Linux-Jumpserver服务

阅读原文时间：2023年07月10日阅读：1

1.介绍

Jumpserver是一款由python编写开源的跳板机(堡垒机)系统，实现了跳板机应有的功能。基于ssh协议来管理，客户端无需安装agent。特点：完全开源，GPL授权 Python编写，支持再次开发实现了跳板机基本功能，认证、授权、审计集成了Ansible。

2.优点

1、完全开源，也可以选择商业支持； 2、支持多种常用的操作系统； 3、提供用户会话记录功能，可以手动终端不明的会话记录； 4、支持录像回放功能，方便生产事故后的问题追溯； 5、所有密码通过系统管理，最终用户不需知道服务器的密码。终结了生产环境密码手工拷贝和传播的方式。

3.安装部署

3.1环境准备

关闭防火墙和SELinux

服务器

作用

jumpserver

10.0.0.123

client

10.0.0.124

3.2更新源

yum install git wegt -y
wget -O /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-7.repo
wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
yum makecach
yum updata -y

3.3安装依赖包

yum -y install epel-release

3.4. 安装 Python3.6 MySQL Redis

yum install -y python36 python36-devel redis mariadb-server mariadb-devel mariadb

3.5启动服务

systemctl start mariadb redis
systemctl enable mariadb redis

3.6进入数据库并创建jumpserver库

mysql -uroot
create database jumpserver default charset 'utf8' collate 'utf8_bin';
grant all on jumpserver.* to 'jumpserver'@'10.0.0.%' identified by 'weakPassword';
flush privileges;

3.7创建 Python 虚拟环境

python3.6 -m venv /opt/py3

3.8载入 Python 虚拟环境

source /opt/py3/bin/activate

3.9获取jumpserver代码

cd /opt && \
wget https://github.com/jumpserver/jumpserver/releases/download/v2.3.1/jumpserver-v2.3.1.tar.gz
tar xf jumpserver-v2.3.1.tar.gz
mv jumpserver-v2.3.1 jumpserver

4.0安装编译环境依赖

cd /opt/jumpserver/requirements
yum install -y $(cat rpm_requirements.txt)
pip install wheel && \
pip install --upgrade pip setuptools && \
pip install -r requirements.txt

#################################
国内源，如果服务启动不成功用国内源
pip install wheel -i https://mirrors.aliyun.com/pypi/simple/
pip install --upgrade pip setuptools -i https://mirrors.aliyun.com/pypi/simple/
pip install -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/

ps:确保已经载入 py3 虚拟环境, 中间如果遇到报错一般是依赖包没装全, 可以通过搜索引擎解决

pip install wheel -i https://mirrors.aliyun.com/pypi/simple/
pip install --upgrade pip setuptools -i https://mirrors.aliyun.com/pypi/simple/
pip install -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/

4.1修改配置文件

cd /opt/jumpserver && \
cp config_example.yml config.yml && \
vi config.yml

https://suijimimashengcheng.51240.com/ 随机密码生成

# SECURITY WARNING: keep the secret key used in production secret!

加密秘钥生产环境中请修改为随机字符串，请勿外泄, 可使用命令生成

cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 49;echo

SECRET_KEY:aumutGWrDOKyOwY0w22Pjg4c4RCZISjUjQAd3CB2oK7dZ7J4Bu #50位

SECURITY WARNING: keep the bootstrap token used in production secret!

预共享Token coco和guacamole用来注册服务账号，不在使用原来的注册接受机制

BOOTSTRAP_TOKEN:KN9X8hHaWuNFQ5gTdjDK #20位

Development env open this, when error occur display the full process track, Production disable it

DEBUG 模式开启DEBUG后遇到错误时可以看到更多日志

DEBUG: false

DEBUG, INFO, WARNING, ERROR, CRITICAL can set. See https://docs.djangoproject.com/en/1.10/topics/logging/

日志级别

LOG_LEVEL: ERROR

LOG_DIR:

Session expiration setting, Default 24 hour, Also set expired on on browser close

浏览器Session过期时间，默认24小时, 也可以设置浏览器关闭则过期

SESSION_COOKIE_AGE: 86400

SESSION_EXPIRE_AT_BROWSER_CLOSE: true

Database setting, Support sqlite3, mysql, postgres ….

