搭建jumpserver堡垒机(二)

六.部署jumpserver服务
官方安装文档：https://docs.jumpserver.org/zh/v2/
1.获取jumpserver程序代码
cd /opt
wget https://github.com/jumpserver/jumpserver/releases/download/v2.1.0/jumpserver-v2.1.0.tar.gz

2.解压缩
tar -zxvf jumpserver-v2.1.0.tar.gz
创建软链接
ln -s /opt/jumpserver-v2.1.0 /opt/jumpserver

3.安装依赖环境（前面已装过,可不执行）
yum install -y bash-completion vim lrzsz wget expect net-tools nc nmap tree dos2unix htop iftop iotop unzip telnet sl psmisc nethogs glances bc ntpdate openldap-devel gcc

4.安装运行jumpserver所需要的python3模块
安装模块前先激活虚拟环境，在虚拟环境中安装
source /opt/jmp_venv1/bin/activate
pip3 install -r /opt/jumpserver/requirements/requirements.txt
查看安装的模块
pip3 list

错误：（requirements.txt中有个tencentcloud-sdk-python==3.0.40报错，可以先去掉后单独下载）

5.修改jumpserver配置文件（config.yml）
创建配置文件
cp /opt/jumpserver/config_example.yml /opt/jumpserver/config.yml
查看需要配置内容（空的位置填上，必要时在给后面端口什么的都加上单引号（如果下面第6步报错TypeError: connect() argument 3 must be str, not int））
grep -Ev '^#|^$' /opt/jumpserver/config.yml
-------------------
SECRET_KEY:
BOOTSTRAP_TOKEN:
DB_ENGINE: mysql
DB_HOST: 127.0.0.1
DB_PORT: 3306
DB_USER: jumpserver
DB_PASSWORD:
DB_NAME: jumpserver
HTTP_BIND_HOST: 0.0.0.0
HTTP_LISTEN_PORT: 8080
WS_LISTEN_PORT: 8070
REDIS_HOST: 127.0.0.1
REDIS_PORT: 6379
---------------------
1）生成密钥
if [ "$SECRET_KEY" = "" ];then SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 50`;echo "SECRET_KEY=$SECRET_KEY" >> ~/.bashrc; echo $SECRET_KEY;else echo $SECRET_KEY;fi

2）生成token密钥
if [ "$BOOTSTRAP_TOKEN" = "" ];then BOOTSTRAP_TOKEN=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 16`;echo "BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN" >> ~/.bashrc; echo $BOOTSTRAP_TOKEN;else echo $BOOTSTRAP_TOKEN;fi

把以上生成的各个密钥写入对应位置（前面留个空格）
把mysql数据块密码填上

 

6.对python程序进行数据块迁移，生成对应表数据
python3 /opt/jumpserver/apps/manage.py makemigrations
python3 /opt/jumpserver/apps/manage.py migrate

7.后台运行jumpserver服务程序（4718端口）
/opt/jumpserver/jms start -d

8.检测是否成功部署好后端
访问
http://xxx.xxx.xxx.xxxx:8080/
进入"欢迎使用JumpServer开源堡垒机"说明后端部署没问题

 

七. 部署koko（或者coco）
koko是go语言开发的组件，实现web terminal server组件
1.下载koko源码
cd /opt
wget https://github.com/jumpserver/koko/releases/download/v2.1.0/koko-v2.1.0-linux-amd64.tar.gz

2.解压缩
tar zxvf koko-v2.1.0-linux-amd64.tar.gz
创建软链接
ln -s /opt/koko-v2.1.0-linux-amd64 /opt/koko

3.修改koko配置信息
创建配置文件
cp /opt/koko/config_example.yml /opt/koko/config.yml
修改配置文件
vim /opt/koko/config.yml
#以下内容（修改BOOTSTRAP_TOKEN密钥(跟jumpserver配置一致)，开启日志，redis）
BOOTSTRAP_TOKEN:
LOG_LEVEL: INFO
REDIS_HOST: 127.0.0.1
REDIS_PORT: 6379
REDIS_PASSWORD:
REDIS_CLUSTERS:
REDIS_DB_ROOM:

4.启动koko程序（日志位置/opt/koko/data/logs/koko.log）
/opt/koko/koko -d

 

八.部署guacamole组件
1.获取软件源码(git clone https://github.com/jumpserver/docker-guacamole-v1.git 获取以下所有，但是guacamole版本低)
cd /opt
wget https://archive.apache.org/dist/guacamole/1.2.0/source/guacamole-server-1.2.0.tar.gz
wget https://archive.apache.org/dist/guacamole/1.2.0/binary/guacamole-1.2.0.war
wget http://download.jumpserver.org/public/ssh-forward.tar.gz
wget https://github.com/jumpserver/docker-guacamole-v1/blob/master/guacamole-auth-jumpserver-1.0.0.jar
curl -sS -o guacamole.properties https://raw.githubusercontent.com/jumpserver/docker-guacamole-v1/master/root/app/guacamole/guacamole.properties

解压缩
tar zxvf guacamole-server-1.2.0.tar.gz
mv guacamole-server-1.2.0 guacamole
tar xf ssh-forward.tar.gz -C /bin/

2.项目编译环境安装
yum install -y cairo-devel libjpeg-turbo-devel libjpeg-devel libpng-devel libtool uuid-devel
可选的软件依赖
yum install -y freerdp-devel pango-devel libssh2-devel libtelnet-devel libvncserver-devel libwebsockets-devel pulseaudio-libs-devel openssl-devel libvorbis-devel libwebp-devel

