jumpserver安裝與配置
參考jumpserver官網http://docs.jumpserver.org/zh/docs/step_by_step.html
一、準備python3和python虛擬環境
1.1安裝依賴包
yum -y install wget sqlite-devel xz gcc automake zlib-devel openssl-devel epel-release git
1.2編譯安裝
wget https://www.python.org/ftp/python/3.6.1/Python-3.6.1.tar.xz
tar xvf Python-3.6.1.tar.xz && cd Python-3.6.1
./configure && make && make install
1.3建立python虛擬環境
cd /opt
python3 -m venv py3
source /opt/py3/bin/activate
1.4自動載入python虛擬環境
cd /opt
git clone git://github.com/kennethreitz/autoenv.git
echo 'source /opt/autoenv/activate.sh' >> ~/.bashrc
source ~/.bashrc
二、安裝Jumpserver
2.1下載或Clone項目
cd /opt
git clone https://github.com/jumpserver/jumpserver.git && cd jumpserver && git checkout master
echo "source /opt/py3/bin/activate" > /opt/jumpserver/.env
2.2安裝依賴RPM包
cd /opt/jumpserver/requirements
yum -y install $(cat rpm_requirements.txt)
2.3安裝python庫依賴
pip install -r requirements.txt
2.4安裝Redis
yum -y install gcc
tar zxvf redis-3.2.12.tar.gz
cd redis-3.2.12
make PREFIX=/data/redis MALLOC=libc install
mkdir -p /data/redis/etc
cd /data/redis/
mkdir logs
mkdir redisdbcache
mkdir var
配置文件 vi /data/redis/etc/redis.conf
daemonize yes
pidfile "/data/redis/var/redis.pid"
bind 192.168.1.161
port 6379
tcp-backlog 2044
timeout 300
tcp-keepalive 0
loglevel notice
logfile "/data/redis/logs/redis.log"
databases 16
save 900 1
save 300 10
save 60 40000
stop-writes-on-bgsave-error yes
rdbcompression yes
rdbchecksum yes
dbfilename dump.rdb
#dir /dev/shm/
dir /data/redis/redisdbcache
slave-serve-stale-data yes
slave-read-only no
repl-disable-tcp-nodelay no
slave-priority 100
maxclients 1000
#這是個需要修改的地方
maxmemory 2GB
maxmemory-policy volatile-lru
maxmemory-samples 3
appendonly no
appendfilename "appendonly.aof"
appendfsync everysec
no-appendfsync-on-rewrite no
auto-aof-rewrite-percentage 100
auto-aof-rewrite-min-size 64mb
aof-load-truncated yes
lua-time-limit 5000
slowlog-log-slower-than 10000
slowlog-max-len 128
latency-monitor-threshold 0
notify-keyspace-events ""
hash-max-ziplist-entries 512
hash-max-ziplist-value 64
list-max-ziplist-entries 512
list-max-ziplist-value 64
set-max-intset-entries 512
zset-max-ziplist-entries 128
zset-max-ziplist-value 64
hll-sparse-max-bytes 3000
activerehashing yes
client-output-buffer-limit normal 0 0 0
client-output-buffer-limit slave 256mb 64mb 60
client-output-buffer-limit pubsub 32mb 8mb 60
hz 20
aof-rewrite-incremental-fsync yes
啓動文件 vi /etc/init.d/redis
#!/bin/sh
#
# redis - this script starts and stops the redis-server daemon
#
# chkconfig: - 85 15
# description: Redis is a persistent key-value database
# processname: redis-server
# config: /usr/local/redis/etc/redis.conf
# pidfile: /usr/local/redis/var/redis.pid
# Source function library.
. /etc/rc.d/init.d/functions
# Source networking configuration.
. /etc/sysconfig/network
# Check that networking is up.
[ "$NETWORKING" = "no" ] && exit 0
redis="/data/redis/bin/redis-server"
prog=$(basename $redis)
REDIS_CONF_FILE="/data/redis/etc/redis.conf"
lockfile=/var/lock/subsys/redis
start() {
[ -x $redis ] || exit 5
[ -f $REDIS_CONF_FILE ] || exit 6
echo -n $"Starting $prog: "
daemon $redis $REDIS_CONF_FILE
retval=$?
