1.安装docker
yum install container-selinux yum-utils ipvsadm -y
yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum clean all
yum makecache
yum install docker-ce docker-ce-cli -y
mkdir /data/docker # 容器数据存放
mkdir /etc/docker # daemon配置信息存放路径
vi /etc/docker/daemon.json
cat > /etc/docker/daemon.json <<EOF
{
"data-root": "/data/docker",
"registry-mirrors": [
"https://6mrynkvw.mirror.aliyuncs.com"
],
"exec-opts": ["native.cgroupdriver=systemd"],
"log-driver": "json-file",
"log-opts": {
"max-size": "100m"
},
"storage-driver": "overlay2",
"storage-opts": [
"overlay2.override_kernel_check=true"
]
}
EOF
systemctl start docker
systemctl enable docker
2. 安装mariadb or MySQL数据库
# 添加repo
touch /etc/yum.repos.d/MariaDB.repo
cat > /etc/yum.repos.d/MariaDB.repo <<EOF
[mariadb]
name=MariaDB
baseurl=http://mirrors.aliyun.com/mariadb/yum/10.3/centos7-amd64/
gpgkey=http://mirrors.aliyun.com/mariadb/yum/RPM-GPG-KEY-MariaDB
gpgcheck=1
EOF
yum install MariaDB-server MariaDB-client -y
systemctl start mariadb
systemctl enable mariadb
## 初始化数据库
mysql_secure_installation
##创建数据库
create database jumpserver default charset 'utf8';
grant all on jumpserver.* to 'jumpserver'@'%' identified by '123456';
flush privileges;
3.安装redis数据库
yum install -y epel-release bash-completion
yum install -y https://repo.ius.io/ius-release-el7.rpmhttps://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
yum install -y redis5.x86_64
systemctl start redis
systemctl enable redis
sed -i "s/bind 127.0.0.1/bind 0.0.0.0/g" /etc/redis.conf
sed -i "561i maxmemory-policy allkeys-lru" /etc/redis.conf
sed -i "481i requirepass weakPassword" /etc/redis.conf
4.部署core web
cd /opt
yum -y install wget
wget https://github.com/jumpserver/installer/releases/download/v2.8.3/jumpserver-installer-v2.8.3.tar.gz
tar -xf jumpserver-installer-v2.8.3.tar.gz
ln -s jumpserver-installer-v2.8.3 jumpserver
cd jumpserver
##
开始安装
./jmsctl.sh install
##按步骤 一直下一步，拉取镜像
██╗██╗ ██╗███╗ ███╗██████╗ ███████╗███████╗██████╗ ██╗ ██╗███████╗██████╗
██║██║ ██║████╗ ████║██╔══██╗██╔════╝██╔════╝██╔══██╗██║ ██║██╔════╝██╔══██╗
██║██║ ██║██╔████╔██║██████╔╝███████╗█████╗ ██████╔╝██║ ██║█████╗ ██████╔╝
██ ██║██║ ██║██║╚██╔╝██║██╔═══╝ ╚════██║██╔══╝ ██╔══██╗╚██╗ ██╔╝██╔══╝ ██╔══██╗
╚█████╔╝╚██████╔╝██║ ╚═╝ ██║██║ ███████║███████╗██║ ██║ ╚████╔╝ ███████╗██║ ██║
╚════╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝
Version: v2.8.3
>>> 安装配置 Docker
1. 安装 Docker
开始下载 Docker 程序 ...
完成
开始下载 Docker Compose 程序 ...
