安装JumpServer堡垒机

什么是堡垒机

即在一个特定的网络环境下，为了保障网络和数据不受来自外部和内部用户的入侵和破坏，而运用各种技术手段实时收集和监控网络环境中每一个组成部分的系统状态、安全事件、网络活动，以便集中报警、及时处理及审计定责、其从功能上讲，它综合了核心系统运维和安全审计管控两大主干功能，从技术实现上讲，通过切断终端计算机对网络和服务器资源的直接访问，而采用协议代理的方式，接管了终端计算机对网络和服务器的访问。形象地说，终端计算机对目标的访问，均需要经过运维安全审计的翻译。打一个比方，运维安全审计扮演着看门者的工作，所有对网络设备和服务器的请求都要从这扇大门经过。因此运维安全审计能够拦截非法访问，和恶意攻击，对不合法命令进行命令阻断，过滤掉所有对目标设备的非法访问行为，并对内部人员误操作和非法操作进行审计监控，以便事后责任追踪。安全审计作为企业信息安全建设不可缺少的组成部分，逐渐受到用户的关注，是企业安全体系中的重要环节。同时，安全审计是事前预防、事中预警的有效风险控制手段，也是事后追溯的可靠证据来源。

JumpServer简介

JumpServer 是全球首款完全开源的堡垒机, 使用 GNU GPL v2.0 开源协议, 是符合 4A 的专业运维审计系统。JumpServer 使用 Python / Django 进行开发, 遵循 Web 2.0 规范, 配备了业界领先的 Web Terminal 解决方案, 交互界面美观、用户体验好。JumpServer 采纳分布式架构, 支持多机房跨区域部署, 中心节点提供 API, 各机房部署登录节点, 可横向扩展、无并发访问限制。JumpServer 现已支持管理 SSH、 Telnet、 RDP、 VNC 协议资产

安装Jumpserver

系统环境

# 系统版本
[root@jumpserver ~]#cat /etc/redhat-release 
CentOS Linux release 7.7.1908 (Core)

配置网络yum源

[root@jumpserver ~]# wget -O /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-7.repo
[root@jumpserver ~]# wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo

更新系统

[root@jumpserver ~]# yum update -y 
[root@jumpserver ~]# cat /etc/redhat-release 
CentOS Linux release 7.7.1908 (Core)

安装jumpserver所需环境

# redis mariadb python 都可以编译安装
[root@jumpserver ~]# yum -y install python36 python36-devel  redis mariadb-server mariadb-devel mariadb

启动服务

# 创建开机自启
[root@jumpserver ~]# systemctl enable redis mariadb
# 启动服务
[root@jumpserver ~]# systemctl start redis mariadb

创建jumpserver数据库

[root@jumpserver ~]# mysql
MariaDB [(none)]> create database jumpserver default charset 'utf8' collate 'utf8_bin';
Query OK, 1 row affected (0.00 sec)
MariaDB [(none)]> grant all on jumpserver.* to 'jumpserver'@'127.0.0.1' identified by 'jumpserver';
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> flush privileges;
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> exit
Bye

创建py3虚拟环境

[root@jumpserver ~]# python3.6 -m venv /opt/py3
# 让其Python虚拟环境生效
[root@jumpserver ~]# source /opt/py3/bin/activate
(py3) [root@jumpserver ~]#

下载jumpserver部署包

(py3) [root@jumpserver ~]# cd /opt && \
wget https://github.com/jumpserver/jumpserver/releases/download/v2.0.2/jumpserver-v2.0.2.tar.gz
# 解压包
(py3) [root@jumpserver opt]# tar xf jumpserver-v2.0.2.tar.gz
(py3) [root@jumpserver opt]# mv jumpserver-v2.0.2 jumpserver

安装编译环境依赖包

(py3) [root@jumpserver opt]# cd /opt/jumpserver/requirements
(py3) [root@jumpserver requirements]# yum install -y $(cat rpm_requirements.txt)

配置PyPI源

(py3) [root@jumpserver requirements]# pip install wheel -i https://mirrors.aliyun.com/pypi/simple/
(py3) [root@jumpserver requirements]# pip install -U pip setuptools -i  https://mirrors.aliyun.com/pypi/simple/
Collecting pip
(py3) [root@jumpserver requirements]# pip install -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/

修改配置文件

# 其中SECRET_KEY、BOOTSTRAP_TOKEN需要手动生成，上方都有说明，以下是配置完成的
(py3) [root@jumpserver requirements]# cd /opt/jumpserver && \
cp config_example.yml config.yml && \
vi config.yml
SECRET_KEY: tWDny8liKq1Zz4HUwlWFN9Ja3gut2wZt2KSjyBgU7foqe9Ecc
BOOTSTRAP_TOKEN: 0pZ51maTshK2ieYuPdkjWEI
DEBUG: false
LOG_LEVEL: ERROR
SESSION_EXPIRE_AT_BROWSER_CLOSE: true
DB_ENGINE: mysql
DB_HOST: 127.0.0.1
DB_PORT: 3306
DB_USER: jumpserver
DB_PASSWORD: jumpserver
DB_NAME: jumpserver
HTTP_BIND_HOST: 0.0.0.0
HTTP_LISTEN_PORT: 8080
WS_LISTEN_PORT: 8070
REDIS_HOST: 127.0.0.1
REDIS_PORT: 6379
WINDOWS_SKIP_ALL_MANUAL_PASSWORD: True 
# 启动jumpserver
(py3) [root@jumpserver jumpserver]# cd /opt/jumpserver
(py3) [root@jumpserver jumpserver]# ./jms start -d

