centos 7.x 安裝開源堡壘機Jumpserver

環境虛擬機系統：centos 7 IP:192.168.168.8 目錄：/opt 代理：nginx 資料庫：mysql 版本大於等於 5.6 mariadb 版本大於等於 5.5.6 更新yum yum update -y關閉防火牆與selinux firewall-cmd --state s ...

環境　　

　　虛擬機　　系統：centos 7

　　IP:192.168.168.8
　　目錄：/opt
　　代理：nginx
　　資料庫：mysql 版本大於等於 5.6 mariadb 版本大於等於 5.5.6

更新yum
　　yum update -y

關閉防火牆與selinux
　　firewall-cmd --state
　　systemctl stop firewalld
　　systemctl disable firewalld

　　vi /etc/sysconfig/selinux
　　SELINUX=enforcing 改為 SELINUX=disabled

　　reboot

修改字元集，否則可能報 input/output error的問題，因為日誌里列印了中文
　　localedef -c -f UTF-8 -i zh_CN zh_CN.UTF-8
　　export LC_ALL=zh_CN.UTF-8
　　echo 'LANG="zh_CN.UTF-8"' > /etc/locale.conf

安裝依賴包
　　yum -y install wget sqlite-devel xz gcc automake zlib-devel openssl-devel epel-release git

安裝redis，Jumpserver 使用 Redis 做 cache 和 celery broke
　　yum -y install redis
　　systemctl enable redis
　　systemctl start redis

安裝Mysql 作為資料庫,如果不使用 Mysql 可以跳過相關 Mysql 安裝和配置
　　yum -y install mariadb mariadb-devel mariadb-server # centos7下安裝的是mariadb
　　systemctl enable mariadb
　　systemctl start mariadb

創建資料庫 Jumpserver 並授權
　　mysql -uroot
　　> create database jumpserver default charset 'utf8';
　　> grant all on jumpserver.* to 'jumpserver'@'127.0.0.1' identified by 'weakPassword';
　　> flush privileges;
　　> quit

安裝 Nginx，用代理伺服器整合Jumpserver與各個組件
　　yum -y install nginx
　　systemctl enable nginx

下載編譯Python3.6.1
　　cd /opt
　　wget https://www.python.org/ftp/python/3.6.1/Python-3.6.1.tar.xz
　　tar xf Python-3.6.1.tar.xz && cd Python-3.6.1
　　./configure && make && make install

配置並載入Python3虛擬環境
　　cd /opt
　　python3 -m venv py3
　　source /opt/py3/bin/activate
　　# 看到下麵的提示符代表成功，以後運行 Jumpserver 都要先運行以上 source 命令，以下所有命令均在該虛擬環境中運行
　　(py3) [root@localhost opt]#

自動載入Python虛擬環境
　　cd /opt
　　git clone git://github.com/kennethreitz/autoenv.git
　　echo 'source /opt/autoenv/activate.sh' >> ~/.bashrc
　　source ~/.bashrc

下載Jumpserver 與 Coco
　　cd /opt
　　git clone https://github.com/jumpserver/jumpserver.git
　　echo "source /opt/py3/bin/activate" > /opt/jumpserver/.env

　　cd /opt
　　git clone https://github.com/jumpserver/coco.git
　　echo "source /opt/py3/bin/activate" > /opt/coco/.env

安裝依賴 RPM 包
　　yum -y install $(cat /opt/jumpserver/requirements/rpm_requirements.txt)
　　yum -y install $(cat /opt/coco/requirements/rpm_requirements.txt)

安裝python庫依賴
　　pip install --upgrade pip
　　pip install -r /opt/jumpserver/requirements/requirements.txt -i https://mirrors.aliyun.com/pypi/simple/
　　pip install -r /opt/coco/requirements/requirements.txt

修改 Jumpserver 配置文件
　　cd /opt/jumpserver
　　cp config_example.py config.py

vi config.py

註意: 配置文件是 Python 格式,不要用 TAB,而要用空格

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
    jumpserver.config
    ~~~~~~~~~~~~~~~~~

    Jumpserver project setting file

    :copyright: (c) 2014-2017 by Jumpserver Team
    :license: GPL v2, see LICENSE for more details.
"""
import os

BASE_DIR = os.path.dirname(os.path.abspath(__file__))


class Config:
    """
    Jumpserver Config File
    Jumpserver 配置文件

    Jumpserver use this config for drive django framework running,
    You can set is value or set the same envirment value,
    Jumpserver look for config order: file => env => default

