# 堡垒机Jumpserver搭建 ### 系统环境 * Ubuntu 18.04.2 LTS ### 安装步骤 ##### 准备 Python3 和 Python 虚拟环境 1. 安装依赖包 ```shell $ apt-get update && apt-get -y upgrade $ apt-get -y install wget gcc libffi-dev git libmysqlclient-dev # 修改字符集, 否则可能报 input/output error的问题, 因为日志里打印了中文 $ apt-get -y install language-pack-zh-hans $ export LC_ALL=zh_CN.UTF-8 $ echo 'LANG="zh_CN.UTF-8"' > /etc/default/locale ``` 2. 安装 Python3.6 ```shell $ add-apt-repository ppa:jonathonf/python-3.6 -y $ apt-get update $ apt-get -y install python3.6 python3.6-dev python3.6-venv # 查看python版本，如果存在多版本python则将系统默认python版本切换为python3.6 $ python --version # 如果版本不是Python 3.6，则 $ echo alias python=python3 >> ~/.bashrc $ source ~/.bashrc # 再次检查python版本 $ python --version ``` 3. 建立 Python 虚拟环境 ```shell $ cd /opt $ python3.6 -m venv py3 $ source /opt/py3/bin/activate # 看到下面的提示符代表成功, 以后运行 Jumpserver 都要先运行以上 source 命令, 以下所有命令均在该虚拟环境中运行 (py3) [root@localhost py3] ``` ### 安装Jumpserver （以下所有命令都在python虚拟环境中执行） 1. 下载或 Clone 项目 ```shell $ cd /opt/ $ git clone https://github.com/jumpserver/jumpserver.git ``` 2. 安装依赖包 ```shell $ cd /opt/jumpserver/requirements $ apt-get -y install $(cat deb_requirements.txt) # 如果没有任何报错请继续 ``` 3. 安装 Python 库依赖 ```shell $ pip install --upgrade pip setuptools $ pip install -r requirements.txt # 如果下载速度很慢, 可以换国内源 $ pip install --upgrade pip setuptools -i https://mirrors.aliyun.com/pypi/simple/ $ pip install -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/ ``` 4. 安装 Redis, Jumpserver 使用 Redis 做 cache 和 celery broke ```shell $ apt-get -y install redis-server ``` 5. 安装 MySQL ```shell $ apt-get -y install mysql-server # 安装过程中注意输入数据库 root账户 的密码 ``` 6. 创建数据库 Jumpserver 并授权 ```shell $ DB_PASSWORD=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 24` # 生成随机数据库密码 $ echo -e "\033[31m 你的数据库密码是 $DB_PASSWORD \033[0m" $ mysql -uroot -p -e "create database jumpserver default charset 'utf8'; grant all on jumpserver.* to 'jumpserver'@'127.0.0.1' identified by '$DB_PASSWORD'; flush privileges;" ``` 7. 修改 Jumpserver 配置文件 ```shell $ cd /opt/jumpserver $ cp config_example.yml config.yml $ SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 50` # 生成随机SECRET_KEY $ echo "SECRET_KEY=$SECRET_KEY" >> ~/.bashrc $ BOOTSTRAP_TOKEN=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 16` # 生成随机BOOTSTRAP_TOKEN $ echo "BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN" >> ~/.bashrc $ sed -i "s/SECRET_KEY:/SECRET_KEY: $SECRET_KEY/g" /opt/jumpserver/config.yml $ sed -i "s/BOOTSTRAP_TOKEN:/BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g" /opt/jumpserver/config.yml $ sed -i "s/# DEBUG: true/DEBUG: false/g" /opt/jumpserver/config.yml $ sed -i "s/# LOG_LEVEL: DEBUG/LOG_LEVEL: ERROR/g" /opt/jumpserver/config.yml $ sed -i "s/# SESSION_EXPIRE_AT_BROWSER_CLOSE: false/SESSION_EXPIRE_AT_BROWSER_CLOSE: true/g" /opt/jumpserver/config.yml $ sed -i "s/DB_PASSWORD: /DB_PASSWORD: $DB_PASSWORD/g" /opt/jumpserver/config.yml $ echo -e "\033[31m 你的SECRET_KEY是 $SECRET_KEY \033[0m" $ echo -e "\033[31m 你的BOOTSTRAP_TOKEN是 $BOOTSTRAP_TOKEN \033[0m" ``` 8. 运行 Jumpserver ```shell $ cd /opt/jumpserver $ ./jms start all -d # 后台运行使用 -d 参数./jms start all -d # 运行不报错, 请继续往下操作安装 SSH Server 和 WebSocket Server: Coco ``` ### 安装 SSH Server 和 WebSocket Server: Coco 1. 下载或 Clone 项目 ```shell $ cd /opt $ source /opt/py3/bin/activate $ git clone https://github.com/jumpserver/coco.git && cd coco && git checkout master ``` 2. 安装依赖 ```shell $ cd /opt/coco/requirements $ pip install -r requirements.txt # 如果下载速度很慢, 可以换国内源 $ pip install -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/ ``` 3. 查看配置文件并运行 ```shell $ cd /opt/coco $ cp config_example.yml config.yml $ vi config.yml # 修改BOOTSTRAP_TOKEN为/opt/jumpserver/config.yml的BOOTSTRAP_TOKEN $ ./cocod start -d # 后台运行使用 -d 参数./cocod start -d ``` ### 安装 Web Terminal 前端: Luna 1. 下载解压Luna ```shell $ cd /opt/ $ wget https://github.com/jumpserver/luna/releases/download/1.4.9/luna.tar.gz # 如果网络有问题导致下载无法完成可以使用下面地址 $ wget https://demo.jumpserver.org/download/luna/1.4.9/luna.tar.gz $ tar xf luna.tar.gz $ chown -R root:root luna ``` ### 配置 Nginx 整合各组件 1. 安装 Nginx ```shell $ apt-get -y install nginx $ rm -rf /etc/nginx/site-enabled/default ``` 2. 创建配置文件 /etc/nginx/site-enabled/jumpserver.conf ```shell $ vim /etc/nginx/site-enabled/jumpserver.conf # 文件内容 server { listen 80; server_name _; client_max_body_size 100m; # 录像及文件上传大小限制 location /luna/ { try_files $uri / /index.html; alias /opt/luna/; # luna 路径, 如果修改安装目录, 此处需要修改 } location /media/ { add_header Content-Encoding gzip; root /opt/jumpserver/data/; # 录像位置, 如果修改安装目录, 此处需要修改 } location /static/ { root /opt/jumpserver/data/; # 静态资源, 如果修改安装目录, 此处需要修改 } location /socket.io/ { proxy_pass http://localhost:5000/socket.io/; # 如果coco安装在别的服务器, 请填写它的ip proxy_buffering off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; access_log off; } location /coco/ { proxy_pass http://localhost:5000/coco/; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; access_log off; } location /guacamole/ { proxy_pass http://localhost:8081/; # 如果guacamole安装在别的服务器, 请填写它的ip proxy_buffering off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; access_log off; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } location / { proxy_pass http://localhost:8080; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } } ``` 3. 重启Nginx ```shell $ nginx -t # 如果没有报错请继续 $ nginx -s reload ``` ### 开始使用Jumpserver 服务全部启动后, 访问http://localhost 账号：admin 密码：admin 完结！