一、一键安装
Jumpserver 官网文档 https://docs.jumpserver.org/zh/master/
二、手动安装
1、准备好lnmp环境
(1)启动防火墙和关闭selinux
# systemctl start iptables
# systemctl enable iptables
# setenforce 0
# sed -i.bak 's#SELINUX=enforcing#SELINUX=disabled#g' /etc/selinux/config
(2)安装一些依赖包
yum -y install ntp make openssl openssl-devel pcre pcre-devel libpng \
libpng-devel libjpeg-6b libjpeg-devel-6b freetype freetype-devel gd \
gd-devel zlib zlib-devel gcc gcc-c++ libXpm libXpm-devel ncurses \
ncurses-devel libmcrypt libmcrypt-devel libxml2 libxml2-devel \
imake autoconf automake screen sysstat compat-libstdc++-33 \
curl curl-devel
(3)卸载已安装的nginx、mysql、php、http
# yum remove nginx
# yum remove mysql
# yum remove php
# yum remove httpd
(4)安装nginx
# systemctl start nginx
# systemctl enable nginx
(5)安装mysql（如果使用python自带的sqlite3，就不用安装mysql）
# wget -i -c http://dev.mysql.com/get/mysql57-community-release-el7-10.noarch.rpm
# yum -y install mysql57-community-release-el7-10.noarch.rpm
# yum -y install mysql-community-server
# systemctl start mysqld.service
# systemctl enable mysqld.service
# systemctl status mysqld.service
(6) 破解mysql
# vim /etc/my.cnf
[mysqld]
skip-grant-tables # 跳过授权表
# systemctl restart mysqld
# mysql -uroot -p # 空密码登录mysql修改密码
mysql> UPDATE mysql.user SET authentication_string=password('Clouddeep@clouddeep.cn') WHERE User='root'; # mysql5.6
mysql> ALTER USER 'root'@'localhost' IDENTIFIED BY 'Clouddeep@8890'; # mysql5.7，密码要复杂
Query OK, 1 row affected, 1 warning (0.00 sec)
# 重启mysql
# systemctl restart mysqld
(7)安装php
# yum install php lighttpd-fastcgi php-cli php-mysql php-gd php-imap \
php-ldap php-odbc php-pear php-xml php-xmlrpc php-mbstring php-mcrypt \
php-mssql php-snmp php-soap php-tidy php-common php-devel php-fpm
# systemctl start php-fpm
# systemctl enable php-fpm
# systemctl status php-fpm
# netstat -nputl |grep php-fpm
tcp 0 0 127.0.0.1:9000 0.0.0.0:* LISTEN 9473/php-fpm: maste
(8) nginx整合php
# vim /etc/nginx/conf.d/virtual.conf
server {
listen 80;
server_name 10.4.7.35;
location / {
root /var/www/html;
index index.html index.htm;
}
location ~ .*\.(php|php5)?$ {
root /var/www/html;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
include fastcgi.conf;
}
}
# echo "<?php phpinfo(); ?>" > /var/www/html/index.php
# systemctl restart nginx
# iptables -I INPUT -p tcp --dport 80 -j ACCEPT
# service iptables save
# curl -I http://10.4.7.35/index.php
HTTP/1.1 200 OK
Server: nginx/1.16.1
