开通VIP，畅享免费电子书等14项超值服
首页
好书
留言交流
下载APP
联系客服
2020.03.06
步步安装(CentOS)
本档旨在帮助户了解各组件之间的关系,产环境部署建议参考进阶安装
档
云服务器快速部署参考极速安装
安装过程中遇到问题可参考安装过程中常的问题
测试推荐环境
CPU:64位双核处理器
内存:4GDDR3
数据库：mysql版本于等于5.6mariadb版本于等于5.5.6
环境
系统:CentOS7
IP:192.168.244.144
设置selinux和防墙
$fifirewall-cmd--zone=public--add-port=80/tcp--permanent#nginx端
端coco
$fifirewall-cmd--reload#重新载规则
$setenforce0
$sed-i"s/SELINUX=enforcing/SELINUX=disabled/g"/etc/selinux/confifig
.准备Python3和Python虚拟环境
1.1安装依赖包
$yum-yinstallwgetgccepel-releasegit
1.2安装Python3.6
$yum-yinstallpython36python36-devel
#如果下载速度很慢,可以换国内源
1.3建Python虚拟环境
因为CentOS7带的是Python2,Yum等具依赖原来的Python,为了不扰
乱原来的环境我们来使Python虚拟环境$cd/opt
$python3.6-mvenvpy3
$source/opt/py3/bin/activate
#看到下的提示符代表成功,以后运Jumpserver都要先运以上source命
令,以下所有命令均在该虚拟环境中运
(py3)[root@localhostpy3]
.安装Jumpserver
2.1下载或Clone项
项提交较多gitclone时较,你可以选择去Github项直接下载zip包。
$cd/opt/
2.2安装依赖RPM包
$cd/opt/jumpserver/requirements
$yum-yinstall$(catrpm_requirements.txt)#如果没有任何报错请继续
2.3安装Python库依赖
$pipinstall--upgradepipsetuptools
$pipinstall-rrequirements.txt
2.4安装Redis,Jumpserver使Redis做cache和celerybroke
$yum-yinstallredis
$systemctlenableredis
$systemctlstartredis
2.5安装MySQL
置
$yum-yinstallmariadbmariadb-develmariadb-servermariadb-shared#
centos7下安装的是mariadb
$systemctlenablemariadb
$systemctlstartmariadb
机数据库密码
$echo-e"\033[31m你的数据库密码是$DB_PASSWORD\033[0m"
privileges;"
2.7修改Jumpserver配置件
$cd/opt/jumpserver
$cpconfifig_example.ymlconfifig.yml
$SECRET_KEY=`cat/dev/urandom|tr-dcA-Za-z0-9|head-c50`#成随机
SECRET_KEY
$echo"SECRET_KEY=$SECRET_KEY">>~/.bashrc
$BOOTSTRAP_TOKEN=`cat/dev/urandom|tr-dcA-Za-z0-9|head-c16`#
成随机BOOTSTRAP_TOKEN
$echo"BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN">>~/.bashrc
$sed-i"s/SECRET_KEY:/SECRET_KEY:$SECRET_KEY/g"/opt/jumpserver/
confifig.yml
$sed-i"s/BOOTSTRAP_TOKEN:/BOOTSTRAP_TOKEN:
$BOOTSTRAP_TOKEN/g"/opt/jumpserver/confifig.yml
$sed-i"s/#DEBUG:true/DEBUG:false/g"/opt/jumpserver/confifig.yml
$sed-i"s/#LOG_LEVEL:DEBUG/LOG_LEVEL:ERROR/g"/opt/jumpserver/
$sed-i"s/#SESSION_EXPIRE_AT_BROWSER_CLOSE:false/
SESSION_EXPIRE_AT_BROWSER_CLOSE:true/g"/opt/jumpserver/
$sed-i"s/DB_PASSWORD:/DB_PASSWORD:$DB_PASSWORD/g"/opt/
jumpserver/confifig.yml
$echo-e"\033[31m你的SECRET_KEY是$SECRET_KEY\033[0m"
$echo-e"\033[31m你的BOOTSTRAP_TOKEN是$BOOTSTRAP_TOKEN
\033[0m"
$viconfifig.yml#确认内容有没有错误
#SECURITYWARNING:keepthesecretkeyusedinproductionsecret!
#加密秘钥产环境中请修改为随机字符串,请勿外泄
SECRET_KEY:
#SECURITYWARNING:keepthebootstraptokenusedinproductionsecret!
#预共享Tokencoco和guacamole来注册服务账号,不在使原来的注册接受机制
BOOTSTRAP_TOKEN:
#Developmentenvopenthis,whenerroroccurdisplaythefullprocesstrack,
Productiondisableit
#DEBUG模式开启DEBUG后遇到错误时可以看到更多志
DEBUG:false
docs.djangoproject.com/en/1.10/topics/logging/
#志级别
LOG_LEVEL:ERROR
#LOG_DIR:
#Sessionexpirationsetting,Default24hour,Alsosetexpiredononbrowser
close
#SESSION_COOKIE_AGE:86400
SESSION_EXPIRE_AT_BROWSER_CLOSE:true
#Databasesetting,Supportsqlite3,mysql,postgres....
