|
|
@@ -0,0 +1,261 @@
|
|
|
+# 堡垒机Jumpserver搭建
|
|
|
+
|
|
|
+### 系统环境
|
|
|
+
|
|
|
+* Ubuntu 18.04.2 LTS
|
|
|
+
|
|
|
+### 安装步骤
|
|
|
+
|
|
|
+##### 准备 Python3 和 Python 虚拟环境
|
|
|
+
|
|
|
+1. 安装依赖包
|
|
|
+
|
|
|
+ ```shell
|
|
|
+ $ apt-get update && apt-get -y upgrade
|
|
|
+ $ apt-get -y install wget gcc libffi-dev git libmysqlclient-dev
|
|
|
+
|
|
|
+ # 修改字符集, 否则可能报 input/output error的问题, 因为日志里打印了中文
|
|
|
+ $ apt-get -y install language-pack-zh-hans
|
|
|
+ $ export LC_ALL=zh_CN.UTF-8
|
|
|
+ $ echo 'LANG="zh_CN.UTF-8"' > /etc/default/locale
|
|
|
+ ```
|
|
|
+
|
|
|
+2. 安装 Python3.6
|
|
|
+
|
|
|
+ ```shell
|
|
|
+ $ add-apt-repository ppa:jonathonf/python-3.6 -y
|
|
|
+ $ apt-get update
|
|
|
+ $ apt-get -y install python3.6 python3.6-dev python3.6-venv
|
|
|
+ # 查看python版本，如果存在多版本python则将系统默认python版本切换为python3.6
|
|
|
+ $ python --version
|
|
|
+ # 如果版本不是Python 3.6，则
|
|
|
+ $ echo alias python=python3 >> ~/.bashrc
|
|
|
+ $ source ~/.bashrc
|
|
|
+ # 再次检查python版本
|
|
|
+ $ python --version
|
|
|
+ ```
|
|
|
+
|
|
|
+3. 建立 Python 虚拟环境
|
|
|
+
|
|
|
+ ```shell
|
|
|
+ $ cd /opt
|
|
|
+ $ python3.6 -m venv py3
|
|
|
+ $ source /opt/py3/bin/activate
|
|
|
+
|
|
|
+ # 看到下面的提示符代表成功, 以后运行 Jumpserver 都要先运行以上 source 命令, 以下所有命令均在该虚拟环境中运行
|
|
|
+ (py3) [root@localhost py3]
|
|
|
+ ```
|
|
|
+
|
|
|
+### 安装Jumpserver （以下所有命令都在python虚拟环境中执行）
|
|
|
+
|
|
|
+1. 下载或 Clone 项目
|
|
|
+
|
|
|
+ ```shell
|
|
|
+ $ cd /opt/
|
|
|
+ $ git clone https://github.com/jumpserver/jumpserver.git
|
|
|
+ ```
|
|
|
+
|
|
|
+2. 安装依赖包
|
|
|
+
|
|
|
+ ```shell
|
|
|
+ $ cd /opt/jumpserver/requirements
|
|
|
+ $ apt-get -y install $(cat deb_requirements.txt) # 如果没有任何报错请继续
|
|
|
+ ```
|
|
|
+
|
|
|
+3. 安装 Python 库依赖
|
|
|
+
|
|
|
+ ```shell
|
|
|
+ $ pip install --upgrade pip setuptools
|
|
|
+ $ pip install -r requirements.txt
|
|
|
+
|
|
|
+ # 如果下载速度很慢, 可以换国内源
|
|
|
+ $ pip install --upgrade pip setuptools -i https://mirrors.aliyun.com/pypi/simple/
|
|
|
+ $ pip install -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/
|
|
|
+ ```
|
|
|
+
|
|
|
+4. 安装 Redis, Jumpserver 使用 Redis 做 cache 和 celery broke
|
|
|
+
|
|
|
+ ```shell
|
|
|
+ $ apt-get -y install redis-server
|
|
|
+ ```
|
|
|
+
|
|
|
+5. 安装 MySQL
|
|
|
+
|
|
|
+ ```shell
|
|
|
+ $ apt-get -y install mysql-server # 安装过程中注意输入数据库 root账户 的密码
|
|
|
+ ```
|
|
|
+
|
|
|
+6. 创建数据库 Jumpserver 并授权
|
|
|
+
|
|
|
+ ```shell
|
|
|
+ $ DB_PASSWORD=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 24` # 生成随机数据库密码
|
|
|
+ $ echo -e "\033[31m 你的数据库密码是 $DB_PASSWORD \033[0m"
|
|
|
