jumpserver 堡垒机搭建

最新推荐文章于 2024-05-29 09:35:30 发布

生于海平

最新推荐文章于 2024-05-29 09:35:30 发布

阅读量368

点赞数 1

本文链接：https://blog.csdn.net/weixin_45028478/article/details/100990534

版权

jumpserver 堡垒机搭建

jumpserver版本: 1.5.2-2
WEB服务: TOMCAT 9
pyhton版本: python 3.6
web服务: openresy 1.15
系统使用 centos 7.4
数据库: mariadb

简单使用

*	安装完成后,登录地址为:http://ip  用户名/密码:admin/admin/a
*	登录登录查询终端中.两个终端为绿色,一个为ssh,一个windowns使用
*	windows远程只能网页终端.linux 可使用ssh远程操作
*   创建管理用户->系统用户->创建资产->授权用户->登录测试
*	ssh登录 : ssh 用户名@服务器ip -p 端口(未修改端口为:2222)  例;ssh admin@1.1.1.1 -p 2222  输入密码即可
*	详细使用教程请到jumpserver官网查看

##备注
* 该文档使用版本为固定版本,只需拉取项目做,安装好依赖便直接可以启动使用;
* 原项目中使用COCO改用GO语语COCO与进行编译打包好,进行配置即可启动使用;
* 使用文档请到正版本作者下查看;
* 文中所代码均为搭建测试使用;
* 系统使用到java
* 使用数据库名: jumpserver 用户名: jumpserver 密码: aa123456

安装开始

*	关闭系统selinux 为disable

临时关闭slelinux

setenforce 0

永久关才selinux

sed -i “s/enforcing/disabled/g” /etc/selinux/config

安装前更新一下系统所有包

yum -y update

安装必要系统包

yum -y install wget gcc epel-release git python36 python36-devel redis mariadb mariadb-devel mariadb-server

安装RDP远程依赖包

mkdir /usr/local/lib/freerdp/
ln -s /usr/local/lib/freerdp /usr/lib64/freerdp
rpm --import http://li.nux.ro/download/nux/RPM-GPG-KEY-nux.ro
rpm -Uvh http://li.nux.ro/download/nux/dextop/el7/x86_64/nux-dextop-release-0-5.el7.nux.noarch.rpm
yum -y localinstall --nogpgcheck https://download1.rpmfusion.org/free/el/rpmfusion-free-release-7.noarch.rpm https://download1.rpmfusion.org/nonfree/el/rpmfusion-nonfree-release-7.noarch.rpm
yum -y install java-1.8.0-openjdk libtool cairo-devel libjpeg-turbo-devel libpng-devel uuid-devel ffmpeg-devel freerdp-devel freerdp-plugins pango-devel libssh2-devel libtelnet-devel libvncserver-devel pulseaudio-libs-devel openssl-devel libvorbis-devel libwebp-devel ghostscript

启动redis,mysqlo数据库/开机启动

systemctl start redis
systemctl enable redis
systemctl start mariadb
systemctl enable mariadb

创建数据库jumpserver数据库并授权用户名

* 	登录数据库:		mysql -uroot
*	创建数据库:		create database jumpserver default charset 'utf8';
*	授权用户:		grant all on jumpserver.* to 'jumpserver'@'127.0.0.1' identified by 'aa123456';
*	生效:			flush privileges;

创建项目总目录jump

mkdir /jump
cd /jump

创建python3 虚拟环境

python3.6 -m venv py

启用python3 虚拟环境

source /jump/py/bin/activate

进入目录拉取jumpserver/koko/guacamole

git clone https://git.dev.tencent.com/wolfwolf/jumpserver.git
git clone https://git.dev.tencent.com/wolfwolf/koko.git
git clone https://git.dev.tencent.com/wolfwolf/guacamole.git

进入到jumpserver 后面管理目录

*	安装rpm依赖
*	安装python依赖
*	启动服务查看是否正常
* 	必须在python虚拟机下启动
*	启动jms服务加-d后台运行

cd /jump/jumpserver
yum install -y $(cat /jump/jumpserver/requirements/rpm_requirements.txt)
pip install -r /jump/jumpserver/requirements/requirements.txt
cp /jump/jumpserver/config.yml_bak /jump/jump/jumpserver/config.yml
mkdir /jump/jumpserver/tmp
rm -rf /jump/jumpserver/data/*
./jms start all -d

进入到koko目录

*	安装python依赖
*	启动服务
*   后台运行添 & 符号
* 	并将luna解压并授权

cd /jump/koko
rm -rf /jump/koko/data/*
/jump/koko/koko >>/jump/koko/logs/koko.log &
tar xf luna.tar.gz -C /jump/
chown root:root /jump/luna

