ACCESS KEY 保存的地址, 默认注册后会保存到该文件中
ACCESS_KEY_STORE = os.path.join(BASE_DIR, 'keys', '.access_key')

# 加密密钥
SECRET_KEY = None

# 设置日志级别 ['DEBUG', 'INFO', 'WARN', 'ERROR', 'FATAL', 'CRITICAL']
LOG_LEVEL = 'INFO'

# 日志存放的目录
LOG_DIR = os.path.join(BASE_DIR, 'logs')

# Session录像存放目录
SESSION_DIR = os.path.join(BASE_DIR, 'sessions')

# 资产显示排序方式, ['ip', 'hostname']
ASSET_LIST_SORT_BY = 'ip'

# 登录是否支持密码认证
PASSWORD_AUTH = True

# 登录是否支持秘钥认证
PUBLIC_KEY_AUTH = True

# SSH白名单
ALLOW_SSH_USER = 'all' # ['test', 'test2']

# SSH黑名单, 如果用户同时在白名单和黑名单，黑名单优先生效
BLOCK_SSH_USER = []

# 和Jumpserver 保持心跳时间间隔
HEARTBEAT_INTERVAL = 5

# Admin的名字，出问题会提示给用户
ADMINS = 'useyunwei@sina.com'
COMMAND_STORAGE = {
"TYPE": "server"
}
REPLAY_STORAGE = {
"TYPE": "server"
}

# SSH连接超时时间 (default 15 seconds)
SSH_TIMEOUT = 15

# 语言 = en
LANGUAGE_CODE = 'zh'

config = Config()

end

./cocod start -d
./cocod status

启动成功后去Jumpserver会话管理-终端管理（http://10.0.0.125:8080/terminal/terminal/）接受coco的注册

安装Web Terminal前端: Luna

cd /opt
wget https://github.com/jumpserver/luna/releases/download/1.4.1/luna.tar.gz #可上传事先现在的包，解压
tar xvf luna.tar.gz
chown -R root:root luna

安装Windows支持组件（如果不需要管理windows资产，可以直接跳过这一步）

wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
wget -O /etc/yum.repos.d/docker-ce.repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum list docker-ce.x86_64 --showduplicates | sort -r
yum install docker-ce -y
systemctl start docker
systemctl enable docker
systemctl status docker

docker run --name jms_guacamole -d \
-p 8081:8080 -v /opt/guacamole/key:/config/guacamole/key \
-e JUMPSERVER_KEY_DIR=/config/guacamole/key \
-e JUMPSERVER_SERVER=http://<填写jumpserver的url地址> \
jumpserver/guacamole:latest 

启动成功后去Jumpserver会话管理-终端管理（http://10.0.0.125:8080/terminal/terminal/）接受[Gua]开头的一个注册（必须以[Gua]开头）

安装nginx

yum -y install nginx

cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.ori

cat >>/etc/nginx/nginx.conf<<end
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
worker_connections 1024;
}

http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';

access_log /var/log/nginx/access.log main;

sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;

include /etc/nginx/mime.types;
default_type application/octet-stream;

# Load modular configuration files from the /etc/nginx/conf.d directory.
# See http://nginx.org/en/docs/ngx_core_module.html#include
# for more information.
include /etc/nginx/conf.d/*.conf;
server {
listen 80;
client_max_body_size 100m;
location /luna/ {
try_files $uri / /index.html;
alias /opt/luna/;
}
location /media/ {
add_header Content-Encoding gzip;
root /opt/jumpserver/data/;
}

location /static/ {
root /opt/jumpserver/data/;
}
location /socket.io/ {
proxy_pass http://127.0.0.1:5000/socket.io/;
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}
location /guacamole/ {
proxy_pass http://127.0.0.1:8081/;
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}
location / {
proxy_pass http://127.0.0.1:8080;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

}

}

end

cd /opt/jumpserver
source /opt/py3/bin/activate
./jms status

cd /opt/coco
source /opt/py3/bin/activate
./cocod status

docker ps

systemctl restart nginx
systemctl enable nginx
systemctl status nginx

访问：10.0.0.105，如果进入jumpserver界面说明部署成功