您好,登录后才能下订单哦!
Jumpserver 介绍
Jumpserver 核心功能列表
Jumpserver 环境要求
Jumpserver 部署
安装 redis
安装Mariadb
修改 Jumpserver 配置文件
启动 Jumpserver
测试访问
Jumpserver 插件安装
Koko 组件部署
Luna 组件部署
Guacamole 组件部署
配置 Nginx 整合各个组件
官方站点:www.jumpserver.org
Jumpserver是全球首款完全开源的堡垒机,使用GNU GPL v2.0开源协议,是符合4A的韵味安全审计系统。
Jumpserver使用Python/Django开发,遵循 Web 2.0规范,Jumpserver采纳分布式架构,支持多机房跨区域部署,支持横向扩展,无资产数量并发限制。
现在Jumpserver已支持SSH、Telnet、RDP、VNC协议资产。
身份验证 Authentication
账号管理 Account
授权控制 Authorization
安全审计 Audit
资产管理 CMDB
硬件配置:2个CPU核心,4G内存,50G硬盘(最低标准)
操作系统:Linux发行版 x86_64
Python = 3.6x
MySQL Server >= 5.6
Mariadb Server >= 5.5.56
Redis
1.安装依赖环境
yum install wget gcc-c++ epel-release git -y
2.安装python36
[root@Jumpserver ~]# yum install python36.x86_64 python36-devel.x86_64 -y [root@Jumpserver ~]# python36 -V Python 3.6.8
3.建立python虚拟环境
[root@Jumpserver ~]# python36 -m venv /opt/py3
4.载入python3虚拟环境
每次操作 jumpserver 都需要使用下面的命令载入 py3 虚拟环境
看到下面的提示将代表成功进入虚拟环境,以后运行jumpserver都要现运行上面的source命令,以下所有的命令都在虚拟环境中运行
[root@Jumpserver ~]# source /opt/py3/bin/activate (py3) [root@Jumpserver ~]# #进入 jumpserver 目录时将自动载入 python 虚拟环境,就不需要每次进入jumpser操作source命令了 (py3) [root@Jumpserver ~]# echo "source /opt/py3/bin/activate" > /opt/jumpserver/.env
5.获取Jumpserver代码
(py3) [root@Jumpserver ~]# cd /opt/ (py3) [root@Jumpserver opt]# git clone --depth=1 https://github.com/jumpserver/jumpserver.git Cloning into 'jumpserver'... remote: Enumerating objects: 1156, done. remote: Counting objects: 100% (1156/1156), done. remote: Compressing objects: 100% (1028/1028), done. remote: Total 1156 (delta 193), reused 632 (delta 64), pack-reused 0 Receiving objects: 100% (1156/1156), 6.96 MiB | 13.00 KiB/s, done. Resolving deltas: 100% (193/193), done.
6.安装jumpserver依赖RPM包
(py3) [root@Jumpserver opt]# cd /opt/jumpserver/requirements/ (py3) [root@Jumpserver requirements]# yum install $(cat rpm_requirements.txt) -y (py3) [root@Jumpserver requirements]# pip install --upgrade pip (py3) [root@Jumpserver requirements]# pip install -r requirements.txt
Jumpserver要使用redis
可以使用yum安装,也可以编译安装,我这里使用编译安装redis
1.安装redis
[root@Jumpserver src]# wget http://download.redis.io/releases/redis-5.0.5.tar.gz [root@Jumpserver redis-5.0.5]# make [root@Jumpserver redis-5.0.5]# cd src/ [root@Jumpserver src]# make install PREFIX=/usr/local/redis [root@Jumpserver src]# mkdir /usr/local/redis/etc [root@Jumpserver src]# cd /usr/local/src/redis-5.0.5 [root@Jumpserver redis-5.0.5]# cp -rf redis.conf /usr/local/redis/etc/
2.修改配置文件
cat << EOF > /usr/local/redis/etc/redis.conf daemonize yes port 6379 bind IP地址 protected-mode yes pidfile "/usr/local/redis/run/redis.pid" loglevel notice logfile "/usr/local/redis/logs/redis.log" save 900 1 stop-writes-on-bgsave-error yes rdbcompression yes rdbchecksum yes dbfilename dump.rdb dir "/usr/local/redis/data/rdb/" timeout 0 tcp-keepalive 300 EOF
3.创建目录并启动redis
#创建pid文件目录、日志目录、redis持久化目录 [root@Jumpserver redis-5.0.5]# mkdir -p /usr/local/redis/{run,logs} [root@Jumpserver redis-5.0.5]# mkdir -p /usr/local/redis/data/rdb/ #启动redis [root@Jumpserver redis-5.0.5]# /usr/local/redis/bin/redis-server /usr/local/redis/etc/redis.conf