部署Koko组件

(py3) [root@jumpserver jumpserver]# cd /opt && \
wget https://github.com/jumpserver/koko/releases/download/v2.0.2/koko-v2.0.2-linux-amd64.tar.gz
# 解压包并设置权限
[root@jumpserver opt]# tar -xf koko-v2.0.2-linux-amd64.tar.gz && \
mv koko-v2.0.2-linux-amd64 koko && \
chown -R root:root koko && \
cd koko
# 修改配置文件，其中BOOTSTRAP_TOKEN与之前的配置文件中要一致
[root@jumpserver koko]# cp config_example.yml config.yml && \
vim config.yml
CORE_HOST: http://127.0.0.1:8080
BOOTSTRAP_TOKEN: 0pZ51maTshK2ieYuPdkjWEI
LOG_LEVEL: ERROR
# 启动koko
[root@jumpserver koko]# ./koko -d

安装Guacamole 组件

[root@jumpserver koko]# ./koko -d
[root@jumpserver koko]# cd /opt && \
wget -O /opt/guacamole.tar.gz https://github.com/jumpserver/docker-guacamole/archive/2.0.2.tar.gz
# 解压包
[root@jumpserver opt]# tar xf guacamole.tar.gz
[root@jumpserver opt]# mv docker-guacamole-2.0.2 guacamole
[root@jumpserver opt]# cd guacamole/
[root@jumpserver guacamole]# ll 
total 28896
-rw-rw-r-- 1 root root     2276 Jul  3 14:41 Dockerfile
-rw-rw-r-- 1 root root  9287807 Jul  3 14:41 guacamole-1.0.0.war
-rw-rw-r-- 1 root root 15696181 Jul  3 14:41 guacamole-auth-jumpserver-1.0.0.jar
-rw-rw-r-- 1 root root  1048759 Jul  3 14:41 guacamole-server-1.2.0.tar.gz
-rw-rw-r-- 1 root root      871 Jul  3 14:41 README.md
drwxrwxr-x 4 root root       28 Jul  3 14:41 root
-rw-rw-r-- 1 root root  1709677 Jul  3 14:41 s6-overlay-amd64.tar.gz
-rw-rw-r-- 1 root root  1826756 Jul  3 14:41 ssh-forward.tar.gz
# 解压guacamole-server-1.2.0.tar.gz
[root@jumpserver guacamole]# tar -xf guacamole-server-1.2.0.tar.gz && \
tar -xf ssh-forward.tar.gz -C /bin/ && \
chmod +x /bin/ssh-forward
# 编译前安装依赖组件
[root@jumpserver guacamole-server-1.2.0]# yum -y localinstall --nogpgcheck https://mirrors.aliyun.com/rpmfusion/free/el/rpmfusion-free-release-7.noarch.rpm https://mirrors.aliyun.com/rpmfusion/free/el/rpmfusion-free-release-7.noarch.rpm
[root@jumpserver guacamole-server-1.2.0]# yum -y install cairo-devel libjpeg-turbo-devel libpng-devel uuid-devel ffmpeg-devel freerdp1.2-devel pango-devel libssh2-devel libtelnet-devel libvncserver-devel pulseaudio-libs-devel openssl-devel libvorbis-devel libwebp-devel
[root@jumpserver guacamole-server-1.2.0]# ln -s /usr/local/lib/freerdp /usr/lib64/freerdp
# 进入目录编译
[root@jumpserver guacamole]# cd /opt/guacamole/guacamole-server-1.2.0
[root@jumpserver guacamole-server-1.2.0]# ./configure --with-init-dir=/etc/init.d && \
make && \
make install

配置Java环境

(py3) [root@jumpserver koko]# yum install -y java-1.8.0-openjdk
(py3) [root@jumpserver koko]# mkdir -p /config/guacamole /config/guacamole/extensions /config/guacamole/record /config/guacamole/drive && \
chown daemon:daemon /config/guacamole/record /config/guacamole/drive && \
cd /config
# 修改配置文件
(py3) [root@jumpserver config]# tar -xf apache-tomcat-9.0.36.tar.gz && \
mv apache-tomcat-9.0.36 tomcat9 && \
 rm -rf /config/tomcat9/webapps/* && \
sed -i 's/Connector port="8080"/Connector port="8081"/g' /config/tomcat9/conf/server.xml && \
echo "java.util.logging.ConsoleHandler.encoding = UTF-8" >> /config/tomcat9/conf/logging.properties && \
ln -sf /opt/guacamole/guacamole-1.0.0.war /config/tomcat9/webapps/ROOT.war && \
ln -sf /opt/guacamole/guacamole-auth-jumpserver-1.0.0.jar /config/guacamole/extensions/guacamole-auth-jumpserver-1.0.0.jar && \
ln -sf /opt/guacamole/root/app/guacamole/guacamole.properties /config/guacamole/guacamole.properties