+ $ mysql -uroot -p -e "create database jumpserver default charset 'utf8'; grant all on jumpserver.* to 'jumpserver'@'127.0.0.1' identified by '$DB_PASSWORD'; flush privileges;"
|
|
|
+ ```
|
|
|
+
|
|
|
+7. 修改 Jumpserver 配置文件
|
|
|
+
|
|
|
+ ```shell
|
|
|
+ $ cd /opt/jumpserver
|
|
|
+ $ cp config_example.yml config.yml
|
|
|
+
|
|
|
+ $ SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 50` # 生成随机SECRET_KEY
|
|
|
+ $ echo "SECRET_KEY=$SECRET_KEY" >> ~/.bashrc
|
|
|
+ $ BOOTSTRAP_TOKEN=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 16` # 生成随机BOOTSTRAP_TOKEN
|
|
|
+ $ echo "BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN" >> ~/.bashrc
|
|
|
+
|
|
|
+ $ sed -i "s/SECRET_KEY:/SECRET_KEY: $SECRET_KEY/g" /opt/jumpserver/config.yml
|
|
|
+ $ sed -i "s/BOOTSTRAP_TOKEN:/BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g" /opt/jumpserver/config.yml
|
|
|
+ $ sed -i "s/# DEBUG: true/DEBUG: false/g" /opt/jumpserver/config.yml
|
|
|
+ $ sed -i "s/# LOG_LEVEL: DEBUG/LOG_LEVEL: ERROR/g" /opt/jumpserver/config.yml
|
|
|
+ $ sed -i "s/# SESSION_EXPIRE_AT_BROWSER_CLOSE: false/SESSION_EXPIRE_AT_BROWSER_CLOSE: true/g" /opt/jumpserver/config.yml
|
|
|
+ $ sed -i "s/DB_PASSWORD: /DB_PASSWORD: $DB_PASSWORD/g" /opt/jumpserver/config.yml
|
|
|
+
|
|
|
+ $ echo -e "\033[31m 你的SECRET_KEY是 $SECRET_KEY \033[0m"
|
|
|
+ $ echo -e "\033[31m 你的BOOTSTRAP_TOKEN是 $BOOTSTRAP_TOKEN \033[0m"
|
|
|
+ ```
|
|
|
+
|
|
|
+8. 运行 Jumpserver
|
|
|
+
|
|
|
+ ```shell
|
|
|
+ $ cd /opt/jumpserver
|
|
|
+ $ ./jms start all -d # 后台运行使用 -d 参数./jms start all -d
|
|
|
+ # 运行不报错, 请继续往下操作安装 SSH Server 和 WebSocket Server: Coco
|
|
|
+ ```
|
|
|
+
|
|
|
+### 安装 SSH Server 和 WebSocket Server: Coco
|
|
|
+
|
|
|
+1. 下载或 Clone 项目
|
|
|
+
|
|
|
+ ```shell
|
|
|
+ $ cd /opt
|
|
|
+ $ source /opt/py3/bin/activate
|
|
|
+ $ git clone https://github.com/jumpserver/coco.git && cd coco && git checkout master
|
|
|
+ ```
|
|
|
+
|
|
|
+2. 安装依赖
|
|
|
+
|
|
|
+ ```shell
|
|
|
+ $ cd /opt/coco/requirements
|
|
|
+ $ pip install -r requirements.txt
|
|
|
+
|
|
|
+ # 如果下载速度很慢, 可以换国内源
|
|
|
+ $ pip install -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/
|
|
|
+ ```
|
|
|
+
|
|
|
+3. 查看配置文件并运行
|
|
|
+
|
|
|
+ ```shell
|
|
|
+ $ cd /opt/coco
|
|
|
+ $ cp config_example.yml config.yml
|
|
|
+ $ vi config.yml
|
|
|
+ # 修改BOOTSTRAP_TOKEN为/opt/jumpserver/config.yml的BOOTSTRAP_TOKEN
|
|
|
+ $ ./cocod start -d # 后台运行使用 -d 参数./cocod start -d
|
|
|
+ ```
|
|
|
+
|
|
|
+### 安装 Web Terminal 前端: Luna
|
|
|
+
|
|
|
+1. 下载解压Luna
|
|
|
+
|
|
|
+ ```shell
|
|
|
+ $ cd /opt/
|
|
|
+ $ wget https://github.com/jumpserver/luna/releases/download/1.4.9/luna.tar.gz
|
|
|
+
|
|
|
+ # 如果网络有问题导致下载无法完成可以使用下面地址
|
|
|