Jumpserver使用数据库,可以选择MySQL或者Mariadb.Mariadb版本需要等于大于5.56,MySQL版本需要等于大于5.6
在此我选择使用yum方式部署Mariadb
1.查看Mariadb版本是否符合标准

2.安装Mariadb
[root@Jumpserver /]# yum install mariadb.x86_64 mariadb-devel.x86_64 mariadb-server.x86_64 -y
3.启动Mariadb
[root@Jumpserver /]# systemctl enable mariadb [root@Jumpserver /]# systemctl start mariadb
4.修改Mariadb数据库root密码
[root@Jumpserver /]# mysql -uroot -p Enter password: #首次连接数据库,直接回车即可 MariaDB [(none)]> set password for 'root'@localhost=password('xxxxxxxx'); MariaDB [(none)]> flush privileges;
5.创建数据库 Jumpserver 并授权
MariaDB [(none)]> grant all on jumpserver.* to 'jumpserver'@'127.0.0.1' identified by 'xxxxxxxx'; MariaDB [(none)]> flush privileges;
[root@Jumpserver /]# cp -rf /opt/jumpserver/config_example.yml /opt/jumpserver/config.yml [root@Jumpserver /]# grep -Ev "#|^$" /opt/jumpserver/config.yml SECRET_KEY: PwbiQAk0sQCStkR7FwauW3bYCBwJUqPEI4iVs6xyYczfEOWtH #加密秘钥,可以使用配置文件中的命令生成 BOOTSTRAP_TOKEN: PleasgeChangeSameWithJumpserver. #预共享Token coco和guacamole用来注册服务账号,不在使用原来的注册接受机制 DB_ENGINE: mysql #使用MySQL数据库 DB_HOST: 127.0.0.1 #数据库连接地址 DB_PORT: 3306 #数据库连接端口 DB_USER: jumpserver #数据库连接用户 DB_PASSWORD: xxxxxxxx #数据库连接密码 DB_NAME: jumpserver #数据库名称 HTTP_BIND_HOST: 0.0.0.0 #Jumpserver运行时绑定的地址,0.0.0.0表示所有地址都绑定 HTTP_LISTEN_PORT: 8080 #Jumpserver运行时绑定的端口 REDIS_HOST: xxx.xxx.xx.xxx #Jumpserver连接redis主机地址 REDIS_PORT: 6379 #Jumpserver连接redis主机端口
#确保进入 py3 虚拟环境之后,再启动jumpserver,-d 选项为后台启动 [root@Jumpserver jumpserver]# source /opt/py3/bin/activate (py3) [root@Jumpserver jumpserver]# cd /opt/jumpserver/ (py3) [root@Jumpserver jumpserver]# ./jms start -d
访问地址:http://xxxxx:8080/auth/login/?next=/
账号密码默认为:admin/admin


登录成功后的界面还是非常美观的
Jumpserver本身的功能已经足够强大,但是加上以下几个组件更是让Jumpserver锦上添花。
组件如下:
Coco:Coco为 SSH Server 和 Web Terminal Server。用户可以通过使用自己的账户登录 SSH 或者 Web Terminal直接访问被授权的资产。不需要知道服务器的账户和密码,现在 Coco 已经被 koko 取代。
Luna:luna 为 Web Terminal Server 前端页面,用户使用 Web Terminal 方式登录时所需要的插件。
Guacamole:Guacamole 为 Windows 组件,用户可以通过 Web Terminal 来连接 Windows 资产(暂时只能通过 Web Terminal来访问)
各个组件所监听的端口如下:
Jumpserver:8080/tcp Redis:6379/tcp MySQL/Mariadb:3306/tcp Nginx:80/tcp Koko:SSH为2222/tcp,Web Terminal为5000/tcp Guacamole:8081/tcp
1.Koko 组件部署
[root@Jumpserver ~]# source /opt/py3/bin/activate (py3) [root@Jumpserver ~]# cd /opt/ (py3) [root@Jumpserver opt]# wget https://github.com/jumpserver/koko/releases/download/1.5.2/koko-master-6d4e69b-linux-amd64.tar.gz (py3) [root@Jumpserver opt]# tar xf koko-master-6d4e69b-linux-amd64.tar.gz (py3) [root@Jumpserver opt]# chown -R root:root kokodir
2.修改 Koko配置文件
(py3) [root@Jumpserver opt]# cd kokodir/ (py3) [root@Jumpserver kokodir]# cp -rf config_example.yml config.yml #Koko配置文件如下: (py3) [root@Jumpserver kokodir]# grep -Ev "#|^$" /opt/kokodir/config.yml CORE_HOST: http://127.0.0.1:8080 #Jumpserver项目的url, api请求注册会使用 BOOTSTRAP_TOKEN: PleasgeChangeSameWithJumpserver. #Bootstrap Token, 预共享秘钥, 用来注册coco使用的service account和terminal,请和jumpserver 配置文件中的 BOOTSTRAP_TOKEN 保持一致,注册完成后可以删除