数据库设置

See https://docs.djangoproject.com/en/1.10/ref/settings/#databases

SQLite setting:

使用单文件sqlite数据库

DB_ENGINE: sqlite3

DB_NAME:

MySQL or postgres setting like:

使用Mysql作为数据库

DB_ENGINE: mysql
DB_HOST: 127.0.0.1
DB_PORT: 3306
DB_USER: jumpserver
DB_PASSWORD: weakPassword
DB_NAME: jumpserver

When Django start it will bind this host and port

./manage.py runserver 127.0.0.1:8080

运行时绑定端口

HTTP_BIND_HOST: 0.0.0.0
HTTP_LISTEN_PORT: 8080
WS_LISTEN_PORT: 8070

Use Redis as broker for celery and web socket

Redis配置

REDIS_HOST: 127.0.0.1
REDIS_PORT: 6379
REDIS_PASSWORD: ZhYnLrodpmPncovxJTnRyiBs

REDIS_DB_CELERY: 3

REDIS_DB_CACHE: 4

Use OpenID authorization

使用OpenID 来进行认证设置

BASE_SITE_URL: http://localhost:8080

AUTH_OPENID: false # True or False

AUTH_OPENID_SERVER_URL: https://openid-auth-server.com/

AUTH_OPENID_REALM_NAME: realm-name

AUTH_OPENID_CLIENT_ID: client-id

AUTH_OPENID_CLIENT_SECRET: client-secret

AUTH_OPENID_IGNORE_SSL_VERIFICATION: True

AUTH_OPENID_SHARE_SESSION: True

Use Radius authorization

使用Radius来认证

AUTH_RADIUS: false

RADIUS_SERVER: localhost

RADIUS_PORT: 1812

RADIUS_SECRET:

CAS 配置

AUTH_CAS': False,

CAS_SERVER_URL': "http://host/cas/",

CAS_ROOT_PROXIED_AS': 'http://jumpserver-host:port',

CAS_LOGOUT_COMPLETELY': True,

CAS_VERSION': 3,

LDAP/AD settings

LDAP 搜索分页数量

AUTH_LDAP_SEARCH_PAGED_SIZE: 1000

定时同步用户

启用 / 禁用

AUTH_LDAP_SYNC_IS_PERIODIC: True

同步间隔 (单位: 时) (优先）

AUTH_LDAP_SYNC_INTERVAL: 12

Crontab 表达式

AUTH_LDAP_SYNC_CRONTAB: * 6 * * *

LDAP 用户登录时仅允许在用户列表中的用户执行 LDAP Server 认证

AUTH_LDAP_USER_LOGIN_ONLY_IN_USERS: False

LDAP 认证时如果日志中出现以下信息将参数设置为 0 (详情参见：https://www.python-ldap.org/en/latest/faq.html)

In order to perform this operation a successful bind must be completed on the connection

