浏览器上登录堡垒机_干货：JumpServer堡垒机部署文档整理（上）

测试环境说明：

JumpServer Version 2.0.1 GPLv2 操作系统：Centos7.3 ESXI6.5虚拟环境 IP地址：10.128.25.229

系统: CentOS7

硬件配置: 2个CPU核心, 4G内存, 50G硬盘(最低)

操作系统: Linux发行版 x86_64

Python= 3.6.x

MysqlServer≥ 5.6

MariadbServer≥ 5.5.56

Redis

准备工作：设置linux安全、关闭防火墙

[root@jumpserver2 ~]# getenforce

Enforcing

[root@jumpserver2 ~]# cat /etc/selinux/config

# This file controls the state of SELinux on the system.

# SELINUX= can take one of these three values:

# enforcing - SELinux security policy is enforced.

# permissive - SELinux prints warnings instead of enforcing.

# disabled - No SELinux policy is loaded.

SELINUX=disabled

# SELINUXTYPE= can take one of three two values:

# targeted - Targeted processes are protected,

# minimum - Modification of targeted policy. Only selected processes are protected.

# mls - Multi Level Security protection.

SELINUXTYPE=targeted

[root@jumpserver2 ~]# reboot

[root@jumpserver2 ~]#

[root@jumpserver2 ~]# getenforce

Disabled

[root@jumpserver2 ~]# systemctl stop firewalld

修改字符集

[root@jumpserver2 ~]# localedef -c -f UTF-8-i zh_CN zh_CN.UTF-8

[root@jumpserver2 ~]# export LC_ALL=zh_CN.UTF-8

[root@jumpserver2 ~]# echo 'LANG="zh_CN.UTF-8"'> /etc/locale.conf

[root@jumpserver2 ~]#

注：

Using legacy 'setup.py install'for dotmap, since package'wheel'isnot installed.

Using legacy 'setup.py install'for jms-storage, since package'wheel'isnot installed.

Using legacy 'setup.py install'for jumpserver-python-sdk, since package'wheel'isnot installed.

Using legacy 'setup.py install'forMarkupSafe, since package'wheel'isnot installed.

上面这个错误提示，用下面解决。

[root@jumpserver2 ~]# pip install --upgrade pip setuptools==45.2.0

正式安装

一. 准备 Python3 和 Python 虚拟环境

1.1 安装依赖包

[root@jumpserver2 ~]# yum -y install wget gcc epel-release git

已加载插件：fastestmirror, langpacks

Loading mirror speeds from cached hostfile

* base: mirrors.aliyun.com

* extras: mirrors.aliyun.com

* updates: mirrors.aliyun.com

正在解决依赖关系

1.2 安装 Python3.6

[root@jumpserver2 ~]# yum -y install python36 python36-devel

#上面安装缓慢，改为国内源，然后安装

[root@jumpserver2 ~]# wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo

--2020-10-3109:07:32-- http://mirrors.aliyun.com/repo/epel-7.repo

正在解析主机 mirrors.aliyun.com (mirrors.aliyun.com)... 124.239.234.249, 27.128.221.241, 124.239.158.233, ...

[root@jumpserver2 ~]#

[root@jumpserver2 ~]# yum -y install python36 python36-devel

已加载插件：fastestmirror, langpacks

1.3 建立 Python 虚拟环境

因为 CentOS 7 自带的是 Python2, 而 Yum 等工具依赖原来的 Python, 为了不扰乱原来的环境我们来使用 Python 虚拟环境 。

[root@jumpserver2 ~]# cd /opt

[root@jumpserver2 opt]# python3.6-m venv py3

[root@jumpserver2 opt]# source /opt/py3/bin/activate

(py3) [root@jumpserver2 opt]#

# 看到上面的提示符代表成功, 以后运行 Jumpserver 都要先运行以上 source 命令, 以下所有命令均在该虚拟环境中运行(py3) [root@jumpserver2 opt]

二. 安装 Jumpserver

2.1 下载或 Clone 项目

(py3) [root@jumpserver2 opt]# cd /opt/

(py3) [root@jumpserver2 opt]# git clone https://github.com/jumpserver/jumpserver.git

2.2 安装依赖 RPM 包

(py3) [root@jumpserver2 opt]# cd /opt/jumpserver/requirements

(py3) [root@jumpserver2 opt]# yum -y install $(cat rpm_requirements.txt) # 没有任何报错继续

2.3 安装 Python 库依赖

(py3) [root@jumpserver2 requirements ]# pip install --upgrade pip setuptools

(py3) [root@jumpserver2 requirements ]# pip install -r requirements.txt

或者 # 如果下载速度很慢, 可以换国内源

(py3) [root@jumpserver2 requirements ]# pip install --upgrade pip setuptools -i https://mirrors.aliyun.com/pypi/simple/