echo
[ $retval -eq 0 ] && touch $lockfile
return $retval
}
stop() {
echo -n $"Stopping $prog: "
killproc $prog -QUIT
retval=$?
echo
[ $retval -eq 0 ] && rm -f $lockfile
return $retval
}
restart() {
stop
start
}
reload() {
echo -n $"Reloading $prog: "
killproc $redis -HUP
RETVAL=$?
echo
}
force_reload() {
restart
}
rh_status() {
status $prog
}
rh_status_q() {
rh_status >/dev/null 2>&1
}
case "$1" in
start)
rh_status_q && exit 0
$1
;;
stop)
rh_status_q || exit 0
$1
;;
restart|configtest)
$1
;;
reload)
rh_status_q || exit 7
$1
;;
force-reload)
force_reload
;;
status)
rh_status
;;
condrestart|try-restart)
rh_status_q || exit 0
;;
*)
echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}"
exit 2
esac
增加執行權限
chmod +x /etc/init.d/redis
開機啓動
chkconfig redis on
啓動redis
/etc/init.d/redis start
2.5安裝MYSQL
2.6創建數據庫Jumpserver 並授權
#注意我的MYSQL是在另外一臺機器上的
mysql -uroot -p
create database jumpserver default charset 'utf8';
grant all on jumpserver.* to 'jumpserver'@'%' identified by 'yb20180815';
flush privileges;
2.7修改Jumpserver配置文件
cd /opt/jumpserver
cp config_example.py config.py
vi config.py 修改以下配置紅色是修改的內容
注意: 配置文件是 Python 格式，不要用 TAB，而要用空格
"""
jumpserver.config
~~~~~~~~~~~~~~~~~
Jumpserver project setting file
:copyright: (c) 2014-2017 by Jumpserver Team
:license: GPL v2, see LICENSE for more details.
"""
import os
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
class Config:
# Use it to encrypt or decrypt data
# SECURITY WARNING: keep the secret key used in production secret!
SECRET_KEY = os.environ.get('SECRET_KEY') or '2vym+ky!997d5kkcc64mnz06y1mmui3lut#(^wd=%s_qj$1%x'
# Django security setting, if your disable debug model, you should setting that
ALLOWED_HOSTS = ['*']
# Development env open this, when error occur display the full process track, Production disable it
DEBUG = os.environ.get("DEBUG") or True
# DEBUG, INFO, WARNING, ERROR, CRITICAL can set. See https://docs.djangoproject.com/en/1.10/topics/logging/
LOG_LEVEL = os.environ.get("LOG_LEVEL") or 'DEBUG'
LOG_DIR = os.path.join(BASE_DIR, 'logs')