进入 guacamole windows远程功能

*	安装guacamole-server 服务
*	将服务安到/etc/init.d/ 下
*	解压 linux-amd64.tar.gz -C /bin/ 并授权执行权限
* 	添加必要用户环境变量
* 	启动应用

cd /jump/guacamole
tar xf docker-gucamole.tar.gz
tar xf guacamole-server-1.0.0.tar.gz
cd guacamole-server-1.0.0
autoreconf -fi
./configure --with-init-dir=/etc/init.d
make && make install
mkdir /jump/guacamole/lib
ldconfig
tar xf /jump/guacamole/linux-amd64.tar.gz -C /bin
chmod +x /bin/ssh-forward
rm -rf /jump/guacamole/keys/*
export JUMPSERVER_SERVER=http://127.0.0.1:8080
echo “export JUMPSERVER_SERVER=http://127.0.0.1:8080” >> ~/.bashrc
export BOOTSTRAP_TOKEN=aa123456
echo “export BOOTSTRAP_TOKEN=aa123456” >>~/.bashrc
export JUMPSERVER_KEY_DIR=/jump/guacamole/keys
echo “export JUMPSERVER_KEY_DIR=/jump/guacamole/keys” >>~/.bashrc
export GUACAMOLE_HOME=/jump/guacamole
echo “export GUACAMOLE_HOME=/jump/guacamole” >>~/.bashrc

启动应用

/etc/init.d/guacd start #关闭stop
sh /jump/guacamole/tomcat9/bin/startup.sh #关闭shutdown.sh

安装nginx

* 	使用Openresty 
*	导入配置
*	创建web启动用户

下载openresty源码/解压/编译/安装

wget https://openresty.org/download/openresty-1.15.8.1.tar.gz && tar xf openresty-1.15.8.1.tar.gz && cd openresty-1.15.8.1 && ./configure && make && make install
ln -sf /usr/local/openresty/nginx/sbin/nginx /bin/nginx

创建用启

useradd deploy

导入配置文件

cat >/usr/local/openresty/nginx/conf/nginx.conf << EOF
user deploy;
worker_processes auto;
#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;

#pid logs/nginx.pid;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
#log_format main '$remote_addr - $remote_user [$ time_local] “ $KaTeX parse error: Expected 'EOF', got '#' at position 16: request" ' #̲ \dots$ status $body_bytes_sent "$ http_referer” ’
# ‘“ $http_user_agent" "$ http_x_forwarded_for”’;
#access_log logs/access.log main;
sendfile on;
#tcp_nopush on;
#keepalive_timeout 0;
keepalive_timeout 65;
#gzip on;
server {
listen 80; # 代理端口,以后将通过此端口进行访问,不再通过8080端口
server_name localhost;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

	location /luna/ {
		try_files \$uri / /index.html;
		alias /jump/luna/;  # luna 路径,如果修改安装目录,此处需要修改
	}
	location /media/ {
		add_header Content-Encoding gzip;
		root /jump/jumpserver/data/;  # 录像位置,如果修改安装目录,此处需要修改
	}
	location /static/ {
		root /jump/jumpserver/data/;  # 静态资源,如果修改安装目录,此处需要修改
	}
	location /socket.io/ {
		proxy_pass       http://localhost:5000/socket.io/;  # 如果coco安装在别的服务器,请填写它的ip
		proxy_buffering off;
		proxy_http_version 1.1;
		proxy_set_header Upgrade \$http_upgrade;
		proxy_set_header Connection "upgrade";
	}
	location /coco/ {
		proxy_pass       http://localhost:5000/coco/;  # 如果coco安装在别的服务器,请填写它的ip
		proxy_set_header X-Real-IP \$remote_addr;
		proxy_set_header Host \$host;
		proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
		access_log off;
	}
	location /guacamole/ {
		proxy_pass       http://localhost:8081/;  # 如果guacamole安装在别的服务器,请填写它的ip
		proxy_buffering off;
		proxy_http_version 1.1;
		proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
		proxy_set_header Upgrade \$http_upgrade;
		proxy_set_header Connection \$http_connection;
		access_log off;
		client_max_body_size 100m;  # Windows 文件上传大小限制
	}

	location / {
		proxy_pass http://localhost:8080;  # 如果jumpserver安装在别的服务器,请填写它的ip
	}


}

}
EOF

启动nginx

nginx # -t 检测配置文件是否有问题 -s reload 动态加载

生于海平

关注

1
点赞
踩
1

收藏

觉得还不错? 一键收藏
0
评论
jumpserver 堡垒机搭建

jumpserver 堡垒机搭建jumpserver版本: 1.5.2-2WEB服务: TOMCAT 9pyhton版本: python 3.6web服务: openresy 1.15系统使用 centos 7.4数据库: mariadb简单使用* 安装完成后,登录地址为:http://ip 用户名/密码:admin/admin/a* 登录登录查询终端...
复制链接

扫一扫