    Jumpserver使用配置來驅動Django框架的運行，
    你可以在該文件中設置，或者設置同樣名稱的環境變數,
    Jumpserver使用配置的順序: 文件 => 環境變數 => 預設值
    """
    # SECURITY WARNING: keep the secret key used in production secret!
    # 加密秘鑰 生產環境中請修改為隨機字元串，請勿外泄
    SECRET_KEY = '2vym+ky!997d5kkcc64mnz06y1mmui3lut#(^wd=%s_qj$1%x'

    # SECURITY WARNING: keep the bootstrap token used in production secret!
    # 預共用Token coco和guacamole用來註冊服務賬號，不在使用原來的註冊接受機制
    # BOOTSTRAP_TOKEN = 'PleaseChangeMe'

    ALLOWED_HOSTS = ['*']

    # Development env open this, when error occur display the full process track, Production disable it
    # DEBUG 模式 開啟DEBUG後遇到錯誤時可以看到更多日誌
    DEBUG = False

    # DEBUG, INFO, WARNING, ERROR, CRITICAL can set. See https://docs.djangoproject.com/en/1.10/topics/logging/
    # 日誌級別
    LOG_LEVEL = 'ERROR'
    LOG_DIR = os.path.join(BASE_DIR, 'logs')

    # Session expiration setting, Default 24 hour, Also set expired on on browser close
    # 瀏覽器Session過期時間，預設24小時, 也可以設置瀏覽器關閉則過期
    # SESSION_COOKIE_AGE = 3600 * 24
    # SESSION_EXPIRE_AT_BROWSER_CLOSE = False
    SESSION_EXPIRE_AT_BROWSER_CLOSE = True 


    # Database setting, Support sqlite3, mysql, postgres ....
    # 資料庫設置
    # See https://docs.djangoproject.com/en/1.10/ref/settings/#databases

    # SQLite setting:
    # 使用單文件sqlite資料庫
    # DB_ENGINE = 'sqlite3'
    # DB_NAME = os.path.join(BASE_DIR, 'data', 'db.sqlite3')

    # MySQL or postgres setting like:
    # 使用Mysql作為資料庫
    DB_ENGINE = 'mysql'
    DB_HOST = '127.0.0.1'
    DB_PORT = 3306
    DB_USER = 'jumpserver'
    DB_PASSWORD = 'weakPassword'   
    DB_NAME = 'jumpserver'

    # When Django start it will bind this host and port
    # ./manage.py runserver 127.0.0.1:8080
    # 運行時綁定埠
    HTTP_BIND_HOST = '0.0.0.0'
    HTTP_LISTEN_PORT = 8080

    # Use Redis as broker for celery and web socket
    # Redis配置
    REDIS_HOST = '127.0.0.1'
    REDIS_PORT = 6379
    REDIS_PASSWORD = '':
    REDIS_DB_CELERY = 3
    REDIS_DB_CACHE = 4
    
    # Use OpenID authorization
    # 使用OpenID 來進行認證設置
    # BASE_SITE_URL = 'http://localhost:8080'
    # AUTH_OPENID = False  # True or False
    # AUTH_OPENID_SERVER_URL = 'https://openid-auth-server.com/'
    # AUTH_OPENID_REALM_NAME = 'realm-name'
    # AUTH_OPENID_CLIENT_ID = 'client-id'
    # AUTH_OPENID_CLIENT_SECRET = 'client-secret'

    #
    # OTP_VALID_WINDOW = 0

    def __init__(self):
        pass

    def __getattr__(self, item):
        return None


class DevelopmentConfig(Config):
    pass


class TestConfig(Config):
    pass


class ProductionConfig(Config):
    pass


# Default using Config settings, you can write if/else for different env
config = DevelopmentConfig()

修改Coco配置文件
　　cd /opt/coco
　　cp conf_example.py conf.py # 如果 coco 與 jumpserver 分開部署,請手動修改 conf.py
　　vi conf.py
# 註意對齊,不要直接複製本文檔的內容

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
#

import os

BASE_DIR = os.path.dirname(__file__)


class Config:
    """
    Coco config file, coco also load config from server update setting below
    """
    # 項目名稱, 會用來向Jumpserver註冊, 識別而已, 不能重覆
    NAME = "coco"