# Database setting, Support sqlite3, mysql, postgres ....
# See https://docs.djangoproject.com/en/1.10/ref/settings/#databases
# SQLite setting:
DB_ENGINE = 'sqlite3'
DB_NAME = os.path.join(BASE_DIR, 'data', 'db.sqlite3')
# MySQL or postgres setting like:
DB_ENGINE = os.environ.get("DB_ENGINE") or 'mysql'
DB_HOST = os.environ.get("DB_HOST") or '192.168.1.162'
DB_PORT = os.environ.get("DB_PORT") or 3306
DB_USER = os.environ.get("DB_USER") or 'jumpserver'
DB_PASSWORD = os.environ.get("DB_PASSWORD") or 'yb20180815'
DB_NAME = os.environ.get("DB_NAME") or 'jumpserver'
# When Django start it will bind this host and port
# ./manage.py runserver 127.0.0.1:8080
HTTP_BIND_HOST = '0.0.0.0'
HTTP_LISTEN_PORT = 8088
# Use Redis as broker for celery and web socket
REDIS_HOST = os.environ.get("REDIS_HOST") or '192.168.1.161'
REDIS_PORT = os.environ.get("REDIS_PORT") or 6379
REDIS_PASSWORD = os.environ.get("REDIS_PASSWORD") or ''
REDIS_DB_CELERY = os.environ.get('REDIS_DB') or 3
REDIS_DB_CACHE = os.environ.get('REDIS_DB') or 4
def __init__(self):
pass
def __getattr__(self, item):
return None
class DevelopmentConfig(Config):
pass
class TestConfig(Config):
pass
class ProductionConfig(Config):
pass
# Default using Config settings, you can write if/else for different env
config = DevelopmentConfig()
2.8生成數據表結構和初始數據
cd /opt/jumpserver/utils
bash make_migrations.sh
2.9運行Jumpserver
cd /opt/jumpserver
./jms start all -d
三、安裝SSH server和webSocket Server:Coco
3.1下載或clone項目
cd /opt
source /opt/py3/bin/activate
git clone https://github.com/jumpserver/coco.git && cd coco && git checkout master
echo "source /opt/py3/bin/activate" > /opt/coco/.env
3.2安裝依賴
cd /opt/coco/requirements
yum -y install $(cat rpm_requirements.txt)
pip install -r requirements.txt
3.3修改配置文件並運行
cd /opt/coco
cp conf_example.py conf.py
vi config.py
修改以下配置紅色是修改的內容
注意: 配置文件是 Python 格式，不要用 TAB，而要用空格
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
#
import os
BASE_DIR = os.path.dirname(__file__)
class Config:
"""
Coco config file, coco also load config from server update setting below
"""
# 項目名稱, 會用來向Jumpserver註冊, 識別而已, 不能重複
NAME = "localhost"
# Jumpserver項目的url, api請求註冊會使用
CORE_HOST = os.environ.get("CORE_HOST") or 'http://127.0.0.1:8088'
# 啓動時綁定的ip, 默認 0.0.0.0
BIND_HOST = '0.0.0.0'
# 監聽的SSH端口號, 默認2222
SSHD_PORT = 2222
# 監聽的HTTP/WS端口號，默認5000
HTTPD_PORT = 5000
# 項目使用的ACCESS KEY, 默認會註冊,並保存到 ACCESS_KEY_STORE中,
# 如果有需求, 可以寫到配置文件中, 格式 access_key_id:access_key_secret
ACCESS_KEY = None
# ACCESS KEY 保存的地址, 默認註冊後會保存到該文件中
ACCESS_KEY_STORE = os.path.join(BASE_DIR, 'keys', '.access_key')
# 加密密鑰
SECRET_KEY = None
# 設置日誌級別 ['DEBUG', 'INFO', 'WARN', 'ERROR', 'FATAL', 'CRITICAL']
LOG_LEVEL = 'INFO'
# 日誌存放的目錄
LOG_DIR = os.path.join(BASE_DIR, 'logs')
# Session錄像存放目錄
SESSION_DIR = os.path.join(BASE_DIR, 'sessions')
# 資產顯示排序方式, ['ip', 'hostname']
ASSET_LIST_SORT_BY = 'hostname'
# 登錄是否支持密碼認證
PASSWORD_AUTH = True
# 登錄是否支持祕鑰認證
PUBLIC_KEY_AUTH = True
# 和Jumpserver 保持心跳時間間隔
# HEARTBEAT_INTERVAL = 5
# Admin的名字，出問題會提示給用戶
# ADMINS = ''
COMMAND_STORAGE = {
"TYPE": "server"
}
REPLAY_STORAGE = {
"TYPE": "server"
}
config = Config()
啓動
./cocod start -d
四、安裝Web Terminal 前端：Luna