AUTH_LDAP_OPTIONS_OPT_REFERRALS: -1

OTP settings

OTP/MFA 配置

OTP_VALID_WINDOW: 0

OTP_ISSUER_NAME: Jumpserver

Perm show single asset to ungrouped node

是否把未授权节点资产放入到未分组节点中

PERM_SINGLE_ASSET_TO_UNGROUP_NODE: false

启用定时任务

PERIOD_TASK_ENABLE: True

启用二次复合认证配置

LOGIN_CONFIRM_ENABLE: False

Windows 登录跳过手动输入密码

WINDOWS_SKIP_ALL_MANUAL_PASSWORD: True

4.2启动 JumpServer

cd /opt/jumpserver
./jms start -d

4.3部署 KoKo 组件

cd /opt && \
wget https://github.com/jumpserver/koko/releases/download/v2.3.1/koko-v2.3.1-linux-amd64.tar.gz
tar -xf koko-v2.3.1-linux-amd64.tar.gz
mv koko-v2.3.1-linux-amd64 koko
chown -R root:root koko
cd koko
mv kubectl /usr/local/bin/
wget https://download.jumpserver.org/public/kubectl.tar.gz
tar -xf kubectl.tar.gz
chmod 755 kubectl
mv kubectl /usr/local/bin/rawkubectl
rm -rf kubectl.tar.gz
cp config_example.yml config.yml
vi config.yml

# 项目名称, 会用来向Jumpserver注册, 识别而已, 不能重复

NAME: {{ Hostname }}

Jumpserver项目的url, api请求注册会使用

CORE_HOST: http://127.0.0.1:8080

Bootstrap Token, 预共享秘钥, 用来注册coco使用的service account和terminal

BOOTSTRAP_TOKEN: KN9X8hHaWuNFQ5gTdjDK ####和**/opt/jumpserver/config.yml对应**

请和jumpserver 配置文件中保持一致，注册完成后可以删除

启动时绑定的ip, 默认 0.0.0.0

BIND_HOST: 0.0.0.0

监听的SSH端口号, 默认2222

SSHD_PORT: 2222

监听的HTTP/WS端口号，默认5000

HTTPD_PORT: 5000

项目使用的ACCESS KEY, 默认会注册,并保存到 ACCESS_KEY_STORE中,

如果有需求, 可以写到配置文件中, 格式 access_key_id:access_key_secret

ACCESS_KEY: null

ACCESS KEY 保存的地址, 默认注册后会保存到该文件中

ACCESS_KEY_FILE: data/keys/.access_key

设置日志级别 [DEBUG, INFO, WARN, ERROR, FATAL, CRITICAL]

LOG_LEVEL: ERROR ####和/opt/jumpserver/config.yml对应

SSH连接超时时间 (default 15 seconds)

SSH_TIMEOUT: 15

语言 [en,zh]

LANGUAGE_CODE: zh

SFTP的根目录, 可选 /tmp, Home其他自定义目录

SFTP_ROOT: /tmp

SFTP是否显示隐藏文件

SFTP_SHOW_HIDDEN_FILE: false

是否复用和用户后端资产已建立的连接(用户不会复用其他用户的连接)

REUSE_CONNECTION: true

资产加载策略, 可根据资产规模自行调整. 默认异步加载资产, 异步搜索分页; 如果为all, 则资产全部加载, 本地搜索分页.

ASSET_LOAD_POLICY:

zip压缩的最大额度 (单位: M)

ZIP_MAX_SIZE: 1024M

zip压缩存放的临时目录 /tmp

ZIP_TMP_PATH: /tmp

向 SSH Client 连接发送心跳的时间间隔 (单位: 秒)，默认为30, 0则表示不发送

CLIENT_ALIVE_INTERVAL: 30

向资产发送心跳包的重试次数，默认为3

RETRY_ALIVE_COUNT_MAX: 3

会话共享使用的类型 [local, redis], 默认local

SHARE_ROOM_TYPE: local

Redis配置

REDIS_HOST: 127.0.0.1

REDIS_PORT: 6379

REDIS_PASSWORD:

REDIS_CLUSTERS:

REDIS_DB_ROOM:

4.4启动koko

./koko -d后台运行

4.5部署 Guacamole 组件

cd /opt && \
wget -O docker-guacamole-v2.3.1.tar.gz https://github.com/jumpserver/docker-guacamole/archive/master.tar.gz
mkdir /opt/docker-guacamole && \
tar -xf docker-guacamole-v2.3.1.tar.gz -C /opt/docker-guacamole --strip-components 1 && \
rm -rf /opt/docker-guacamole-v2.3.1.tar.gz && \
cd /opt/docker-guacamole && \
wget http://download.jumpserver.org/public/guacamole-server-1.2.0.tar.gz && \
tar -xf guacamole-server-1.2.0.tar.gz && \
wget http://download.jumpserver.org/public/ssh-forward.tar.gz && \
tar -xf ssh-forward.tar.gz -C /bin/ && \
chmod +x /bin/ssh-forward
cd /opt/docker-guacamole/guacamole-server-1.2.0