+ $ wget https://demo.jumpserver.org/download/luna/1.4.9/luna.tar.gz
|
|
|
+
|
|
|
+ $ tar xf luna.tar.gz
|
|
|
+ $ chown -R root:root luna
|
|
|
+ ```
|
|
|
+
|
|
|
+### 配置 Nginx 整合各组件
|
|
|
+
|
|
|
+1. 安装 Nginx
|
|
|
+
|
|
|
+ ```shell
|
|
|
+ $ apt-get -y install nginx
|
|
|
+ $ rm -rf /etc/nginx/site-enabled/default
|
|
|
+ ```
|
|
|
+
|
|
|
+2. 创建配置文件 /etc/nginx/site-enabled/jumpserver.conf
|
|
|
+
|
|
|
+ ```shell
|
|
|
+ $ vim /etc/nginx/site-enabled/jumpserver.conf
|
|
|
+ # 文件内容
|
|
|
+ server {
|
|
|
+ listen 80;
|
|
|
+ server_name _;
|
|
|
+
|
|
|
+ client_max_body_size 100m; # 录像及文件上传大小限制
|
|
|
+
|
|
|
+ location /luna/ {
|
|
|
+ try_files $uri / /index.html;
|
|
|
+ alias /opt/luna/; # luna 路径, 如果修改安装目录, 此处需要修改
|
|
|
+ }
|
|
|
+
|
|
|
+ location /media/ {
|
|
|
+ add_header Content-Encoding gzip;
|
|
|
+ root /opt/jumpserver/data/; # 录像位置, 如果修改安装目录, 此处需要修改
|
|
|
+ }
|
|
|
+
|
|
|
+ location /static/ {
|
|
|
+ root /opt/jumpserver/data/; # 静态资源, 如果修改安装目录, 此处需要修改
|
|
|
+ }
|
|
|
+
|
|
|
+ location /socket.io/ {
|
|
|
+ proxy_pass http://localhost:5000/socket.io/; # 如果coco安装在别的服务器, 请填写它的ip
|
|
|
+ proxy_buffering off;
|
|
|
+ proxy_http_version 1.1;
|
|
|
+ proxy_set_header Upgrade $http_upgrade;
|
|
|
+ proxy_set_header Connection "upgrade";
|
|
|
+ proxy_set_header X-Real-IP $remote_addr;
|
|
|
+ proxy_set_header Host $host;
|
|
|
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
+ access_log off;
|
|
|
+ }
|
|
|
+
|
|
|
+ location /coco/ {
|
|
|
+ proxy_pass http://localhost:5000/coco/;
|
|
|
+ proxy_set_header X-Real-IP $remote_addr;
|
|
|
+ proxy_set_header Host $host;
|
|
|
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
+ access_log off;
|
|
|
+ }
|
|
|
+
|
|
|
+ location /guacamole/ {
|
|
|
+ proxy_pass http://localhost:8081/; # 如果guacamole安装在别的服务器, 请填写它的ip
|
|
|
+ proxy_buffering off;
|
|
|
+ proxy_http_version 1.1;
|
|
|
+ proxy_set_header Upgrade $http_upgrade;
|
|
|
+ proxy_set_header Connection $http_connection;
|
|
|
+ access_log off;
|
|
|
+ proxy_set_header X-Real-IP $remote_addr;
|
|
|
+ proxy_set_header Host $host;
|
|
|
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
+ }
|
|
|
+
|
|
|
+ location / {
|
|
|
+ proxy_pass http://localhost:8080;
|
|
|
+ proxy_set_header X-Real-IP $remote_addr;
|
|
|
+ proxy_set_header Host $host;
|
|
|
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
+ }
|
|
|
+ }
|
|
|
+ ```
|
|
|
+
|
|
|
+3. 重启Nginx
|
|
|
+
|
|
|
+ ```shell
|
|
|
+ $ nginx -t # 如果没有报错请继续
|
|
|
+ $ nginx -s reload
|
|
|
+ ```
|
|
|
+
|
|
|
+### 开始使用Jumpserver
|
|
|
+
|
|
|
+服务全部启动后, 访问http://localhost
|
|
|
+
|
|
|
+账号：admin
|
|
|
+
|
|
|
+密码：admin
|
|
|
+
|
|
|
+完结！
|
