jumpserver安装搭建

最新推荐文章于 2025-04-12 11:10:43 发布

怎么一个人去巴黎

最新推荐文章于 2025-04-12 11:10:43 发布

阅读量994

点赞数

本文链接：https://blog.youkuaiyun.com/weixin_50663202/article/details/109163554

版权

全过程只需要用一台机子装，所以尽量给高配，本人是3G，4核

https://blog.youkuaiyun.com/kadwf123/article/details/98971021

https://docs.jumpserver.org/zh/master/install/step_by_step/

第一个做到前八个，第二个从8.1做到最后(要用docker装的做，nginx直接yum -y install nginx）

一、系统环境准备
1、查看系统版本

cat /etc/redhat-release // 查看系统版本

CentOS Linux release 7.5.1804 (Core)

uname -a // 查看系统信息

Linux localhost.localdomain 3.10.0-862.el7.x86_64 #1 SMP Fri Apr 20 16:44:24 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

2、关闭selinux和防火墙

getenforce //查看selinux的状态

Disabled // 如果是Enable需要修改为Disabled，命令是“setenforce 0”

systemctl stop firewalld.service // 关闭防火墙

3、修改字符集（也可不用做）
因为日志里打印了中文，否则肯能报错：input/output error问题

localedef -c -f UTF-8 -i zh_CN zh_CN.UTF-8

export LC_ALL=zh_CN.UTF-8

echo ‘LANG=“zh_CN.UTF-8”’ > /etc/locale.conf

二、准备Python3和Python虚拟环境
1、安装依赖包

yum -y install wget vim lrzsz xz gcc git epel-release python-pip python-devel mysql-devel automake autoconf sqlite-devel zlib-devel openssl-devel sshpass readline-devel

2、编译安装

yum -y install python36 python36-devel

// 如果下载速度很慢, 可以换国内源

wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo

yum -y install python36 python36-devel

3、建立 Python 虚拟环境
CentOS 7 自带的是 Python2，而 yum 等工具依赖原来的 Python，为了不扰乱原来的环境我们来使用 Python 虚拟环境

cd /opt

python3.6 -m venv py3

source /opt/py3/bin/activate

(py3) [root@localhost opt]# //看到这一行的提示符代表成功，以后运行 Jumpserver 都要先运行以上 source 命令

以下所有命令均在该虚拟环境中运行：

三、安装 Jumpserver
1、下载或 Clone 项目
项目提交较多 git clone 时较大，你可以选择去 Github 项目页面直接下载zip包
(py3) [root@localhost opt]# git clone --depth=1 https://github.com/jumpserver/jumpserver.git
2、安装依赖 RPM 包
(py3) [root@localhost opt]# cd /opt/jumpserver/requirements
(py3) [root@localhost requirements]# yum -y install $(cat rpm_requirements.txt)

//如果下载速度很慢, 可以换国内源

pip install --upgrade pip setuptools -i https://mirrors.aliyun.com/pypi/simple/

pip install -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/

3、安装python库依赖
(py3) [root@localhost opt]# pip install --upgrade pip setuptools
(py3) [root@localhost opt]# pip install -r requirements.txt
4、安装 Redis, Jumpserver 使用 Redis 做 cache 和 celery broke
(py3) [root@localhost opt]# yum -y install redis
(py3) [root@localhost opt]# systemctl enable redis
(py3) [root@localhost opt]# systemctl start redis
5、安装 MySQL
(py3) [root@localhost opt]# yum -y install mariadb mariadb-devel mariadb-server //centos7下安装的是mariadb
(py3) [root@localhost opt]# systemctl enable mariadb
(py3) [root@localhost opt]# systemctl start mariadb
6、创建数据库 Jumpserver 并授权
(py3) [root@localhost opt]# DB_PASSWORD=cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 24 // 生成随机数据库密码
(py3) [root@localhost opt]# mysql -uroot -e “create database jumpserver default charset ‘utf8’; grant all on jumpserver.* to ‘jumpserver’@‘127.0.0.1’ identified by ‘$DB_PASSWORD’; flush privileges;”
7、修改 Jumpserver 配置文件