Date: Tue, 11 May 2021 07:19:19 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.4.16
2、安装redis，jumpserver会用redis做缓存
# yum -y install redis
# systemctl start redis
# systemctl status redis
# netstat -npult|grep redis
tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN 38814/redis-server
3、准备python3环境
(1)安装依赖包
# yum -y install wget sqlite-devel xz gcc automake zlib-devel openssl-devel epel-release git
(2)编译安装python3.6（国外链接）
# https://pan.baidu.com/s/1F-iw0FxuK19kMHCoDm2l3Q #下载下来传到服务器上
# tar xvf Python-3.6.1.tar.xz && cd Python-3.6.1
# ./configure && make && make install
(3)建立python虚拟环境
# cd /opt
# python3 -m venv py3 #相当于创建了一个python3的虚拟环境
# source /opt/py3/bin/activate # 以后启动Jumpserver之前都要先运行source命令进入python3环境再运行)
(py3) [root@bogon opt]# python --version
Python 3.6.1
(4)自动载入python虚拟环境配置
# cd /opt
# git clone git://github.com/kennethreitz/autoenv.git
# echo 'source /opt/autoenv/activate.sh' >> ~/.bashrc
# source ~/.bashrc
二、安装 Jumpserver
以下命令都在python3虚拟环境下运行，都要先运行 # source /opt/py3/bin/activate
1、下载Jumpserver（这里不确定）
(1) 如果这一步不成功就使用第2步
# source /opt/py3/bin/activate
(py3)# cd /opt/
(py3)# yum update nss # 防止下载不成功
(py3)# git clone https://github.com/jumpserver/jumpserver.git && cd jumpserver && git checkout master # 如果不成功去百度网盘下载jumpserver-master.zip
(py3)# echo "source /opt/py3/bin/activate" > /opt/jumpserver/.env
(2) 推荐使用这个步骤安装
# source /opt/py3/bin/activate
(py3)# cd /opt
(py3)# yum -y install unzip
(py3)# unzip jumpserver-master.zip # 去百度网盘下载jumpserver-master.zip
2、安装依赖rpm包
# source /opt/py3/bin/activate
(py3)# cd /opt/jumpserver-master/requirements/
(py3)# yum -y install $(cat rpm_requirements.txt)
3、安装python依赖库
(1) 方法一（如果下载速度很慢, 可以用方法二）
(py3)# pip install -r requirements.txt -i https://pypi.tuna.tsinghua.edu.cn/simple some-package
# 执行完后用echo $?如果返回0并提示以下内容不用管，执行不成功多试几次
You are using pip version 9.0.1, however version 18.0 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.
(2) 方法二(推荐)
(py3)# pip install --upgrade pip setuptools -i https://mirrors.aliyun.com/pypi/simple/
(py3)# pip install -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/
4、创建数据库 Jumpserver并授权 (如果不用mysql的话，这个就不用创建了),我们本次使用的是python自带的sqlite3数据库
(py3)# mysql -u root -p Clouddeep@8890
> create database jumpserver default charset 'utf8';
> grant all on jumpserver.* to 'jumpserver'@'127.0.0.1' identified by 'Jumpserver@8890';
> flush privileges;
5、修改Jumpserver配置文件（修改以下10处）https://blog.csdn.net/jon_stark/article/details/89294724