设置guacamole环境

(py3) [root@jumpserver config]# export JUMPSERVER_SERVER=http://127.0.0.1:8080
(py3) [root@jumpserver config]# echo "export JUMPSERVER_SERVER=http://127.0.0.1:8080" >> ~/.bashrc
(py3) [root@jumpserver config]# export BOOTSTRAP_TOKEN=0pZ51maTshK2ieYuPdkjWEI
(py3) [root@jumpserver config]# echo "export BOOTSTRAP_TOKEN=0pZ51maTshK2ieYuPdkjWEI" >> ~/.bashrc
(py3) [root@jumpserver config]# export JUMPSERVER_KEY_DIR=/config/guacamole/keys
(py3) [root@jumpserver config]# echo "export JUMPSERVER_KEY_DIR=/config/guacamole/keys" >> ~/.bashrc
(py3) [root@jumpserver config]# export GUACAMOLE_HOME=/config/guacamole
(py3) [root@jumpserver config]# echo "export GUACAMOLE_HOME=/config/guacamole" >> ~/.bashrc
(py3) [root@jumpserver config]# export GUACAMOLE_LOG_LEVEL=ERROR
(py3) [root@jumpserver config]# echo "export GUACAMOLE_LOG_LEVEL=ERROR" >> ~/.bashrc
(py3) [root@jumpserver config]# export JUMPSERVER_ENABLE_DRIVE=true
(py3) [root@jumpserver config]# echo "export JUMPSERVER_ENABLE_DRIVE=true" >> ~/.bashrc

启动Guacamole和Tomcat服务

(py3) [root@jumpserver config]# /etc/init.d/guacd start
Starting guacd: guacd[33111]: INFO:    Guacamole proxy daemon (guacd) version 1.2.0 started
SUCCESS
(py3) [root@jumpserver config]# sh /config/tomcat9/bin/startup.sh
Using CATALINA_BASE:   /config/tomcat9
Using CATALINA_HOME:   /config/tomcat9
Using CATALINA_TMPDIR: /config/tomcat9/temp
Using JRE_HOME:        /usr
Using CLASSPATH:       /config/tomcat9/bin/bootstrap.jar:/config/tomcat9/bin/tomcat-juli.jar
Tomcat started.

下载Lina组件

(py3) [root@jumpserver ~]# cd /opt
(py3) [root@jumpserver opt]# wget https://github.com/jumpserver/luna/releases/download/v2.0.2/luna-v2.0.2.tar.gz
(py3) [root@jumpserver opt]# tar -xf luna-v2.0.2.tar.gz
(py3) [root@jumpserver opt]# mv luna-v2.0.2 luna

安装Nginx 采用yum

# 配置Nginx的官方yum仓库
(py3) [root@jumpserver opt]# vim /etc/yum.repos.d/nginx.repo
[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true
(py3) [root@jumpserver opt]# yum -y install nginx
# 把Luna和lina两个目录都允许Nginx用户访问操作
(py3) [root@jumpserver opt]# chown -R nginx.nginx luna lina
# 配置nginx
(py3) [root@jumpserver opt]# echo > /etc/nginx/conf.d/default.conf
(py3) [root@jumpserver opt]# vi /etc/nginx/conf.d/jumpserver.conf
server {
    listen 80;
    client_max_body_size 100m;  # 录像及文件上传大小限制
    location /ui/ {
        try_files $uri / /index.html;
        alias /opt/lina/;
    }
    location /luna/ {
        try_files $uri / /index.html;
        alias /opt/luna/;  # luna 路径, 如果修改安装目录, 此处需要修改
    }
    location /media/ {
        add_header Content-Encoding gzip;
        root /opt/jumpserver/data/;  # 录像位置, 如果修改安装目录, 此处需要修改
    }
    location /static/ {
        root /opt/jumpserver/data/;  # 静态资源, 如果修改安装目录, 此处需要修改
    }
    location /koko/ {
        proxy_pass       http://localhost:5000;
        proxy_buffering off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        access_log off;
    }
    location /guacamole/ {
        proxy_pass       http://localhost:8081/;
        proxy_buffering off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        access_log off;
    }
    location /ws/ {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass http://localhost:8070;
        proxy_http_version 1.1;
        proxy_buffering off;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
    location /api/ {
        proxy_pass http://localhost:8080;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
    location /core/ {
        proxy_pass http://localhost:8080;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
    location / {
        rewrite ^/(.*)$ /ui/$1 last;
    }
}

启动Nginx服务

# 启动之前先检查配置文件语法是否有问题
(py3) [root@jumpserver opt]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
(py3) [root@jumpserver opt]# systemctl enable nginx
(py3) [root@jumpserver opt]# systemctl restart nginx

通过浏览器访问
在浏览器输入你本地服务器的IP地址即可默认用户名密码都是admin