3.启动 Koko
#先重启下 Jumpserver (py3) [root@Jumpserver jumpserver]# ./jms restart #先进行前台启动 koko,如果前台没问题,则使用 nohup & 命令来后台启动 (py3) [root@Jumpserver kokodir]# nohup ./koko & #查看koko进程 (py3) [root@Jumpserver kokodir]# ps -ef|grep koko root 24694 23736 0 04:44 pts/1 00:00:00 ./koko root 24734 23736 0 04:45 pts/1 00:00:00 grep --color=auto koko (py3) [root@Jumpserver kokodir]# ss -anplt | grep koko LISTEN 0 128 :::5000 :::* users:(("koko",pid=24694,fd=7)) LISTEN 0 128 :::2222 :::* users:(("koko",pid=24694,fd=8))
(py3) [root@Jumpserver /]# cd /opt/ (py3) [root@Jumpserver opt]# wget https://github.com/jumpserver/luna/releases/download/1.5.2/luna.tar.gz (py3) [root@Jumpserver opt]# tar xf luna.tar.gz (py3) [root@Jumpserver opt]# chown -R root:root luna
Guacamole这里使用docker部署
1.安装 docker
1)卸载老版本docker yum remove docker \ docker-common \ docker-selinux \ docker-engine 2)设置yum仓库 yum install -y yum-utils \ device-mapper-persistent-data \ lvm2 yum-config-manager \ --add-repo \ https://download.docker.com/linux/centos/docker-ce.repo 3)安装docker-ce版本 yum list docker-ce --showduplicates | sort -r #列出docker版本 yum install docker-ce-18.06.3.ce -y #选择最新版本安装 4)修改 docker pull 镜像时的加速文件 mkdir /etc/docker vim /etc/docker/daemon.json { "registry-mirrors": ["http://hub-mirror.c.163.com"] } 5)启动 docker systemctl start docker systemctl enable docker
2.使用docker启动Guacamole
docker run --name jms_guacamole -d -p 127.0.0.1:8081:8081 \ -e JUMPSERVER_SERVER=http://127.0.0.1:8080 \ -e BOOTSTRAP_TOKEN=PleasgeChangeSameWithJumpserver \ jumpserver/jms_guacamole:1.5.2
参数解释:
docker run:启动一个容器 --name:指定容器名称 -d:后台启动容器 -p:将容器的127.0.0.1监听的8081端口映射到宿主机的8081端口 -e:设置环境变量 -e JUMPSERVER_SERVER=http://127.0.0.1:8080:将值http://127.0.0.1:8080设置变量为JUMPSERVER_SERVER -e BOOTSTRAP_TOKEN=PleasgeChangeSameWithJumpserver:将值PleasgeChangeSameWithJumpserver设置变量为-e BOOTSTRAP_TOKEN jumpserver/jms__guacamole:1.5.2:下载镜像的名称及版本

1.安装 Nginx
1)准备安装环境 [root@Jumpserver ~]# yum install gcc-c++ libtool pcre-devel openssl-devel zlib-devel -y [root@Jumpserver ~]# useradd -d /home/nginx -M -s /sbin/nologin nginx [root@Jumpserver ~]# id nginx uid=1001(nginx) gid=1001(nginx) groups=1001(nginx) 2)下载并安装Nginx [root@Jumpserver ~]# cd /usr/local/src/ [root@Jumpserver src]# wget http://nginx.org/download/nginx-1.15.10.tar.gz [root@Jumpserver src]# tar xf nginx-1.15.10.tar.gz -C /usr/local/src/ [root@Jumpserver src]# cd /usr/local/src/nginx-1.15.10 [root@Jumpserver nginx-1.15.10]# ./configure --prefix=/usr/local/nginx \ --sbin-path=/usr/local/nginx/sbin/nginx \ --conf-path=/usr/local/nginx/conf/nginx.conf \ --pid-path=/usr/local/nginx/logs/nginx.pid \ --error-log-path=/usr/local/nginx/logs/error.log \ --http-log-path=/usr/local/nginx/logs/access.log \ --with-pcre \ --user=nginx \ --group=nginx \ --with-file-aio \ --with-http_gzip_static_module \ --with-http_stub_status_module \ --with-http_v2_module \ --with-threads \ --with-http_realip_module \ --with-http_ssl_module [root@Jumpserver nginx-1.15.10]# make && make install [root@Jumpserver nginx-1.15.10]# echo $? 0