(py3)# cd /opt/jumpserver-master/
(py3)# cp config_example.yml config.yml
(py3)# vim /opt/jumpserver-master/config.yml
# 加密秘钥 生产环境中请修改为随机字符串，请勿外泄, 可使用命令生成
# $ cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 49;echo
SECRET_KEY: 用上面的命令生成
# 预共享Token coco和guacamole用来注册服务账号, 不在使用原来的注册接受机制，使用命令生成
# $ cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 16;echo
BOOTSTRAP_TOKEN: 用上面的命令生成
# Development env open this, when error occur display the full process track, Production disable it
# DEBUG 模式 开启DEBUG后遇到错误时可以看到更多日志
DEBUG: false
# DEBUG, INFO, WARNING, ERROR, CRITICAL can set. See https://docs.djangoproject.com/en/1.10/topics/logging/
# 日志级别
LOG_LEVEL: ERROR
# Session expiration setting, Default 24 hour, Also set expired on on browser close
# 浏览器Session过期时间, 默认24小时, 也可以设置浏览器关闭则过期
# SESSION_COOKIE_AGE: 86400
SESSION_EXPIRE_AT_BROWSER_CLOSE: true
# Database setting, Support sqlite3, mysql, postgres ....
# 数据库设置
# See https://docs.djangoproject.com/en/1.10/ref/settings/#databases
# SQLite setting:
# 使用单文件sqlite数据库
# DB_ENGINE: sqlite3
# DB_NAME:
# MySQL or postgres setting like:
# 使用Mysql作为数据库
DB_ENGINE: mysql
DB_HOST: 127.0.0.1
DB_PORT: 3306
DB_USER: jumpserver
DB_PASSWORD: Jumpserver@8890
DB_NAME: jumpserver
# When Django start it will bind this host and port
# ./manage.py runserver 127.0.0.1:8080
# 运行时绑定端口
HTTP_BIND_HOST: 0.0.0.0
HTTP_LISTEN_PORT: 8080
WS_LISTEN_PORT: 8070
# Use Redis as broker for celery and web socket
# Redis配置
REDIS_HOST: 127.0.0.1
REDIS_PORT: 6379
# REDIS_PASSWORD:
# REDIS_DB_CELERY: 3
# REDIS_DB_CACHE: 4
# Use OpenID authorization
# 使用OpenID 来进行认证设置
# BASE_SITE_URL: http://localhost:8080
# AUTH_OPENID: false # True or False
# AUTH_OPENID_SERVER_URL: https://openid-auth-server.com/
# AUTH_OPENID_REALM_NAME: realm-name
# AUTH_OPENID_CLIENT_ID: client-id
# AUTH_OPENID_CLIENT_SECRET: client-secret
# OTP settings
# OTP/MFA 配置
# OTP_VALID_WINDOW: 0
# OTP_ISSUER_NAME: Jumpserver
6、生成数据库表结构和初始化数据
# source /opt/py3/bin/activate
(py3) [root@bogon ~]# cd /opt/jumpserver-master/utils/
(py3) [root@bogon utils]# bash make_migrations.sh
(py3) [root@bogon utils]# echo $?
0 # 0表示正确
7、运行jumpserver
# source /opt/py3/bin/activate
(py3)# cd /opt/jumpserver-master
# ./jms start all # 后台运行使用 -d 参数./jms start all -d
# iptables -I INPUT -p tcp --dport 8080 -j ACCEPT
# service iptables save
# 新版本更新了运行脚本，使用方式./jms start|stop|status|restart all 后台运行请添加 -d 参数
运行不报错，请浏览器访问 http://10.4.7.35:8080/ 默认账号: admin 密码: admin
三、安装SSH Server 和 WebSocket Server:Coco
1、下载Clone项目
# cd /opt
# source /opt/py3/bin/activate
# git clone https://github.com/jumpserver/coco.git && cd coco && git checkout master
# echo "source /opt/py3/bin/activate" > /opt/coco/.env # 进入 coco 目录时将自动载入 python 虚拟环境
# 首次进入 coco 文件夹会有提示，按 y 即可
# Are you sure you want to allow this? (y/N) y
2、安装依赖
# cd /opt/coco/requirements
# yum -y install $(cat rpm_requirements.txt)
# pip install -r requirements.txt -i https://pypi.tuna.tsinghua.edu.cn/simple
# 执行完后用echo $?如果返回0并提示以下内容不用管
You are using pip version 9.0.1, however version 18.0 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.
