jumpserver版本：Version 1.4.1-2 （社區版）

主機IP地址：10.0.0.105

準備環境
1、安裝依賴
yum -y install wget sqlite-devel xz gcc automake zlib-devel openssl-devel git epel-release

2、安裝python3.6.3
wget https://www.python.org/ftp/python/3.6.1/Python-3.6.1.tar.xz

tar xvf Python-3.6.1.tar.xz && cd Python-3.6.1

./configure && make && make install

3、設置虛擬環境
cd /opt

python3 -m venv py3

source /opt/py3/bin/activate #看到下面的提示符代表成功，以後運行Jumpserver都要先運行以上source命令，
#以下所有命令均在該虛擬環境中運行
(py3) [root@localhost py3]

4、自動載入Python虛擬環境配置

cd /opt
git clone https://github.com/kennethreitz/autoenv.git

echo ‘source /opt/autoenv/activate.sh‘ >> ~/.bashrc

source ~/.bashrc

0、安裝Jumpserver
cd /opt/
git clone https://github.com/jumpserver/jumpserver.git && cd jumpserver && git checkout master #也可上傳事先下載的包，解壓
echo "source /opt/py3/bin/activate" > /opt/jumpserver/.env

cd /opt/jumpserver/requirements
yum -y install $(cat rpm_requirements.txt)

pip install -r requirements.txt -i https://pypi.python.org/simple

1、安裝redis
yum -y install redis
systemctl enable redis
systemctl start redis

2、安裝mysql
yum -y install mariadb mariadb-devel mariadb-server
systemctl enable mariadb
systemctl start mariadb

創建數據庫Jumpserver 並授權
mysql -uroot -p
>
create database jumpserver default charset ‘utf8‘;
grant all on jumpserver.* to ‘jumpserver‘@‘127.0.0.1‘ identified by ‘china123‘;
flush privileges;

3、修改Jumpserver配置文件
cd /opt/jumpserver

#cp config_example.py config.py
#vi config.py

cat >> config.py<<end
import os

BASE_DIR = os.path.dirname(os.path.abspath(__file__))

class Config:
# Use it to encrypt or decrypt data
# SECURITY WARNING: keep the secret key used in production secret!
SECRET_KEY = os.environ.get(‘SECRET_KEY‘) or ‘40347338aeeky!997d5kkcc4498551fd92c64mnz06y1mme-42d0ui3lut-a94#(^wd=%s_qj$1%x‘

# Django security setting, if your disable debug model, you should setting that
ALLOWED_HOSTS = [‘*‘]

# Development env open this, when error occur display the full process track, Production disable it
DEBUG = os.environ.get("DEBUG") or True

# DEBUG, INFO, WARNING, ERROR, CRITICAL can set. See https://docs.djangoproject.com/en/1.10/topics/logging/
LOG_LEVEL = os.environ.get("LOG_LEVEL") or ‘DEBUG‘
LOG_DIR = os.path.join(BASE_DIR, ‘logs‘)

# Database setting, Support sqlite3, mysql, postgres ....
# See https://docs.djangoproject.com/en/1.10/ref/settings/#databases

# SQLite setting:
#DB_ENGINE = ‘sqlite3‘
#DB_NAME = os.path.join(BASE_DIR, ‘data‘, ‘db.sqlite3‘)

#MySQL or postgres setting like:
DB_ENGINE = os.environ.get("DB_ENGINE") or ‘mysql‘
DB_HOST = os.environ.get("DB_HOST") or ‘127.0.0.1‘
DB_PORT = os.environ.get("DB_PORT") or 3306
DB_USER = os.environ.get("DB_USER") or ‘jumpserver‘
DB_PASSWORD = os.environ.get("DB_PASSWORD") or ‘china123‘
DB_NAME = os.environ.get("DB_NAME") or ‘jumpserver‘

# When Django start it will bind this host and port
# ./manage.py runserver 127.0.0.1:8080
HTTP_BIND_HOST = ‘0.0.0.0‘
HTTP_LISTEN_PORT = 8080

# Use Redis as broker for celery and web socket
REDIS_HOST = os.environ.get("REDIS_HOST") or ‘127.0.0.1‘
REDIS_PORT = os.environ.get("REDIS_PORT") or 6379
REDIS_PASSWORD = os.environ.get("REDIS_PASSWORD") or ‘‘
REDIS_DB_CELERY = os.environ.get(‘REDIS_DB‘) or 3
REDIS_DB_CACHE = os.environ.get(‘REDIS_DB‘) or 4

def __init__(self):
pass

def __getattr__(self, item):
return None

class DevelopmentConfig(Config):
pass

class TestConfig(Config):
pass

class ProductionConfig(Config):
pass

# Default using Config settings, you can write if/else for different env
config = DevelopmentConfig()

end

cd /opt/jumpserver/utils

bash make_migrations.sh

cd /opt/jumpserver

./jms start gunicorn -d
./jms start celery -d
./jms start beat -d
./jms status
netstat -tunlp|grep -E "8080|6379|3306"

在瀏覽器中訪問：10.0.0.105:8080，

用戶名密碼默認均為admin

安裝SSH Server 和WebSocket Server:Coco

cd /opt
source /opt/py3/bin/activate

git clone https://github.com/jumpserver/coco.git && cd coco && git checkout master #此步可上傳事先下載的安裝包，解壓

echo "source /opt/py3/bin/activate" > /opt/coco/.env

cd /opt/coco/requirements

yum -y install $(cat rpm_requirements.txt)

pip install -r requirements.txt -i https://pypi.python.org/simple

cd /opt/coco

#cp conf_example.py conf.py #如果coco與jumpserver分開部署，請手動修改conf.py
#vi conf.py

cat >>conf.py<<end
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
#

import os

BASE_DIR = os.path.dirname(__file__)

class Config:
"""
Coco config file, coco also load config from server update setting below
"""
# 項目名稱, 會用來向Jumpserver註冊, 識別而已, 不能重復
NAME = "localhost"