#数据库设置
#SQLitesetting:
#使单件sqlite数据库
#DB_ENGINE:sqlite3
#DB_NAME:
#MySQLorpostgressettinglike:
#使Mysql作为数据库
DB_ENGINE:mysql
DB_HOST:127.0.0.1
DB_PORT:3306
DB_USER:jumpserver
DB_PASSWORD:
DB_NAME:jumpserver
#WhenDjangostartitwillbindthishostandport
#./manage.pyrunserver127.0.0.1:8080
#运时绑定端
HTTP_BIND_HOST:0.0.0.0HTTP_LISTEN_PORT:8080
#UseRedisasbrokerforceleryandwebsocket
#Redis配置
REDIS_HOST:127.0.0.1
REDIS_PORT:6379
#REDIS_PASSWORD:
#REDIS_DB_CELERY:3
#REDIS_DB_CACHE:4
#UseOpenIDauthorization
#使OpenID来进认证设置
#AUTH_OPENID:false#TrueorFalse
#AUTH_OPENID_REALM_NAME:realm-name
#AUTH_OPENID_CLIENT_ID:client-id
#AUTH_OPENID_CLIENT_SECRET:client-secret
#OTPsettings
#OTP/MFA配置
#OTP_VALID_WINDOW:0
#OTP_ISSUER_NAME:Jumpserver
2.8运Jumpserver
$./jmsstartall-d#后台运使-d参数./jmsstartall-d
#新版本更新了运脚本,使式./jmsstart|stop|statusall后台运请添加-d
参数
运不报错,请继续往下操作
三.安装SSHServer和WebSocketServer:Coco
3.1下载或Clone项
$cd/opt
3.2安装依赖
$cd/opt/coco/requirements
$yum-yinstall$(catrpm_requirements.txt)$pipinstall-rrequirements.txt
3.3修改配置件并运
$cd/opt/coco
$sed-i"s/BOOTSTRAP_TOKEN:
BOOTSTRAP_TOKEN:$BOOTSTRAP_TOKEN/g"/opt/coco/confifig.yml
$sed-i"s/#LOG_LEVEL:INFO/LOG_LEVEL:ERROR/g"/opt/coco/confifig.yml
$viconfifig.yml
#项名称,会来向Jumpserver注册,识别已,不能重复
#NAME:{{Hostname}}
#Jumpserver项的url,api请求注册会使
#BootstrapToken,预共享秘钥,来注册coco使的serviceaccount和terminal
#请和jumpserver配置件中保持致,注册完成后可以删除
BOOTSTRAP_TOKEN:
#启动时绑定的ip,默认0.0.0.0
#BIND_HOST:0.0.0.0
#监听的SSH端号,默认2222
#SSHD_PORT:2222
#监听的HTTP/WS端号,默认5000
#HTTPD_PORT:5000
#项使的ACCESSKEY,默认会注册,并保存到ACCESS_KEY_STORE中,
#如果有需求,可以写到配置件中,格式access_key_id:access_key_secret
#ACCESS_KEY:null
#ACCESSKEY保存的地址,默认注册后会保存到该件中
#ACCESS_KEY_STORE:data/keys/.access_key
#加密密钥
#SECRET_KEY:null#设置志级别[DEBUG,INFO,WARN,ERROR,FATAL,CRITICAL]
#志存放的录
#LOG_DIR:logs
#SSH名单
#ALLOW_SSH_USER:all
#SSH名单,如果户同时在名单和名单,名单优先效
#BLOCK_SSH_USER:
#-
#HEARTBEAT_INTERVAL:5
#Admin的名字,出问题会提示给户
#SSH_TIMEOUT:15
#语[en,zh]
#LANGUAGE_CODE:zh
#SFTP的根录,可选/tmp,Home其他定义录
#SFTP_ROOT:/tmp
#SFTP是否显示隐藏件
#SFTP_SHOW_HIDDEN_FILE:false
#是否复和户后端资产已建的连接(户不会复其他户的连接)
#REUSE_CONNECTION:true
$./cocodstart-d#后台运使-d参数./cocodstart-d
#新版本更新了运脚本,使式./cocodstart|stop|status后台运请添加-d
四.安装WebTerminal前端:Luna
接解压不需要编译
4.1解压Luna
#如果络有问题导致下载法完成可以使下地址
$tarxfluna.tar.gz
$chown-Rroot:rootluna
五.安装Windows持组件(如果不需要管理windows资产,可以直接跳过这
步)
5.1安装依赖
release-0-5.el7.nux.noarch.rpm
el/rpmfusion-nonfree-release-7.noarch.rpm
$yuminstall-yjava-1.8.0-openjdklibtool
$yuminstall-ycairo-devellibjpeg-turbo-devellibpng-develuuid-devel
$yuminstall-yffmpeg-develfreerdp-develfreerdp-pluginspango-devellibssh2-
devellibtelnet-devellibvncserver-develpulseaudio-libs-developenssl-devel
libvorbis-devellibwebp-develghostscript
5.2编译安装guacamole服务
$cd/opt/docker-guacamole/
$tar-xfguacamole-server-0.9.14.tar.gz
$cdguacamole-server-0.9.14
$autoreconf-fifi
$./confifigure--with-init-dir=/etc/init.d
$make&&makeinstall
$ln-s/usr/local/lib/freerdp/*.so/usr/lib64/freerdp/
$cd..