(py3) [root@jumpserver2 requirements ]# pip install -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/

2.4 安装 Redis, Jumpserver 使用 Redis 做 cache 和 celery broke

(py3) [root@jumpserver2 requirements ]# yum -y install redis

(py3) [root@jumpserver2 requirements ]# systemctl enable redis

(py3) [root@jumpserver2 requirements ]# systemctl start redis

2.5 安装 MySQL

(py3) [root@jumpserver2 requirements]# yum -y install mariadb mariadb-devel mariadb-server

# centos7下安装的是mariadb

(py3) [root@jumpserver2 requirements]# systemctl enable mariadb

Created symlink from/etc/systemd/system/multi-user.target.wants/mariadb.service to /usr/lib/systemd/system/mariadb.service.

(py3) [root@jumpserver2 requirements]# systemctl start mariadb

2.6 创建数据库 Jumpserver 并授权

(py3) [root@jumpserver2 requirements]# DB_PASSWORD=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 24`

(py3) [root@jumpserver2 requirements]# echo -e "\033[31m 你的数据库密码是 $DB_PASSWORD \033[0m"

你的数据库密码是 1IpF7aKoZMUTadukkuKxt32d

(py3) [root@jumpserver2 requirements]# mysql -uroot -e "create database jumpserver default charset 'utf8'; grant all on jumpserver.* to 'jumpserver'@'127.0.0.1' identified by '$DB_PASSWORD'; flush privileges;"

(py3) [root@jumpserver2 requirements]#

2.7 修改 Jumpserver 配置文件

(py3) [root@jumpserver2 requirements ]# cd /opt/jumpserver

(py3) [root@jumpserver2 jumpserver]# cp config_example.yml config.yml

接着修改

(py3) [root@jumpserver2 jumpserver]# SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 50`

(py3) [root@jumpserver2 jumpserver]# BOOTSTRAP_TOKEN=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 16`

(py3) [root@jumpserver2 jumpserver]# sed -i "s/SECRET_KEY:/SECRET_KEY: $SECRET_KEY/g"/opt/jumpserver/config.yml

(py3) [root@jumpserver2 jumpserver]# sed -i "s/BOOTSTRAP_TOKEN:/BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g"/opt/jumpserver/config.yml

(py3) [root@jumpserver2 jumpserver]# sed -i "s/# DEBUG: true/DEBUG: false/g"/opt/jumpserver/config.yml

(py3) [root@jumpserver2 jumpserver]# sed -i "s/# LOG_LEVEL: DEBUG/LOG_LEVEL: ERROR/g"/opt/jumpserver/config.yml

(py3) [root@jumpserver2 jumpserver]# sed -i "s/# SESSION_EXPIRE_AT_BROWSER_CLOSE: false/SESSION_EXPIRE_AT_BROWSER_CLOSE: true/g"/opt/jumpserver/config.yml

(py3) [root@jumpserver2 jumpserver]# sed -i "s/DB_PASSWORD: /DB_PASSWORD: $DB_PASSWORD/g"/opt/jumpserver/config.yml

(py3) [root@jumpserver2 jumpserver]# echo -e "\033[31m 你的SECRET_KEY是 $SECRET_KEY \033[0m"

你的SECRET_KEY是 ZwEicLmfh2lv4frlxWMILa05SqF4smyVbvKTBmUFv4rtFUTQw6

(py3) [root@jumpserver2 jumpserver]# echo -e "\033[31m 你的BOOTSTRAP_TOKEN是 $BOOTSTRAP_TOKEN \033[0m"