3、修改配置文件（修改2处）
# cd /opt/coco
# cp conf_example.py conf.py # 如果 coco 与 jumpserver 分开部署，请手动修改 conf.py
# vi conf.py
# 注意对齐，不要直接复制本文档的内容
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
#
import os
BASE_DIR = os.path.dirname(__file__)
class Config:
"""
Coco config file, coco also load config from server update setting below
"""
# 项目名称, 会用来向Jumpserver注册, 识别而已, 不能重复
# NAME = "localhost"
NAME = "coco" #1、这里增加
# Jumpserver项目的url, api请求注册会使用, 如果Jumpserver没有运行在127.0.0.1:8080，请修改此处
# CORE_HOST = os.environ.get("CORE_HOST") or 'http://127.0.0.1:8080'
CORE_HOST = 'http://127.0.0.1:8080' #2、这里增加用来连接jumpserver
# 启动时绑定的ip, 默认 0.0.0.0
# BIND_HOST = '0.0.0.0'
# 监听的SSH端口号, 默认2222
# SSHD_PORT = 2222
# 监听的HTTP/WS端口号，默认5000
# HTTPD_PORT = 5000
# 项目使用的ACCESS KEY, 默认会注册,并保存到 ACCESS_KEY_STORE中,
# 如果有需求, 可以写到配置文件中, 格式 access_key_id:access_key_secret
# ACCESS_KEY = None
# ACCESS KEY 保存的地址, 默认注册后会保存到该文件中
# ACCESS_KEY_STORE = os.path.join(BASE_DIR, 'keys', '.access_key')
# 加密密钥
# SECRET_KEY = None
# 设置日志级别 ['DEBUG', 'INFO', 'WARN', 'ERROR', 'FATAL', 'CRITICAL']
# LOG_LEVEL = 'INFO'
LOG_LEVEL = 'WARN'
# 日志存放的目录
# LOG_DIR = os.path.join(BASE_DIR, 'logs')
# Session录像存放目录
# SESSION_DIR = os.path.join(BASE_DIR, 'sessions')
# 资产显示排序方式, ['ip', 'hostname']
# ASSET_LIST_SORT_BY = 'ip'
# 登录是否支持密码认证
# PASSWORD_AUTH = True
# 登录是否支持秘钥认证
# PUBLIC_KEY_AUTH = True
# 和Jumpserver 保持心跳时间间隔
# HEARTBEAT_INTERVAL = 5
# Admin的名字，出问题会提示给用户
# ADMINS = ''
COMMAND_STORAGE = {
"TYPE": "server"
}
REPLAY_STORAGE = {
"TYPE": "server"
}
config = Config()
4、启动cocod，并去Jumpserver——会话管理接受coco的注册（入下图所示）
# ./cocod start # 后台运行使用 -d 参数./cocod start -d
# 新版本更新了运行脚本，使用方式./cocod start|stop|status|restart 后台运行请添加 -d 参数
四、安装Web Terminal 前端：Luna
1、下载并解压Luna (可到百度云下载)
# cd /opt
# wget https://github.com/jumpserver/luna/releases/download/1.3.3/luna.tar.gz
# tar xvf luna.tar.gz
# chown -R root:root luna
五、配置 Nginx 整合各组件
1、修改nginx配置文件（把下面的内容粘贴就可以）
# cat /etc/nginx/conf.d/jumpserver.conf
server {
listen 80; # 代理端口，以后将通过此端口进行访问，不再通过8080端口
server_name 172.16.12.33;
location /luna/ {
try_files $uri / /index.html;
alias /opt/luna/; # luna 路径，如果修改安装目录，此处需要修改
}
location /media/ {
add_header Content-Encoding gzip;
root /opt/jumpserver/data/; # 录像位置，如果修改安装目录，此处需要修改
}
location /static/ {
root /opt/jumpserver/data/; # 静态资源，如果修改安装目录，此处需要修改
}
location /socket.io/ {
proxy_pass http://localhost:5000/socket.io/; # 如果coco安装在别的服务器，请填写它的ip
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}
location / {
proxy_pass http://localhost:8080; # 如果jumpserver安装在别的服务器，请填写它的ip
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
2、启动nginx和其他服务
# /etc/init.d/nginx start #端口80
# /etc/init.d/mysqld start #端口3306（如果使用sqlite3就不用启动mysql）
# /etc/init.d/php-fpm start #端口9000
# /etc/init.d/redis start #端口6379
# source /opt/py3/bin/activate
# cd /opt/jumpserver/ && ./jms start -d #启动jumpserver，端口号8080,jumpserver的数据库在/opt/jumpserver/data/db.sqlite3，直接备份这个文件就可以了。
# cd /opt/coco && ./cocod start -d #确保jumpserver启动后再启动coco，端口号2222
3、服务全部启动后，访问 http://172.16.12.33，访问nginx代理的端口，不要再通过8080端口访问。默认账号: admin 密码: admin
录像路径：./opt/jumpserver/data/media/
六、使用方法看管理文档
http://docs.jumpserver.org/zh/docs/admin_guide.html
http://docs.jumpserver.org/zh/docs/
按官方文档以下2步做就可以了
扫一扫
1083
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
