CentOS 7 安装文档

  • 开头的行表示注释

  • > 开头的行表示需要在 mysql 中执行
  • $ 开头的行表示需要执行的命令云服务器快速部署参考 极速安装
  • 系统: CentOS 7
  • IP: 192.168.244.144
  • 目录: /opt
  • 数据库: mariadb
  • 代理: nginx
  1. # 修改 Jumpserver 配置文件
  2. $ cd /opt/jumpserver
  3. $ cp config_example.yml config.yml
  4.  
  5. $ SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 50`  # 生成随机SECRET_KEY
  6. $ echo "SECRET_KEY=$SECRET_KEY" >> ~/.bashrc
  7. $ BOOTSTRAP_TOKEN=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 16`  # 生成随机BOOTSTRAP_TOKEN
  8. $ echo "BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN" >> ~/.bashrc
  9.  
  10. $ sed -i "s/SECRET_KEY:/SECRET_KEY: $SECRET_KEY/g" /opt/jumpserver/config.yml
  11. $ sed -i "s/BOOTSTRAP_TOKEN:/BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g" /opt/jumpserver/config.yml
  12. $ sed -i "s/# DEBUG: true/DEBUG: false/g" /opt/jumpserver/config.yml
  13. $ sed -i "s/# LOG_LEVEL: DEBUG/LOG_LEVEL: ERROR/g" /opt/jumpserver/config.yml
  14. $ sed -i "s/# SESSION_EXPIRE_AT_BROWSER_CLOSE: false/SESSION_EXPIRE_AT_BROWSER_CLOSE: true/g" /opt/jumpserver/config.yml
  15. $ sed -i "s/DB_PASSWORD: /DB_PASSWORD: $DB_PASSWORD/g" /opt/jumpserver/config.yml
  16.  
  17. $ echo -e "\033[31m 你的SECRET_KEY是 $SECRET_KEY \033[0m"
  18. $ echo -e "\033[31m 你的BOOTSTRAP_TOKEN是 $BOOTSTRAP_TOKEN \033[0m"
  19.  
  20. $ vi config.yml  # 确认内容有没有错误
  1. # SECURITY WARNING: keep the secret key used in production secret!
  2. # 加密秘钥 生产环境中请修改为随机字符串, 请勿外泄, PS: 纯数字不可以
  3. SECRET_KEY:
  4.  
  5. # SECURITY WARNING: keep the bootstrap token used in production secret!
  6. # 预共享Token coco和guacamole用来注册服务账号, 不在使用原来的注册接受机制
  7. BOOTSTRAP_TOKEN:
  8.  
  9. # Development env open this, when error occur display the full process track, Production disable it
  10. # DEBUG 模式 开启DEBUG后遇到错误时可以看到更多日志
  11. DEBUG: false
  12.  
  13. # DEBUG, INFO, WARNING, ERROR, CRITICAL can set. See https://docs.djangoproject.com/en/1.10/topics/logging/
  14. # 日志级别
  15. LOG_LEVEL: ERROR
  16. # LOG_DIR:
  17.  
  18. # Session expiration setting, Default 24 hour, Also set expired on on browser close
  19. # 浏览器Session过期时间, 默认24小时, 也可以设置浏览器关闭则过期
  20. # SESSION_COOKIE_AGE: 86400
  21. SESSION_EXPIRE_AT_BROWSER_CLOSE: true
  22.  
  23. # Database setting, Support sqlite3, mysql, postgres ....
  24. # 数据库设置
  25. # See https://docs.djangoproject.com/en/1.10/ref/settings/#databases
  26.  
  27. # SQLite setting:
  28. # 使用单文件sqlite数据库
  29. # DB_ENGINE: sqlite3
  30. # DB_NAME:
  31.  
  32. # MySQL or postgres setting like:
  33. # 使用Mysql作为数据库
  34. DB_ENGINE: mysql
  35. DB_HOST: 127.0.0.1
  36. DB_PORT: 3306
  37. DB_USER: jumpserver
  38. DB_NAME: jumpserver
  39.  
  40. # When Django start it will bind this host and port
  41. # ./manage.py runserver 127.0.0.1:8080
  42. # 运行时绑定端口
  43. HTTP_BIND_HOST: 0.0.0.0
  44. HTTP_LISTEN_PORT: 8080
  45.  
  46. # Use Redis as broker for celery and web socket
  47. # Redis配置
  48. REDIS_HOST: 127.0.0.1
  49. REDIS_PORT: 6379
  50. # REDIS_PASSWORD:
  51. # REDIS_DB_CELERY: 3
  52. # REDIS_DB_CACHE: 4
  53.  
  54. # Use OpenID authorization
  55. # 使用OpenID 来进行认证设置
  56. # BASE_SITE_URL: http://localhost:8080
  57. # AUTH_OPENID: false  # True or False
  58. # AUTH_OPENID_SERVER_URL: https://openid-auth-server.com/
  59. # AUTH_OPENID_REALM_NAME: realm-name
  60. # AUTH_OPENID_CLIENT_ID: client-id
  61. # AUTH_OPENID_CLIENT_SECRET: client-secret
  62.  
