Centos 7.* Jumserver安装日志审计和资产管理

###

1.部署redis nginx mysql python3环境,安装git

# 安装应用
yum install -y redis nginx
yum install -y mariadb-server mariadb
yum install -y python3
yum -y install git 

# 启动服务
systemctl start redis
systemctl start mariadb

# 创建jumpserver使用的数据库
mysql -e "create database jumpserver default charset 'utf8' collate 'utf8_bin';"

2.创建 py3 虚拟环境 -- 载入 py3 虚拟环境

python3.6 -m venv /opt/py3
source /opt/py3/bin/activate

3.获取jumpserver代码 安装依赖

# 进入py3虚拟环境，进行操作
source /opt/py3/bin/activate
cd /opt

# --depth用于指定克隆深度，为1即表示只克隆最近一次commit.
# git clone --depth=1 https://github.com/jumpserver/jumpserver.git
tar xf jumpserver_source.tar.gz -C /opt

cd /opt/jumpserver/requirements 
yum install -y $(cat rpm_requirements.txt) python36-devel  openssl-devel gcc*
pip3 install wheel -i https://mirrors.aliyun.com/pypi/simple/ 
pip3 install --upgrade pip setuptools -i https://mirrors.aliyun.com/pypi/simple/
pip3 install -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/

4.修改jumpserver配置文件

# 进入py3虚拟环境，进行操作
source /opt/py3/bin/activate 

# 生成SECRET_KEY和BOOTSTRAP_TOKEN
#[root@jumpserver ~]# cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 49;echo
#YL3rJbUvpy9QFo9zmYrLXf4PKvs1fo9K1AC01XyWc9Wp1Cb02
#[root@jumpserver ~]# cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 17;echo
#mCXCv0QYlHYuCYkuu
cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 49;echo
cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 17;echo

# 修改配置文件
cd /opt/jumpserver 
cp config_example.yml config.yml 
sed -i "s/SECRET_KEY:/SECRET_KEY: 'YL3rJbUvpy9QFo9zmYrLXf4PKvs1fo9K1AC01XyWc9Wp1Cb02'/g" config.yml 
sed -i 's/DB_USER: jumpserver/DB_USER: root/g' config.yml 
sed -i "s/BOOTSTRAP_TOKEN:/BOOTSTRAP_TOKEN: 'mCXCv0QYlHYuCYkuu'/g" config.yml

5.启动jumpserver

source /opt/py3/bin/activate && cd /opt/jumpserver && ./jms start -d

6.部署koko服务并启动【xshell连接koko服务端口2222，可弹出jumpserver资产列表】

#koko功能： 实现了 SSH Server 和 Web Terminal Server 的组件，提供 SSH 和 WebSocket 接口, 使用 Paramiko 和 Flask 开发
# 进入沙盒环境，进行操作 
source /opt/py3/bin/activate
cd /opt 
wget https://github.com/jumpserver/koko/releases/download/v2.3.0/koko-v2.3.0-linux-amd64.tar.gz
tar xf `find / -name "koko-v2.3.0-linux-amd64.tar.gz"` -C ./  
mv koko-v2.3.0-linux-amd64 kokodir
chown -R root:root kokodir 
cd kokodir 
cp config_example.yml config.yml
cp kubectl /usr/local/bin/
sed -i "s/BOOTSTRAP_TOKEN: <PleasgeChangeSameWithJumpserver>/BOOTSTRAP_TOKEN: 'mCXCv0QYlHYuCYkuu'/g" config.yml
cd /opt/kokodir
wget https://download.jumpserver.org/public/kubectl.tar.gz
tar -xf kubectl.tar.gz
chmod 755 kubectl
mv kubectl /usr/local/bin/rawkubectl
cd /opt/kokodir && ./koko -d

7.安装并启动 guacamole 组件

#guacamole功能： Apache 跳板机项目，Jumpserver 使用其组件实现 RDP 功能，Jumpserver 并没有修改其代码而是添加了额外的插件，支持 Jumpserver 调用
# 进入py3虚拟环境，进行操作
source /opt/py3/bin/activate 
cd /opt 
#git clone --depth=1 https://github.com/jumpserver/docker-guacamole.git
wget -O guacamole-v2.3.0.tar.gz https://github.com/jumpserver/docker-guacamole/archive/master.tar.gz
mkdir /opt/docker-guacamole
tar xf `find / -name "guacamole-v2.3.0.tar.gz"` -C /opt/docker-guacamole --strip-components 1

cd /opt/docker-guacamole 
wget http://download.jumpserver.org/public/guacamole-server-1.2.0.tar.gz

wget http://download.jumpserver.org/public/ssh-forward.tar.gz
tar -xf ssh-forward.tar.gz -C /bin/
chmod +x /bin/ssh-forward

#tar xf guacamole-server-1.2.0.tar.gz 
cd /opt/docker-guacamole/guacamole-server-1.2.0 

yum install -y cairo-devel libjpeg-turbo-devel libpng-devel uuid-devel 
yum install -y ffmpeg-devel freerdp1.2-devel pango-devel  libssh2-devel libtelnet-devel libvncserver-devel pulseaudio-libs-devel openssl-devel libvorbis-devel libwebp-devel >/dev/null && 
ln -s /usr/local/lib/freerdp/*.so /usr/lib64/freerdp/ 
autoreconf -fi 
yum install  -y make  