(py3) [root@localhost opt]# cd /opt/jumpserver/
(py3) [root@localhost jumpserver]# cp config_example.yml config.yml
(py3) [root@localhost jumpserver]# SECRET_KEY=cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 50 // 生成随机的SECRET_KEY
(py3) [root@localhost jumpserver]# echo “SECRET_KEY= $KaTeX parse error: Expected 'EOF', got '#' at position 60: \dotsst jumpserver]#̲ BOOTSTRAP_TOKE\dots$ BOOTSTRAP_TOKEN” >> ~/.bashrc
(py3) [root@localhost jumpserver]# sed -i “s/SECRET_KEY:/SECRET_KEY: $SECRET_KEY/g” /opt/jumpserver/config.yml
(py3) [root@localhost jumpserver]# sed -i “s/BOOTSTRAP_TOKEN:/BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g” /opt/jumpserver/config.yml
(py3) [root@localhost jumpserver]# sed -i “s/# DEBUG: true/DEBUG: false/g” /opt/jumpserver/config.yml
(py3) [root@localhost jumpserver]# sed -i “s/# LOG_LEVEL: DEBUG/LOG_LEVEL: ERROR/g” /opt/jumpserver/config.yml
(py3) [root@localhost jumpserver]# sed -i “s/# SESSION_EXPIRE_AT_BROWSER_CLOSE: false/SESSION_EXPIRE_AT_BROWSER_CLOSE: true/g” /opt/jumpserver/config.yml
(py3) [root@localhost jumpserver]# sed -i “s/DB_PASSWORD: /DB_PASSWORD: $DB_PASSWORD/g” /opt/jumpserver/config.yml

8、运行 Jumpserver
(py3) [root@jumpserver jumpserver]# cd /opt/jumpserver
(py3) [root@jumpserver jumpserver]# ./jms start all -d // 新版本更新了运行脚本，使用方式./jms start|stop|status|restart all 后台运行请添加 -d 参数
下面换另一个网址做，不要按照正常步骤，按照docker的装
8. 正常部署 KoKo 组件
cd /opt &&
wget https://github.com/jumpserver/koko/releases/download/v2.4.0/koko-v2.4.0-linux-amd64.tar.gz
tar -xf koko-v2.4.0-linux-amd64.tar.gz &&
mv koko-v2.4.0-linux-amd64 koko &&
chown -R root:root koko && \cd koko
mv kubectl /usr/local/bin/ &&
wget https://download.jumpserver.org/public/kubectl.tar.gz &&
tar -xf kubectl.tar.gz &&
chmod 755 kubectl &&
mv kubectl /usr/local/bin/rawkubectl &&
rm -rf kubectl.tar.gz
cp config_example.yml config.yml &&
vi config.yml
BOOTSTRAP_TOKEN 需要从 jumpserver/config.yml 里面获取, 保证一致
./koko
可以 -d 参数在后台运行
8.1. Docker 部署 KoKo 组件
如果前面已经正常部署了 KoKo, 可以跳过此步骤
例:
docker run --name jms_koko -d
-p 2222:2222
-p 127.0.0.1:5000:5000
-e CORE_HOST=http://192.168.244.144:8080
-e BOOTSTRAP_TOKEN=zxffNymGjP79j6BN
-e LOG_LEVEL=ERROR
–privileged=true
–restart=always
jumpserver/jms_koko:v2.4.0
9. 正常部署 Guacamole 组件
建议使用 Docker 部署 Guacamole 组件 , 部分环境可能无法正常编译安装
cd /opt &&
wget -O docker-guacamole-v2.4.0.tar.gz https://github.com/jumpserver/docker-guacamole/archive/master.tar.gz
mkdir /opt/docker-guacamole &&
tar -xf docker-guacamole-v2.4.0.tar.gz -C /opt/docker-guacamole --strip-components 1 &&
rm -rf /opt/docker-guacamole-v2.4.0.tar.gz && \cd /opt/docker-guacamole &&
wget http://download.jumpserver.org/public/guacamole-server-1.2.0.tar.gz &&
tar -xf guacamole-server-1.2.0.tar.gz &&
wget http://download.jumpserver.org/public/ssh-forward.tar.gz &&
tar -xf ssh-forward.tar.gz -C /bin/ &&
chmod +x /bin/ssh-forward
cd /opt/docker-guacamole/guacamole-server-1.2.0
根据 Guacamole官方文档文档安装对应的依赖包
./configure --with-init-dir=/etc/init.d &&
make &&
make install
需要先在当前环境配置好 Java
mkdir -p /config/guacamole /config/guacamole/extensions /config/guacamole/record /config/guacamole/drive &&
chown daemon:daemon /config/guacamole/record /config/guacamole/drive && \cd /config
访问此处下载最新的 Tomcat9
tar -xf apache-tomcat-9.0.36.tar.gz &&
mv apache-tomcat-9.0.36 tomcat9 &&
rm -rf /config/tomcat9/webapps/* &&
sed -i ‘s/Connector port=“8080”/Connector port=“8081”/g’ /config/tomcat9/conf/server.xml && \echo “java.util.logging.ConsoleHandler.encoding = UTF-8” >> /config/tomcat9/conf/logging.properties &&
wget http://download.jumpserver.org/release/v2.4.0/guacamole-client-v2.4.0.tar.gz &&
tar -xf guacamole-client-v2.4.0.tar.gz &&
rm -rf guacamole-client-v2.4.0.tar.gz &&
cp guacamole-client-v2.4.0/guacamole-.war /config/tomcat9/webapps/ROOT.war &&
cp guacamole-client-v2.4.0/guacamole-.jar /config/guacamole/extensions/ &&
mv /opt/docker-guacamole/guacamole.properties /config/guacamole/ &&
rm -rf /opt/docker-guacamole &&
设置 Guacamole 环境
export JUMPSERVER_SERVER=http://127.0.0.1:8080echo “export JUMPSERVER_SERVER=http://127.0.0.1:8080” >> ~/.bashrcexport BOOTSTRAP_TOKEN=zxffNymGjP79j6BNecho “export BOOTSTRAP_TOKEN=zxffNymGjP79j6BN” >> ~/.bashrcexport JUMPSERVER_KEY_DIR=/config/guacamole/data/keysecho “export JUMPSERVER_KEY_DIR=/config/guacamole/data/keys” >> ~/.bashrcexport GUACAMOLE_HOME=/config/guacamoleecho “export GUACAMOLE_HOME=/config/guacamole” >> ~/.bashrcexport GUACAMOLE_LOG_LEVEL=ERRORecho “export GUACAMOLE_LOG_LEVEL=ERROR” >> ~/.bashrcexport JUMPSERVER_ENABLE_DRIVE=trueecho “export JUMPSERVER_ENABLE_DRIVE=true” >> ~/.bashrc
环境变量说明
/etc/init.d/guacd start
sh /config/tomcat9/bin/startup.sh
9.1 Docker 部署 Guacamole 组件
如果前面已经正常部署了 Guacamole, 可以跳过此步骤
docker run --name jms_guacamole -d
-p 127.0.0.1:8081:8080
-e JUMPSERVER_SERVER=http://<Jumpserver_url>
-e BOOTSTRAP_TOKEN=<Jumpserver_BOOTSTRAP_TOKEN>
-e GUACAMOLE_LOG_LEVEL=ERROR
jumpserver/jms_guacamole:
<Jumpserver_url> 为 JumpServer 的 url 地址, <Jumpserver_BOOTSTRAP_TOKEN> 需要从 jumpserver/config.yml 里面获取, 保证一致, 是版本
例:
docker run --name jms_guacamole -d
-p 127.0.0.1:8081:8080
-e JUMPSERVER_SERVER=http://192.168.244.144:8080
-e BOOTSTRAP_TOKEN=abcdefg1234
-e GUACAMOLE_LOG_LEVEL=ERROR
jumpserver/jms_guacamole:v2.4.0
10. 下载 Lina 组件
cd /opt
wget https://github.com/jumpserver/lina/releases/download/v2.4.0/lina-v2.4.0.tar.gz
tar -xf lina-v2.4.0.tar.gz
mv lina-v2.4.0 lina
chown -R nginx:nginx lina
11. 下载 Luna 组件¶
cd /opt
wget https://github.com/jumpserver/luna/releases/download/v2.4.0/luna-v2.4.0.tar.gz
tar -xf luna-v2.4.0.tar.gz
mv luna-v2.4.0 luna
chown -R nginx:nginx luna
12. 配置 Nginx 整合各组件
参考官方文档安装最新的稳定版 nginx
echo > /etc/nginx/conf.d/default.conf
vi /etc/nginx/conf.d/jumpserver.conf
下面全部复制粘贴
server {
listen 80;