# Jumpserver項目的url, api請求註冊會使用
CORE_HOST = os.environ.get("CORE_HOST") or ‘http://127.0.0.1:8080‘

# 啟動時綁定的ip, 默認 0.0.0.0
BIND_HOST = ‘0.0.0.0‘

# 監聽的SSH端口號, 默認2222
# SSHD_PORT = 2222

# 監聽的HTTP/WS端口號，默認5000
HTTPD_PORT = 5000

# 項目使用的ACCESS KEY, 默認會註冊,並保存到 ACCESS_KEY_STORE中,
# 如果有需求, 可以寫到配置文件中, 格式 access_key_id:access_key_secret
ACCESS_KEY = None

# ACCESS KEY 保存的地址, 默認註冊後會保存到該文件中
ACCESS_KEY_STORE = os.path.join(BASE_DIR, ‘keys‘, ‘.access_key‘)

# 加密密鑰
SECRET_KEY = None

# 設置日誌級別 [‘DEBUG‘, ‘INFO‘, ‘WARN‘, ‘ERROR‘, ‘FATAL‘, ‘CRITICAL‘]
LOG_LEVEL = ‘INFO‘

# 日誌存放的目錄
LOG_DIR = os.path.join(BASE_DIR, ‘logs‘)

# Session錄像存放目錄
SESSION_DIR = os.path.join(BASE_DIR, ‘sessions‘)

# 資產顯示排序方式, [‘ip‘, ‘hostname‘]
ASSET_LIST_SORT_BY = ‘ip‘

# 登錄是否支持密碼認證
PASSWORD_AUTH = True

# 登錄是否支持秘鑰認證
PUBLIC_KEY_AUTH = True

# SSH白名單
ALLOW_SSH_USER = ‘all‘ # [‘test‘, ‘test2‘]

# SSH黑名單, 如果用戶同時在白名單和黑名單，黑名單優先生效
BLOCK_SSH_USER = []

# 和Jumpserver 保持心跳時間間隔
HEARTBEAT_INTERVAL = 5

# Admin的名字，出問題會提示給用戶
ADMINS = ‘[email protected]‘
COMMAND_STORAGE = {
"TYPE": "server"
}
REPLAY_STORAGE = {
"TYPE": "server"
}

# SSH連接超時時間 (default 15 seconds)
SSH_TIMEOUT = 15

# 語言 = en
LANGUAGE_CODE = ‘zh‘

config = Config()

end

./cocod start -d
./cocod status

啟動成功後去Jumpserver會話管理-終端管理（http://10.0.0.125:8080/terminal/terminal/）接受coco的註冊

安裝Web Terminal前端: Luna

cd /opt
wget https://github.com/jumpserver/luna/releases/download/1.4.1/luna.tar.gz #可上傳事先現在的包，解壓
tar xvf luna.tar.gz
chown -R root:root luna

安裝Windows支持組件（如果不需要管理windows資產，可以直接跳過這一步）

wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
wget -O /etc/yum.repos.d/docker-ce.repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum list docker-ce.x86_64 --showduplicates | sort -r
yum install docker-ce -y
systemctl start docker
systemctl enable docker
systemctl status docker

docker run --name jms_guacamole -d \
-p 8081:8080 -v /opt/guacamole/key:/config/guacamole/key \
-e JUMPSERVER_KEY_DIR=/config/guacamole/key \
-e JUMPSERVER_SERVER=http://<填寫jumpserver的url地址> \
jumpserver/guacamole:latest

啟動成功後去Jumpserver會話管理-終端管理（http://10.0.0.125:8080/terminal/terminal/）接受[Gua]開頭的一個註冊（必須以[Gua]開頭）

安裝nginx

yum -y install nginx

cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.ori

cat >>/etc/nginx/nginx.conf<<end
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
worker_connections 1024;
}

http {
log_format main ‘$remote_addr - $remote_user [$time_local] "$request" ‘
‘$status $body_bytes_sent "$http_referer" ‘
‘"$http_user_agent" "$http_x_forwarded_for"‘;

access_log /var/log/nginx/access.log main;

sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;

include /etc/nginx/mime.types;
default_type application/octet-stream;

# Load modular configuration files from the /etc/nginx/conf.d directory.
# See http://nginx.org/en/docs/ngx_core_module.html#include
# for more information.
include /etc/nginx/conf.d/*.conf;
server {
listen 80;
client_max_body_size 100m;
location /luna/ {
try_files $uri / /index.html;
alias /opt/luna/;
}
location /media/ {
add_header Content-Encoding gzip;
root /opt/jumpserver/data/;
}

location /static/ {
root /opt/jumpserver/data/;
}
location /socket.io/ {
proxy_pass http://127.0.0.1:5000/socket.io/;
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}
location /guacamole/ {
proxy_pass http://127.0.0.1:8081/;
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}
location / {
proxy_pass http://127.0.0.1:8080;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

}

}

end

cd /opt/jumpserver
source /opt/py3/bin/activate
./jms status

cd /opt/coco
source /opt/py3/bin/activate
./cocod status

docker ps

systemctl restart nginx
systemctl enable nginx
systemctl status nginx

訪問：10.0.0.105，如果進入jumpserver界面說明部署成功

快速部署jumpserver堡壘機