2.配置 Nginx
[root@Jumpserver /]# mv /usr/local/nginx/conf/nginx.conf /usr/local/nginx/conf/nginx.conf.defaults [root@Jumpserver /]# vim /usr/local/nginx/conf/nginx.conf #全局字段配置 user nginx nginx; worker_processes auto; error_log logs/error.log info; pid logs/nginx.pid; worker_rlimit_nofile 65535; events { use epoll; worker_connections 65535; multi_accept on; } http { include mime.types; default_type application/octet-stream; charset utf-8; server_tokens off; #定义Nginx缓存设置 client_header_buffer_size 4096; large_client_header_buffers 4 128k; client_header_timeout 15; client_body_timeout 15; send_timeout 65; client_max_body_size 10m; open_file_cache max=65535 inactive=60s; open_file_cache_valid 30s; open_file_cache_min_uses 1; open_file_cache_errors on; server_names_hash_bucket_size 128; #定义Nginx日志访问格式 log_format main '$remote_addr" "$remote_user" "[$time_local]" "$request"' ' "$status" "$body_bytes_sent" "$http_referer"' ' "$http_user_agent" "$http_x_forwarded_for" "$gzip_ratio"' ' "$upstream_addr" "$request_time" "$upstream_response_time" "$http_host"'; access_log logs/access.log main; #网络连接功能 sendfile on; autoindex on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 65; types_hash_max_size 2048; reset_timedout_connection on; #压缩功能配置 gzip on; gzip_min_length 1k; gzip_buffers 16 64K; gzip_http_version 1.1; gzip_comp_level 6; gzip_types text/plain application/x-javascript text/css application/xml application/javascript; gzip_vary on; gzip_proxied any; underscores_in_headers on; proxy_ignore_client_abort on; include /usr/local/nginx/conf/conf.d/*.conf; }
3.创建 Nginx 文件并整合功能
[root@Jumpserver /]# mkdir /usr/local/nginx/conf/conf.d [root@Jumpserver /]# vim /usr/local/nginx/conf/conf.d/jumpserver.conf server { listen 80; client_max_body_size 100m; # 录像及文件上传大小限制 location /luna/ { try_files $uri / /index.html; alias /opt/luna/; # luna 路径, 如果修改安装目录, 此处需要修改 } location /media/ { add_header Content-Encoding gzip; root /opt/jumpserver/data/; # 录像位置, 如果修改安装目录, 此处需要修改 } location /static/ { root /opt/jumpserver/data/; # 静态资源, 如果修改安装目录, 此处需要修改 } location /socket.io/ { proxy_pass http://localhost:5000/socket.io/; proxy_buffering off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; access_log off; } location /coco/ { proxy_pass http://localhost:5000/coco/; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; access_log off; } location /guacamole/ { proxy_pass http://localhost:8081/; proxy_buffering off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; access_log off; } location / { proxy_pass http://localhost:8080; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } }
4.启动 检查并启动Nginx
[root@Jumpserver /]# /usr/local/nginx/sbin/nginx -t nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful [root@Jumpserver /]# /usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf
5.输入URL并登录
http://IP
默认账号密码:admin/admin

免责声明:本站发布的内容(图片、视频和文字)以原创、转载和分享为主,文章观点不代表本网站立场,如果涉及侵权请联系站长邮箱:is@yisu.com进行举报,并提供相关证据,一经查实,将立刻删除涉嫌侵权内容。