CentOS7安装部署jumpserver0.5

组件说明

Jumpserver为管理后台,管理员可以通过Web页面进行资产管理、用户管理、资产授权等操作;

Coco为SSH Server和Web Terminal Server.用户可以通过使用自己的账户登录SSH或者Web Terminal直接访问被授权的资产,不需要知道服务器的账户密码;

Luna为Web Terminal Server前端页面,用户使用Web Terminal方式登录所需要的组件;

Guacamole为Windows组件,这里暂不安装.

1.准备环境

现在生产环境大多使用的是0.3.2版本,其文档较全,安装也较简易,本篇博客将部署jumpserver0.5版.

系统:CentOS7.4、CentOS7.6都行
CentOS Linux release 7.6.1810 (Core)
# 关闭selinux、防火墙
setenforce 0
systemctl stop iptables.service
systemctl stop firewalld.service
# 安装依赖包
yum -y install zlib-devel bzip2-devel openssl-devel ncurses-devel sqlite-devel \
readline-devel tk-devel gdbm-devel db4-devel libpcap-devel xz-devel gcc gcc-c++
yum -y install git automake autoconf vim sshpass lrzsz
yum -y install python36 python36-devel
# 修改字符集,否则可能报input/output error的问题,因为日志里打印了中文
localedef -c -f UTF-8 -i zh_CN zh_CN.UTF-8
export LC_ALL=zh_CN.UTF-8
echo 'LANG="zh_CN.UTF-8"' > /etc/locale.conf
# 建立 Python 虚拟环境
cd /opt
python3.6 -m venv py3-jumpserver5
source /opt/py3-jumpserver5/bin/activate

2.安装Jumpserver

以后运行Jumpserver都要先运行以上source命令,以下所有命令均在该虚拟环境中运行

cd /opt/
git clone --depth=1 https://github.com/jumpserver/jumpserver.git

# 安装依赖RPM包
cd /opt/jumpserver/requirements
yum -y install $(cat rpm_requirements.txt)

# 安装Python库依赖
pip install --upgrade pip setuptools -i https://mirrors.aliyun.com/pypi/simple/
pip install -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/

# 安装Redis,Jumpserver使用Redis做cache和celery broke
yum -y install redis
systemctl enable redis
systemctl start redis

# 使用mariadb做后端存储
yum -y install mariadb mariadb-devel mariadb-server
systemctl enable mariadb
systemctl start mariadb

# 创建数据库Jumpserver并授权
DB_PASSWORD=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 24`  # 生成随机数据库密码
echo -e "\033[31m 你的数据库密码是 $DB_PASSWORD \033[0m"  # 237RcqZYul8nLjfIlJoSRz7W
mysql -uroot -e "create database jumpserver default charset 'utf8'; grant all on jumpserver.* to 'jumpserver'@'127.0.0.1' identified by '$DB_PASSWORD'; flush privileges;"

# 修改Jumpserver配置文件
cp config_example.yml config.yml

SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 50`
echo "SECRET_KEY=$SECRET_KEY" >> ~/.bashrc
BOOTSTRAP_TOKEN=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 16`
echo "BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN" >> ~/.bashrc

sed -i "s/SECRET_KEY:/SECRET_KEY: $SECRET_KEY/g" /opt/jumpserver/config.yml
sed -i "s/BOOTSTRAP_TOKEN:/BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g" /opt/jumpserver/config.yml
sed -i "s/# DEBUG: true/DEBUG: false/g" /opt/jumpserver/config.yml
sed -i "s/# LOG_LEVEL: DEBUG/LOG_LEVEL: ERROR/g" /opt/jumpserver/config.yml
sed -i "s/# SESSION_EXPIRE_AT_BROWSER_CLOSE: false/SESSION_EXPIRE_AT_BROWSER_CLOSE: true/g" /opt/jumpserver/config.yml
sed -i "s/DB_PASSWORD: /DB_PASSWORD: $DB_PASSWORD/g" /opt/jumpserver/config.yml

echo -e "\033[31m 你的SECRET_KEY是 $SECRET_KEY \033[0m"
echo -e "\033[31m 你的BOOTSTRAP_TOKEN是 $BOOTSTRAP_TOKEN \033[0m"

# 运行 Jumpserver
./jms start all -d  # 后台运行使用 -d 参数./jms start all -d
gunicorn is running: 12578
celery is running: 12594
beat is running: 12596

3.安装SSH Server和WebSocket Server:Coco

cd /opt
git clone --depth=1 https://github.com/jumpserver/coco.git
cd /opt/coco/requirements
yum -y install $(cat rpm_requirements.txt)
pip install -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/
cd /opt/coco/
cp config_example.yml config.yml
sed -i "s/BOOTSTRAP_TOKEN: <PleasgeChangeSameWithJumpserver>/BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g" /opt/coco/config.yml
sed -i "s/# LOG_LEVEL: INFO/LOG_LEVEL: ERROR/g" /opt/coco/config.yml
./cocod start -d

4.安装Web Terminal前端:Luna

Luna已改为纯前端,需要Nginx来运行访问
cd /opt && wget https://demo.jumpserver.org/download/luna/1.4.10/luna.tar.gz
tar xf luna.tar.gz
chown -R root:root luna

端口说明
Jumpserver:默认端口为 8080/tcp,配置文件在 jumpserver/config.yml;
Coco:默认SSH端口为 2222/tcp,默认Web Terminal端口为 5000/tcp,配置文件在coco/config.yml;
Guacamole:默认端口为 8081/tcp;
Nginx:默认端口为 80/tcp;
Redis:默认端口为 6379/tcp;
Mysql:默认端口为 3306/tcp.

5.配置Nginx整合各组件

yum install yum-utils
vi /etc/yum.repos.d/nginx.repo

[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key

yum makecache fast
yum install -y nginx
rm -rf /etc/nginx/conf.d/default.conf
systemctl enable nginx

vi /etc/nginx/conf.d/jumpserver.conf
server {
    listen 80;  # 代理端口, 以后将通过此端口进行访问, 不再通过8080端口
    # server_name demo.jumpserver.org;  # 修改成你的域名或者注释掉

    client_max_body_size 100m;  # 录像及文件上传大小限制

    location /luna/ {
        try_files $uri / /index.html;
        alias /opt/luna/;  # luna 路径, 如果修改安装目录, 此处需要修改
    }

    location /media/ {
        add_header Content-Encoding gzip;
        root /opt/jumpserver/data/;  # 录像位置, 如果修改安装目录, 此处需要修改
    }

    location /static/ {
        root /opt/jumpserver/data/;  # 静态资源, 如果修改安装目录, 此处需要修改
    }

    location /socket.io/ {
        proxy_pass       http://localhost:5000/socket.io/;  # 如果coco安装在别的服务器, 请填写它的ip
        proxy_buffering off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        access_log off;
    }

    location /coco/ {
        proxy_pass       http://localhost:5000/coco/;  # 如果coco安装在别的服务器, 请填写它的ip
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        access_log off;
    }

    location / {
        proxy_pass http://localhost:8080;  # 如果jumpserver安装在别的服务器, 请填写它的ip
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

#运行 Nginx
nginx -t   # 确保配置没有问题
systemctl start nginx

6.开始使用Jumpserver

服务全部启动后,访问http://10.0.0.66,访问nginx代理的端口,不要再通过8080端口访问,默认账号: admin,密码: admin

参考博文:http://docs.jumpserver.org/zh/docs/setup_by_centos.html

参考博文:https://blog.csdn.net/gx_1_11_real/article/details/79433128