    # Jumpserver項目的url, api請求註冊會使用
    CORE_HOST = os.environ.get("CORE_HOST") or 'http://127.0.0.1:8080'

    # Bootstrap Token, 預共用秘鑰, 用來註冊coco使用的service account和terminal
    # 請和jumpserver 配置文件中保持一致，註冊完成後可以刪除
    # BOOTSTRAP_TOKEN = "PleaseChangeMe"

    # 啟動時綁定的ip, 預設 0.0.0.0
    # BIND_HOST = '0.0.0.0'

    # 監聽的SSH埠號, 預設2222
    # SSHD_PORT = 2222

    # 監聽的HTTP/WS埠號，預設5000
    # HTTPD_PORT = 5000

    # 項目使用的ACCESS KEY, 預設會註冊,並保存到 ACCESS_KEY_STORE中,
    # 如果有需求, 可以寫到配置文件中, 格式 access_key_id:access_key_secret
    # ACCESS_KEY = None

    # ACCESS KEY 保存的地址, 預設註冊後會保存到該文件中
    # ACCESS_KEY_STORE = os.path.join(BASE_DIR, 'keys', '.access_key')

    # 加密密鑰
    # SECRET_KEY = None

    # 設置日誌級別 ['DEBUG', 'INFO', 'WARN', 'ERROR', 'FATAL', 'CRITICAL']
    LOG_LEVEL = 'ERROR'

    # 日誌存放的目錄
    # LOG_DIR = os.path.join(BASE_DIR, 'logs')

    # Session錄像存放目錄
    # SESSION_DIR = os.path.join(BASE_DIR, 'sessions')

    # 資產顯示排序方式, ['ip', 'hostname']
    # ASSET_LIST_SORT_BY = 'ip'

    # 登錄是否支持密碼認證
    # PASSWORD_AUTH = True

    # 登錄是否支持秘鑰認證
    # PUBLIC_KEY_AUTH = True
    
    # SSH白名單
    # ALLOW_SSH_USER = 'all'  # ['test', 'test2']

    # SSH黑名單, 如果用戶同時在白名單和黑名單，黑名單優先生效
    # BLOCK_SSH_USER = []

    # 和Jumpserver 保持心跳時間間隔
    # HEARTBEAT_INTERVAL = 5

    # Admin的名字，出問題會提示給用戶
    # ADMINS = ''
    COMMAND_STORAGE = {
        "TYPE": "server"
    }
    REPLAY_STORAGE = {
        "TYPE": "server"
    }

    # SSH連接超時時間 (default 15 seconds)
    # SSH_TIMEOUT = 15

    # 語言 = en
    LANGUAGE_CODE = 'zh'


config = Config()

安裝 Web Terminal 前端: Luna
　　cd /opt
　　wget https://github.com/jumpserver/luna/releases/download/1.4.1/luna.tar.gz
　　tar xf luna.tar.gz
　　chown -R root:root luna

安裝windows支持組件
　　yum remove docker-latest-logrotate docker-logrotate docker-selinux dockdocker-engine
　　yum install -y yum-utils device-mapper-persistent-data lvm2
　　yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
　　yum makecache fast
　　yum -y install docker-ce
　　systemctl start docker -d
　　docker pull jumpserver/guacamole:latest

重新打開一個終端
配置Nginx整合組件
　　source /opt/py3/bin/activate
　　cd /opt/
　　vi /etc/nginx/conf.d/jumpserver.conf

server {
    listen 80;  # 代理埠,以後將通過此埠進行訪問,不再通過8080埠
    # server_name demo.jumpserver.org;  # 修改成你的功能變數名稱或者註釋掉

    client_max_body_size 100m;  # 錄像及文件上傳大小限制

    location /luna/ {
        try_files $uri / /index.html;
        alias /opt/luna/;  # luna 路徑,如果修改安裝目錄,此處需要修改
    }

    location /media/ {
        add_header Content-Encoding gzip;
        root /opt/jumpserver/data/;  # 錄像位置,如果修改安裝目錄,此處需要修改
    }

    location /static/ {
        root /opt/jumpserver/data/;  # 靜態資源,如果修改安裝目錄,此處需要修改
    }

    location /socket.io/ {
        proxy_pass       http://localhost:5000/socket.io/;  # 如果coco安裝在別的伺服器,請填寫它的ip
        proxy_buffering off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        access_log off;
    }

    location /coco/ {
        proxy_pass       http://localhost:5000/coco/;  # 如果coco安裝在別的伺服器,請填寫它的ip
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        access_log off;
    }

    location /guacamole/ {
        proxy_pass       http://localhost:8081/;  # 如果guacamole安裝在別的伺服器,請填寫它的ip
        proxy_buffering off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        access_log off;
    }

    location / {
        proxy_pass http://localhost:8080;  # 如果jumpserver安裝在別的伺服器,請填寫它的ip
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

　　cd /opt/
　　cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak
　　vim /etc/nginx/nginx.conf

