Jumpserver Readthedocs Io ZH Docs PDF

√ √
00A0 2203∃ 2200∀ 2286⊆ 2713x 27FA⇐⇒ 221A 221B 3 2295⊕ 2297⊗
Jumpserver Documentation
�� latest
Jumpserver team
2020 � 02 � 01 �
Contents
1 �� 3
2 �� 5
2.1 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.2 Docker �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.3 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2.4 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
2.5 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
2.6 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
3 �� 77
3.1 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
3.2 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
3.3 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
3.4 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
3.5 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
3.6 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
3.7 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
3.8 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
4 �� 129
4.1 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
4.2 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
4.3 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
4.4 Web�� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
4.5 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
5 �� 135
5.1 REST API�� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
5.2 Jumpserver ��(Draft) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
5.3 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
5.4 API �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
5.5 API �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
6 �� 147
7 �� 149
i
7.1 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
7.2 QQ � . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
7.3 Github . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
7.4 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
7.5 Demo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
7.6 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
8 Snapshot �� 151
8.1 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
8.2 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
8.3 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
8.4 Linux �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
8.5 Windows �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
9 FAQ 155
9.1 MFA �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
9.2 LDAP �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
9.3 Docker �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
9.4 Radius �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
9.5 Jms_core �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
9.6 Jms_koko �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
9.7 Jms_guacamole �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
9.8 Windows SSH �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
9.9 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
9.10 Nginx SSL �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168
9.11 Firewalld �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
9.12 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
9.13 �� . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172
10 �� 177
10.1 1.5.6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
10.2 1.5.5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
10.3 1.5.4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
10.4 1.5.3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
10.5 1.5.2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
10.6 1.5.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182
10.7 1.5.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
10.8 1.4.10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
10.9 1.4.9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
10.10 1.4.8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
10.11 1.4.7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
10.12 1.4.6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
10.13 1.4.5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
10.14 1.4.4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186
10.15 1.4.3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186
10.16 1.4.2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186
10.17 1.4.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186
10.18 1.4.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187
10.19 1.3.3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187
10.20 1.3.2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187
10.21 1.3.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
10.22 1.3.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
10.23 1.2.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
10.24 1.1.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
ii
10.25 1.1.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
10.26 1.0.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
10.27 0.5.0beta . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
10.28 0.4.0beta . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
10.29 0.3.3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
10.30 0.3.2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
10.31 0.3.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
10.32 0.3.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
10.33 0.2.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
10.34 0.1.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192
10.35 0.1.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192
iii
iv
Jumpserver Documentation, �� latest
��
Contents 1
2 Contents
CHAPTER 1
��
�� Jumpserver ��

Jumpserver ��, �� GNU GPL v2.0 ��, �� 4A ��
Jumpserver �� Python / Django ��, �� Web 2.0 ��, �� Web Terminal ��, ��
Jumpserver ��, ��, �� API, ��, ��
Jumpserver �� SSH� Telnet� RDP� VNC ��
��, ��
3
4 Chapter 1. ��
CHAPTER 2
��
• �� docker ��, ��

Jumpserver ��
• ��: 2�CPU��, 4G ��, 50G ��
• ��: Linux �� x86_64
• Python = 3.6.x
• Mysql Server � 5.6
• Mariadb Server � 5.5.56
• Redis
2.1 ��
2.1.1 ��
��
• �� Centos7 ��
• ��
��
��
$ echo -e "\033[31m 1. �� Selinux �� \033[0m" \

&& if [ "$(systemctl status firewalld | grep running)" != "" ]; then firewall-cmd --
,→zone=public --add-port=80/tcp --permanent; firewall-cmd --zone=public --add-port=2222/
,→tcp --permanent; firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source␣
,→address="172.17.0.0/16" port protocol="tcp" port="8080" accept"; firewall-cmd --reload;
,→ fi \
(��)
5
(��)
&& if [ "$(getenforce)" != "Disabled" ]; then setsebool -P httpd_can_network_connect 1;
,→ fi
$ echo -e "\033[31m 2. �� \033[0m" \

&& yum update -y \
&& ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime \
&& yum -y install kde-l10n-Chinese \
&& localedef -c -f UTF-8 -i zh_CN zh_CN.UTF-8 \
&& export LC_ALL=zh_CN.UTF-8 \
&& echo 'LANG="zh_CN.UTF-8"' > /etc/locale.conf \
&& yum -y install wget gcc epel-release git \
&& yum install -y yum-utils device-mapper-persistent-data lvm2 \
&& yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/
,→docker-ce.repo \
&& yum makecache fast \

&& rpm --import https://mirrors.aliyun.com/docker-ce/linux/centos/gpg \
&& echo -e "[nginx-stable]\nname=nginx stable repo\nbaseurl=http://nginx.org/packages/
,→centos/\$releasever/\$basearch/\ngpgcheck=1\nenabled=1\ngpgkey=https://nginx.org/keys/
,→nginx_signing.key" > /etc/yum.repos.d/nginx.repo \
&& rpm --import https://nginx.org/keys/nginx_signing.key \

&& yum -y install redis mariadb mariadb-devel mariadb-server MariaDB-shared nginx␣
,→docker-ce \
&& systemctl enable redis mariadb nginx docker \

&& systemctl start redis mariadb \
&& yum -y install python36 python36-devel \
&& python3.6 -m venv /opt/py3
$ echo -e "\033[31m 3. �� \033[0m" \

&& cd /opt \
&& if [ ! -d "/opt/jumpserver" ]; then git clone --depth=1 https://github.com/
,→jumpserver/jumpserver.git; fi \
&& if [ ! -f "/opt/luna.tar.gz" ]; then wget https://demo.jumpserver.org/download/luna/

,→1.5.6/luna.tar.gz; tar xf luna.tar.gz; chown -R root:root luna; fi \
&& yum -y install $(cat /opt/jumpserver/requirements/rpm_requirements.txt) \

&& echo -e "[easy_install]\nindex_url = https://mirrors.aliyun.com/pypi/simple/" > ~/.
,→pydistutils.cfg \
&& source /opt/py3/bin/activate \

&& pip install wheel -i https://mirrors.aliyun.com/pypi/simple/ \
&& pip install --upgrade pip setuptools -i https://mirrors.aliyun.com/pypi/simple/ \
&& pip install -r /opt/jumpserver/requirements/requirements.txt -i https://mirrors.
,→aliyun.com/pypi/simple/ \
&& curl -sSL https://get.daocloud.io/daotools/set_mirror.sh | sh -s http://f1361db2.m.

,→daocloud.io \
&& systemctl restart docker \

&& docker pull wojiushixiaobai/jms_koko:1.5.6 \
&& docker pull wojiushixiaobai/jms_guacamole:1.5.6 \
&& rm -rf /etc/nginx/conf.d/default.conf \
&& wget -O /etc/nginx/conf.d/jumpserver.conf https://demo.jumpserver.org/download/
,→nginx/conf.d/jumpserver.conf
$ echo -e "\033[31m 4. �� \033[0m" \

(��)
6 Chapter 2. ��
(��)
&& source ~/.bashrc \
&& if [ "$DB_PASSWORD" = "" ]; then DB_PASSWORD=`cat /dev/urandom | tr -dc A-Za-z0-9 |␣
,→head -c 24`; fi \
&& if [ "$SECRET_KEY" = "" ]; then SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 |␣

,→head -c 50`; echo "SECRET_KEY=$SECRET_KEY" >> ~/.bashrc; fi \
&& if [ "$BOOTSTRAP_TOKEN" = "" ]; then BOOTSTRAP_TOKEN=`cat /dev/urandom | tr -dc A-

,→Za-z0-9 | head -c 16`; echo "BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN" >> ~/.bashrc; fi \
&& if [ "$Server_IP" = "" ]; then Server_IP=`ip addr | grep 'state UP' -A2 | grep inet␣
,→| egrep -v '(127.0.0.1|inet6|docker)' | awk '{print $2}' | tr -d "addr:" | head -n 1 |␣
,→cut -d / -f1`; fi \
&& if [ ! -d "/var/lib/mysql/jumpserver" ]; then mysql -uroot -e "create database␣

,→jumpserver default charset 'utf8';grant all on jumpserver.* to 'jumpserver'@'127.0.0.1
,→' identified by '$DB_PASSWORD';flush privileges;"; fi \
&& if [ ! -f "/opt/jumpserver/config.yml" ]; then cp /opt/jumpserver/config_example.

,→yml /opt/jumpserver/config.yml; sed -i "s/SECRET_KEY:/SECRET_KEY: $SECRET_KEY/g" /opt/
,→jumpserver/config.yml; sed -i "s/BOOTSTRAP_TOKEN:/BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g"␣
,→/opt/jumpserver/config.yml; sed -i "s/# DEBUG: true/DEBUG: false/g" /opt/jumpserver/
,→config.yml; sed -i "s/# LOG_LEVEL: DEBUG/LOG_LEVEL: ERROR/g" /opt/jumpserver/config.
,→yml; sed -i "s/# SESSION_EXPIRE_AT_BROWSER_CLOSE: false/SESSION_EXPIRE_AT_BROWSER_
,→CLOSE: true/g" /opt/jumpserver/config.yml; sed -i "s/DB_PASSWORD: /DB_PASSWORD: $DB_
,→PASSWORD/g" /opt/jumpserver/config.yml; fi
$ echo -e "\033[31m 5. �� Jumpserver \033[0m" \

&& systemctl start nginx \
&& cd /opt/jumpserver \
&& ./jms start -d \
&& docker run --name jms_koko -d -p 2222:2222 -p 127.0.0.1:5000:5000 -e CORE_
,→HOST=http://$Server_IP:8080 -e BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN --restart=always␣
,→wojiushixiaobai/jms_koko:1.5.6 \
&& docker run --name jms_guacamole -d -p 127.0.0.1:8081:8080 -e JUMPSERVER_

,→SERVER=http://$Server_IP:8080 -e BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN --restart=always␣
,→wojiushixiaobai/jms_guacamole:1.5.6 \
&& echo -e "\033[31m �� $DB_PASSWORD \033[0m" \

&& echo -e "\033[31m ��SECRET_KEY� $SECRET_KEY \033[0m" \
&& echo -e "\033[31m ��BOOTSTRAP_TOKEN� $BOOTSTRAP_TOKEN \033[0m" \
&& echo -e "\033[31m ��IP� $Server_IP \033[0m" \
&& echo -e "\033[31m �� http://$Server_IP ��:admin ��:admin \033[0m"
$ echo -e "\033[31m 6. �� \033[0m" \

&& if [ ! -f "/usr/lib/systemd/system/jms.service" ]; then wget -O /usr/lib/systemd/
,→system/jms.service https://demo.jumpserver.org/download/shell/centos/jms.service;␣
,→chmod 755 /usr/lib/systemd/system/jms.service; systemctl enable jms; fi
��
• �� Centos7 (7.x)
• ��
• �� root ��
��, ��, ��
Koko�Guacamole ��(��)
2.1. �� 7
$ cd /opt
$ yum -y install wget
$ wget -O /opt/jms_install.sh https://demo.jumpserver.org/download/jms_install.sh
$ sh jms_install.sh
# ��, ��
$ systemctl start jms_core # �� jms_core ��
$ docker start jms_koko
$ docker start jms_guacamole
# ��
$ docker stop jms_koko
$ docker stop jms_guacamole
$ systemctl stop jms_core # �� jms_core
# ��
$ systemctl status jms_core
$ docker logs -f jms_koko
$ docker logs -f jms_guacamole
Koko�Guacamole ��(��)
$ yum -y install wget

$ cd /opt
$ wget -O jms_localinstall.sh https://demo.jumpserver.org/download/jms_localinstall.sh
$ sh jms_localinstall.sh
# ��, ��
$ systemctl start jms_core # �� jms_core ��
$ systemctl start jms_koko
$ systemctl start jms_guacamole
# ��
$ systemctl stop jms_guacamole
$ systemctl stop jms_koko
$ systemctl stop jms_core # �� jms_core
# ��
$ systemctl status jms_core
$ systemctl status jms_koko
$ systemctl status jms_guacamole
2.2 Docker ��
Jumpserver �� All in one Docker, ��, �� Database � Redis

Docker-Compose �� docker-compose��
��
• �� root ��
• �� SECRET_KEY ��, ��, ��
8 Chapter 2. ��
# ��, ��
$ if [ "$SECRET_KEY" = "" ]; then SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 | head␣
,→-c 50`; echo "SECRET_KEY=$SECRET_KEY" >> ~/.bashrc; echo $SECRET_KEY; else echo
,→$SECRET_KEY; fi
$ if [ "$BOOTSTRAP_TOKEN" = "" ]; then BOOTSTRAP_TOKEN=`cat /dev/urandom | tr -dc A-Za-

,→z0-9 | head -c 16`; echo "BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN" >> ~/.bashrc; echo
,→$BOOTSTRAP_TOKEN; else echo $BOOTSTRAP_TOKEN; fi
$ docker run --name jms_all -d -p 80:80 -p 2222:2222 -e SECRET_KEY=$SECRET_KEY -e␣