Luna已改爲純前端，需要Nginx來運行訪問
4.1解壓Luna
cd /opt
wget https://github.com/jumpserver/luna/releases/download/1.4.0/luna.tar.gz
tar zxvf luna.tar.gz
chown -R root:root luna
五、配置nignx
5.1 安裝nginx
cd /opt
yum -y install gd gd2 gd-devel gd2-devel pcre pcre-devel
tar zxvf openssl-1.0.2d.tar.gz
tar zxvf nginx-1.12.2.tar.gz
cd nginx-1.12.2
./configure --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --with-http_stub_status_module --with-http_ssl_module --with-openssl=/opt/openssl-1.0.2d --with-http_realip_module --with-pcre --with-http_gzip_static_module
make && make install
5.2配置nginx
vi /etc/nginx/nginx.conf
user nobody nobody;
worker_processes 8;
error_log /var/log/nginx/error.log;
pid /var/run/nginx.pid;
worker_rlimit_nofile 102400;
events {
worker_connections 65535;
use epoll;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] [$request_time $upstream_response_time] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
log_format new '$remote_addr^A$http_x_forwarded_for^A$host^A$time_local^A$status^A'
'$request_time^A$request_length^A$bytes_sent^A$http_referer^A$request^A$http_user_agent';
access_log off;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
server_tokens off;
server_names_hash_bucket_size 128;
client_header_buffer_size 512k;
client_body_buffer_size 512k;
client_max_body_size 50m;
large_client_header_buffers 4 512k;
send_timeout 10000;
client_header_timeout 500;
client_body_timeout 500;
fastcgi_buffers 8 512k;
connection_pool_size 256;
request_pool_size 4k;
output_buffers 4 32k;
postpone_output 1460;
gzip on;
gzip_vary on;
gzip_static on;
gzip_min_length 1k;
gzip_buffers 4 16k;
gzip_http_version 1.0;
gzip_comp_level 6;
gzip_types text/plain application/x-javascript application/javascript text/css application/xml text/javascript ;
gzip_disable "MSIE [1-6]\.";
fastcgi_intercept_errors on;
keepalive_timeout 150;
proxy_buffering on;
proxy_buffer_size 512k;
proxy_buffers 32 256k;
proxy_busy_buffers_size 512k;
proxy_ignore_client_abort off;
proxy_intercept_errors on;
proxy_redirect off;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_connect_timeout 5000;
proxy_send_timeout 5000;
proxy_read_timeout 5000;
include /etc/nginx/conf.d/*.conf;
}
配置 jumpserver.conf
mkdir /etc/nginx/conf.d/
cd /etc/nginx/conf.d/
vi jumpserver.conf
server {
listen 8000; # 代理端口，以後將通過此端口進行訪問，不再通過8088端口
client_max_body_size 100m; # 錄像上傳大小限制
location /luna/ {
try_files $uri / /index.html;
alias /opt/luna/; # luna 路徑，如果修改安裝目錄，此處需要修改
}
location /media/ {
add_header Content-Encoding gzip;
root /opt/jumpserver/data/; # 錄像位置，如果修改安裝目錄，此處需要修改
}
location /static/ {
root /opt/jumpserver/data/; # 靜態資源，如果修改安裝目錄，此處需要修改
}
location /socket.io/ {
proxy_pass http://localhost:5000/socket.io/; # 如果coco安裝在別的服務器，請填寫它的ip
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}
location /guacamole/ {
proxy_pass http://localhost:8081/; # 如果guacamole安裝在別的服務器，請填寫它的ip
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}
location / {
proxy_pass http://localhost:8088; # 如果jumpserver安裝在別的服務器，請填寫它的ip
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
啓動nignx
nignx
平滑重啓nginx
nignx -s reload
登錄http://192.168.1.161:8000 用戶名 admin 密碼 admin