  63. # OTP settings
  64. # OTP/MFA 配置
  65. # OTP_VALID_WINDOW: 0
  66. # OTP_ISSUER_NAME: Jumpserver
  1. # 安装 docker 部署 coco 与 guacamole
  2. $ yum install -y yum-utils device-mapper-persistent-data lvm2
  3. $ yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
  4. $ yum makecache fast
  5. $ rpm --import https://mirrors.aliyun.com/docker-ce/linux/centos/gpg
  6. $ yum -y install docker-ce
  7. $ systemctl enable docker
  8. $ curl -sSL https://get.daocloud.io/daotools/set_mirror.sh | sh -s http://f1361db2.m.daocloud.io
  9. $ systemctl restart docker
  10.  
  11. # 允许 容器ip 访问宿主 8080 端口, (容器的 ip 可以进入容器查看)
  12. $ firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="172.17.0.0/16" port protocol="tcp" port="8080" accept"
  13. $ firewall-cmd --reload
  14. # 172.17.0.x 是docker容器默认的IP池, 这里偷懒直接授权ip段了, 可以根据实际情况单独授权IP
  15.  
  16. # 获取当前服务器 IP
  17. $ Server_IP=`ip addr | grep inet | egrep -v '(127.0.0.1|inet6|docker)' | awk '{print $2}' | tr -d "addr:" | head -n 1 | cut -d / -f1`
  18. $ echo -e "\033[31m 你的服务器IP是 $Server_IP \033[0m"
  19.  
  20. # http://<Jumpserver_url> 指向 jumpserver 的服务端口, 如 http://192.168.244.144:8080
  21. # BOOTSTRAP_TOKEN 为 Jumpserver/config.yml 里面的 BOOTSTRAP_TOKEN
  22. $ docker run --name jms_coco -d -p 2222:2222 -p 5000:5000 -e CORE_HOST=http://$Server_IP:8080 -e BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN jumpserver/jms_coco:1.4.8
  23. $ docker run --name jms_guacamole -d -p 8081:8081 -e JUMPSERVER_SERVER=http://$Server_IP:8080 -e BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN jumpserver/jms_guacamole:1.4.8
  1. # 安装 Web Terminal 前端: Luna  需要 Nginx 来运行访问 访问(https://github.com/jumpserver/luna/releases)下载对应版本的 release 包, 直接解压, 不需要编译
  2. $ cd /opt
  3. $ wget https://github.com/jumpserver/luna/releases/download/1.4.8/luna.tar.gz
  4.  
  5. # 如果网络有问题导致下载无法完成可以使用下面地址
  6. $ wget https://demo.jumpserver.org/download/luna/1.4.8/luna.tar.gz
  7.  
  8. $ tar xf luna.tar.gz
  9. $ chown -R root:root luna
  1. $ vi /etc/nginx/conf.d/jumpserver.conf
  2.  
  3. server {
  4.     listen 80;
  5.  
  6.     client_max_body_size 100m;  # 录像及文件上传大小限制
  7.  
  8.     location /luna/ {
  9.         alias /opt/luna/;  # luna 路径, 如果修改安装目录, 此处需要修改
  10.     }
  11.  
  12.     location /media/ {
  13.         add_header Content-Encoding gzip;
  14.         root /opt/jumpserver/data/;  # 录像位置, 如果修改安装目录, 此处需要修改
  15.     }
  16.  
  17.     location /static/ {
  18.         root /opt/jumpserver/data/;  # 静态资源, 如果修改安装目录, 此处需要修改
  19.     }
  20.  
  21.     location /socket.io/ {
  22.         proxy_pass       http://localhost:5000/socket.io/;
  23.         proxy_buffering off;
  24.         proxy_http_version 1.1;
  25.         proxy_set_header Upgrade $http_upgrade;
  26.         proxy_set_header Connection "upgrade";
  27.         proxy_set_header X-Real-IP $remote_addr;
  28.         proxy_set_header Host $host;
  29.         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  30.         access_log off;
  31.     }
  32.  
  33.     location /coco/ {
  34.         proxy_pass       http://localhost:5000/coco/;
  35.         proxy_set_header X-Real-IP $remote_addr;
  36.         proxy_set_header Host $host;
  37.         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  38.         access_log off;
  39.     }
  40.  
  41.     location /guacamole/ {
  42.         proxy_pass       http://localhost:8081/;
  43.         proxy_buffering off;
  44.         proxy_http_version 1.1;
  45.         proxy_set_header Upgrade $http_upgrade;
  46.         proxy_set_header Connection $http_connection;
  47.         proxy_set_header X-Real-IP $remote_addr;
  48.         proxy_set_header Host $host;
  49.         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  50.         access_log off;
  51.     }
  52.  
  53.     location / {
  54.         proxy_pass http://localhost:8080;
  55.         proxy_set_header X-Real-IP $remote_addr;
  56.         proxy_set_header Host $host;
  57.         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  58.     }
  59. }
  1. # 运行 Nginx
  2. $ nginx -t   # 确保配置没有问题, 有问题请先解决
  3. $ systemctl start nginx
  4.  
  5. # 访问 http://192.168.244.144 (注意 没有 :8080 通过 nginx 代理端口进行访问)
  6. # 默认账号: admin 密码: admin  到会话管理-终端管理 接受 coco Guacamole 等应用的注册
  7. # 测试连接
  8. $ ssh -p2222 admin@192.168.244.144
  9. $ sftp -P2222 admin@192.168.244.144
  10.   密码: admin
  11.  
  12. # 如果是用在 Windows 下, Xshell Terminal 登录语法如下
  13. $ ssh admin@192.168.244.144 2222
  14. $ sftp admin@192.168.244.144 2222
  15.   密码: admin
  16.   如果能登陆代表部署成功
  17.  
  18. # sftp默认上传的位置在资产的 /tmp 目录下