$rm-rfguacamole-server-0.9.14$ldconfifig
5.3配置Tomcat
$mkdir-p/confifig/guacamole/confifig/guacamole/lib/confifig/guacamole/
extensions#创建guacamole录
$ln-sf/opt/docker-guacamole/guacamole-auth-jumpserver-0.9.14.jar/confifig/
guacamole/extensions/guacamole-auth-jumpserver-0.9.14.jar
$ln-sf/opt/docker-guacamole/root/app/guacamole/guacamole.properties/
confifig/guacamole/guacamole.properties#guacamole配置件
$cd/confifig
apache-tomcat-8.5.40.tar.gz
$tarxfapache-tomcat-8.5.40.tar.gz
$rm-rfapache-tomcat-8.5.40.tar.gz
$mvapache-tomcat-8.5.40tomcat8
$rm-rf/confifig/tomcat8/webapps/*
$ln-sf/opt/docker-guacamole/guacamole-0.9.14.war/confifig/tomcat8/webapps/
ROOT.war#guacamoleclient
conf/server.xml#修改默认端为8081
等级为WARNING
amd64.tar.gz
$tarxflinux-amd64.tar.gz-C/bin/
$chmod+x/bin/ssh-forward
5.4配置环境变量
#勿多次执以下环境设置
127.0.0.1:8080指jumpserver访问地址
#BOOTSTRAP_TOKEN为Jumpserver/confifig.yml的BOOTSTRAP_TOKEN
$exportBOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN
$echo"exportBOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN">>~/.bashrc
$exportJUMPSERVER_KEY_DIR=/confifig/guacamole/keys
$echo"exportJUMPSERVER_KEY_DIR=/confifig/guacamole/keys">>
~/.bashrc
$exportGUACAMOLE_HOME=/confifig/guacamole
$echo"exportGUACAMOLE_HOME=/confifig/guacamole">>~/.bashrc
5.5启动Guacamole
$/etc/init.d/guacdstart
$sh/confifig/tomcat8/bin/startup.sh
六.配置Nginx整合各组件
6.1安装Nginx
$yuminstallyum-utils
$vi/etc/yum.repos.d/nginx.repo
[nginx-stable]
name=nginxstablerepo
gpgcheck=1
enabled=1
$yummakecachefast
$yuminstall-ynginx
$rm-rf/etc/nginx/conf.d/default.conf
$systemctlenablenginx
6.3准备配置件修改/etc/nginx/conf.d/jumpserver.conf
$vi/etc/nginx/conf.d/jumpserver.conf
server{
listen80;#代理端,以后将通过此端进访问,不再通过8080端
#server_namedemo.jumpserver.org;#修改成你的域名或者注释掉
client_max_body_size100m;#录像及件上传限制
location/luna/{
try_fifiles$uri//index.html;
alias/opt/luna/;#luna路径,如果修改安装录,此处需要修改}
location/media/{
add_headerContent-Encodinggzip;
root/opt/jumpserver/data/;#录像位置,如果修改安装录,此处需要修改
}
location/static/{
root/opt/jumpserver/data/;#静态资源,如果修改安装录,此处需要修改
location/socket.io/{
务器,请填写它的ip
proxy_bufferingoff;
proxy_set_headerConnection"upgrade";
proxy_set_headerX-Real-IP$remote_addr;
proxy_set_headerHost$host;
proxy_set_headerX-Forwarded-For$proxy_add_x_forwarded_for;
access_logoff;
location/coco/{
请填写它的ip
location/guacamole/{
proxy_set_headerHost$host;proxy_set_headerX-Forwarded-For$proxy_add_x_forwarded_for;
location/{
填写它的ip
6.3运Nginx
nginx-t#确保配置没有问题,有问题请先解决
#CentOS7
$systemctlstartnginx
6.4开始使Jumpserver
检查应是否已经正常运
8080端访问
默认账号:admin密码:admin
到Jumpserver会话管理-终端管理检查CocoGuacamole等应的注册。