大橙子网站建设,新征程启航
为企业提供网站建设、域名注册、服务器等服务
博文大纲:
一、Jumpserver简介
二、安装Jumpserver准备环境
三、配置Python 3环境
四、安装Jumpserver
五、安装mariadb、redis并配置jumpserver
六、安装coco组件并配置
七、安装guacamole及luna
八、安装nginx
九、客户端访问测试新会网站建设公司成都创新互联,新会网站设计制作,有大型网站制作公司丰富经验。已为新会近1000家提供企业网站建设服务。企业网站搭建\成都外贸网站建设公司要多少钱,请找那个售后服务好的新会做网站的公司定做!
Jumpserver是全球首款完全开源的堡垒机,使用GNU GPL v2.0开源协议,是符合4A的专业运维审计系统。
Jumpserver 使用 Python / Django 进行开发, 遵循 Web 2.0 规范, 配备了业界领先的 Web Terminal 解决方案, 交互界面美观、用户体验好。
Jumpserver 采纳分布式架构, 支持多机房跨区域部署, 中心节点提供 API, 各机房部署登录节点, 可横向扩展、无并发访问限制。
Jumpserver 现已支持管理 SSH、 Telnet、 RDP、 VNC 协议资产。
Jumpserver的特点:
- 完全开源;
- Python编写,易于二次开发;
- 实现跳板机的基本功能、认证、授权、审计;
- 集成了Ansiable,实现批量操作命令等;
- 支持web终端;
- Bootstrap编写,界面美观;
- 自动收集硬件信息;
- 录像回放、命令搜索、实时监控;
下载所需软件包
- 硬件配置:2个CPU核心、4G内存、50G硬盘(最低);
- 操作系统:Linux 发行版 x86_64;
- python环境3.6.x以上;
- 数据库:msyq或者mariadb,l版本必须是5.6以上;
- Redis;
- Jumpserver:管理后台,管理员可以通过Web页面进行资产管理、用户管理、资产授权等操作;用户可以通过Web页面进行资产登录、文件管理等操作;
- koko:提供SSH Server 和 Web Terminal Server 。用户可以使用自己的账户通过 SSH 或者 Web Terminal 访问 SSH 协议和 Telnet 协议资产;
- Luna:提供Web Terminal Server前端页面,用户使用Web Termina方式登录所需组件;
- Guacamole:为 RDP 协议和 VNC 协议资产组件, 用户可以通过 Web Terminal 来连接 RDP 协议和 VNC 协议资产(常用于windows服务器);
如图:
- Jumpserver默认Web端口为8080/tcp、默认WS端口为8070/tcp;配置文件为jumpserver/config.yml;
- koko默认SSH端口为2222/tcp、默认为Web Terninal端口为5000/tcp;配置文件为koko/config.yml;
- Guacamole默认端口为 8081/tcp; 配置文件为/config/tomcat9/conf/server.xml
- Nginx默认端口为 80/tcp;
- Redis默认端口为 6379/tcp;
- MySQL/mariadb默认端口为 3306/tcp;
[root@jumpserver ~]# localedef -c -f UTF-8 -i zh_CN zh_CN.UTF-8
[root@jumpserver ~]# export LC_ALL=zh_CN.UTF-8
[root@jumpserver ~]# echo 'LC_ALL=zh_CN.UTF-8' > /etc/locale.conf
[root@jumpserver ~]# yum -y install wget sqlite-devel xz gcc automake zlib-devel openssl-devel epel-release git
//下载所需依赖
[root@jumpserver ~]# tar xf Python-3.6.1.tar.xz -C /usr/src
[root@jumpserver ~]# cd /usr/src/Python-3.6.1/
[root@jumpserver Python-3.6.1]# ./configure && make && make install
//编译安装python 3环境
[root@jumpserver Python-3.6.1]# cd /opt
[root@jumpserver opt]# python3 -m venv py3
[root@jumpserver opt]# source /opt/py3/bin/activate
(py3) [root@jumpserver opt]#
//出现这样的字符表示在python 3虚拟环境成功
(py3) [root@jumpserver opt]# unzip autoenv.zip
(py3) [root@jumpserver opt]# echo "source /opt/autoenv/activate.sh" >> /root/.bashrc
(py3) [root@jumpserver opt]# source /root/.bashrc
//使用autoenv设置为自动载入python 3的虚拟环境
(py3) [root@jumpserver opt]# unzip jumpserver.zip
(py3) [root@jumpserver opt]# echo "source /opt/py3/bin/activate" > /opt/jumpserver/.env
(py3) [root@jumpserver opt]# cd jumpserver/
autoenv:
autoenv: WARNING:
autoenv: This is the first time you are about to source /opt/jumpserver/.env:
autoenv:
autoenv: --- (begin contents) ---------------------------------------
autoenv: source /opt/py3/bin/activate$
autoenv:
autoenv: --- (end contents) -----------------------------------------
autoenv:
autoenv: Are you sure you want to allow this? (y/N) y //输入“y”表示自动载入python3环境
(py3) [root@jumpserver jumpserver]# cd requirements/
(py3) [root@jumpserver requirements]# yum -y install $(cat rpm_requirements.txt)
//安装所需依赖
(py3) [root@jumpserver requirements]# pip install --upgrade pip
(py3) [root@jumpserver requirements]# pip install wheel
(py3) [root@jumpserver requirements]# pip install -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/
//安装python所需依赖
安装mariadb
(py3) [root@jumpserver requirements]# yum -y install mariadb mariadb-devel mariadb-server
(py3) [root@jumpserver requirements]# systemctl start mariadb