3.安装FFmpeg工具（音视频处理）
官网：http://li.nux.ro/repos.html
yum install -y epel-release
rpm -v --import http://li.nux.ro/download/nux/RPM-GPG-KEY-nux.ro
rpm -Uvh http://li.nux.ro/download/nux/dextop/el7/x86_64/nux-dextop-release-0-5.el7.nux.noarch.rpm
yum install -y ffmpeg ffmpeg-devel

4.编译安装guacamole服务
cd /opt/guacamole
./configure --with-init-dir=/etc/init.d
make
make install

5.部署java开发环境
yum install -y java-1.8.0-openjdk

6.创建guacamole所需文件夹
mkdir -p /config/guacamole /config/guacamole/extensions /config/guacamole/record /config/guacamole/drive
chown daemon:daemon /config/guacamole/record /config/guacamole/drive

7.下载tomcat工具（运行java项目）
cd /opt
wget https://dlcdn.apache.org/tomcat/tomcat-9/v9.0.98/bin/apache-tomcat-9.0.98.tar.gz
解压缩，修改端口
tar xf apache-tomcat-9.0.98.tar.gz
mv apache-tomcat-9.0.98 tomcat9
rm -rf /opt/tomcat9/webapps/*
sed -i 's/Connector port="8080"/Connector port="8081"/g' /opt/tomcat9/conf/server.xml
# echo "java.util.logging.ConsoleHandler.encoding = UTF-8" >> /opt/tomcat9/conf/logging.properties （tomcat版本高的话，不用添加了，本身就有）

8. 配置guacamole与tomcat结合
ln -sf /opt/guacamole-1.2.0.war /opt/tomcat9/webapps/ROOT.war
mv /opt/guacamole-auth-jumpserver-1.0.0.jar /config/guacamole/extensions/guacamole-auth-jumpserver-1.0.0.jar
mv /opt/guacamole.properties /config/guacamole/guacamole.properties

9.设置guacamole的运行环境
# http://127.0.0.1:8080 指 jumpserver 访问地址
export JUMPSERVER_SERVER=http://127.0.0.1:8080
echo "export JUMPSERVER_SERVER=http://127.0.0.1:8080" >> ~/.bashrc
# BOOTSTRAP_TOKEN 为/opt/jumpserver/config.yml 里面的 BOOTSTRAP_TOKEN 值
export BOOTSTRAP_TOKEN=******
echo "export BOOTSTRAP_TOKEN=******" >> ~/.bashrc
export JUMPSERVER_KEY_DIR=/config/guacamole/keys
echo "export JUMPSERVER_KEY_DIR=/config/guacamole/keys" >> ~/.bashrc
export GUACAMOLE_HOME=/config/guacamole
echo "export GUACAMOLE_HOME=/config/guacamole" >> ~/.bashrc
export GUACAMOLE_LOG_LEVEL=ERROR
echo "export GUACAMOLE_LOG_LEVEL=ERROR" >> ~/.bashrc
export JUMPSERVER_ENABLE_DRIVE=true
echo "export JUMPSERVER_ENABLE_DRIVE=true" >> ~/.bashrc

10.启动guacd和tomcat
/etc/init.d/guacd start
sh /opt/tomcat9/bin/startup.sh

 

九.安装前端服务组件
1.安装lina组件（前端模块）
获取lina
cd /opt
wget https://github.com/jumpserver/lina/releases/download/v2.1.0/lina-v2.1.0.tar.gz
解压缩
tar zxvf lina-v2.1.0.tar.gz
mv lina-v2.1.0 lina
修改属主
chown -R nginx:nginx lina

2.安装luna组件（web terminal前端）
获取luna
wget https://github.com/jumpserver/luna/releases/download/v2.1.1/luna-v2.1.1.tar.gz
解压缩
tar zxvf luna-v2.1.1.tar.gz
mv luna-v2.1.1 luna

3.安装部署nginx
下载nginx
yum install -y nginx
修改配置文件(删除一些默认配置，添加新的配置)
删除一些默认配置
sed -i '38,58d' /etc/nginx/nginx.conf
添加新的配置
vim /etc/nginx/conf.d/jumpserver.conf
--------------------------------------------------------------------------------
server {
listen 80;

client_max_body_size 100m; # 录像及文件上传大小限制

location /ui/ {
try_files $uri / /index.html;
alias /opt/lina/;
}

location /luna/ {
try_files $uri / /index.html;
alias /opt/luna/; # luna 路径, 如果修改安装目录, 此处需要修改
}

location /media/ {
add_header Content-Encoding gzip;
root /opt/jumpserver/data/; # 录像位置, 如果修改安装目录, 此处需要修改
}

location /static/ {
root /opt/jumpserver/data/; # 静态资源, 如果修改安装目录, 此处需要修改
}

location /koko/ {
proxy_pass http://localhost:5000;
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}

location /guacamole/ {
proxy_pass http://localhost:8081/;
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}

location /ws/ {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://localhost:8070;
proxy_http_version 1.1;
proxy_buffering off;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}

location /api/ {
proxy_pass http://localhost:8080;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

location /core/ {
proxy_pass http://localhost:8080;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

location / {
rewrite ^/(.*)$ /ui/$1 last;
}
}
---------------------------------------------------------------------------------

检测配置
nginx -t

配置没问题，则启动
systemctl start nginx
systemctl enable nginx

十.访问 jumpserver 服务 (对应80端口)
http://xxx.xxx.xxx.xxx/core/auth/login/
默认账户密码：admin/admin