,→BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN jumpserver/jms_all:latest
# macOS �� key ��

$ if [ "$SECRET_KEY" = "" ]; then SECRET_KEY=`LC_CTYPE=C tr -dc A-Za-z0-9 < /dev/urandom␣
,→| head -c 50`; echo "SECRET_KEY=$SECRET_KEY" >> ~/.bash_profile; echo $SECRET_KEY;␣
,→else echo $SECRET_KEY; fi
$ if [ "$BOOTSTRAP_TOKEN" = "" ]; then BOOTSTRAP_TOKEN=`LC_CTYPE=C tr -dc A-Za-z0-9 < /

,→dev/urandom | head -c 16`; echo "BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN" >> ~/.bash_profile;␣
,→echo $BOOTSTRAP_TOKEN; else echo $BOOTSTRAP_TOKEN; fi
��
• ��: http://<��IP>
• SSH ��: ssh -p 2222 <��IP>
• XShell �� connection ��, �� ssh �� 2222
• �� admin �� admin
��
• mysql �� 5.6
• mariadb �� 5.5.6
• �� uft8
��
• ��
# mysql
$ create database jumpserver default charset 'utf8';
$ grant all on jumpserver.* to 'jumpserver'@'%' identified by 'weakPassword';
��
• SECRET_KEY = **
• BOOTSTRAP_TOKEN = **
• DB_HOST = mysql_host
• DB_PORT = 3306
• DB_USER = jumpserver
• DB_PASSWORD = weakPassword
• DB_NAME = jumpserver
• REDIS_HOST = 127.0.0.1
2.2. Docker �� 9
• REDIS_PORT = 6379
• REDIS_PASSWORD =
• VOLUME /opt/jumpserver/data/media
• VOLUME /var/lib/mysql
$ docker run --name jms_all -d \

-v /opt/jumpserver:/opt/jumpserver/data/media \
-p 80:80 \
-p 2222:2222 \
-e SECRET_KEY=xxxxxx \
-e BOOTSTRAP_TOKEN=xxx \
-e DB_HOST=192.168.x.x \
-e DB_PORT=3306 \
-e DB_USER=root \
-e DB_PASSWORD=xxx \
-e DB_NAME=jumpserver \
-e REDIS_HOST=192.168.x.x \
-e REDIS_PORT=6379 \
-e REDIS_PASSWORD=xxx \
jumpserver/jms_all:latest
��
• https://github.com/jumpserver/Dockerfile
2.3 ��
2.3.1 ��
• Jumpserver ��, �� Web ��, �� Web ��, ��

• koko � SSH Server � Web Terminal Server �� SSH �� Web Terminal �� SSH �� Telnet ��
• Luna � Web Terminal Server ��, �� Web Terminal ��
• Guacamole � RDP �� VNC ��, �� Web Terminal �� RDP �� VNC �� (�� Web Terminal ��)
2.3.2 ��
• Jumpserver �� Web �� 8080/tcp, �� WS �� 8070/tcp, �� jumpserver/config.yml

• koko �� SSH �� 2222/tcp, �� Web Terminal �� 5000/tcp �� koko/config.yml
• Guacamole �� 8081/tcp, �� /config/tomcat9/conf/server.xml
• Nginx �� 80/tcp
• Redis �� 6379/tcp
• Mysql �� 3306/tcp
10 Chapter 2. ��
Protocol Server name Port

TCP Jumpserver 8070, 8080
TCP koko 2222, 5000
TCP Guacamole 8081
TCP Db 3306
TCP Redis 6379
TCP Nginx 80
2.3.3 ��(��CentOS 7)
CentOS 7 ��
��
• # ��
• > �� mysql ��
• $ ��
��
�� FAQ ��
��
• ��: CentOS 7
• IP: 192.168.244.144
• ��: /opt
• ��: mariadb
• ��: nginx
��
$ yum update -y
# �� selinux ��, �� Selinux ��

$ systemctl start firewalld
$ firewall-cmd --zone=public --add-port=80/tcp --permanent # nginx ��
$ firewall-cmd --zone=public --add-port=2222/tcp --permanent # ��SSH�� koko
--permanent ��, ��
$ firewall-cmd --reload # ��
$ setenforce 0
$ sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
# ��
(��)
2.3. �� 11
(��)
$ yum -y install wget gcc epel-release git
# �� Redis, Jumpserver �� Redis � cache � celery broke

$ yum -y install redis
$ systemctl enable redis
$ systemctl start redis
# �� MySQL, �� Mysql �� Mysql ��, ��sqlite3, mysql, postgres�

$ yum -y install mariadb mariadb-devel mariadb-server MariaDB-shared # centos7��mariadb,␣
,→��mysql��
$ systemctl enable mariadb

$ systemctl start mariadb
# �� Jumpserver ��
$ DB_PASSWORD=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 24` # ��
$ echo -e "\033[31m �� $DB_PASSWORD \033[0m"
$ mysql -uroot -e "create database jumpserver default charset 'utf8'; grant all on␣
,→jumpserver.* to 'jumpserver'@'127.0.0.1' identified by '$DB_PASSWORD'; flush␣
,→privileges;"
# �� Nginx, �� Jumpserver ��

$ vi /etc/yum.repos.d/nginx.repo
[nginx]
name=nginx repo
baseurl=http://nginx.org/packages/centos/7/$basearch/
gpgcheck=0
enabled=1
$ yum -y install nginx

$ systemctl enable nginx
# �� Python3.6
$ yum -y install python36 python36-devel
# �� Python3 ��

$ cd /opt
$ python3.6 -m venv py3 # py3 ��, ��
$ source /opt/py3/bin/activate # �� deactivate ��
# ��, �� Jumpserver �� source ��, ��

(py3) [root@localhost py3]
# �� Jumpserver
$ cd /opt/
$ git clone --depth=1 https://github.com/jumpserver/jumpserver.git
# �� RPM �
$ yum -y install $(cat /opt/jumpserver/requirements/rpm_requirements.txt)
# �� Python ��
$ pip install wheel
$ pip install --upgrade pip setuptools
(��)
(��)
$ pip install -r /opt/jumpserver/requirements/requirements.txt
$ cd /opt/jumpserver
$ cp config_example.yml config.yml
$ SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 50` # ��SECRET_KEY

$ echo "SECRET_KEY=$SECRET_KEY" >> ~/.bashrc
$ BOOTSTRAP_TOKEN=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 16` # ��BOOTSTRAP_TOKEN
$ echo "BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN" >> ~/.bashrc
$ sed -i "s/SECRET_KEY:/SECRET_KEY: $SECRET_KEY/g" /opt/jumpserver/config.yml

$ sed -i "s/BOOTSTRAP_TOKEN:/BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g" /opt/jumpserver/config.
,→yml
$ sed -i "s/# DEBUG: true/DEBUG: false/g" /opt/jumpserver/config.yml

$ sed -i "s/# LOG_LEVEL: DEBUG/LOG_LEVEL: ERROR/g" /opt/jumpserver/config.yml
$ sed -i "s/# SESSION_EXPIRE_AT_BROWSER_CLOSE: false/SESSION_EXPIRE_AT_BROWSER_CLOSE:␣
,→true/g" /opt/jumpserver/config.yml
$ sed -i "s/DB_PASSWORD: /DB_PASSWORD: $DB_PASSWORD/g" /opt/jumpserver/config.yml
$ echo -e "\033[31m ��SECRET_KEY� $SECRET_KEY \033[0m"

$ echo -e "\033[31m ��BOOTSTRAP_TOKEN� $BOOTSTRAP_TOKEN \033[0m"
$ vi config.yml # ��
# SECURITY WARNING: keep the secret key used in production secret!

# �� , ��, PS: ��
SECRET_KEY:
# SECURITY WARNING: keep the bootstrap token used in production secret!

# ��Token koko�guacamole��, ��
BOOTSTRAP_TOKEN:
# Development env open this, when error occur display the full process track, Production␣
,→disable it
# DEBUG �� DEBUG��
DEBUG: false
# DEBUG, INFO, WARNING, ERROR, CRITICAL can set. See https://docs.djangoproject.com/en/1.

,→10/topics/logging/
# ��
LOG_LEVEL: ERROR
# LOG_DIR:
# Session expiration setting, Default 24 hour, Also set expired on on browser close
# ��Session��, ��24��, ��
# SESSION_COOKIE_AGE: 86400
SESSION_EXPIRE_AT_BROWSER_CLOSE: true
# Database setting, Support sqlite3, mysql, postgres ....

# ��
(��)
2.3. �� 13
(��)
# See https://docs.djangoproject.com/en/1.10/ref/settings/#databases
# SQLite setting:
# ��sqlite��
# DB_ENGINE: sqlite3
# DB_NAME:
# MySQL or postgres setting like:

# ��Mysql��
DB_ENGINE: mysql
DB_HOST: 127.0.0.1
DB_PORT: 3306
DB_USER: jumpserver
DB_PASSWORD:
DB_NAME: jumpserver
# When Django start it will bind this host and port

# ./manage.py runserver 127.0.0.1:8080
# ��
HTTP_BIND_HOST: 0.0.0.0
HTTP_LISTEN_PORT: 8080
# Use Redis as broker for celery and web socket

# Redis��
REDIS_HOST: 127.0.0.1
REDIS_PORT: 6379
# REDIS_PASSWORD:
# REDIS_DB_CELERY: 3
# REDIS_DB_CACHE: 4
# Use OpenID authorization

# ��OpenID ��
# BASE_SITE_URL: http://localhost:8080
# AUTH_OPENID: false # True or False
# AUTH_OPENID_SERVER_URL: https://openid-auth-server.com/
# AUTH_OPENID_REALM_NAME: realm-name
# AUTH_OPENID_CLIENT_ID: client-id
# AUTH_OPENID_CLIENT_SECRET: client-secret
# OTP settings
# OTP/MFA ��
# OTP_VALID_WINDOW: 0
# OTP_ISSUER_NAME: Jumpserver
# �� Jumpserver
$ ./jms start -d # �� -d ��./jms start -d
# ��, ��./jms start|stop|status all �� -d ��
$ wget -O /usr/lib/systemd/system/jms.service https://demo.jumpserver.org/download/shell/

,→centos/jms.service
(��)
(��)
$ chmod 755 /usr/lib/systemd/system/jms.service
$ systemctl enable jms # ��
# �� docker �� koko � guacamole

$ yum install -y yum-utils device-mapper-persistent-data lvm2
$ yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-
,→ce.repo
$ yum makecache fast

$ rpm --import https://mirrors.aliyun.com/docker-ce/linux/centos/gpg
$ yum -y install docker-ce
$ systemctl enable docker
$ curl -sSL https://get.daocloud.io/daotools/set_mirror.sh | sh -s http://f1361db2.m.
,→daocloud.io
$ systemctl restart docker
# �� ip �� 8080 ��, (�� ip ��)

$ firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="172.17.0.
,→0/16" port protocol="tcp" port="8080" accept"
$ firewall-cmd --reload
# 172.17.0.x �docker��IP�, ��ip��, ��IP
# �� IP
$ Server_IP=`ip addr | grep 'state UP' -A2 | grep inet | egrep -v '(127.0.0.
,→1|inet6|docker)' | awk '{print $2}' | tr -d "addr:" | head -n 1 | cut -d / -f1`
$ echo -e "\033[31m ��IP� $Server_IP \033[0m"
# http://<Jumpserver_url> �� jumpserver ��, � http://192.168.244.144:8080

# BOOTSTRAP_TOKEN � Jumpserver/config.yml �� BOOTSTRAP_TOKEN
$ docker run --name jms_koko -d -p 2222:2222 -p 127.0.0.1:5000:5000 -e CORE_HOST=http://
,→$Server_IP:8080 -e BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN --restart=always wojiushixiaobai/
,→jms_koko:1.5.6
$ docker run --name jms_guacamole -d -p 127.0.0.1:8081:8080 -e JUMPSERVER_SERVER=http://

,→jms_guacamole:1.5.6
# �� Web Terminal ��: Luna �� Nginx �� (https://github.com/jumpserver/luna/releases)��␣

,→release �, ��, ��
$ cd /opt
$ wget https://github.com/jumpserver/luna/releases/download/1.5.6/luna.tar.gz
# ��
$ wget https://demo.jumpserver.org/download/luna/1.5.6/luna.tar.gz
$ tar xf luna.tar.gz
$ chown -R root:root luna
# �� Nginx ��
$ rm -rf /etc/nginx/conf.d/default.conf
$ vi /etc/nginx/conf.d/jumpserver.conf
(��)
2.3. �� 15
(��)
server {
listen 80;
# server_name _;
client_max_body_size 100m; # ��
location /luna/ {
try_files $uri / /index.html;
alias /opt/luna/; # luna ��, ��, ��
}
location /media/ {
add_header Content-Encoding gzip;
root /opt/jumpserver/data/; # ��, ��, ��
}
location /static/ {
}
location /koko/ {
proxy_pass http://localhost:5000;
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}
location /guacamole/ {
proxy_pass http://localhost:8081/;
proxy_set_header Connection $http_connection;
access_log off;
}
location /ws/ {
(��)
(��)
access_log off;
}
location / {
access_log off;
}
}
# �� Nginx
$ nginx -t # ��, ��
$ systemctl start nginx
# �� http://192.168.244.144 (�� :8080 �� nginx ��)