(py3) [root@jumpserver requirements]# mysqladmin -u root password 123.com
(py3) [root@jumpserver requirements]# mysql -u root -p123.com
MariaDB [(none)]> create database jumpserver default charset 'utf8' ;
MariaDB [(none)]> grant all on jumpserver.* to jumpserver@127.0.0.1 identified by '123.com';
MariaDB [(none)]> flush privileges;
(py3) [root@jumpserver requirements]# ss -lnt | grep 3306
LISTEN 0 50 *:3306 *:*
安装redis
(py3) [root@jumpserver requirements]# yum -y install redis
(py3) [root@jumpserver requirements]# systemctl start redis
(py3) [root@jumpserver requirements]# ss -lnt | grep 6379
LISTEN 0 128 127.0.0.1:6379 *:*
配置jumpserver
(py3) [root@jumpserver ~]# cd /opt/jumpserver/
(py3) [root@jumpserver jumpserver]# cp config_example.yml config.yml
#生成秘钥令牌
(py3) [root@jumpserver jumpserver]# SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 50`
(py3) [root@jumpserver jumpserver]# echo "SECRET_KEY=$SECRET_KEY" >> ~/.bashrc
(py3) [root@jumpserver jumpserver]# BOOTSTRAP_TOKEN=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 16`
(py3) [root@jumpserver jumpserver]# echo "BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN" >> ~/.bashrc
(py3) [root@jumpserver jumpserver]# sed -i "s/SECRET_KEY:/SECRET_KEY: $SECRET_KEY/g" /opt/jumpserver/config.yml
(py3) [root@jumpserver jumpserver]# sed -i "s/BOOTSTRAP_TOKEN:/BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g" /opt/jumpserver/config.yml
(py3) [root@jumpserver jumpserver]# sed -i "s/# DEBUG: true/DEBUG: false/g" /opt/jumpserver/config.yml
(py3) [root@jumpserver jumpserver]# sed -i "s/# LOG_LEVEL: DEBUG/LOG_LEVEL: ERROR/g" /opt/jumpserver/config.yml
(py3) [root@jumpserver jumpserver]# sed -i "s/# SESSION_EXPIRE_AT_BROWSER_CLOSE: False/SESSION_EXPIRE_AT_BROWSER_CLOSE: true/g" /opt/jumpserver/config.yml
(py3) [root@jumpserver jumpserver]# sed -i "s/DB_PASSWORD: /DB_PASSWORD: 123.com/g" /opt/jumpserver/config.yml
(py3) [root@jumpserver jumpserver]# echo -e "\033[31m 你的SECRET_KEY是 $SECRET_KEY \033[0m"
你的SECRET_KEY是 UmIWcyEGJN6JfCbCYnthtlK7z4wQ8HwlEL2DagdBxPJjWWRdSN
(py3) [root@jumpserver jumpserver]# echo -e "\033[31m 你的BOOTSTRAP_TOKEN是 $BOOTSTRAP_TOKEN \033[0m"
你的BOOTSTRAP_TOKEN是 qFs86ALWXpamrBaH
(py3) [root@jumpserver jumpserver]# egrep -v '^$|^#' config.yml
SECRET_KEY: UmIWcyEGJN6JfCbCYnthtlK7z4wQ8HwlEL2DagdBxPJjWWRdSN
BOOTSTRAP_TOKEN: qFs86ALWXpamrBaH
DEBUG: false
LOG_LEVEL: ERROR
DB_ENGINE: mysql
DB_HOST: 127.0.0.1
DB_PORT: 3306
DB_USER: jumpserver
DB_PASSWORD: 123.com
DB_NAME: jumpserver
HTTP_BIND_HOST: 0.0.0.0
HTTP_LISTEN_PORT: 8080
REDIS_HOST: 127.0.0.1
REDIS_PORT: 6379
(py3) [root@jumpserver jumpserver]# ./jms start all -d
(py3) [root@jumpserver jumpserver]# ss -lnt | grep 8080
LISTEN 0 128 *:8080 *:*
(py3) [root@jumpserver opt]# unzip coco.zip
(py3) [root@jumpserver opt]# cd coco
(py3) [root@jumpserver coco]# echo "source /opt/py3/bin/activate" > /opt/coco/.env
(py3) [root@jumpserver coco]# cd requirements/
autoenv:
autoenv: WARNING:
autoenv: This is the first time you are about to source /opt/coco/.env:
autoenv:
autoenv: --- (begin contents) ---------------------------------------
autoenv: source /opt/py3/bin/activate$
autoenv:
autoenv: --- (end contents) -----------------------------------------
autoenv:
autoenv: Are you sure you want to allow this? (y/N) y
(py3) [root@jumpserver requirements]# yum -y install $(cat rpm_requirements.txt)
(py3) [root@jumpserver requirements]# pip install -r requirements.txt
(py3) [root@jumpserver requirements]# cd ..