你的BOOTSTRAP_TOKEN是 uSBKn3R6h1Glh5cd

(py3) [root@jumpserver2 jumpserver]#

然后检查文件修改情况：

(py3) [root@jumpserver2 jumpserver]# cat config.yml

# SECURITY WARNING: keep the secret key used in production secret!

# 加密秘钥 生产环境中请修改为随机字符串，请勿外泄, 可使用命令生成

# $ cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 49;echo

SECRET_KEY: ZwEicLmfh2lv4frlxWMILa05SqF4smyVbvKTBmUFv4rtFUTQw6

# SECURITY WARNING: keep the bootstrap token used in production secret!

# 预共享Token coco和guacamole用来注册服务账号，不在使用原来的注册接受机制

BOOTSTRAP_TOKEN: uSBKn3R6h1Glh5cd

# Development env open this, when error occur display the full process track, Production disable it

# DEBUG 模式 开启DEBUG后遇到错误时可以看到更多日志

DEBUG: false

# DEBUG, INFO, WARNING, ERROR, CRITICAL can set. See https://docs.djangoproject.com/en/1.10/topics/logging/

# 日志级别

LOG_LEVEL: ERROR

# LOG_DIR:

# Session expiration setting, Default 24 hour, Also set expired on on browser close

# 浏览器Session过期时间，默认24小时, 也可以设置浏览器关闭则过期

# SESSION_COOKIE_AGE: 86400

SESSION_EXPIRE_AT_BROWSER_CLOSE: true

# Database setting, Support sqlite3, mysql, postgres ....

# 数据库设置

# See https://docs.djangoproject.com/en/1.10/ref/settings/#databases

# SQLite setting:

# 使用单文件sqlite数据库

# DB_ENGINE: sqlite3

# DB_NAME:

# MySQL or postgres setting like:

# 使用Mysql作为数据库

DB_ENGINE: mysql

DB_HOST: 127.0.0.1

DB_PORT: 3306

DB_USER: jumpserver

DB_PASSWORD: 1IpF7aKoZMUTadukkuKxt32d

DB_NAME: jumpserver

# When Django start it will bind this host and port

# ./manage.py runserver 127.0.0.1:8080

# 运行时绑定端口

HTTP_BIND_HOST: 0.0.0.0

HTTP_LISTEN_PORT: 8080

WS_LISTEN_PORT: 8070

# Use Redis as broker for celery and web socket

# Redis配置

REDIS_HOST: 127.0.0.1

REDIS_PORT: 6379

# REDIS_PASSWORD:

# REDIS_DB_CELERY: 3

# REDIS_DB_CACHE: 4

# Use OpenID Authorization

# 使用 OpenID 进行认证设置

# AUTH_OPENID: False # True or False

# BASE_SITE_URL: None

# AUTH_OPENID_CLIENT_ID: client-id

# AUTH_OPENID_CLIENT_SECRET: client-secret

# AUTH_OPENID_PROVIDER_ENDPOINT: https://op-example.com/

# AUTH_OPENID_PROVIDER_AUTHORIZATION_ENDPOINT: https://op-example.com/authorize

# AUTH_OPENID_PROVIDER_TOKEN_ENDPOINT: https://op-example.com/token

# AUTH_OPENID_PROVIDER_JWKS_ENDPOINT: https://op-example.com/jwks

# AUTH_OPENID_PROVIDER_USERINFO_ENDPOINT: https://op-example.com/userinfo

# AUTH_OPENID_PROVIDER_END_SESSION_ENDPOINT: https://op-example.com/logout

# AUTH_OPENID_PROVIDER_SIGNATURE_ALG: HS256

# AUTH_OPENID_PROVIDER_SIGNATURE_KEY: None

# AUTH_OPENID_SCOPES: "openid profile email"

# AUTH_OPENID_ID_TOKEN_MAX_AGE: 60

# AUTH_OPENID_ID_TOKEN_INCLUDE_CLAIMS: True

# AUTH_OPENID_USE_STATE: True

# AUTH_OPENID_USE_NONCE: True

# AUTH_OPENID_SHARE_SESSION: True

# AUTH_OPENID_IGNORE_SSL_VERIFICATION: True

# AUTH_OPENID_ALWAYS_UPDATE_USER: True

# Use Radius authorization

# 使用Radius来认证

# AUTH_RADIUS: false

# RADIUS_SERVER: localhost

# RADIUS_PORT: 1812

# RADIUS_SECRET:

# CAS 配置

# AUTH_CAS': False,

# CAS_SERVER_URL': "http://host/cas/",

# CAS_ROOT_PROXIED_AS': 'http://jumpserver-host:port',

# CAS_LOGOUT_COMPLETELY': True,

# CAS_VERSION': 3,

# LDAP/AD settings

# LDAP 搜索分页数量

# AUTH_LDAP_SEARCH_PAGED_SIZE: 1000

#

# 定时同步用户

# 启用 / 禁用

# AUTH_LDAP_SYNC_IS_PERIODIC: True

# 同步间隔 (单位: 时) (优先)

# AUTH_LDAP_SYNC_INTERVAL: 12

# Crontab 表达式

# AUTH_LDAP_SYNC_CRONTAB: * 6 * * *

#

# LDAP 