4.6根据 Guacamole官方文档文档安装对应的依赖包

yum install cairo-devel libjpeg-turbo-devel libpng-devel uuid-devel ffmpeg-devel freerdp-devel pango-devel libssh2-devel libtelnet-devel libvncserver-devel libwebsockets-devel pulseaudio-libs-devel openssl-devel libvorbis-devel libwebp-devel -y

4.7安装Guacamole

./configure --with-init-dir=/etc/init.d && \
make && \
make install

4.8需要先在当前环境配置好 Java

yum install -y java-1.8.0-openjdk
mkdir -p /config/guacamole /config/guacamole/extensions /config/guacamole/record /config/guacamole/drive && \
chown daemon:daemon /config/guacamole/record /config/guacamole/drive && \
cd /config

4.9下载Tomcat

wget http://mirrors.tuna.tsinghua.edu.cn/apache/tomcat/tomcat-9/v9.0.38/bin/apache-tomcat-9.0.38.tar.gz
tar -xf apache-tomcat-9.0.38.tar.gz
mv apache-tomcat-9.0.38 tomcat9
rm -rf /config/tomcat9/webapps/*
sed -i 's/Connector port="8080"/Connector port="8081"/g' /config/tomcat9/conf/server.xml

echo "java.util.logging.ConsoleHandler.encoding = UTF-8" >> /config/tomcat9/conf/logging.properties

wget http://download.jumpserver.org/release/v2.3.1/guacamole-client-v2.3.1.tar.gz
tar -xf guacamole-client-v2.3.1.tar.gz
rm -rf guacamole-client-v2.3.1.tar.gz
cp guacamole-client-v2.3.1/guacamole-*.war /config/tomcat9/webapps/ROOT.war
cp guacamole-client-v2.3.1/guacamole-*.jar /config/guacamole/extensions/
mv /opt/docker-guacamole/guacamole.properties /config/guacamole/
rm -rf /opt/docker-guacamole

5.0设置 Guacamole 环境

export JUMPSERVER_SERVER=http://127.0.0.1:8080
echo "export JUMPSERVER_SERVER=http://127.0.0.1:8080" >> ~/.bashrc
export BOOTSTRAP_TOKEN=KN9X8hHaWuNFQ5gTdjDK #对应jumpserver/config.yml 文件
echo "export BOOTSTRAP_TOKEN=KN9X8hHaWuNFQ5gTdjDK" >> ~/.bashrc #对应jumpserver/config.yml 文件
export JUMPSERVER_KEY_DIR=/config/guacamole/data/keys
echo "export JUMPSERVER_KEY_DIR=/config/guacamole/data/keys" >> ~/.bashrc
export GUACAMOLE_HOME=/config/guacamole
echo "export GUACAMOLE_HOME=/config/guacamole" >> ~/.bashrc
export GUACAMOLE_LOG_LEVEL=ERROR
echo "export GUACAMOLE_LOG_LEVEL=ERROR" >> ~/.bashrc
export JUMPSERVER_ENABLE_DRIVE=true
echo "export JUMPSERVER_ENABLE_DRIVE=true" >> ~/.bashrc

/etc/init.d/guacd start
sh /config/tomcat9/bin/startup.sh

ps:环境变量说明

JUMPSERVER_SERVER 指 core 访问地址
BOOTSTRAP_TOKEN 为 Jumpserver/config.yml 里面的 BOOTSTRAP_TOKEN 值
JUMPSERVER_KEY_DIR 认证成功后 key 存放目录
GUACAMOLE_HOME 为 guacamole.properties 配置文件所在目录
GUACAMOLE_LOG_LEVEL 为生成日志的等级
JUMPSERVER_ENABLE_DRIVE 为 rdp 协议挂载共享盘