(py3) [root@jumpserver coco]# cp config_example.yml config.yml
(py3) [root@jumpserver coco]# echo -e "\033[31m 你的BOOTSTRAP_TOKEN是 $BOOTSTRAP_TOKEN \033[0m"
你的BOOTSTRAP_TOKEN是 qFs86ALWXpamrBaH
(py3) [root@jumpserver coco]# sed -i "s/BOOTSTRAP_TOKEN: /BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g" config.yml
(py3) [root@jumpserver coco]# sed -i "s/# LOG_LEVEL: INFO/LOG_LEVEL: ERROR/g" config.yml
(py3) [root@jumpserver coco]# egrep -v '^$|^#' config.yml
CORE_HOST: http://127.0.0.1:8080
BOOTSTRAP_TOKEN: qFs86ALWXpamrBaH
//注意保证16个随机字符保证与jumpserver配置文件中的16个随机字符保证一致
LOG_LEVEL: ERROR
(py3) [root@jumpserver coco]# ./cocod start -d
(py3) [root@jumpserver coco]# ss -lnt | grep 2222
LISTEN 0 5 *:2222 *:*
(py3) [root@jumpserver ~]# yum install -y yum-utils device-mapper-persistent-data lvm2
(py3) [root@jumpserver ~]# yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
(py3) [root@jumpserver ~]# yum makecache fast
(py3) [root@jumpserver ~]# yum -y install docker-ce
(py3) [root@jumpserver ~]# systemctl start docker
(py3) [root@jumpserver ~]# docker load < guacamole.tar
(py3) [root@jumpserver ~]# docker run --name jms_guacamole -d \
-p 8081:8080 -v /opt/guacamole/key:/config/guacamole/key \
-e JUMPSERVER_KEY_DIR=/config/guacamole/key \
-e JUMPSERVER_SERVER=http://192.168.1.10:8080 \
jumpserver/guacamole:latest
(py3) [root@jumpserver ~]# ss -lnt | grep 8081
LISTEN 0 128 :::8081 :::*
(py3) [root@jumpserver ~]# tar zxf luna.tar.gz -C /opt
(py3) [root@jumpserver ~]# tar zxf nginx-1.2.4.tar.gz -C /usr/src
(py3) [root@jumpserver ~]# cd /usr/src/nginx-1.2.4/
(py3) [root@jumpserver nginx-1.2.4]# ./configure && make && make install
(py3) [root@jumpserver nginx-1.2.4]# ln -sf /usr/local/nginx/sbin/nginx /usr/local/bin/
(py3) [root@jumpserver nginx-1.2.4]# cd /usr/local/nginx/conf/
(py3) [root@jumpserver conf]# cp nginx.conf nginx.conf.bak
(py3) [root@jumpserver conf]# mv /root/nginx.conf .
mv:是否覆盖"./nginx.conf"? y
(py3) [root@jumpserver conf]# nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
(py3) [root@jumpserver conf]# nginx
(py3) [root@jumpserver conf]# ss -lnt | grep -w 80
LISTEN 0 128 *:80 *:*
如图:
此用户用于登录Jumpserver web页面的用户,创建过程如下:
此用户主要用于管理后端资源,创建方法如下:
此用户主要用于登录后端资产,创建方法如下:
实验环境,所以就开启一台虚拟机192.168.1.1作为测试(web页面的客户端与后端资产肯定不在同一网段,因为用户是通过公网登录到jumpserver才可以对后端服务器进行操作的)!
最后,虽然写文档花费了不少时间,但是还是建议大家参考Jumpserver官方文档
————————————本文到此结束,感谢阅读——————————————