{"id":955,"date":"2021-10-11T17:29:05","date_gmt":"2021-10-12T00:29:05","guid":{"rendered":"https:\/\/www.xh86.me\/?p=955"},"modified":"2021-10-11T17:29:05","modified_gmt":"2021-10-12T00:29:05","slug":"jumpserver-%e8%87%aa%e5%bb%ba%e6%9c%8d%e5%8a%a1%e5%99%a8%e6%9e%81%e9%80%9f%e5%ae%89%e8%a3%85","status":"publish","type":"post","link":"https:\/\/www.xh86.me\/?p=955","title":{"rendered":"jumpserver \u81ea\u5efa\u670d\u52a1\u5668\u6781\u901f\u5b89\u88c5"},"content":{"rendered":"
\n
\n
\n

\u8bf4\u660e<\/strong><\/p>\n

    \n
  • \u5168\u65b0\u5b89\u88c5\u7684 Centos7 \u7cfb\u7edf<\/li>\n
  • \u4fdd\u6301\u670d\u52a1\u5668\u7f51\u7edc\u7545\u901a<\/li>\n<\/ul>\n

    \u5f00\u59cb\u5b89\u88c5<\/strong><\/p>\n

    \u4ee5\u4e0b\u547d\u4ee4\u5747\u5728\u4e00\u4e2a\u7ec8\u7aef\u91cc\u9762\u6267\u884c<\/p>\n

    \n
    \n
    $ echo<\/span> -e \"\\033[31m 1. \u9632\u706b\u5899 Selinux \u8bbe\u7f6e \\033[0m\"<\/span> \\<\/span>\r\n  &&<\/span> if<\/span> [<\/span> \"<\/span>$(<\/span>systemctl status firewalld |<\/span> grep running)<\/span>\"<\/span> !=<\/span> \"\"<\/span> ]<\/span>;<\/span> then<\/span> firewall-cmd --zone=<\/span>public --add-port=<\/span>80<\/span>\/tcp --permanent;<\/span> firewall-cmd --zone=<\/span>public --add-port=<\/span>2222<\/span>\/tcp --permanent;<\/span> firewall-cmd --permanent --add-rich-rule=<\/span>\"rule family=\"<\/span>ipv4\" source address=\"<\/span>172<\/span>.17.0.0\/16\" port protocol=\"<\/span>tcp\" port=\"<\/span>8080<\/span>\" accept\"<\/span>;<\/span> firewall-cmd --reload;<\/span> fi<\/span> \\<\/span>\r\n  &&<\/span> if<\/span> [<\/span> \"<\/span>$(<\/span>getenforce)<\/span>\"<\/span> !=<\/span> \"Disabled\"<\/span> ]<\/span>;<\/span> then<\/span> setsebool -P httpd_can_network_connect 1<\/span>;<\/span> fi<\/span>\r\n<\/pre>\n<\/div>\n<\/div>\n
    \n
    \n
    $ echo<\/span> -e \"\\033[31m 2. \u90e8\u7f72\u73af\u5883 \\033[0m\"<\/span> \\<\/span>\r\n  &&<\/span> yum update -y \\<\/span>\r\n  &&<\/span> ln -sf \/usr\/share\/zoneinfo\/Asia\/Shanghai \/etc\/localtime \\<\/span>\r\n  &&<\/span> yum -y install kde-l10n-Chinese \\<\/span>\r\n  &&<\/span> localedef -c -f UTF-8 -i zh_CN zh_CN.UTF-8 \\<\/span>\r\n  &&<\/span> export<\/span> LC_ALL<\/span>=<\/span>zh_CN.UTF-8 \\<\/span>\r\n  &&<\/span> echo<\/span> 'LANG=\"zh_CN.UTF-8\"'<\/span> > \/etc\/locale.conf \\<\/span>\r\n  &&<\/span> yum -y install wget gcc epel-release git \\<\/span>\r\n  &&<\/span> yum install -y yum-utils device-mapper-persistent-data lvm2 \\<\/span>\r\n  &&<\/span> yum-config-manager --add-repo http:\/\/mirrors.aliyun.com\/docker-ce\/linux\/centos\/docker-ce.repo \\<\/span>\r\n  &&<\/span> yum makecache fast \\<\/span>\r\n  &&<\/span> rpm --import https:\/\/mirrors.aliyun.com\/docker-ce\/linux\/centos\/gpg \\<\/span>\r\n  &&<\/span> echo<\/span> -e \"[nginx-stable]\\nname=nginx stable repo\\nbaseurl=http:\/\/nginx.org\/packages\/centos\/\\$releasever\/\\$basearch\/\\ngpgcheck=1\\nenabled=1\\ngpgkey=https:\/\/nginx.org\/keys\/nginx_signing.key\"<\/span> > \/etc\/yum.repos.d\/nginx.repo \\<\/span>\r\n  &&<\/span> rpm --import https:\/\/nginx.org\/keys\/nginx_signing.key \\<\/span>\r\n  &&<\/span> yum -y install redis mariadb mariadb-devel mariadb-server mariadb-shared nginx docker-ce \\<\/span>\r\n  &&<\/span> systemctl enable<\/span> redis mariadb nginx docker \\<\/span>\r\n  &&<\/span> systemctl start redis mariadb \\<\/span>\r\n  &&<\/span> yum -y install python36 python36-devel \\<\/span>\r\n  &&<\/span> python3.6 -m venv \/opt\/py3\r\n<\/pre>\n<\/div>\n<\/div>\n
    \n
    \n
    $ echo<\/span> -e \"\\033[31m 3. \u4e0b\u8f7d\u7ec4\u4ef6 \\033[0m\"<\/span> \\<\/span>\r\n  &&<\/span> cd<\/span> \/opt \\<\/span>\r\n  &&<\/span> if<\/span> [<\/span> ! -d \"\/opt\/jumpserver\"<\/span> ]<\/span>;<\/span> then<\/span> git clone https:\/\/github.com\/jumpserver\/jumpserver.git;<\/span> cd<\/span> \/opt\/jumpserver;<\/span> git checkout 1<\/span>.4.8;<\/span> cd<\/span> \/opt;<\/span> fi<\/span> \\<\/span>\r\n  &&<\/span> if<\/span> [<\/span> ! -f \"\/opt\/luna.tar.gz\"<\/span> ]<\/span>;<\/span> then<\/span> wget https:\/\/demo.jumpserver.org\/download\/luna\/1.4.8\/luna.tar.gz;<\/span> tar xf luna.tar.gz;<\/span> chown -R root:root luna;<\/span> fi<\/span> \\<\/span>\r\n  &&<\/span> yum -y install $(<\/span>cat \/opt\/jumpserver\/requirements\/rpm_requirements.txt)<\/span> \\<\/span>\r\n  &&<\/span> source<\/span> \/opt\/py3\/bin\/activate \\<\/span>\r\n  &&<\/span> pip install wheel -i https:\/\/mirrors.aliyun.com\/pypi\/simple\/ \\<\/span>\r\n  &&<\/span> pip install --upgrade pip setuptools -i https:\/\/mirrors.aliyun.com\/pypi\/simple\/ \\<\/span>\r\n  &&<\/span> pip install -r \/opt\/jumpserver\/requirements\/requirements.txt -i https:\/\/mirrors.aliyun.com\/pypi\/simple\/ \\<\/span>\r\n  &&<\/span> mkdir \/etc\/docker \\<\/span>\r\n  &&<\/span> wget -O \/etc\/docker\/daemon.json http:\/\/demo.jumpserver.org\/download\/docker\/daemon.json \\<\/span>\r\n  &&<\/span> systemctl restart docker \\<\/span>\r\n  &&<\/span> docker pull jumpserver\/jms_coco:1.4.8 \\<\/span>\r\n  &&<\/span> docker pull jumpserver\/jms_guacamole:1.4.8 \\<\/span>\r\n  &&<\/span> rm -rf \/etc\/nginx\/conf.d\/default.conf \\<\/span>\r\n  &&<\/span> wget -O \/etc\/nginx\/conf.d\/jumpserver.conf https:\/\/demo.jumpserver.org\/download\/nginx\/conf.d\/jumpserver_1.4.8.conf\r\n<\/pre>\n<\/div>\n<\/div>\n
    \n
    \n
    $ echo<\/span> -e \"\\033[31m 4. \u5904\u7406\u914d\u7f6e\u6587\u4ef6 \\033[0m\"<\/span> \\<\/span>\r\n  &&<\/span> if<\/span> [<\/span> \"<\/span>$DB_PASSWORD<\/span>\"<\/span> =<\/span> \"\"<\/span> ]<\/span>;<\/span> then<\/span> DB_PASSWORD<\/span>=<\/span>`<\/span>cat \/dev\/urandom |<\/span> tr -dc A-Za-z0-9 |<\/span> head -c 24<\/span>`<\/span>;<\/span> fi<\/span> \\<\/span>\r\n  &&<\/span> if<\/span> [<\/span> \"<\/span>$SECRET_KEY<\/span>\"<\/span> =<\/span> \"\"<\/span> ]<\/span>;<\/span> then<\/span> SECRET_KEY<\/span>=<\/span>`<\/span>cat \/dev\/urandom |<\/span> tr -dc A-Za-z0-9 |<\/span> head -c 