用户登录时仅允许在用户列表中的用户执行 LDAP Server 认证

# AUTH_LDAP_USER_LOGIN_ONLY_IN_USERS: False

#

# LDAP 认证时如果日志中出现以下信息将参数设置为 0 (详情参见：https://www.python-ldap.org/en/latest/faq.html)

# In order to perform this operation a successful bind must be completed on the connection

# AUTH_LDAP_OPTIONS_OPT_REFERRALS: -1

# OTP settings

# OTP/MFA 配置

# OTP_VALID_WINDOW: 0

# OTP_ISSUER_NAME: Jumpserver

# Perm show single asset to ungrouped node

# 是否把未授权节点资产放入到 未分组 节点中

# PERM_SINGLE_ASSET_TO_UNGROUP_NODE: False

#

# 同一账号仅允许在一台设备登录

# USER_LOGIN_SINGLE_MACHINE_ENABLED: False

#

# 启用定时任务

# PERIOD_TASK_ENABLE: True

#

# 启用二次复合认证配置

# LOGIN_CONFIRM_ENABLE: False

#

# Windows 登录跳过手动输入密码

# WINDOWS_SKIP_ALL_MANUAL_PASSWORD: False

(py3) [root@jumpserver2 jumpserver]#

2.8 运行 Jumpserver

(py3) [root@jumpserver2 jumpserver]# ./jms start all -d

# 后台运行使用 -d 参数./jms start all -d

# 新版本更新了运行脚本, 使用方式./jms start|stop|status|restart all 后台运行请添加 -d 参数

如果运行不报错, 请继续往下操作。

三. 安装 SSH Server 和 WebSocket Server: Coco

3.1 下载或 Clone 项目

(py3) [root@jumpserver2 jumpserver]# cd /opt

(py3) [root@jumpserver2 opt]# source /opt/py3/bin/activate

(py3) [root@jumpserver2 opt]# git clone https://github.com/jumpserver/coco.git

3.2 安装依赖

(py3) [root@jumpserver2 opt]# cd /opt/coco/requirements

(py3) [root@jumpserver2 requirements]# yum -y install $(cat rpm_requirements.txt)

(py3) [root@jumpserver2 requirements]# pip install -r requirements.txt

# 如果下载速度很慢, 可以换国内源

(py3) [root@jumpserver2 requirements]# pip install -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/

3.3 修改配置文件并运行

(py3) [root@jumpserver2 requirements]# cd /opt/coco

(py3) [root@jumpserver2 coco]# cp config_example.yml config.yml

(py3) [root@jumpserver2 coco]# sed -i "s/BOOTSTRAP_TOKEN: /BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g"/opt/coco/config.yml

(py3) [root@jumpserver2 coco]# sed -i "s/# LOG_LEVEL: INFO/LOG_LEVEL: ERROR/g"/opt/coco/config.yml

查看配置文件

(py3) [root@jumpserver2 coco]# cat config.yml

# 项目名称, 会用来向Jumpserver注册, 识别而已, 不能重复

# NAME: {{ Hostname }}

# Jumpserver项目的url, api请求注册会使用

CORE_HOST: http://127.0.0.1:8080

# Bootstrap Token, 预共享秘钥, 用来注册coco使用的service account和terminal

# 请和jumpserver 配置文件中保持一致，注册完成后可以删除

BOOTSTRAP_TOKEN:

# 启动时绑定的ip, 默认 0.0.0.0

# BIND_HOST: 0.0.0.0

# 监听的SSH端口号, 默认2222

# SSHD_PORT: 2222

# 监听的HTTP/WS端口号，默认5000

# HTTPD_PORT: 5000

# 项目使用的ACCESS KEY, 默认会注册,并保存到 ACCESS_KEY_STORE中,

# 如果有需求, 可以写到配置文件中, 格式 access_key_id:access_key_secret

# ACCESS_KEY: null

# ACCESS KEY 保存的地址, 默认注册后会保存到该文件中

# ACCESS_KEY_FILE: data/keys/.access_key

# 加密密钥

# SECRET_KEY: null

# 设置日志级别 [DEBUG, INFO, WARN, ERROR, FATAL, CRITICAL]

LOG_LEVEL: ERROR

# 日志存放的目录

# LOG_DIR: logs

# SSH白名单

# ALLOW_SSH_USER: all

# SSH黑名单, 如果用户同时在白名单和黑名单，黑名单优先生效

# BLOCK_SSH_USER:

# -

# 和Jumpserver 保持心跳时间间隔

# HEARTBEAT_INTERVAL: 5

# Admin的名字，出问题会提示给用户

# ADMINS: ''

# SSH连接超时时间 (default 15 seconds)

# SSH_TIMEOUT: 15

# 语言 [en,zh]

# LANGUAGE_CODE: zh

# SFTP的根目录, 可选 /tmp, Home其他自定义目录

# SFTP_ROOT: /tmp

# SFTP是否显示隐藏文件

# SFTP_SHOW_HIDDEN_FILE: false

# 是否复用和用户后端资产已建立的连接(用户不会复用其他用户的连接)

# REUSE_CONNECTION: true

# 是否强制删除文件夹:(default false)

# FORCE_REMOVE_FOLDER: false

# Telnet连接协商使用的终端类型

# TELNET_TTYPE: XTERM-256COLOR

(py3) [root@jumpserver2 coco]#

下接：JumpServer堡垒机部署文档整理(下)。

学习|生活|分享|积累|永不停步

请留下你指尖的温度

让太阳拥抱你

微信ID:haopython