5.1下载 Lina 组件

cd /opt
wget https://github.com/jumpserver/lina/releases/download/v2.3.1/lina-v2.3.1.tar.gz
tar -xf lina-v2.3.1.tar.gz
mv lina-v2.3.1 lina
useradd nginx -M -s/sbin/nologin
chown -R nginx:nginx lina

5.2下载 Luna 组件

cd /opt
wget https://github.com/jumpserver/luna/releases/download/v2.3.1/luna-v2.3.1.tar.gz
tar -xf luna-v2.3.1.tar.gz
mv luna-v2.3.1 luna
chown -R nginx:nginx luna

5.3配置 Nginx 整合各组件

vim /etc/yum.repos.d/nginx.repo
[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

yum install nginx -y

echo > /etc/nginx/conf.d/default.conf
vi /etc/nginx/conf.d/jumpserver.conf

server {
listen 80;

client\_max\_body\_size 100m;  # 录像及文件上传大小限制

location /ui/ {  
    try\_files $uri / /index.html;  
    alias /opt/lina/;  
}

location /luna/ {  
    try\_files $uri / /index.html;  
    alias /opt/luna/;  # luna 路径, 如果修改安装目录, 此处需要修改  
}

location /media/ {  
    add\_header Content-Encoding gzip;  
    root /opt/jumpserver/data/;  # 录像位置, 如果修改安装目录, 此处需要修改  
}

location /static/ {  
    root /opt/jumpserver/data/;  # 静态资源, 如果修改安装目录, 此处需要修改  
}

location /koko/ {  
    proxy\_pass       http://localhost:5000;  
    proxy\_buffering off;  
    proxy\_http\_version 1.1;  
    proxy\_set\_header Upgrade $http\_upgrade;  
    proxy\_set\_header Connection "upgrade";  
    proxy\_set\_header X-Real-IP $remote\_addr;  
    proxy\_set\_header Host $host;  
    proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;  
    access\_log off;  
}

location /guacamole/ {  
    proxy\_pass       http://localhost:8081/;  
    proxy\_buffering off;  
    proxy\_http\_version 1.1;  
    proxy\_set\_header Upgrade $http\_upgrade;  
    proxy\_set\_header Connection $http\_connection;  
    proxy\_set\_header X-Real-IP $remote\_addr;  
    proxy\_set\_header Host $host;  
    proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;  
    access\_log off;  
}

location /ws/ {  
    proxy\_set\_header X-Real-IP $remote\_addr;  
    proxy\_set\_header Host $host;  
    proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;  
    proxy\_pass http://localhost:8070;  
    proxy\_http\_version 1.1;  
    proxy\_buffering off;  
    proxy\_set\_header Upgrade $http\_upgrade;  
    proxy\_set\_header Connection "upgrade";  
}

location /api/ {  
    proxy\_pass http://localhost:8080;  
    proxy\_set\_header X-Real-IP $remote\_addr;  
    proxy\_set\_header Host $host;  
    proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;  
}

location /core/ {  
    proxy\_pass http://localhost:8080;  
    proxy\_set\_header X-Real-IP $remote\_addr;  
    proxy\_set\_header Host $host;  
    proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;  
}

location / {  
    rewrite ^/(.\*)$ /ui/$1 last;  
}

}

5.4检查语法，开启服务

nginx -t
systemctl start nginx

5.5开始使用 JumpServer

服务全部启动后, 访问 JumpServer 服务器 nginx 代理的 80 端口, 不要通过8080端口访问默认账号: admin 密码: admin

手机扫一扫

移动阅读更方便

你可能感兴趣的文章

Linux-Jumpserver服务

1.介绍

2.优点

3.安装部署

3.1环境准备

3.2更新源

3.3安装依赖包

3.4. 安装 Python3.6 MySQL Redis

3.5启动服务

3.6进入数据库并创建jumpserver库

3.7创建 Python 虚拟环境

3.8载入 Python 虚拟环境

3.9获取jumpserver代码

4.0安装编译环境依赖

4.1修改配置文件

加密秘钥 生产环境中请修改为随机字符串，请勿外泄, 可使用命令生成

cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 49;echo

SECURITY WARNING: keep the bootstrap token used in production secret!