完成
2. 配置 Docker
是否需要自定义 Docker 数据目录, 默认将使用 /var/lib/docker 目录? (y/n) (默认为 n): n
完成
3. 启动 Docker
Docker 版本发生改变 或 Docker 配置文件发生变化，是否要重启? (y/n) (默认为 y): y
完成
>>> 加载 Docker 镜像
Docker: Pulling from jumpserver/core:v2.8.3 [ OK ]
Docker: Pulling from jumpserver/koko:v2.8.3 [ OK ]
Docker: Pulling from jumpserver/luna:v2.8.3 [ OK ]
Docker: Pulling from jumpserver/nginx:alpine2 [ OK ]
Docker: Pulling from jumpserver/redis:6-alpine [ OK ]
Docker: Pulling from jumpserver/lina:v2.8.3 [ OK ]
Docker: Pulling from jumpserver/mysql:5 [ OK ]
Docker: Pulling from jumpserver/guacamole:v2.8.3 [ OK ]
>>> 安装配置 JumpServer
1. 检查配置文件
配置文件位置: /opt/jumpserver/config
/opt/jumpserver/config/config.txt [ √ ]
/opt/jumpserver/config/nginx/lb_http_server.conf [ √ ]
/opt/jumpserver/config/nginx/lb_ssh_server.conf [ √ ]
/opt/jumpserver/config/core/config.yml [ √ ]
/opt/jumpserver/config/koko/config.yml [ √ ]
/opt/jumpserver/config/mysql/my.cnf [ √ ]
/opt/jumpserver/config/redis/redis.conf [ √ ]
完成
2. 配置 Nginx
配置文件位置: /opt/jumpserver/config/nginx/cert
/opt/jumpserver/config/nginx/cert/server.crt [ √ ]
/opt/jumpserver/config/nginx/cert/server.key [ √ ]
完成
3. 备份配置文件
备份至 /opt/jumpserver/config/backup/config.txt.2021-03-19_08-01-51
完成
4. 配置网络
是否需要支持 IPv6? (y/n) (默认为 n): n
完成
5. 配置加密密钥
SECRETE_KEY: ICAgIGluZXQ2IDI0MDk6OGE0ZDpjMjg6ZjkwMTo6ZDRjLzEyO
BOOTSTRAP_TOKEN: ICAgIGluZXQ2IDI0
完成
6. 配置持久化目录
是否需要自定义持久化存储, 默认将使用目录 /opt/jumpserver? (y/n) (默认为 n): n
完成
7. 配置 MySQL
是否使用外部mysql (y/n) (默认为n): y
请输入mysql的主机地址 (无默认值): 192.168.1.110
请输入mysql的端口 (默认为3306): 3306
请输入mysql的数据库(事先做好授权) (默认为jumpserver): jumpserver
请输入mysql的用户名 (无默认值): jumpserver
请输入mysql的密码 (无默认值): mypasword
完成
8. 配置 Redis
是否使用外部redis (y/n) (默认为n): y
请输入redis的主机地址 (无默认值): 192.168.1.110
请输入redis的端口 (默认为6379): 6379
请输入redis的密码 (无默认值): mypasword
完成
>>> 安装完成了
1. 可以使用如下命令启动, 然后访问
./jmsctl.sh start
2. 其它一些管理命令
./jmsctl.sh stop
./jmsctl.sh restart
./jmsctl.sh backup
./jmsctl.sh upgrade
更多还有一些命令, 你可以 ./jmsctl.sh --help 来了解
3. Web 访问
默认用户: admin 默认密码: admin
4. SSH/SFTP 访问
ssh admin@192.168.1.110 -p2222
sftp -P2222 admin@192.168.1.110
5. 更多信息
我们的官网: https://www.jumpserver.org/
我们的文档: https://docs.jumpserver.org/
5.部署 Tengine 服务
1.配置 Repo
vi /etc/yum.repos.d/nginx.repo
[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true
2.安装 Tengine
yum install -y https://github.com/wojiushixiaobai/tengine-rpm/releases/download/2.3.2/tengine-2.3.2-1.el7.ngx.x86_64.rpm
3.配置 Nginx
vi /etc/nginx/nginx.conf
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
stream {
log_format proxy '$remote_addr [$time_local] '
'$protocol $status $bytes_sent $bytes_received '
'$session_time "$upstream_addr" '
'"$upstream_bytes_sent" "$upstream_bytes_received" "$upstream_connect_time"';
access_log /var/log/nginx/tcp-access.log proxy;
open_log_file_cache off;
upstream kokossh {
# core web 节点
server 192.168.1.110:2222;
least_conn;
}
server {
# 对外 ssh 端口
listen 2222;
proxy_pass kokossh;
proxy_protocol on;
proxy_connect_timeout 1s;
}
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
#gzip on;
include /etc/nginx/conf.d/*.conf;
}
### 创建证书
mkdir /opt/ssl
cd mkdir ssl
##
生成私钥文件
openssl genrsa -out private.key 1024
# -out 参数指定密钥文件存放的位置和名字，1024是指密钥文件的长度，一般为1024或者2048
1
2
生成一个证书请求
openssl req -new -key private.key -out cert_req.csr
# 指定密钥密钥文件来生成一个ca请求
# 这个步骤会要求填入国家区域以及域名等信息
# 最重要的一行是Common Name，需要填入与服务器关联的域名，或者是您服务器的公共IP地址
1
2
3
4
将请求发给CA机构进行签名
openssl x509 -req -days 365 -in cert_req.csr -signkey private.key -out server_cert.crt