# ��: admin ��: admin ��-�� koko Guacamole ��
# ��
$ ssh -p2222 admin@192.168.244.144
$ sftp -P2222 admin@192.168.244.144
��: admin
# �� Windows �, Xshell Terminal ��

$ ssh admin@192.168.244.144 2222
$ sftp admin@192.168.244.144 2222
��: admin
��
# sftp�� /tmp ��

# windows�� Guacamole RDP�� G ��
�� FAQ
2.3.4 ��(��CentOS 8)
CentOS 8 ��
��
• # ��
• > �� mysql ��
• $ ��
�� FAQ ��
��
2.3. �� 17
• IP: 192.168.244.144
• ��: /opt
• ��: mariadb
• ��: nginx
��
$ yum update -y
# �� selinux ��, �� Selinux ��

$ firewall-cmd --zone=public --add-port=80/tcp --permanent # nginx ��
$ firewall-cmd --zone=public --add-port=2222/tcp --permanent # ��SSH�� koko
--permanent ��, ��
$ firewall-cmd --reload # ��
$ setsebool -P httpd_can_network_connect 1
# ��
# �� Redis, Jumpserver �� Redis � cache � celery broke

# �� MySQL, �� Mysql �� Mysql ��, ��sqlite3, mysql, postgres�

$ yum -y install mariadb mariadb-devel mariadb-server
$ mysql -uroot -e "create database jumpserver default charset 'utf8'; grant all on␣
,→privileges;"
# �� Nginx, �� Jumpserver ��

[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

(��)
(��)
# �� Python3.6
# �� Python3 ��

$ cd /opt
$ python3.6 -m venv py3 # py3 ��, ��
$ source /opt/py3/bin/activate # �� deactivate ��

# �� Jumpserver
$ cd /opt/
# �� RPM �
$ yum -y install gcc krb5-devel libtiff-devel libjpeg-devel libzip-devel freetype-devel␣
,→libwebp-devel tcl-devel tk-devel sshpass openldap-devel mariadb-devel libffi-devel␣
,→openssh-clients telnet openldap-clients
$ pip install wheel


,→yml


$ vi config.yml # ��

(��)
2.3. �� 19
(��)
# �� , ��, PS: ��
SECRET_KEY:

BOOTSTRAP_TOKEN:
,→disable it
DEBUG: false

# ��
LOG_LEVEL: ERROR
# LOG_DIR:
# ��Session��, ��24��, ��

# ��
# SQLite setting:
# DB_NAME:

# ��Mysql��
DB_ENGINE: mysql
DB_HOST: 127.0.0.1
DB_PORT: 3306
DB_USER: jumpserver
DB_PASSWORD:
DB_NAME: jumpserver

# ��

# Redis��
REDIS_PORT: 6379
# REDIS_PASSWORD:
(��)
(��)
# REDIS_DB_CACHE: 4

# OTP settings
# OTP/MFA ��
# �� Jumpserver
# �� podman �� koko � guacamole

$ yum install -y podman-docker
$ alias docker=podman
$ echo "alias docker=podman" >> ~/.bashrc
# �� podman ��
$ vi /etc/containers/registries.conf
...
[registries.search]
# registries = ['registry.redhat.io', 'quay.io', 'docker.io']
registries = ['dockerhub.azk8s.cn', 'docker.mirrors.ustc.edu.cn', 'docker.io']
...
# �� ip �� 8080 ��, (�� ip ��)

$ firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.88.0.0/
,→16" port protocol="tcp" port="8080" accept"
# 10.88.0.x � podman ��IP�, ��ip��, ��IP
# �� IP
# http://<Jumpserver_url> �� jumpserver ��, � http://192.168.244.144:8080

(��)
2.3. �� 21
(��)
,→$Server_IP:8080 -e BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN wojiushixiaobai/jms_koko:1.5.6

,→$Server_IP:8080 -e BOOTSTRAP_TOKEN=$BOOTSTRAP_TOKEN wojiushixiaobai/jms_guacamole:1.5.6
# �� Web Terminal ��: Luna �� Nginx �� (https://github.com/jumpserver/luna/releases)��␣

,→release �, ��, ��
$ cd /opt
# ��
# �� Nginx ��
server {
listen 80;
# server_name _;
location /luna/ {
}
location /media/ {
}
location /static/ {
}
location /koko/ {
access_log off;
(��)
(��)
}
access_log off;
}
location /ws/ {
access_log off;
}
location / {
access_log off;
}
}
# �� Nginx
$ nginx -t # ��, ��
# �� http://192.168.244.144 (�� :8080 �� nginx ��)

# ��
$ ssh -p2222 admin@192.168.244.144
$ sftp -P2222 admin@192.168.244.144
��: admin

$ ssh admin@192.168.244.144 2222
$ sftp admin@192.168.244.144 2222
��: admin
��
(��)
2.3. �� 23
(��)

�� FAQ
2.3.5 ��(��Ubuntu 18.04)
Ubuntu 18.04 ��
��
• # ��
• > �� mysql ��
• $ ��
�� FAQ ��
��
• ��: Ubuntu 18.04

• IP: 192.168.244.144
• ��: /opt
• ��: mariadb
• ��: nginx
��
�. �� Python3 � Python ��
1.1 ��
$ apt-get update && apt-get -y upgrade

$ apt-get -y install wget gcc libffi-dev git
1.2 �� Redis, Jumpserver �� Redis � cache � celery broke
$ apt-get -y install redis-server
1.3 �� MySQL
�� Mysql ��, �� Mysql �� Mysql ��
$ apt-get -y install mysql-server libmysqlclient-dev
1.4 �� Jumpserver ��

$ mysql -uroot -p -e "create database jumpserver default charset 'utf8'; grant all on␣
,→privileges;"
1.5 �� Python3.6
$ apt-get -y install python3.6-dev python3-venv
1.6 �� Python ��

�� Python ��
$ cd /opt
$ python3.6 -m venv py3
$ source /opt/py3/bin/activate

�. �� Jumpserver
2.1 �� Clone ��
$ cd /opt/
2.2 ��
$ cd /opt/jumpserver/requirements
$ apt-get -y install $(cat deb_requirements.txt)
2.3 �� Python ��
$ pip install wheel

$ pip install -r requirements.txt


,→yml

(��)
2.3. �� 25
(��)

$ vim config.yml # ��

# �� , ��, PS: ��
SECRET_KEY:

BOOTSTRAP_TOKEN:
,→disable it
DEBUG: false

# ��
LOG_LEVEL: ERROR
# LOG_DIR:
# ��Session��, ��24��, ��

# ��
# SQLite setting:
# DB_NAME:

# ��Mysql��
DB_ENGINE: mysql
DB_HOST: 127.0.0.1
DB_PORT: 3306
DB_USER: jumpserver
DB_PASSWORD:
DB_NAME: jumpserver
(��)
(��)

# ��

# Redis��
REDIS_PORT: 6379
# REDIS_PASSWORD:
# REDIS_DB_CACHE: 4

# OTP settings
# OTP/MFA ��
2.5 �� Jumpserver
$ wget -O /lib/systemd/system/jms.service https://demo.jumpserver.org/download/shell/

,→ubuntu/jms.service
$ chmod 755 /lib/systemd/system/jms.service

$ systemctl enable jms # ��
��, ��
�. �� SSH Server � WebSocket Server: koko
3.1 �� Docker
$ apt-get -y install apt-transport-https ca-certificates curl software-properties-common

$ curl -fsSL http://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg | sudo apt-key add -
$ add-apt-repository "deb [arch=amd64] http://mirrors.aliyun.com/docker-ce/linux/ubuntu
,→$(lsb_release -cs) stable"
(��)
2.3. �� 27
(��)
$ apt-get -y update
$ apt-get -y install docker-ce
,→daocloud.io
$ systemctl restart docker.service

3.2 �� koko

,→jms_koko:1.5.6
�. �� RDP Server � VNC Server: Guacamole
4.1 �� Guacamole

�. �� Web Terminal ��: Luna
��(https://github.com/jumpserver/luna/releases)�� release �, ��, ��

5.1 �� Luna
$ cd /opt/
# ��
�. �� Nginx ��
6.1 �� Nginx
$ apt-get -y install curl gnupg2 ca-certificates lsb-release

$ add-apt-repository "deb http://nginx.org/packages/ubuntu/ $(lsb_release -cs) nginx"
$ curl -fsSL http://nginx.org/keys/nginx_signing.key | sudo apt-key add -
$ apt-get update
$ apt-get -y install nginx
6.2 �� /etc/nginx/conf.d/jumpserver.conf
$ vim /etc/nginx/conf.d/jumpserver.conf
server {
listen 80;
server_name _;
location /luna/ {
alias /opt/luna/;
}
location /media/ {
root /opt/jumpserver/data/;
}
location /static/ {
root /opt/jumpserver/data/;
}
location /koko/ {
access_log off;
}
access_log off;
}
location /ws/ {
(��)
2.3. �� 29
(��)
access_log off;
}
location / {
}
6.3 �� Nginx
$ nginx -t # ��
$ systemctl restart nginx

��, �� http://192.168.244.144
��: admin ��: admin
�Jumpserver ��-�� koko Guacamole ��
��
�� macOS � Linux, ��

$ ssh -p2222 admin@192.168.244.144
$ sftp -P2222 admin@192.168.244.144
��: admin
�� Windows, Xshell Terminal ��

$ ssh admin@192.168.244.144 2222
$ sftp admin@192.168.244.144 2222
��: admin
��

�� FAQ
2.3.6 ��(��CentOS 7)
�� - ��
��
• �� IP: 192.168.100.10 192.168.100.11 192.168.100.12
• Redis ip: 192.168.100.20
• Jumpserver IP: 192.168.100.30
• koko IP: 192.168.100.40
• Guacamole IP: 192.168.100.50
• Tengine �� IP: 192.168.100.100
Protocol Server name Port Used By

TCP Jumpserver 8070, 8080 Nginx, koko, Guacamole
TCP koko 2222, 5000 Tengine
TCP Guacamole 8081 Tengine
TCP Db 3306 Jumpserver
TCP Redis 6379 Jumpserver
TCP Tengine 80, 2222 All User
Nginx �� upstream ��, �� session ��
��
ssh�telnet�� koko � jumpserver ��

rdp�� guacamole �jumpserver ��
��
�� Tengine �� HA � ��, ��, ��, �� Tengine ��(��)� ��
�� - Tengine ��
��
• # ��
• $ ��
��
• IP: 192.168.100.100
Protocol ServerName IP Port Used By

TCP Tengine 192.168.100.100 80, 443, 2222 All
TCP Tengine 192.168.100.100 3306 Jumpserver
2.3. �� 31
��
# ��
$ yum upgrade -y
# �� epel-release �
$ yum -y install epel-release
# ��, �� 80 443 2222 ��

$ firewall-cmd --zone=public --add-port=80/tcp --permanent
$ firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="192.168.
,→100.0/24" port protocol="tcp" port="3306" accept"
# 192.168.100.0/24 �� Jumpserver ��, ��, ��
# �� selinux
$ setenforce 0
# �� Tengine
# �� http://tengine.taobao.org/
# �� luna
$ cd /opt
# ��
# �� Nginx
$ vi /etc/nginx/nginx.conf
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log warn;

pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
stream {
log_format proxy '$remote_addr [$time_local] '
'$protocol $status $bytes_sent $bytes_received '
(��)
(��)
'$session_time "$upstream_addr" '
'"$upstream_bytes_sent" "$upstream_bytes_received" "$upstream_
,→ connect_time"';
access_log /var/log/nginx/tcp-access.log proxy;

open_log_file_cache off;
upstream MariaDB {
server 192.168.100.10:3306;
server 192.168.100.11:3306 backup; # ��
server 192.168.100.12:3306 down; # ��
# �� Mariadb ��ip
}
upstream kokossh {
server 192.168.100.40:2222;
server 192.168.100.40:2223; # ��
# �� koko ssh ��ip
least_conn;
}
server {
listen 3306;
proxy_pass MariaDB;
proxy_connect_timeout 1s; # detect failure quickly
}
server {
listen 2222;
proxy_pass kokossh;
proxy_protocol on;
proxy_connect_timeout 1s; # detect failure quickly
}
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '

'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
# tcp_nopush on;
keepalive_timeout 65;
# ��
server_tokens off;
(��)
2.3. �� 33
(��)
include /etc/nginx/conf.d/*.conf;
}
# ��
$ mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.bak
upstream jumpserver {
server 192.168.100.30:80;
# �� jumpserver ��ip
}
upstream koko {
server 192.168.100.40:5000 weight=1;
server 192.168.100.40:5001 weight=1; # ��
# �� koko ��ip
ip_hash;
}
upstream guacamole {
server 192.168.100.50:8081 weight=1;
server 192.168.100.50:8082 weight=1; # ��
# �� guacamole ��ip
ip_hash;
}
server {
listen 80;
server_name www.jumpserver.org; # ��
return 301 https://$server_name$request_uri;
}
server {
# �� https ��, �� https ��
listen 443 ssl;
server_name demo.jumpserver.org; # ��
ssl on;
ssl_certificate /etc/nginx/sslkey/1_jumpserver.org_bundle.crt; # ��
ssl_certificate_key /etc/nginx/sslkey/2_jumpserver.org.key; # ��
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!
,→RC4;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_prefer_server_ciphers on;
location / {
proxy_pass http://jumpserver; # jumpserver
(��)
(��)
access_log off;
}
location /luna/ {
alias /opt/luna/; # luna ��
}
location /koko/ {
proxy_pass http://koko; # koko
access_log off;
}
proxy_pass http://guacamole/; # guacamole
access_log off;
}
}
# nginx ��, ��

$ nginx -t
# �� http://192.168.100.100
# ��
$ ssh -p2222 admin@192.168.100.100
$ sftp -P2222 admin@192.168.100.100
��: admin

(��)
2.3. �� 35
(��)
$ ssh admin@192.168.100.100 2222
$ sftp admin@192.168.100.100 2222
��: admin
��

�� FAQ
�� - mariadb ��
��
• # ��
• $ ��
• > ��
��
• ��: MariaDB Galera Cluster

TCP Mariadb-01 192.168.100.10 3306 Jumpserver
��
# ��
$ yum upgrade -y
# �� MariaDB �
$ vi /etc/yum.repos.d/MariaDB.repo
[mariadb]
name = MariaDB
baseurl = http://mirrors.ustc.edu.cn/mariadb/yum/10.1/centos7-amd64
gpgkey=http://mirrors.ustc.edu.cn/mariadb/yum/RPM-GPG-KEY-MariaDB
gpgcheck=1
# �� MariaDB Galera Cluster

$ yum install -y mariadb mariadb-server MariaDB-shared mariadb-common galera rsync
# �� Firewalld � Selinux
(��)
(��)



,→100.0/24" port protocol="udp" port="4567" accept"
# 192.168.100.0/24 �� Jumpserver ��, ��, ��
$ setenforce 0
# � 192.168.100.10 ��
$ mysql_secure_installation # �� root ��, �� y
$ systemctl stop mariadb
# � 192.168.100.10 ��
$ vi /etc/my.cnf.d/server.cnf
...
[galera]
wsrep_on=ON
wsrep_provider=/usr/lib64/galera/libgalera_smm.so
wsrep_cluster_name=galera_cluster
wsrep_cluster_address="gcomm://192.168.100.10,192.168.100.11,192.168.100.12"
wsrep_node_name=Mariadb-01 # �� hostname
wsrep_node_address=192.168.100.10 # �� ip
binlog_format=row
default_storage_engine=InnoDB
innodb_autoinc_lock_mode=2
...
# � 192.168.100.11 ��
...
[galera]
wsrep_on=ON
binlog_format=row
...
# � 192.168.100.12 ��
(��)
2.3. �� 37
(��)
...
[galera]
wsrep_on=ON
binlog_format=row
# � 192.168.100.10 ��
$ sudo -u mysql /usr/sbin/mysqld --wsrep-new-cluster &> /tmp/wsrep_new_cluster.log &
$ disown $!
$ tail -f /tmp/wsrep_new_cluster.log # �� ready for connections, ��
# � 192.168.100.11 � 192.168.100.12 �� mariadb ��

# ��
$ ps -ef | grep mysqld | grep -v grep | awk '{print $2}' | xargs kill -9
# �� MariaDB Galera Cluster

$ mysql -uroot -p -e "show status like 'wsrep_cluster_size'" # ��3��
$ mysql -uroot -p -e "show status like 'wsrep_connected'" # ��ON
$ mysql -uroot -p -e "show status like 'wsrep_incoming_addresses'" # ��3�ip
$ mysql -uroot -p -e "show status like 'wsrep_local_state_comment'" # ��
$ mysql -uroot
> create database jumpserver default charset 'utf8';
> grant all on jumpserver.* to 'jumpserver'@'192.168.100.%' identified by 'weakPassword';
> flush privileges;
> quit
�� nginx �� tcp ��
�� - redis ��
��
• # ��
• $ ��
��
• IP: 192.168.100.20

TCP Redis 192.168.100.20 6379 Jumpserver
��
# ��
$ yum upgrade -y
# �� redis ��
$ yum install -y install epel-release
$ yum install -y redis
# ��, �� 6379 �� jumpserver ��

,→100.30" port protocol="tcp" port="6379" accept"
# �� redis ��
# �� redis ��
$ vi /etc/redis.conf
...
# bind 127.0.0.1 # ��, ��

bind 0.0.0.0
requirepass weakPassword # redis ��
maxmemory-policy allkeys-lru # ��, ��key
...
# �� redis
# redis ��, ��
�� - jumpserver ��
��
• # ��
• $ ��
2.3. �� 39
��
• IP: 192.168.100.30

TCP Jumpserver 192.168.100.30 80 Tengine
��
# ��
$ yum upgrade -y
# ��
$ yum -y install gcc epel-release git
# �� 8080 �� koko � guacamole � tengine ��




# �� Python3.6
# �� py3 ��
$ python3.6 -m venv /opt/py3
# �� Jumpserver
# �� RPM �
$ pip install wheel
# �� jumpserver ��

(��)
(��)

,→yml


$ vi config.yml

# �� , ��, ��
SECRET_KEY:

BOOTSTRAP_TOKEN:
,→disable it
DEBUG: false

# ��
LOG_LEVEL: ERROR
# LOG_DIR:
# ��Session��, ��24��, ��

# ��
# SQLite setting:
# DB_NAME:

(��)
2.3. �� 41
(��)
# ��Mysql��
DB_ENGINE: mysql
DB_HOST: 192.168.100.100
DB_PORT: 3306
DB_USER: jumpserver
DB_PASSWORD: ��
DB_NAME: jumpserver

# ��

# Redis��
REDIS_PORT: 6379
# REDIS_PASSWORD:
# REDIS_DB_CACHE: 4

# OTP settings
# OTP/MFA ��
# �� Jumpserver
# �� Nginx ��
[nginx]
name=nginx repo
baseurl=http://nginx.org/packages/centos/7/$basearch/
gpgcheck=0
enabled=1

(��)
(��)
# �� Nginx ��
server {
listen 80;
location /media/ {
}
location /static/ {
}
location /ws/ {
access_log off;
}
location / {
access_log off;
}
}
# �� Nginx
$ nginx -t # ��, ��
# ��, ��
�� - koko ��
2.3. �� 43
��
• # ��
• $ ��
��
• IP: 192.168.100.40

TCP koko 192.168.100.40 2222, 5000 Nginx
TCP koko01 192.168.100.40 2223, 5001 Nginx
��
# ��
$ yum upgrade -y
# ��, �� 2222 5000 �� nginx ��


# �� docker
$ yum install -y yum-utils device-mapper-persistent-data lvm2
,→ce.repo

,→daocloud.io

$ systemctl start docker
# �� docker ��
$ docker run --name jms_koko -d \
-p 2222:2222 \
-p 5000:5000 \
-e CORE_HOST=http://192.168.100.30:8080 \
-e BOOTSTRAP_TOKEN=��token \
wojiushixiaobai/jms_koko:1.5.6
# �� http://192.168.100.100/terminal/terminal/ �� koko ��
��


$ docker run --name jms_koko1 -d \

-p 2223:2222 \
-p 5001:5000 \
-e CORE_HOST=http://192.168.100.100 \
wojiushixiaobai/jms_koko:1.5.6
# �� http://192.168.100.100/terminal/terminal/ �� koko ��
�� - guacamole ��
��
• # ��
• $ ��
��
• IP: 192.168.100.50

TCP Guacamole 192.168.100.50 8081 Nginx
TCP Guacamole1 192.168.100.50 8082 Nginx
��
# ��
$ yum upgrade -y
# ��, �� 8081 �� nginx ��

# �� docker
$ sudo yum install -y yum-utils device-mapper-persistent-data lvm2
,→ce.repo
(��)
2.3. �� 45
(��)
,→daocloud.io

$ systemctl start docker
$ docker run --name jms_guacamole -d \
-p 8081:8080 \
-e JUMPSERVER_KEY_DIR=/config/guacamole/key \
-e JUMPSERVER_SERVER=http://192.168.100.30:8080 \
wojiushixiaobai/jms_guacamole:1.5.6
# �� http://192.168.100.100/terminal/terminal/ �� guacamole ��
��

$ docker run --name jms_guacamole1 -d \
-p 8082:8081 \
-e JUMPSERVER_KEY_DIR=/config/guacamole/key \
-e JUMPSERVER_SERVER=http://192.168.100.100 \
wojiushixiaobai/jms_guacamole:1.5.6
# �� http://192.168.100.100/terminal/terminal/ �� guacamole ��
2.4 ��
�� SECRET_KEY ��, ��
2.4.1 1.0.0-1.4.3 �� 1.4.4
��
• ��
• �� 0.x �� 1.x ��
• �� 1.0.x - 1.4.3 ��
• � 1.4.x �� mysql �� 5.6, mariadb �� 5.5.56
• ��
0. ��
# ��, ��
$ cd /opt/jumpserver/apps
$ for d in $(ls); do if [ -d $d ] && [ -d $d/migrations ]; then ll ${ d}/migrations/*.py␣
,→| grep -v __init__.py; fi; done
# ��, �� jumpserver ��

$ mysql -uroot -p
> use jumpserver;
> select app, name from django_migrations where app in('assets', 'audits', 'common', 'ops
,→', 'orgs', 'perms', 'terminal', 'users') order by app asc;
# ��, ��
��
1. �� Jumpserver
$ cp -r /opt/jumpserver /opt/jumpserver_bak
$ mysqldump -uroot -p jumpserver > /opt/jumpserver.sql
# �� releases ��, �� git pull ��

$ cd /opt/jumpserver_bak/apps
$ for d in $(ls);do
if [ -d $d ] && [ -d $d/migrations ];then
cp ${ d}/migrations/*.py /opt/jumpserver/apps/${ d}/migrations/
fi
done
$ ./jms stop
$ git fetch
$ git checkout 1.4.4
$ mv config.py config_old.bak
$ cp config_example.py config.py
$ vi config.py # � config_old.bak ��
"""
jumpserver.config
~~~~~~~~~~~~~~~~~
Jumpserver project setting file
:copyright: (c) 2014-2017 by Jumpserver Team

:license: GPL v2, see LICENSE for more details.
"""
import os
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
(��)
2.4. �� 47
(��)
class Config:
# Use it to encrypt or decrypt data
# Jumpserver �� SECRET_KEY ��, ��

# �� SECRET_KEY ��, �� config_old.bak
SECRET_KEY = os.environ.get('SECRET_KEY') or '2vym+ky!997d5kkcc64mnz06y1mmui3lut#(^
,→wd=%s_qj$1%x'
# Django security setting, if your disable debug model, you should setting that
ALLOWED_HOSTS = ['*']
# DEBUG �� True�� False��, ��, ��

# ��DEBUG = False, ��8080��, �� nginx ��
DEBUG = os.environ.get("DEBUG") or False
# ��, ��DEBUG, ��INFO, WARNING, ERROR, CRITICAL, ��INFO

LOG_LEVEL = os.environ.get("LOG_LEVEL") or 'WARNING'
LOG_DIR = os.path.join(BASE_DIR, 'logs')
# ��, ��sqlite3, mysql, postgres�, ��sqlite3

# ��SQLite3, ��
# DB_ENGINE = 'sqlite3'
# DB_NAME = os.path.join(BASE_DIR, 'data', 'db.sqlite3')
# ��, ��, ��config_old.bak

DB_ENGINE = os.environ.get("DB_ENGINE") or 'mysql'
DB_HOST = os.environ.get("DB_HOST") or '127.0.0.1'
DB_PORT = os.environ.get("DB_PORT") or 3306
DB_USER = os.environ.get("DB_USER") or 'jumpserver'
DB_PASSWORD = os.environ.get("DB_PASSWORD") or 'weakPassword'
DB_NAME = os.environ.get("DB_NAME") or 'jumpserver'
# Django ��ip��
HTTP_BIND_HOST = '0.0.0.0'
HTTP_LISTEN_PORT = 8080
# �� Redis ��, ��, ��config_old.bak

REDIS_HOST = os.environ.get("REDIS_HOST") or '127.0.0.1'
REDIS_PORT = os.environ.get("REDIS_PORT") or 6379
REDIS_PASSWORD = os.environ.get("REDIS_PASSWORD") or ''
REDIS_DB_CELERY = os.environ.get('REDIS_DB') or 3
REDIS_DB_CACHE = os.environ.get('REDIS_DB') or 4
def __init__(self):
pass
def __getattr__(self, item):

return None
(��)
(��)
class DevelopmentConfig(Config):
pass
class TestConfig(Config):
pass
class ProductionConfig(Config):
pass
# Default using Config settings, you can write if/else for different env
config = DevelopmentConfig()
$ pip install -r requirements/requirements.txt

$ cd utils
$ sh make_migrations.sh
# �� 1.1.0 ��

$ sh 2018_04_11_migrate_permissions.sh
# �� 1.4.0 ��, ��

$ sh 2018_07_15_set_win_protocol_to_ssh.sh
# �� jumpserver
$ cd ../
$ ./jms start -d
# �� 1.4.2 ��

$ vi /etc/nginx/conf.d/jumpserver.conf # ��/etc/nginx/nginx.conf
server {
listen 80;
location /luna/ {
}
location /media/ {
}
location /static/ {
(��)
2.4. �� 49
(��)
}
location /koko/ {
access_log off;
}
access_log off;
}
location /ws/ {
access_log off;
}
location / {
}
}
# ��
$ nginx -s reload
2.4.2 1.4.4 ��
��
• �� 1.4.4 ��, �� 1.4.4
• � 1.4.5 ��, �� migrations
• ��
Jumpserver
$ ./jms stop
# �� Jumpserver
$ cp -r /opt/jumpserver /opt/jumpserver_1.4.4_bak
$ git fetch
$ git checkout master
$ git pull
$ git clean -df # ��, ��
$ git reset --hard # ��, ��
$ git pull
# �� config.yml, �� config.yml ��

$ mv config.py config_1.4.4.bak
$ BOOTSTRAP_TOKEN=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 16` # �� BOOTSTRAP_
,→TOKEN

,→yml

$ vi config.yml

# �� SECRET_KEY ��, ��config_1.4.4.bak��
SECRET_KEY: *****

# ��Token koko�guacamole��, ��, ��
BOOTSTRAP_TOKEN: *****
,→disable it
DEBUG: false

# ��
LOG_LEVEL: ERROR
(��)
2.4. �� 51
(��)
# LOG_DIR:
# ��Session��, ��24��, ��

# ��
# SQLite setting:
# DB_NAME:

# ��Mysql��
DB_ENGINE: mysql
DB_HOST: 127.0.0.1
DB_PORT: 3306
DB_USER: jumpserver
DB_PASSWORD: *****
DB_NAME: jumpserver

# ��

# Redis��
REDIS_PORT: 6379
# REDIS_PASSWORD:
# REDIS_DB_CACHE: 4

# OTP settings
# OTP/MFA ��
$ pip install wheel

$ cd utils
$ vi 1.4.4_to_1.4.5_migrations.sh
#!/bin/bash
#
host=127.0.0.1 # �� Jumpserver ��IP

port=3306 # �� Jumpserver ��
username=root # ��
db=jumpserver # �� Jumpserver ��
echo "�� migrations"

mysqldump -u${username} -h${host} -P${port} -p ${db} django_migrations > django_
,→migrations.sql.bak
ret=$?
if [ ${ret} == "0" ];then

echo "��migrations��"
mysql -u${username} -h${host} -P${port} -p ${db} < django_migrations.sql
else
echo "Not valid"
fi
$ sh 1.4.4_to_1.4.5_migrations.sh
$ cd ../
$ ./jms start -d
server {
listen 80;
location /luna/ {
}
location /media/ {
}
location /static/ {
}
location /koko/ {
(��)
2.4. �� 53
(��)
access_log off;
}
access_log off;
}
location /ws/ {
access_log off;
}
location / {
}
}
# ��
$ nginx -s reload
Luna
��: �� release �
$ cd /opt
$ rm -rf luna luna.tar.gz
(��)
(��)
# ��
# ��
Koko
$ cd /opt
$ wget https://github.com/jumpserver/koko/releases/download/1.5.6/koko-master-linux-
,→amd64.tar.gz
# ��
$ wget https://demo.jumpserver.org/download/koko/1.5.6/koko-master-linux-amd64.tar.gz
$ tar xf koko-master-linux-amd64.tar.gz
$ chown -R root:root kokodir
$ cd kokodir
$ sed -i "s/BOOTSTRAP_TOKEN: <PleasgeChangeSameWithJumpserver>/BOOTSTRAP_TOKEN:
,→$BOOTSTRAP_TOKEN/g" /opt/kokodir/config.yml
$ sed -i "s/# LOG_LEVEL: INFO/LOG_LEVEL: ERROR/g" /opt/kokodir/config.yml

$ vim config.yml
$ ./koko # �� ./koko -d
docker �� koko
# �� Web �� - �� koko ��

$ docker rm jms_koko
$ docker pull wojiushixiaobai/jms_koko:1.5.6
$ docker run --name jms_koko -d -p 2222:2222 -p 5000:5000 -e CORE_HOST=http://
,→<Jumpserver_url> -e BOOTSTRAP_TOKEN=<Jumpserver_BOOTSTRAP_TOKEN> --restart=always␣
,→wojiushixiaobai/jms_koko:<Tag>
# <Jumpserver_url> � jumpserver � url ��, <Jumpserver_BOOTSTRAP_TOKEN> �� jumpserver/

,→config.yml ��, ��, <Tag> ��
# �: docker run --name jms_koko -d -p 2222:2222 -p 5000:5000 -e CORE_HOST=http://192.168.

,→244.144:8080 -e BOOTSTRAP_TOKEN=abcdefg1234 --restart=always wojiushixiaobai/jms_
,→koko:1.5.6
Guacamole
�� guacamole
$ /etc/init.d/guacd stop
$ sh /config/tomcat8/bin/shutdown.sh
$ cd /opt/docker-guacamole
$ git pull
(��)
2.4. �� 55
(��)
$ cd /config
$ rm -rf /config/tomcat8
# �� https://tomcat.apache.org/download-90.cgi �� tomcat9

$ wget http://mirrors.tuna.tsinghua.edu.cn/apache/tomcat/tomcat-9/v9.0.30/bin/apache-
,→tomcat-9.0.30.tar.gz
$ tar xf apache-tomcat-9.0.30.tar.gz
$ mv apache-tomcat-9.0.30 tomcat9
$ rm -rf /config/tomcat9/webapps/*
$ sed -i 's/Connector port="8080"/Connector port="8081"/g' /config/tomcat9/conf/server.
,→xml
$ echo "java.util.logging.ConsoleHandler.encoding = UTF-8" >> /config/tomcat9/conf/

,→logging.properties
$ ln -sf /opt/docker-guacamole/guacamole-1.0.0.war /config/tomcat9/webapps/ROOT.war

$ ln -sf /opt/docker-guacamole/guacamole-auth-jumpserver-1.0.0.jar /config/guacamole/
,→extensions/guacamole-auth-jumpserver-1.0.0.jar
$ ln -sf /opt/docker-guacamole/root/app/guacamole/guacamole.properties /config/guacamole/

,→guacamole.properties
$ wget https://github.com/ibuler/ssh-forward/releases/download/v0.0.5/linux-amd64.tar.gz
# ��
$ wget https://demo.jumpserver.org/download/ssh-forward/v0.0.5/linux-amd64.tar.gz
$ tar xf linux-amd64.tar.gz -C /bin/

$ chmod +x /bin/ssh-forward
# BOOTSTRAP_TOKEN �� jumpserver/config.yml ��

$ export BOOTSTRAP_TOKEN=*****
$ echo "export BOOTSTRAP_TOKEN=*****" >> ~/.bashrc
$ /etc/init.d/guacd start
$ sh /config/tomcat9/bin/startup.sh
docker �� guacamole
# �� Web �� - �� guacamole ��

$ docker rm jms_guacamole
$ docker pull wojiushixiaobai/jms_guacamole:1.5.6
$ docker run --name jms_guacamole -d -p 8081:8080 -e JUMPSERVER_SERVER=http://

,→wojiushixiaobai/jms_guacamole:<Tag>

# �: docker run --name jms_guacamole -d -p 8081:8080 -e JUMPSERVER_SERVER=http://192.168.

,→guacamole:1.5.6
� Web �� - ��
2.4.3 1.4.5-1.4.7 ��
��
• ��
Jumpserver
$ ./jms stop
$ git pull
# �� config.yml, �� config.bak ��

$ mv config.py config_1.4.5.bak
$ vi config.yml

# �� SECRET_KEY ��, ��config_1.4.5.bak��
SECRET_KEY: *****

# ��Token koko�guacamole��, ��, ��
BOOTSTRAP_TOKEN: *****
,→disable it
DEBUG: false

# ��
LOG_LEVEL: ERROR
# LOG_DIR:
# ��Session��, ��24��, ��

# ��
# SQLite setting:
# DB_NAME:

# ��Mysql��
(��)
2.4. �� 57
(��)
DB_ENGINE: mysql
DB_HOST: 127.0.0.1
DB_PORT: 3306
DB_USER: jumpserver
DB_PASSWORD: *****
DB_NAME: jumpserver

# ��

# Redis��
REDIS_PORT: 6379
# REDIS_PASSWORD:
# REDIS_DB_CACHE: 4

# OTP settings
# OTP/MFA ��
$ pip install wheel

$ ./jms start -d
server {
listen 80;
location /luna/ {
}
(��)
(��)
location /media/ {
}
location /static/ {
}
location /koko/ {
access_log off;
}
access_log off;
}
location /ws/ {
access_log off;
}
location / {
}
}
2.4. �� 59
# ��
$ nginx -s reload
Luna
$ cd /opt
# ��
# ��
Koko
$ cd /opt
,→amd64.tar.gz
# ��
$ cd kokodir

$ vim config.yml
$ ./koko # �� ./koko -d
docker �� koko
# �� Web �� - �� koko ��



,→koko:1.5.6
Guacamole
�� guacamole
$ git pull
$ cd /config

,→xml



# ��




,→wojiushixiaobai/jms_guacamole:1.5.6


,→guacamole:1.5.6
2.4. �� 61
� Web �� - ��
2.4.4 1.4.8-1.4.10 ��
Jumpserver
$ ./jms stop
$ git checkout master
$ git pull
$ pip install wheel
$ ./jms start -d
server {
listen 80;
location /luna/ {
}
location /media/ {
}
location /static/ {
}
location /koko/ {
access_log off;
}
(��)
(��)
access_log off;
}
location /ws/ {
access_log off;
}
location / {
}
}
# ��
$ nginx -s reload
Luna
$ cd /opt
# ��
# ��
Koko
$ cd /opt
,→amd64.tar.gz
(��)
2.4. �� 63
(��)
# ��
$ cd kokodir

$ vim config.yml
$ ./koko # �� ./koko -d
docker �� koko

# �� Web �� - �� koko ��


,→koko:1.5.6
Guacamole
�� guacamole
$ git pull
$ cd /config

,→xml


,→extensions/guacamole-auth-jumpserver-1.0.0.jar (��)
(��)
# ��




,→wojiushixiaobai/jms_guacamole:1.5.6


,→guacamole:1.5.6
� Web �� - ��
2.4.5 1.5.0 ��
Jumpserver
$ ./jms stop
$ git pull
$ pip install wheel
$ ./jms start -d
server {
(��)
2.4. �� 65
(��)
listen 80;
location /luna/ {
}
location /media/ {
}
location /static/ {
}
location /ws/ {
access_log off;
}
location /koko/ {
access_log off;
}
access_log off;
(��)
(��)
}
location / {
}
}
# ��
$ nginx -s reload
Luna
$ cd /opt
# ��
# ��
Koko
$ cd /opt
,→amd64.tar.gz
# ��
$ cd kokodir

$ vim config.yml
$ ./koko # �� ./koko -d
docker �� koko
# �� Web �� - �� koko ��

(��)
2.4. �� 67
(��)


,→koko:1.5.6
Guacamole
�� guacamole
$ git pull
$ cd /config

,→xml





,→wojiushixiaobai/jms_guacamole:<Tag>

(��)
(��)
,→guacamole:1.5.6
� Web �� - ��
2.5 ��
� Jumpserver ��, �� ”��” � ”jumpserver��” �� 1.4.5 ��, �� ”��” ”��” � ”��”
1. ��
# �� jumpserver ��
$ mysqldump -uroot -p jumpserver > /opt/jumpserver.sql
# � jumpserver.sql �� /opt ��
# �� Jumpserve �� /opt ��
2. �� (�� mysql-server ��)

$ yum -y install mariadb mariadb-devel mariadb-server MariaDB-shared

$ mysql -uroot
> create database jumpserver default charset 'utf8';
> grant all on jumpserver.* to 'jumpserver'@'127.0.0.1' identified by 'weakPassword';
> use jumpserver;
> source /opt/jumpserver.sql;
> quit
$ cd /opt
$ python3.6 -m venv py3
$ yum -y install $(cat rpm_requirements.txt)
$ pip install wheel
3. ��
$ vi config.yml
# �� redis ��, ��, �� redis ��
2.5. �� 69
4. �� jumpserver
$ ./jms start
5. ��
2.6 ��
• �� jms koko guacamole ��

• ��
• ��
• ��
1. ��
$ rm -rf /opt/jumpserver # jumpserver ��

$ rm -rf /opt/koko /opt/kokodir # koko ��
$ rm -rf /opt/docker-guacamole # guacamole ��
$ rm -rf /opt/py3 # python3 ��
$ rm -rf /config # guacamole client ��
$ rm -rf /etc/nginx/conf.d/jumpserver.conf
2. �� docker ��
$ rm -rf /opt/jumpserver # jumpserver ��

$ rm -rf /opt/py3 # python3 ��
$ rm -rf /etc/nginx/conf.d/jumpserver.conf
$ docker rmi wojiushixiaobai/jms_koko:1.5.6 # ��
$ docker rmi wojiushixiaobai/jms_guacamole:1.5.6 # ��
# ��
$ rm -rf /usr/lib/systemd/system/jms.service
$ rm -rf /opt/start_jms.sh
$ rm -rf /opt/stop_jms.sh
# ��
$ mysql -uroot
> drop database jumpserver;
> exit
# �� redis
$ redis-cli -h 127.0.0.1
> flushall
> exit
$ reboot # ��
��
• ��, ��
1. �� python3.6 mysql Redis
# ��, ��
2. �� py3 ��
$ python3.6 -m venv /opt/py3
3. �� py3 ��
# �� jumpserver �� py3 ��

# �� source: not found , �� "." �� "source"
$ . /opt/py3/bin/activate
# �� ~/.bashrc �� source /opt/py3/bin/activate
4. �� jumpserver ��
$ cd /opt
# �� git ��
# �� https://demo.jumpserver.org/download/jumpserver/ ��
5. ��
# ��, ��
# � Centos: yum install -y $(cat rpm_requirements.txt)
# � Ubuntu: apt-get install -y $(cat deb_requirements.txt)
$ pip install wheel

# �� py3 ��, ��, ��
6. ��
$ vim config.yml
# �� SECRET_KEY � BOOTSTRAP_TOKEN ��
7. �� jumpserver
$ ./jms start # �� -d �� ./jms start -d
# �� py3 ��, �� FAQ ��
8. �� koko ��
$ cd /opt
# �� https://github.com/jumpserver/koko/releases �� release �� /opt��
(��)
2.6. �� 71
(��)
,→amd64.tar.gz

$ cd kokodir
$ vim config.yml
# BOOTSTRAP_TOKEN �� jumpserver/config.yml ��, ��
$ ./koko # �� -d �� ./koko -d
8.1. docker �� koko ��
# �� koko, �� koko


# �: docker run --name jms_koko -d -p 2222:2222 -p 127.0.0.1:5000:5000 -e CORE_

,→HOST=http://192.168.244.144:8080 -e BOOTSTRAP_TOKEN=abcdefg1234 --restart=always␣
,→wojiushixiaobai/jms_koko:1.5.6
9. �� guacamole ��
# �� docker �� guacamole �� , ��
$ cd /opt
$ git clone --depth=1 https://github.com/jumpserver/docker-guacamole.git
$ tar xf guacamole-server-1.0.0.tar.gz
$ cd /opt/docker-guacamole/guacamole-server-1.0.0
# �� http://guacamole.apache.org/doc/gug/installing-guacamole.html ��
# Ubuntu: apt-get install -y libcairo2-dev libjpeg-turbo8-dev libpng12-dev libossp-uuid-

,→dev
# Ubuntu: apt-get install -y libavcodec-dev libavutil-dev libswscale-dev libfreerdp-dev␣

,→libpango1.0-dev libssh2-1-dev libtelnet-dev libvncserver-dev libpulse-dev libssl-dev␣
,→libvorbis-dev libwebp-dev
# ln -s /usr/local/lib/freerdp /usr/lib/x86_64-linux-gnu/freerdp
# Debian: apt-get install -y libcairo2-dev libjpeg62-turbo-dev libpng12-dev libossp-uuid-

,→dev