client_max_body_size 100m;  # 录像及文件上传大小限制

location /ui/ {
    try_files $uri / /index.html;
    alias /opt/lina/;
}

location /luna/ {
    try_files $uri / /index.html;
    alias /opt/luna/;  # luna 路径, 如果修改安装目录, 此处需要修改
}

location /media/ {
    add_header Content-Encoding gzip;
    root /opt/jumpserver/data/;  # 录像位置, 如果修改安装目录, 此处需要修改
}

location /static/ {
    root /opt/jumpserver/data/;  # 静态资源, 如果修改安装目录, 此处需要修改
}

location /koko/ {
    proxy_pass       http://localhost:5000;
    proxy_buffering off;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    access_log off;
}

location /guacamole/ {
    proxy_pass       http://localhost:8081/;
    proxy_buffering off;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    access_log off;
}

location /ws/ {
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass http://localhost:8070;
    proxy_http_version 1.1;
    proxy_buffering off;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}

location /api/ {
    proxy_pass http://localhost:8080;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

location /core/ {
    proxy_pass http://localhost:8080;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

location / {
    rewrite ^/(.*)$ /ui/$1 last;
}

}
nginx -t
nginx -s reload

13.开始使用 JumpServer
Yum 安装的nginx /etc/nginx/nginx.conf 里面server全部删掉，大概20行，再去刷新
检查应用是否已经正常运行
服务全部启动后, 访问 JumpServer 服务器 nginx 代理的 80 端口, 不要通过8080端口访问默认账号: admin 密码: admin