预共享Token coco和guacamole用来注册服务账号，不在使用原来的注册接受机制

Development env open this, when error occur display the full process track, Production disable it

DEBUG 模式 开启DEBUG后遇到错误时可以看到更多日志

DEBUG, INFO, WARNING, ERROR, CRITICAL can set. See https://docs.djangoproject.com/en/1.10/topics/logging/

日志级别

LOG_DIR:

Session expiration setting, Default 24 hour, Also set expired on on browser close

浏览器Session过期时间，默认24小时, 也可以设置浏览器关闭则过期

SESSION_COOKIE_AGE: 86400

Database setting, Support sqlite3, mysql, postgres ….

数据库设置

See https://docs.djangoproject.com/en/1.10/ref/settings/#databases

SQLite setting:

使用单文件sqlite数据库

DB_ENGINE: sqlite3

DB_NAME:

MySQL or postgres setting like:

使用Mysql作为数据库

When Django start it will bind this host and port

./manage.py runserver 127.0.0.1:8080

运行时绑定端口

Use Redis as broker for celery and web socket

Redis配置

REDIS_DB_CELERY: 3

REDIS_DB_CACHE: 4

Use OpenID authorization

使用OpenID 来进行认证设置

BASE_SITE_URL: http://localhost:8080

AUTH_OPENID: false # True or False

AUTH_OPENID_SERVER_URL: https://openid-auth-server.com/

AUTH_OPENID_REALM_NAME: realm-name

AUTH_OPENID_CLIENT_ID: client-id

AUTH_OPENID_CLIENT_SECRET: client-secret

AUTH_OPENID_IGNORE_SSL_VERIFICATION: True

AUTH_OPENID_SHARE_SESSION: True

Use Radius authorization

使用Radius来认证

AUTH_RADIUS: false

RADIUS_SERVER: localhost

RADIUS_PORT: 1812

RADIUS_SECRET:

CAS 配置

AUTH_CAS': False,

CAS_SERVER_URL': "http://host/cas/",

CAS_ROOT_PROXIED_AS': 'http://jumpserver-host:port',

CAS_LOGOUT_COMPLETELY': True,

CAS_VERSION': 3,

LDAP/AD settings

LDAP 搜索分页数量

AUTH_LDAP_SEARCH_PAGED_SIZE: 1000

定时同步用户

启用 / 禁用

AUTH_LDAP_SYNC_IS_PERIODIC: True

同步间隔 (单位: 时) (优先）

AUTH_LDAP_SYNC_INTERVAL: 12

Crontab 表达式

AUTH_LDAP_SYNC_CRONTAB: * 6 * * *

LDAP 用户登录时仅允许在用户列表中的用户执行 LDAP Server 认证

AUTH_LDAP_USER_LOGIN_ONLY_IN_USERS: False

LDAP 认证时如果日志中出现以下信息将参数设置为 0 (详情参见：https://www.python-ldap.org/en/latest/faq.html)

In order to perform this operation a successful bind must be completed on the connection

AUTH_LDAP_OPTIONS_OPT_REFERRALS: -1

加密秘钥生产环境中请修改为随机字符串，请勿外泄, 可使用命令生成

DEBUG 模式开启DEBUG后遇到错误时可以看到更多日志

是否把未授权节点资产放入到未分组节点中

4.6根据 Guacamole官方文档文档安装对应的依赖包