# Debian: apt-get install -y libavcodec-dev libavutil-dev libswscale-dev libfreerdp-dev␣

,→libpango1.0-dev libssh2-1-dev libtelnet-dev libvncserver-dev libpulse-dev libssl-dev␣
,→libvorbis-dev libwebp-dev
# ln -s /usr/local/lib/freerdp /usr/lib/x86_64-linux-gnu/freerdp
(��)
(��)
# yum -y localinstall --nogpgcheck https://mirrors.aliyun.com/rpmfusion/free/el/
,→rpmfusion-free-release-7.noarch.rpm https://mirrors.aliyun.com/rpmfusion/nonfree/el/
,→rpmfusion-nonfree-release-7.noarch.rpm
# Fedora/CentOS/RHEL: yum install -y cairo-devel libjpeg-turbo-devel libpng-devel uuid-

,→devel
# Fedora/CentOS/RHEL: yum install -y ffmpeg-devel freerdp1.2-devel pango-devel libssh2-

,→devel libtelnet-devel libvncserver-devel pulseaudio-libs-devel openssl-devel libvorbis-
,→devel libwebp-devel
# ln -s /usr/local/lib/freerdp /usr/lib64/freerdp
$ autoreconf -fi
$ ./configure --with-init-dir=/etc/init.d
$ make
$ make install
# �� jdk8 jre8

# Ubuntu: apt-get -y install default-jre default-jdk
# Centos: yum install -y java-1.8.0-openjdk

$ mkdir -p /config/guacamole /config/guacamole/extensions /config/guacamole/record
$ chown daemon:daemon /config/guacamole/record /config/guacamole/drive
$ cd /config
,→xml



# �� guacamole ��
$ export JUMPSERVER_SERVER=http://127.0.0.1:8080 # http://127.0.0.1:8080 � jumpserver ��
$ echo "export JUMPSERVER_SERVER=http://127.0.0.1:8080" >> ~/.bashrc
# BOOTSTRAP_TOKEN � Jumpserver/config.yml �� BOOTSTRAP_TOKEN �

$ export BOOTSTRAP_TOKEN=******
$ echo "export BOOTSTRAP_TOKEN=******" >> ~/.bashrc
$ export JUMPSERVER_KEY_DIR=/config/guacamole/keys
$ echo "export JUMPSERVER_KEY_DIR=/config/guacamole/keys" >> ~/.bashrc
$ export GUACAMOLE_HOME=/config/guacamole
$ echo "export GUACAMOLE_HOME=/config/guacamole" >> ~/.bashrc
(��)
2.6. �� 73
(��)
$ export GUACAMOLE_LOG_LEVEL=ERROR
$ echo "export GUACAMOLE_LOG_LEVEL=ERROR" >> ~/.bashrc
$ export JUMPSERVER_ENABLE_DRIVE=true
$ echo "export JUMPSERVER_ENABLE_DRIVE=true" >> ~/.bashrc
9.1 docker �� guacamole ��

,→<Jumpserver_url> -e BOOTSTRAP_TOKEN=<Jumpserver_BOOTSTRAP_TOKEN> wojiushixiaobai/jms_
,→guacamole:<Tag>

# �: docker run --name jms_guacamole -d -p 127.0.0.1:8081:8080 -e JUMPSERVER_

,→SERVER=http://192.168.244.144:8080 -e BOOTSTRAP_TOKEN=abcdefg1234 wojiushixiaobai/jms_
,→guacamole:1.5.6
10. �� luna ��
$ cd /opt
# �� https://github.com/jumpserver/luna/releases ��
11. �� nginx ��
# �� http://nginx.org/en/linux_packages.html �� nginx
$ vim /etc/nginx/conf.d/jumpserver.conf
server {
listen 80;
location /luna/ {
}
location /media/ {
}
location /static/ {
(��)
(��)
}
location /koko/ {
access_log off;
}
access_log off;
}
location /ws/ {
}
location / {
}
}
$ nginx -t
$ nginx -s reload
2.6. �� 75
# ��
# ��, �� jumpserver �� nginx �� 80 ��, ��8080��
# ��: admin ��: admin
�� FAQ
CHAPTER 3
��
��
3.1 ��
3.1.1 ��
• � Jumpserver ��-�� koko Guacamole ��, �� FAQ ��
3.1.2 ��
1.1 ��
# �� url �"localhost"�� url ��, ��"localhost" ��
77
1.2 ��
# ��"��", ��
# �� 25 ��, �� SSL � TLS; �� SSL, �� 465; �� TLS, �� 587
# �� SSL � TLS
# ��, ��"��"��, ��, Jumpserver �� SMTP ��, ��
1.3 LDAP��
# ��"ldap"�� jumpserver, ��, ��

# �"��"��
# DN � OU ��(� "DN:cn=Manage,ou=Jumpserver,dc=jumpserver,ou=org")
# �� gui �� ldap ��, ��, �cn=��
3.1. �� 79
�� LDAP ��
1.4 ��
# "��"�"��"� SSH ��(�� SSH ��, �� web ��)

# "Telnet��" telnet��
# "��""��"��
# "��""��"��, ��Jumpserver ��-�� terminal�� , �� Jumpserver ��

# �� koko ��
3.1. �� 81
1.5 ��
# "MAF��"��"MFA", �� jumpserver ��(��)

# "��"�"��"�� jumpserver ��
# "SSH��"�� koko ��
# "��"��
3.1.3 ��
# ��"��"��"��", ��
# ��"��"��, ��, (��)
# ��, �� Jumpserver ��(��, ��)��(��)
# ��, Jumpserver ��"��"��
# ��, ��, �� Jumpserver ��
# �� Jumpserver, ��, ��
��MFA � Google Authenticator, ��APP��
3.1. �� 83
3.1.4 ��
3.1 ��
# "��"��, ��, ��

�� linux �� windows ��, �� Linux �� Windows ��, ��"��"��
3.2 ��
# "��"�� root, �� NOPASSWD: ALL sudo ��, Jumpserver ��

# "��"�� Jumpserver ��, ��(��, ��)
# "��" ��
# "ssh��" ��, ��key��, �� RSA DSA ��
3.1. �� 85
3.3 ��
# "��"� Jumpserver ��, ��(��, ��)

# "��"�"��"�"Sudo"��"��"��, ��
# ssh �� "Sudo" �� sudo ��,
# ssh ��"��"��, "��"��"home"��(�: ��700��)
# ssh �� "ssh��" ��, ��key��, �� RSA DSA ��
# �� telnet � vnc ��
# �� "sudo" ��

Sudo /bin/su # ��sudo��sudo su��
Sudo /usr/bin/git, /usr/bin/php, /bin/cat, /bin/more, /bin/less, /usr/bin/tail

# ��sudo��git php cat more less tail
Sudo !/usr/bin/yum # ��sudo yum��
# ��, ��
# "��"��, ��"��" Jumpserver ��"Ansible"��, "root"��

# ��"Ansible", ��"��"�"��"��, �� Windows ��
# ��, ��"��"
Windows �� windows-ssh-setup
3.4 ��
��, ��, �� ssh � telnet ��
3.1. �� 87
# "��"��"��"��"��"
# �"��"��"��"��
# �� "��" �� "��" ��
# �� "��" �� "��" , ��

# �� .*
3.5 ��
��, ��, ��SSH�RDP�VNC
# "��"��, ��
# ��"��"��, ��
# ��"��"��, ��, ��
��
3.1. �� 89
# ��"��"��, ��"��"��
# ��"��"��, ��"��"��, ��, ��
# IP��IP��(��IP��, ��jumpserer��IP��)
�� ssh ��
�: ��"��", ��"��"��
�: "Windows��"��"ssh��"
3.6 ��
# ��"��"��"��"��, ��
# ��"��"��, ��, ��
# IP ��, ��"��"�� IP ��
# �� IP ��, ��, Jumpserver �� IP ��
3.1. �� 91
# ��, ssh ��"��"��, ��

��"python"��, ��2.6, Ubuntu��root��ssh��, ��
# ��, ��"��"��"��"�� SSH � Jumpserver ��
3.1.5 ��
4.1 ��
# "��", ��, ��

# "��"�"��"��, ��
# "��"�"��"��, ��
# "��", ��
# ��(�), ��(��), ��, �� Linux�Windows ��, �� Linux �� Windows ��
��, ��, ��, ��
3.1.6 ��
# ��"��", ��, ��
3.1. �� 93
5.2 ��
# �� "��" ��

# �� "Web��"
# �� "��" ��, ��

# ��, �� FAQ ��
5.3 ��
# �� "Server" ��, ��, ��
5.4 ��
# �� "��"
# ��, �� SSH ��
# �� sftp ��
3.1. �� 95
�� Jumpserver ��, Jumpserver ��, ��, ��”��”��
3.2 ��
3.2.1 ��
1.1 ��
��”��”��”��”, ��
��”��”��, ��, ��, ��, ��

��, �� Jumpserver ��, ��, ��
��, Jumpserver ��”��”��
3.2. �� 97
��, ��, �� Jumpserver ��
3.2.2 ��
2.1 ��
��, ��, ��, ��, ��, ��
��”��”��”��”, ��
��”��”��, ��
��, ��, ��
3.3 ��
3.3.1 ��
1.1 ��
��, ��, ��
3.3. �� 99
1.2 ��
��, ��, ��

3.3.2 ��
��
2.1 ��
2.2 ��
��, ��
3.3. �� 101

2.3 ��
2.4 ��
��, ��, ��, �� ssh ��

3.3.3 ��
��root�� NOPASSWD: ALL sudo�� Jumpserver�� Windows �� administrators ��
3.1 ��
3.3. �� 103

3.2 ��

3.3.4 ��
�� Jumpserver�� web, sa, dba(ssh web@some-host), ��(ssh xiaoming@some-

host); �� Jumpserver, Jumpserver�� Jumpserver �� ansible ��ansible,
��: user@domain.com��
4.1 ��
4.2 ��
3.3. �� 105

3.3.5 ��
��, ��, ��, ��1-��1-��

5.1 ��
5.2 ��
��”��”��, ��
3.3. �� 107

��, ��, ��
3.3.6 ��
�� , �� , ��, �� , ��

6.1 ��
6.2 ��
��

6.3 ��
��
6.4 ��
3.3. �� 109

��, ��
3.4 ��
3.4.1 ��
��, �� ”��” ��, ��

1.1 ��

1.2 ��
��, ��, ��
��, ��, ��
��, ��
��, ��, ��, �� Linux�Windows ��, �� Linux �� Windows ��
��, �� (��, ��, ��)
3.4. �� 111

3.5 ��
3.5.1 ��
1.1 ��
��”��”��”��”��, ��, ��7��
��
��
��
�� IP ��
�� IP ��, �� koko�
��: ��
��: ��
��

��, ��, ��

1.2 ��
��
��”��”��
3.5.2 ��
2.1 ��
��, �� IP ��
3.5. �� 113

2.2 ��
Jumpserver ��”��”��, ��
3.5.3 ��
��, ��, ��

��”��”��, ��, ��, ��
3.5.4 ��Web ��
Web ��, ��, ��, ��”Server”��”Disconnect”��
3.5. �� 115

3.5.5 ��
�� SSH ��(��), ��

3.5.6 ��
�� Jumpserver ��, ��koko�Gua ��, �� Jumpserver ��, � Jumpserver ��
3.6 ��
3.6.1 ��
�� Jumpserver ��, ��, ��7��
3.6. �� 117

��
3.6.2 ��
��, �� ansible ��, ��

3.7 ��
��
3.7. �� 119

��FTP��
��

��
��
3.7. �� 121

3.8 ��
�� ”��” ��, ��, ��LDAP ��
3.8.1 ��
�� ”��” ��, ��, �� URL�� URL�Email ��, ��”��”��, ��

3.8.2 ��
�� ”��” ��, ��
3.8. �� 123

3.8.3 ��LDAP ��
��” LDAP ��” ��, �� LDAP ��, �� LDAP ��DN�� OU��LDAP �� SSL�� LDAP ��, ��”��”��, ��,
��”��”��, �� LDAP ��
�� ldapsearch��, ��, ��
# �� testuser��ldap server��, �� %(user)s

ldapsearch -x -W -H ldap://127.0.0.1:389 -b "ou=People,dc=xxx,dc=com" -D "cn=admin,
,→dc=xxx,dc=com" "(cn=testuser)"
ldapsearch -x -W -H ldap://127.0.0.1:389 -b "dc=xxx,dc=com" -D "cn=admin,dc=xxx,dc=com"

,→"(&(cn=testuser)(objectClass=account))"
# extended LDIF
#
# LDAPv3
# base <ou=People,dc=xxx,dc=com> with scope subtree
# filter: (cn=*)
# requesting: ALL
#
# testuser, People, xxx.com

dn: uid=testuser,ou=People,dc=xxx,dc=com
uid: testuser # ��jumpserver username
cn: testuser # ��jumpserver name
mail: xyz@google.coom # ��jumpserver email
objectClass: account
objectClass: posixAccount
objectClass: top
(��)

(��)
objectClass: shadowAccount
...
�� ”FAQ��” � LDAP �� <faq_ldap.html>
3.8.4 ��
�� ”��” ��, ��, ��, ��”��”��, ��

��, �� IP ��, �� koko � Gua �� Jumpserver ��, �� Jumpserver ��(1��)�� koko � Gua ��,
Jumpserver ��”��”, �”��”��”��”��
3.8. �� 125

��
�� ”��” ��, ��

3.8. �� 127


CHAPTER 4
��
4.1 ��
��, ��
129
4.2 ��
��, �� ansible ��, ��
# ��, ��, ��, ��

# �� shell ��, �: sudo ifconfig
4.3 ��
��, ��

4.4 Web��
�� web ��
4.4. Web�� 131

�� Jumpserver �, ��

$ ssh -p 2222 ��@Jumpserver IP��
4.5 ��
��, �� ( �� /tmp ), ��, �� ssh ��
• Windows �� Windows ��, �� - G�, �� G ��, �� Ctrl + alt + shift

4.5. �� 133


CHAPTER 5
��
5.1 REST API��
�� REST API ��

RESTful API ��
Github API ��
5.1.1 ��
API ��, �� HTTPS ��
5.1.2 ��
�� API ��, ��, �� APP, ��
https://example.org/api/
5.1.3 ��
� API �� URL �, �� APP �� Jumpserver ��, �� APP ��
https://example.com/api/:app:/:version:/:resource:
https://example.com/api/assets/v1.0/assets [GET, POST]
https://example.com/api/assets/v1.0/assets/1 [GET, PUT, DELETE]
135
5.1.4 ��
��”��”(endpoint), �� API �� RESTful ��, ��(Resource), ��, ��, ��,

��”��”(Collection), �� API �� Cmdb �� Assets ��, IDC ��
https://example.com/api/:app:/:version:/:resource:
https://example.com/api/assets/v1.0/assets [GET, POST]

https://example.com/api/assets/v1.0/assets/1 [GET, PUT, DELETE]
https://example.com/api/assets/v1.0/idcs [GET, POST]
��(CRUD)API, �� HTTP Method �� URL ��, URL ��(��), ��API�� ID, ��, GET ��
URL Parameter(��”?client_id=xxxxx&app_id=xxxxxx”), PUT/POST/DELETE ��
5.1.5 HTTP Method
��, � HTTP ��

��HTTP��(�� SQL ��)�
• GET(SELECT)��(��)�
• POST(CREATE)��
• PUT(UPDATE)��(��, ��
• PATCH(UPDATE)��(��)�
• DELETE(DELETE)��
5.1.6 ��
��
?keyword=localhost ��
?limit=10��
?offset=10��
?page=2&per_page=100��, ��
?sort=name&order=asc��, ��
?asset_id=1��
5.1.7 ��
��, ��(��HTTP��)�
• 200 OK - [GET]��, ��(Idempotent)�
• 201 CREATED - [POST/PUT/PATCH]��
• 202 Accepted - [*]��(��)
• 204 NO CONTENT - [DELETE]��
• 400 INVALID REQUEST - [POST/PUT/PATCH]��, ��, ��
• 401 Unauthorized - [*]��(��)�
• 403 Forbidden - [*] ��(�401��), ��

• 404 NOT FOUND - [*]��, ��, ��

• 406 Not Acceptable - [GET]��(��JSON��, ��XML��)�
• 410 Gone -[GET]��, ��
• 422 Unprocesable entity - [POST/PUT/PATCH] ��, ��
• 500 INTERNAL SERVER ERROR - [*]��, ��
5.1.8 ��
��4xx, ��, �� error ��, ��
{
error: "Invalid API key"
}
5.1.9 ��
��, ��
GET /collection��(��)
GET /collection/resource��
POST /collection��
PUT /collection/resource��
PATCH /collection/resource��
DELETE /collection/resource��
5.1.10 Hypermedia API
RESTful API �� Hypermedia, ��, �� API ��, ��, �� , �� api.example.com ��, ��
{"link": {
"rel": "collection https://www.example.com/zoos",
"href": "https://api.example.com/zoos",
"title": "List of zoos",
"type": "application/vnd.yourformat+json"
}}
��, �� Link ��, �� API ��

• rel �� API ��(Collection ��, �� Collection ��)
• href �� API ��
• title �� API ��
• type ��
Hypermedia API �� HATEOAS� Github API ��.
5.1. REST API�� 137

5.1.11 ��
(1)API �� OAuth 2.0 ��

(2)��, �� JSON�
5.2 Jumpserver ��(Draft)
5.2.1 ��
1. Python 3.6.1
2. Django 2.1
3. Flask 1.0.2 Luna
4. Paramiko 2.4.1 Coco
5.2.2 Django ��
1. �� Class Base View ��, ��

2. �� Django Form
3. �� URL ��, ��, �� Static ��
4. ��, ��
5. ��
6. ��
7. ��
8. �� Django ��
5.2.3 ��
Python ��, �� pocoo �Style Guidance, ��
��
��
1. Python ��4��, �� Python ��

2. Web ��(HTML�CSS�JavaScript), Node.js ��2��, �� TAB� �� Python ��, �� JS ��, 2��
��
� PEP8 ��, Python ��79��, �� Django ��, URL ��, ��21��, ��120��
��HTML ��

��
��, ��””��, ��”.”��”=”��, ��4��
this_is_a_very_long(function_call, 'with many parameters') \

.that_returns_an_object_with_an_attribute
MyModel.query.filter(MyModel.scalar > 120) \

.order_by(MyModel.name.desc()) \
.limit(10)
��”()”��”{}”��, ��
this_is_a_very_long(function_call, 'with many parameters',

23, 42, 'and even more')
��, ��”[”�”(”��
items = [
'this is the first', 'set of items', 'with more items',
'to come in this line', 'like this'
]
��
��, ��
def hello(name):
print 'Hello %s!' % name
def goodbye(name):
print 'See you %s.' % name
class MyClass(object):
"""This is a simple docstring."""
def __init__(self, name):

self.name = name
def get_annoying_name(self):
return self.name.upper() + '!!!!111'
��
��
1. ��(��, -, ~�), ��

2. ��
5.2. Jumpserver ��(Draft) 139

exp = -1.05
value = (item_value / item_count) * offset / exp
value = my_list[index]
value = my_dict['key']
��
1. ��, ��”==”�”!=”�
2. ��(singletons)��, �� is � is not�
3. ��True�False��(��, ��foo == False, ��not foo)�
��
�� foo not in bar, �� not foo in bar�
��
1. ��(CamelCase), ��(HTTPWriter, �� HttpWriter)�

2. ��_��_��(lowercase_with_underscores)�
3. ��_��_��(lowercase_with_underscores)�
4. ��_��_��(UPPERCASE_WITH_UNDERSCORES)�
5. ��name_re�
6. ��(mixin classes)��
7. ��(keywords)��, ��(trailing underscore)� ��, ��, ��
8. ��, ��, �� (�� for i in)
9. ��, ��
��
1. ��cls ��
2. ��self ��
3. property��(lambdas)�, �� x ��, ��display_name = property(lambda x: x.real_name or
x.username)�
��(Docstring, ��, ��)
�� reStructuredText ��, �� Sphinx ��, �� , �� , ��,
�� (��, ��)

def foo():
"""This is a simple docstring."""
def bar():
"""This is a longer docstring with so much information in there
that it spans three lines. In this case, the closing triple quote
is on its own line.
"""
��(��)��, ��
��
�� utf-8 ��(�� ASCII ��, ��), ��
# -*- coding: utf-8 -*-

"""
package.module
~~~~~~~~~~~~~~
A brief description goes here.
:copyright: (c) YEAR by AUTHOR.

