Jumpserver

一、跳板机概述

日常普通运维: 运维管理与维护环境,一般通过远程连接工具,进行去维护与管理,好处方便. 缺点不方便进行行为审计(什么时间什么地点,做了什么),批量管理较难

自动化运维与管理: 推荐通过跳板机连接用户管理服务器, 进行批量管理可以利用自动化工具(密钥认证,Ansible批量部署,批量更新,批量配置)

跳板机/堡垒机: 运维管理服务器入口

二、常用跳板机选择

跳板机
teleport	功能简单,使用方便,简约风
Jms(JumpServer)	功能详细,需要系统配置会更高
商业软件/硬件

三、JMS 架构

四、部署

服务器最少需要2c4G
[root@jumpserver ~]# ll
total 2088768
-rw-------. 1 root root       1340 Jan  9 09:09 anaconda-ks.cfg
-rw-r--r--  1 root root 2138892766 Mar 31 11:09 jumpserver-offline-installer-v3.0.4-amd64-247.tar.gz
[root@jumpserver ~]# mkdir -p /app/tools/
[root@jumpserver ~]# tar xf jumpserver-offline-installer-v3.0.4-amd64-247.tar.gz -C /app/tools/
[root@jumpserver ~]# ln -s /app/tools/jumpserver-offline-installer-v3.0.4-amd64-247/ /app/tools/jumpserver
[root@jumpserver ~]# cd /app/tools/jumpserver      
[root@jumpserver /app/tools/jumpserver]# ll
total 72
-rw-r--r-- 1 root root  2121 Mar  8 16:26 cn-quick_start.sh
drwxr-xr-x 2 root root  4096 Mar  8 16:26 compose
-rw-r--r-- 1 root root  4220 Mar  8 16:26 config-example.txt
drwxr-xr-x 8 root root   101 Mar  8 16:26 config_init
-rwxr-xr-x 1 root root  7048 Mar  8 16:26 jmsctl.sh
-rw-r--r-- 1 root root 35148 Mar  8 16:26 LICENSE
drwxr-xr-x 4 root root    29 Mar  8 16:26 locale
-rw-r--r-- 1 root root  1992 Mar  8 16:26 quick_start.sh
-rw-r--r-- 1 root root  1874 Mar  8 16:26 README.md
drwxr-xr-x 4 root root   307 Mar  8 16:26 scripts
-rw-r--r-- 1 root root    22 Mar  8 16:26 static.env
drwxr-xr-x 2 root root    41 Mar  8 16:26 utils
[root@jumpserver /app/tools/jumpserver]# ./jmsctl.sh install


       ██╗██╗   ██╗███╗   ███╗██████╗ ███████╗███████╗██████╗ ██╗   ██╗███████╗██████╗
       ██║██║   ██║████╗ ████║██╔══██╗██╔════╝██╔════╝██╔══██╗██║   ██║██╔════╝██╔══██╗
       ██║██║   ██║██╔████╔██║██████╔╝███████╗█████╗  ██████╔╝██║   ██║█████╗  ██████╔╝
  ██   ██║██║   ██║██║╚██╔╝██║██╔═══╝ ╚════██║██╔══╝  ██╔══██╗╚██╗ ██╔╝██╔══╝  ██╔══██╗
  ╚█████╔╝╚██████╔╝██║ ╚═╝ ██║██║     ███████║███████╗██║  ██║ ╚████╔╝ ███████╗██║  ██║
   ╚════╝  ╚═════╝ ╚═╝     ╚═╝╚═╝     ╚══════╝╚══════╝╚═╝  ╚═╝  ╚═══╝  ╚══════╝╚═╝  ╚═╝

								   Version:  v3.0.4  

1. Check Configuration File
Path to Configuration file: /opt/jumpserver/config
/opt/jumpserver/config/config.txt 	 [ √ ]
/opt/jumpserver/config/nginx/cert/server.crt  	 [ √ ]
/opt/jumpserver/config/nginx/cert/server.key  	 [ √ ]
complete

>>> Install and Configure Docker
1. Install Docker
complete

2. Configure Docker
Do you want to support IPv6? (y/n)  (default n): n  #输入n

*****
*****
>>> Install and Configure JumpServer
1. Configure Private Key
SECRETE_KEY:     ODA2NzRkNTYtZDYyOC1lYTkyLTA3ZGUtNzg4ODJmMzE4YTQ2
BOOTSTRAP_TOKEN: ODA2NzRkNTYtZDYyOC1lYTky
complete

2. Configure Persistent Directory
Do you need custom persistent store, will use the default directory /data/jumpserver? (y/n)  (default n):   #回车

complete

3. Configure MySQL
Do you want to use external MySQL? (y/n)  (default n):  #回车
complete

4. Configure Redis
Do you want to use external Redis? (y/n)  (default n): #回车
complete

5. Configure External Port
Do you need to customize the JumpServer external port? (y/n)  (default n): complete #回车

>>> The Installation is Complete
1. You can use the following command to start, and then visit
cd /app/tools/jumpserver
./jmsctl.sh start

2. Other management commands
./jmsctl.sh stop
./jmsctl.sh restart
./jmsctl.sh backup
./jmsctl.sh upgrade
For more commands, you can enter ./jmsctl.sh --help to understand

3. Web access
http://10.0.0.65:80
Default username: admin  Default password: admin

4. SSH/SFTP access
ssh -p2222 admin@10.0.0.65
sftp -P2222 admin@10.0.0.65

5. More information
Official Website: https://www.jumpserver.org/
Documentation: https://docs.jumpserver.org/

[root@jumpserver /app/tools/jumpserver]# ./jmsctl.sh start

五、使用

1.创建资产节点

2.创建资产

创建主机账号

3.创建用户组

3.添加用户

4.资产授权

5.登陆测试

6.设置命令过滤

7.命令行访问

[root@jumpserver ~]# ssh -p2222 admin@10.0.0.65
admin@10.0.0.65's password:    #输入jumpserver的密码
		Administrator,  JumpServer 开源堡垒机

	1) 输入 部分IP，主机名，备注 进行搜索登录(如果唯一).
	2) 输入 / + IP，主机名，备注 进行搜索，如：/192.168.
	3) 输入 p 进行显示您有权限的资产.
	4) 输入 g 进行显示您有权限的节点.
	5) 输入 h 进行显示您有权限的主机.
	6) 输入 d 进行显示您有权限的数据库.
	7) 输入 k 进行显示您有权限的Kubernetes.
	8) 输入 r 进行刷新最新的机器和节点信息.
	9) 输入 s 进行中文-English-日本語语言切换.
	10) 输入 ? 进行显示帮助.
	11) 输入 q 进行退出.
Opt>