50<\/span>`<\/span>;<\/span> echo<\/span> \"SECRET_KEY=<\/span>$SECRET_KEY<\/span>\"<\/span> >> ~\/.bashrc;<\/span> fi<\/span> \\<\/span>\r\n  &&<\/span> if<\/span> [<\/span> \"<\/span>$BOOTSTRAP_TOKEN<\/span>\"<\/span> =<\/span> \"\"<\/span> ]<\/span>;<\/span> then<\/span> BOOTSTRAP_TOKEN<\/span>=<\/span>`<\/span>cat \/dev\/urandom |<\/span> tr -dc A-Za-z0-9 |<\/span> head -c 16<\/span>`<\/span>;<\/span> echo<\/span> \"BOOTSTRAP_TOKEN=<\/span>$BOOTSTRAP_TOKEN<\/span>\"<\/span> >> ~\/.bashrc;<\/span> fi<\/span> \\<\/span>\r\n  &&<\/span> if<\/span> [<\/span> \"<\/span>$Server_IP<\/span>\"<\/span> =<\/span> \"\"<\/span> ]<\/span>;<\/span> then<\/span> Server_IP<\/span>=<\/span>`<\/span>ip addr |<\/span> grep inet |<\/span> egrep -v '(127.0.0.1|inet6|docker)'<\/span> |<\/span> awk '{print $2}'<\/span> |<\/span> tr -d \"addr:\"<\/span> |<\/span> head -n 1<\/span> |<\/span> cut -d \/ -f1`<\/span>;<\/span> fi<\/span> \\<\/span>\r\n  &&<\/span> if<\/span> [<\/span> ! -d \"\/var\/lib\/mysql\/jumpserver\"<\/span> ]<\/span>;<\/span> then<\/span> mysql -uroot -e \"create database jumpserver default charset 'utf8';grant all on jumpserver.* to 'jumpserver'@'127.0.0.1' identified by '<\/span>$DB_PASSWORD<\/span>';flush privileges;\"<\/span>;<\/span> fi<\/span> \\<\/span>\r\n  &&<\/span> if<\/span> [<\/span> ! -f \"\/opt\/jumpserver\/config.yml\"<\/span> ]<\/span>;<\/span> then<\/span> cp \/opt\/jumpserver\/config_example.yml \/opt\/jumpserver\/config.yml;<\/span> sed -i \"s\/SECRET_KEY:\/SECRET_KEY: <\/span>$SECRET_KEY<\/span>\/g\"<\/span> \/opt\/jumpserver\/config.yml;<\/span> sed -i \"s\/BOOTSTRAP_TOKEN:\/BOOTSTRAP_TOKEN: <\/span>$BOOTSTRAP_TOKEN<\/span>\/g\"<\/span> \/opt\/jumpserver\/config.yml;<\/span> sed -i \"s\/# DEBUG: true\/DEBUG: false\/g\"<\/span> \/opt\/jumpserver\/config.yml;<\/span> sed -i \"s\/# LOG_LEVEL: DEBUG\/LOG_LEVEL: ERROR\/g\"<\/span> \/opt\/jumpserver\/config.yml;<\/span> sed -i \"s\/# SESSION_EXPIRE_AT_BROWSER_CLOSE: false\/SESSION_EXPIRE_AT_BROWSER_CLOSE: true\/g\"<\/span> \/opt\/jumpserver\/config.yml;<\/span> sed -i \"s\/DB_PASSWORD: \/DB_PASSWORD: <\/span>$DB_PASSWORD<\/span>\/g\"<\/span> \/opt\/jumpserver\/config.yml;<\/span> fi<\/span>\r\n<\/pre>\n<\/div>\n<\/div>\n
    \n
    \n
    $ echo<\/span> -e \"\\033[31m 5. \u542f\u52a8 Jumpserver \\033[0m\"<\/span> \\<\/span>\r\n  &&<\/span> systemctl start nginx \\<\/span>\r\n  &&<\/span> cd<\/span> \/opt\/jumpserver \\<\/span>\r\n  &&<\/span> .\/jms start -d \\<\/span>\r\n  &&<\/span> docker run --name jms_coco -d -p 2222<\/span>:2222 -p 5000<\/span>:5000 -e CORE_HOST<\/span>=<\/span>http:\/\/$Server_IP<\/span>:8080 -e BOOTSTRAP_TOKEN<\/span>=<\/span>$BOOTSTRAP_TOKEN<\/span> jumpserver\/jms_coco:1.4.8 \\<\/span>\r\n  &&<\/span> docker run --name jms_guacamole -d -p 8081<\/span>:8081 -e JUMPSERVER_SERVER<\/span>=<\/span>http:\/\/$Server_IP<\/span>:8080 -e BOOTSTRAP_TOKEN<\/span>=<\/span>$BOOTSTRAP_TOKEN<\/span> jumpserver\/jms_guacamole:1.4.8 \\<\/span>\r\n  &&<\/span> echo<\/span> -e \"\\033[31m \u4f60\u7684\u6570\u636e\u5e93\u5bc6\u7801\u662f <\/span>$DB_PASSWORD<\/span> \\033[0m\"<\/span> \\<\/span>\r\n  &&<\/span> echo<\/span> -e \"\\033[31m \u4f60\u7684SECRET_KEY\u662f <\/span>$SECRET_KEY<\/span> \\033[0m\"<\/span> \\<\/span>\r\n  &&<\/span> echo<\/span> -e \"\\033[31m \u4f60\u7684BOOTSTRAP_TOKEN\u662f <\/span>$BOOTSTRAP_TOKEN<\/span> \\033[0m\"<\/span> \\<\/span>\r\n  &&<\/span> echo<\/span> -e \"\\033[31m \u4f60\u7684\u670d\u52a1\u5668IP\u662f <\/span>$Server_IP<\/span> \\033[0m\"<\/span> \\<\/span>\r\n  &&<\/span> echo<\/span> -e \"\\033[31m \u8bf7\u6253\u5f00\u6d4f\u89c8\u5668\u8bbf\u95ee http:\/\/<\/span>$Server_IP<\/span> \u7528\u6237\u540d:admin \u5bc6\u7801:admin \\033[0m\"<\/span>\r\n<\/pre>\n<\/div>\n<\/div>\n
    \n
    \n
    $ echo<\/span> -e \"\\033[31m 6. \u914d\u7f6e\u81ea\u542f \\033[0m\"<\/span> \\<\/span>\r\n  &&<\/span> if<\/span> [<\/span> ! -f \"\/usr\/lib\/systemd\/system\/jms.service\"<\/span> ]<\/span>;<\/span> then<\/span> wget -O \/usr\/lib\/systemd\/system\/jms.service https:\/\/demo.jumpserver.org\/download\/shell\/1.4.8\/centos\/jms.service;<\/span> chmod 755<\/span> \/usr\/lib\/systemd\/system\/jms.service;<\/span> fi<\/span> \\<\/span>\r\n  &&<\/span> if<\/span> [<\/span> ! -f \"\/opt\/start_jms.sh\"<\/span> ]<\/span>;<\/span> then<\/span> wget -O \/opt\/start_jms.sh https:\/\/demo.jumpserver.org\/download\/shell\/1.4.8\/centos\/start_jms.sh;<\/span> fi<\/span> \\<\/span>\r\n  &&<\/span> if<\/span> [<\/span> ! -f \"\/opt\/stop_jms.sh\"<\/span> ]<\/span>;<\/span> then<\/span> wget -O \/opt\/stop_jms.sh https:\/\/demo.jumpserver.org\/download\/shell\/1.4.8\/centos\/stop_jms.sh;<\/span> fi<\/span> \\<\/span>\r\n  &&<\/span> if<\/span> [<\/span> \"<\/span>$(<\/span>cat \/etc\/rc.local |<\/span> grep start_jms.sh)<\/span>\"<\/span> ==<\/span> \"\"<\/span> ]<\/span>;<\/span> then<\/span> echo<\/span> \"sh \/opt\/start_jms.sh\"<\/span> >> \/etc\/rc.local;<\/span> chmod +x \/etc\/rc.d\/rc.local;<\/span> fi<\/span> \\<\/span>\r\n  &&<\/span> echo<\/span> -e \"\\033[31m \u542f\u52a8\u505c\u6b62\u7684\u811a\u672c\u5728 \/opt \u76ee\u5f55\u4e0b, \u5982\u679c\u81ea\u542f\u5931\u8d25\u53ef\u4ee5\u624b\u52a8\u542f\u52a8 \\033[0m\"<\/span><\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
    \u8bf4\u660e \u5168\u65b0\u5b89\u88c5\u7684 Centos7 \u7cfb\u7edf \u4fdd\u6301\u670d\u52a1\u5668\u7f51\u7edc\u7545\u901a \u5f00\u59cb\u5b89\u88c5 \u4ee5\u4e0b\u547d\u4ee4\u5747\u5728\u4e00\u4e2a\u7ec8\u7aef\u91cc\u9762\u6267\u884c $ ech […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-955","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/955","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=955"}],"version-history":[{"count":1,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/955\/revisions"}],"predecessor-version":[{"id":956,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/955\/revisions\/956"}],"wp:attachment":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=955"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=955"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=955"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}