./configure --with-init-dir=/etc/init.d 
make  && make install 

# 先在当前环境配置好 jdk8 jre8
yum install -y java-1.8.0-openjdk

mkdir -p /config/guacamole/{lib,extensions,record,drive,data/log/} 
chown daemon:daemon /config/guacamole/{record,drive}
cd /config 
tar xf `find / -name "apache-tomcat-9.0.27.tar.gz"` -C ./ 
mv apache-tomcat-9.0.27 tomcat9 
rm -rf /config/tomcat9/webapps/* 
sed -i 's/Connector port="8080"/Connector port="8081"/g' /config/tomcat9/conf/server.xml 
echo "java.util.logging.ConsoleHandler.encoding = UTF-8" >> /config/tomcat9/conf/logging.properties 
wget http://download.jumpserver.org/release/v2.3.0/guacamole-client-v2.3.0.tar.gz
tar -xf guacamole-client-v2.3.0.tar.gz
cp guacamole-client-v2.3.0/guacamole-*.war /config/tomcat9/webapps/ROOT.war
cp guacamole-client-v2.3.0/guacamole-*.jar /config/guacamole/extensions/
mv /opt/docker-guacamole/guacamole.properties /config/guacamole

ln -sf /opt/docker-guacamole/guacamole-1.0.0.war /config/tomcat9/webapps/ROOT.war
ln -sf /opt/docker-guacamole/guacamole-auth-jumpserver-1.0.0.jar /config/guacamole/extensions/guacamole-auth-jumpserver-1.0.0.jar 
ln -sf /opt/docker-guacamole/root/app/guacamole/guacamole.properties /config/guacamole/guacamole.properties 


# 设置 guacamole 环境
# http://127.0.0.1:8080 指 jumpserver 访问地址
source /opt/py3/bin/activate && 
export JUMPSERVER_SERVER=http://127.0.0.1:8080
echo "export JUMPSERVER_SERVER=http://127.0.0.1:8080" >> ~/.bashrc

# BOOTSTRAP_TOKEN 为 Jumpserver/config.yml 里面的 BOOTSTRAP_TOKEN 值
export BOOTSTRAP_TOKEN=mCXCv0QYlHYuCYkuu 
echo "export BOOTSTRAP_TOKEN=mCXCv0QYlHYuCYkuu" >> ~/.bashrc 

export JUMPSERVER_KEY_DIR=/config/guacamole/keys 
echo "export JUMPSERVER_KEY_DIR=/config/guacamole/keys" >> ~/.bashrc 

export GUACAMOLE_HOME=/config/guacamole && 
echo "export GUACAMOLE_HOME=/config/guacamole" >> ~/.bashrc 

export GUACAMOLE_LOG_LEVEL=ERROR 
echo "export GUACAMOLE_LOG_LEVEL=ERROR" >> ~/.bashrc 

/etc/init.d/guacd start 
sh /config/tomcat9/bin/startup.sh

8.部署luna插件

#luna功能： 现在是 Web Terminal 前端，计划前端页面都由该项目提供，Jumpserver 只提供 API，不再负责后台渲染html等
source /opt/py3/bin/activate 
cd /opt 
tar xf `find / -name "luna.tar.gz"`  -C ./ 
chown -R root:root luna

9.生成nginx代理jumpserver配置文件

source /opt/py3/bin/activate 
echo 'server {
    listen 80;
    server_name alpha.example.com
    client_max_body_size 100m;  # 录像及文件上传大小限制
    location / {
        proxy_pass http://localhost:8080;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
    location /luna/ {
        try_files $uri / /index.html;
        alias /opt/luna/;  # luna 路径, 如果修改安装目录, 此处需要修改
    }
    location /media/ {
        add_header Content-Encoding gzip;
        root /opt/jumpserver/data/;  # 录像位置, 如果修改安装目录, 此处需要修改
    }
    location /static/ {
        root /opt/jumpserver/data/;  # 静态资源, 如果修改安装目录, 此处需要修改
    }
    location /koko/ {
        proxy_pass       http://localhost:5000;
        proxy_buffering off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        access_log off;
    }
    location /guacamole/ {
        proxy_pass       http://localhost:8081/;
        proxy_buffering off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        access_log off;
    }
    location /ws/ {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass http://localhost:8070;
        proxy_http_version 1.1;
        proxy_buffering off;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}' >/etc/nginx/conf.d/jumpserver.conf
nginx -t && nginx

 10.关于日志存储

在 Jumpserver 中，有登陆日志、FTP日志、操作日志、改密日志、批量命令，还有Windows操作录屏。这些日志都会占用磁盘空间，数据库记录。

用户登录日志：jumpserver库下audits_userloginlog表
改密日志：jumpserver库下audits_passwordchangelog表
审计操作日志(管理员操作创用户分权限日志): jumpserver库下audits_operatelog表
ftp文件上传下载日志： jumpserver库下audits_ftplog表
执行终端命令日志： jumpserver库下terminal_command表
终端会话连接：jumpserver库下terminal_session表

###