echo > /etc/nginx/conf.d/default.conf
vi /etc/nginx/conf.d/jumpserver.conf
upstream core_web {
# 用户连接时使用 ip_hash 负载
server 192.168.1.110:8080;
session_sticky;
}
upstream core_task {
# use_task = 1 的任务服务器, 目前只能单任务运行
server 192.168.1.110:8080;
}
server {
listen 80;
server_name 192.168.1.110; # 自行修改成你的域名
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl;
server_name 192.168.1.110; # 自行修改成你的域名
ssl_certificate /etc/nginx/sslkey/1_jumpserver.org.crt; # 自行设置证书
ssl_certificate_key /etc/nginx/sslkey/2_jumpserver.org.key; # 自行设置证书
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
client_max_body_size 4096m; # 录像上传大小限制
location ~ /replay/ {
proxy_pass http://core_web;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location ~ /(ops|task|tasks|flower)/ {
proxy_pass http://core_task;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location /ws/ {
proxy_pass http://core_task/ws/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location / {
proxy_pass http://core_web;
proxy_buffering off;
proxy_request_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
nginx -t
systemctl enable nginx
systemctl start nginx
6.部署 MinIO 服务
1.利用容器部署minio
docker pull minio/minio:latest
latest: Pulling from minio/minio
a591faa84ab0: Pull complete
76b9354adec6: Pull complete
f9d8746550a4: Pull complete
890b1dd95baa: Pull complete
3a8518c890dc: Pull complete
8053f0501aed: Pull complete
506c41cb8532: Pull complete
Digest: sha256:e7a725edb521dd2af07879dad88ee1dfebd359e57ad8d98104359ccfbdb92024
Status: Downloaded newer image for minio/minio:latest
docker.io/minio/minio:latest
2.持久化目录
mkdir -p /opt/jumpserver/minio/data /opt/jumpserver/minio/config
3.启动minio
## 请自行修改账号密码并牢记, 丢失后可以删掉容器后重新用新密码创建, 数据不会丢失
# 9000 # 访问端口
# MINIO_ROOT_USER=minio # minip 账号
# MINIO_ROOT_PASSWORD=8d98104359ccfbdb92024 # minio 密码有复杂度要求，我随机复制一个
docker run --name jms_minio -d -p 9000:9000 -e MINIO_ROOT_USER=minio -e MINIO_ROOT_PASSWORD=8d98104359ccfbdb92024 -v /opt/jumpserver/minio/data:/data -v /opt/jumpserver/minio/config:/root/.minio --restart=always minio/minio:latest server /data
4.设置minio
访问 http://192.168.1.110:9000, 输入刚才设置的 MinIO 账号密码登录
# MINIO_ROOT_USER=minio # minip 账号
# MINIO_ROOT_PASSWORD=8d98104359ccfbdb92024 # minio 密码有复杂度要求，我随机复制一个
点击右下角的 + 号, 选择 Create bucket 创建桶, Bucket Name 输入 jumpserver 回车确认
5.设置 JumpServer
访问 JumpServer Web 页面并使用管理员账号进行登录
点击左侧菜单栏的 [终端管理], 在页面的上方选择 [存储配置], 在 [录像存储] 下方选择 [创建] 选择 [Ceph]
根据下方的说明进行填写, 保存后在 [终端管理] 页面对所有组件进行 [更新], 录像存储选择 [jms-mino], 提交
选项 参考值 说明
名称 (Name) jms-minio 标识, 不可重复
类型 (Type) Ceph 固定, 不可更改
桶名称 (Bucket) jumpserver Bucket Name
Access key minio MINIO_ROOT_USER
Secret key 8d98104359ccfbdb92024 MINIO_ROOT_PASSWORD
端点 (Endpoint) http://192.168.1.110:9000 minio 服务访问地址
7.jms服务开机自启动
vi /usr/lib/systemd/system/jms.service
[Unit]
Description=jumpserver
After=network.target
[Service]
Type=simple
WorkingDirectory=/opt/jumpserver
#EnvironmentFile=/opt/jumpserver/static.env
ExecStart=/opt/jumpserver/jmsctl.sh start ##改成后台执行，不然的话，服务启动太慢，造成超时，服务启动失败
ExecStop=/opt/jumpserver/jmsctl.sh stop
User=root
[Install]
WantedBy=multi-user.target
[Unit]
Description=jms
After=network.target mariadb.service redis.service
Wants=mariadb.service redis.service
[Service]
Type=forking
WorkingDirectory=/opt/jumpserver
EnvironmentFile=/opt/jumpserver/config/config.txt
ExecStart=/opt/jumpserver/jmsctl.sh start
ExecStop=/opt/jumpserver/jmsctl.sh stop
User=root
[Install]
WantedBy=multi-user.target