# For more information on configuration, see:
    #   * Official English Documentation: http://nginx.org/en/docs/
    #   * Official Russian Documentation: http://nginx.org/ru/docs/

    user nginx;
    worker_processes auto;
    error_log /var/log/nginx/error.log;
    pid /run/nginx.pid;

    # Load dynamic modules. See /usr/share/nginx/README.dynamic.
    include /usr/share/nginx/modules/*.conf;

    events {
        worker_connections 1024;
    }

    http {
        log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                          '$status $body_bytes_sent "$http_referer" '
                          '"$http_user_agent" "$http_x_forwarded_for"';

        access_log  /var/log/nginx/access.log  main;

        sendfile            on;
        tcp_nopush          on;
        tcp_nodelay         on;
        keepalive_timeout   65;
        types_hash_max_size 2048;

        include             /etc/nginx/mime.types;
        default_type        application/octet-stream;

        # Load modular configuration files from the /etc/nginx/conf.d directory.
        # See http://nginx.org/en/docs/ngx_core_module.html#include
        # for more information.
        include /etc/nginx/conf.d/*.conf;

        #server {
            #listen       80 default_server;
            #listen       [::]:80 default_server;
            #server_name  _;
            #root         /usr/share/nginx/html;

            # Load configuration files for the default server block.
            #include /etc/nginx/default.d/*.conf;

            #location / {
           # }

            #error_page 404 /404.html;
                #location = /40x.html {
            #}

            #error_page 500 502 503 504 /50x.html;
                #location = /50x.html {
            #}
        #}

    # Settings for a TLS enabled server.
    #
    #    server {
    #        listen       443 ssl http2 default_server;
    #        listen       [::]:443 ssl http2 default_server;
    #        server_name  _;
    #        root         /usr/share/nginx/html;
    #
    #        ssl_certificate "/etc/pki/nginx/server.crt";
    #        ssl_certificate_key "/etc/pki/nginx/private/server.key";
    #        ssl_session_cache shared:SSL:1m;
    #        ssl_session_timeout  10m;
    #        ssl_ciphers HIGH:!aNULL:!MD5;
    #        ssl_prefer_server_ciphers on;
    #
    #        # Load configuration files for the default server block.
    include /etc/nginx/default.d/*.conf;
    #
    #        location / {
    #        }
    #
    #        error_page 404 /404.html;
    #            location = /40x.html {
    #        }
    #
    #        error_page 500 502 503 504 /50x.html;
    #            location = /50x.html {
    #        }
    #    }

    }

　　nginx -t

生成資料庫表結構和初始化數據
　　cd /opt/jumpserver/utils
　　bash make_migrations.sh

運行 Jumpserver
　　cd ..
　　./jms start all -d
# 新版本更新了運行腳本，使用方式./jms start|stop|status|restart all 後臺運行請添加 -d 參數

　　運行Coco
　　cd /opt/coco
　　./cocod start -d

#在第一個終端里
啟動 Guacamole
# 註意：這裡需要修改下 http://<填寫jumpserver的url地址> 例: http://192.168.168.8, 否則會出錯
# 不能使用 127.0.0.1 ，可以更換 registry.jumpserver.org/public/guacamole:latest

　　docker run --name jms_guacamole -d \
　　-p 8081:8080 -v /opt/guacamole/key:/config/guacamole/key \
　　-e JUMPSERVER_KEY_DIR=/config/guacamole/key \
　　-e JUMPSERVER_SERVER=http://192.168.168.8:8080 \
　　jumpserver/guacamole:latest

　　systemctl start nginx

　　登錄Web管理界面：192.168.168.8

參考鏈接1：http://docs.jumpserver.org/zh/docs/step_by_step.html

參考鏈接2：http://docs.jumpserver.org/zh/docs/setup_by_centos7.html

參考鏈接3：https://www.cnblogs.com/bigdevilking/p/9427941.html

參考鏈接4：http://docs.jumpserver.org/zh/docs/faq_install.html