:license: LICENSE_NAME, see LICENSE_FILE for more details.
"""
��(Comment)
�� reStructuredText �� , ��#��”:”� (��, ��)
class User(object):
#: the name of the user as unicode string
name = Column(String)
#: the sha1 hash of the password + inline salt
pw_hash = Column(String)
5.3 ��
��(��)�
.
�� config-example.py // ��
�� docs // �� DOC ��
� �� README.md
�� LICENSE
�� README.md
�� install // ��
�� logs // ��
(��)
5.3. �� 141

(��)
�� apps // ��, �� APP ��
� �� assets // APP ��
� � �� admin.py
� � �� apps.py // �� Django APP ��
� � �� api.py // API ��
� � �� __init__.py // ��, ��, �� APP ��
� � �� migrations // Models Migrations ��
� � � �� __init__.py
� � �� models.py // ��
� � �� static // APP ��, ��
� � � �� assets // ��, ��
� � � �� some_image.png
� � �� templates // APP ��
� � � �� assets // ��, ��
� � � �� asset_list.html
� � �� templatetags // ��
� � �� tests.py // ��
� � �� urls.py // Urlconf ��
� � �� utils.py // � Views � API ��, API � Views ��
� � �� views.py // Views ��
� �� common
� � �� templatetags // �� Template Tag
� � �� utils.py // ��
� � �� views.py
� �� fixtures // ��
� � �� init.json // ��
� � �� fake.json // ��
� �� jumpserver // ��
� � �� __init__.py
� � �� settings.py // ��
� � �� urls.py // �� Urlconf
� � �� wsgi.py
� �� manage.py
� �� static // ��
� �� i18n // ��
� �� templates // ��
5.4 API ��
Jumpserver Api ��:

• Session ��session_id��
• Token ��Token��Token��, ��
• Private Token ��Token
• Access Key�� Http Header��
5.4.1 Session
��cookie�� sessionid, ��sessionid�� cookie�

5.4.2 Token
�� Api��token��MFA��
$ curl -X POST http://localhost/api/v1/authentication/auth/ -H 'Content-Type:␣

,→application/json' -d '{"username": "admin", "password": "admin"}' # ��token
{"token":"937b38011acf499eb474e2fecb424ab3"} # ��token
$ curl -H 'Authorization: Bearer 937b38011acf499eb474e2fecb424ab3' -H "Content-

,→Type:application/json" http://localhost/api/v1/users/users/
# ��token��, token�� 1��
5.4.3 Private Token
��Private token��
$ python manage.py shell
>>> from users.models import User
>>> u = User.objects.get(username='admin')
>>> u.create_private_token()
937b38011acf499eb474e2fecb424ab3
# ��, �� private_token, ��

>>> u.private_token
<PrivateToken: 937b38011acf499eb474e2fecb424ab3>
# 937b38011acf499eb474e2fecb424ab3 ��
$ curl -H 'Authorization: Token 937b38011acf499eb474e2fecb424ab3' -H "Content-

,→Type:application/json" http://localhost/api/v1/users/users/
5.4.4 Access Key ��
Access key �� IETF ��

��
1. �� access key, key�ID(keyId)��(keySecret), ��key��
2. �� (��)�� keyId ��header��: �
Authorization: Signature keyId="Test",algorithm="rsa-sha256",

signature="jKyvPcxB4JbmYY4mByyBY7cZfNl4OW9HpFQlG7N4YcJPteKTu4MW
CLyk+gIr0wDgqtLWf9NLpMAMimdfsH7FSWGfbMFSrsVTHNTk0rK3usrfFnti1dx
sM4jl0kYJCKTGI/UWkqiaxwNiKqGcdlEDrTcUhhsFsOIo8VhddmZTZ8w="
3. �� keyId��keySecret, ��

python ��requests��:
$ pip install requests drf-httpsig

$ python
5.4. API �� 143

import requests
from httpsig.requests_auth import HTTPSignatureAuth
KEY_ID = 'su-key'
SECRET = 'my secret string'
signature_headers = ['(request-target)', 'accept', 'date', 'host']

headers = {
'Accept': 'application/json',
'Date': "Mon, 17 Feb 2014 06:11:05 GMT"
}
auth = HTTPSignatureAuth(key_id=KEY_ID, secret=SECRET,

algorithm='hmac-sha256',
headers=signature_headers)
req = requests.get('http://localhost/api/v1/users/users/',
auth=auth, headers=headers)
print(req.content)
5.4.5 ��
import requests
import json
from pprint import pprint
def get_token():
url = 'https://demo.jumpserver.org/api/v1/authentication/auth/'
query_args = {
"username": "admin",
"password": "admin"
}
response = requests.post(url, data=query_args)
return json.loads(response.text)['token']
def get_user_info():
url = 'https://demo.jumpserver.org/api/v1/users/users/'
token = get_token()
header_info = { "Authorization": 'Bearer ' + token }
response = requests.get(url, headers=header_info)
pprint(json.loads(response.text))
get_user_info()

5.5 API ��
5.5.1 Api ��
http://HOST:PORT/api/{VERSION}/{APP}/{RESOURCE}/ http://HOST:PORT/
api/{VERSION}/{APP}/{RESOURCE}/{RESOURCEID}/
�:
• ��
http://localhost/api/v1/assets/assets/
• ��
http://localhost/api/v1/assets/assets/2c56fd37-db65-40ed-b787-b65a98635f12/
5.5.2 Api ��
�� http://Jumpserver�URL��/docs ��(� http://192.168.244.144/docs)

�� debug ��
$ vi jumpserver/config.yml
...
DEBUG: true
5.5. API �� 145


CHAPTER 6
��
�� Jumpserver ��, ��, ��

• halcyon <��> DevOps ��, 0.3.2 ��
• jiaxiangkong <��> Jumpserver ��
• liuz <��> �� Web Terminal ��
• yumaojun03 <��> DevOps ��, �� Python�Go �� PaaS ��
• kelianchun <��> DevOps ��, �� Bugs
• �� <��> Django ��, ��
• sofia <��> ��, ��
• q4speed <��> ��, �� Windows ��
• ZhangFengyi <��> ��
• Aaron3S <��> ��
• liqiang-fit2cloud <��> ��, ��
• wojiushixiaobai <��> ��, ��bug, ��
147

CHAPTER 7
��
7.1 ��
��:
7.2 QQ �
�1: 390139816 (�)

�2: 399218702 (�)
�3: 552054376 (�)
�4: 794442067 (�)
�5: 773866691 (�)
7.3 Github
https://github.com/jumpserver/jumpserver.git
7.4 ��
http://www.jumpserver.org
7.5 Demo
https://demo.jumpserver.org
149
7.6 ��
support@fit2cloud.com

CHAPTER 8
Snapshot ��
8.1 ��
151
8.2 ��
8.3 ��
152 Chapter 8. Snapshot ��

8.4 Linux ��
8.5 Windows ��
8.4. Linux �� 153

154 Chapter 8. Snapshot ��

CHAPTER 9
FAQ
9.1 MFA ��
Multi-Factor Authentication (MFA) �� (TOTP) �� (RFC 6238)
# ��, ��
# �� Google Authenticator, ��
# �� (� Microsoft Authenticator �� )
MFA��
# ��MFA, ��.
# ��, �� users_user �� mfa_level � 0, ��
$ mysql -uroot
> use jumpserver;
> update users_user set mfa_level='0' where username='admin'; # admin ��
# �� MFA ��, �� settings � SECURITY_MFA_AUTH � value �� false

mysql -uroot
> use jumpserver;
> update settings_setting set value='false' where name='SECURITY_MFA_AUTH';
9.2 LDAP ��
• LDAP �� LADP � Windows AD �� jumpserver ��

• �� LDAP ��, ��
1. LDAP ��
155
LDAP�� ldap://serverurl:389 �� ldaps://serverurl:636(��ssl)

# ��LDAP��,��IP, ��
��DN cn=administrator,cn=Users,dc=jumpserver,dc=org
# ��, jumpserver��ldap��
�� # ��
��OU ou=jumpserver,dc=jumpserver,dc=org
# ��jumpserver��, ��ou��jumpserver
# �OU�� ou=jumpserver,dc=jumpserver,dc=org | ou=user,dc=jumpserver,dc=org | ou=xxx,
,→dc=jumpserver,dc=org
�� (cn=%(user)s)
# ��ldap��, ��
LADP�� {"username": "cn", "name": "sn", "email": "mail"}

username name email �jumpserver��(��)
cn sn mail �ldap��(��)
# ��, �ldap��jumpserver�
��SSL
# �� LDAP�� ldaps://serverurl:636
��LDAP��
# �� LDAP�� jumpserver,��
2. ��
DN ��DN, ��OU, ��

��cn=admin,ou=aaa,dc=jumpserver,dc=org,��cn=admin,ou=aaa,dc=jumpserver,dc=org ��cn=admin,
,→dc=jumpserver,dc=org
��OU ��OU��OU, ��OU

��ou=aaa,ou=bbb,ou=ccc,dc=jumpserver,dc=org,��ou=ccc,dc=jumpserver,dc=org,��
�� , ��OU��, ��

��(uid=%(user)s) � (sAMAccountName=%(user)s) �, ��
LADP�� username name email ��, ��, ��

��{"username": "uid", "name": "sn", "email": "mail"} � {"username": "sAMAccountName",
,→"name": "cn", "email": "mail"}
"username": "uid" �� uid �� (uid=%(user)s) �� uid ��

��(sAMAccountName=%(user)s) ��{"username": "sAMAccountName",
username � jumpserver ��, name � jumpserver ��, mail � jumpserver ��
��ldap��jumpserver��, �ldap��jumpserver��, �ldap��jumpserver��
9.3 Docker ��
1. ��
156 Chapter 9. FAQ

$ docker images
2. ��
$ docker ps -a
3. ��
$ docker ps
4. ��
$ docker exec -it <�� CONTAINER ID �� NAMES > /bin/bash
# �:
$ docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS ␣
,→PORTS NAMES
ecda634206af jumpserver/guacamole:test "/init" 12 days ago Up 3 days 0.0.
,→0.0:8081->8080/tcp jms_guacamole
$ docker exec -it ecda634206af /bin/bash � docker exec -it jms_guacamole /bin/bash
# �� /bin/bash �� /bin/sh �: docker exec -it jms_koko /bin/sh
5. ��
$ docker start <�� CONTAINER ID �� NAMES >

$ docker stop <�� CONTAINER ID �� NAMES >
$ docker restart <�� CONTAINER ID �� NAMES >
# �:
$ docker ps
,→PORTS NAMES
$ docker start ecda634206af � docker start jms_guacamole

$ docker stop ecda634206af � docker stop jms_guacamole
$ docker restart ecda634206af � docker restart jms_guacamole
6. �� log
$ docker logs -f <�� CONTAINER ID �� NAMES >
# �:
$ docker ps
,→PORTS NAMES
$ docker logs -f ecda634206af � docker logs -f jms_guacamole
7. ��
9.3. Docker �� 157

$ docker rm <�� CONTAINER ID �� NAMES >
# �:
$ docker ps
,→PORTS NAMES
$ docker rm ecda634206af � docker rm jms_guacamole
8. ��
$ docker rmi <�� CONTAINER ID>
# �:
$ docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
jumpserver/guacamole test e0c2ec53a8fd 13 days ago 1.23GB
$ docker rmi e0c2ec53a8fd
9. ��
$ docker pull <��:��>
# �:
$ docker pull wojiushixiaobai/jms_all:latest
9.4 Radius ��
�� Radius �� jumpserver ��

1. �� Jumpserver �� Radius ��
$ vi /opt/jumpserver/config.yml
# ��
AUTH_RADIUS: True
RADIUS_SERVER: 127.0.0.1
RADIUS_PORT: 1812
RADIUS_SECRET: radius_secret
# ��, �� jumpserver ��
2. ��
# RADIUS_SERVER: 127.0.0.1 � Radius ��IP��
# RADIUS_PORT: 1812 � Radius ��
# RADIUS_SECRET: radius_secret � Radius ��
(��)
158 Chapter 9. FAQ

(��)
# freeradius � SECRET � clients.conf ��
# �� SECRET �� web �� RADIUS Authentication Settings �� Shared Secret ��
# �� SECRET �� web �� Authentication Options �� Shared Secret ��
# ��
# ��
AUTH_RADIUS: True
RADIUS_SERVER: 47.98.186.18
RADIUS_PORT: 1812
RADIUS_SECRET: testing123
9.5 Jms_core ��
• Jms_core �� https://github.com/jumpserver/jumpserver ��
• Jms_core �� /opt/jumpserver
��
1. Jms_core ��
- �� ModuleNotFoundError: No module named 'daemon'

- �� redis.exceptions.ConnectionError: Error 111 connecting to 127.0.0.1:6379. Connection␣

,→refused
# �� redis ��
- �� django.db.utils.OperationalError: (2006, "Can't connect to MySQL server on '127.0.0.1

,→' (115)")
# ��
- �� xxxx is running: 0
$ ./jms stop
$ rm -rf tmp/*.pid
$ ps aux | grep python3 # ��, ��, �� kill �
$ ./jms start -d
- config.yml ��
# ��: ��, ��, ��
# SECRET_KEY: 5RLbBjm8AkMSvnft... # ��: ��, ��
# BOOTSTRAP_TOKEN: ihR4WG4gRShCnpQL... # ��: ��, ��
# DB_PASSWORD: '123456' # ��
# DB_PASSWORD: cPzxaiUAtA5IkdT2... # ��
# REDIS_PASSWORD: '888888' # ��
# REDIS_PASSWORD: Ma5bzA3gVK5oY17l... # ��
2. Web ��
9.5. Jms_core �� 159

# ��, �� 8080 �� Web ��, �� nginx ��, �� 80 ��
# �� IE ��
# ��, �� jumpserver/logs/ �� log, ��
3. Web ��
# �� admin
# ��, ��
- ��, �� smtp, ��, ��

$ python manage.py changepassword <user_name>
- ��
$ python manage.py createsuperuser --username=user --email=user@domain.com
- ��, ��; ��, ��

> from users.models import User
> u = User.objects.get(username='admin') # admin ��
> u.reset_password('password') # password ��
> u.save()
- �� LDAP ��, �� ldap ��, �� LDAP

$ mysql -uroot
$ use jumpserver;
$ update settings_setting set value='false' where name='AUTH_LDAP';
- �� OpenID �� Radius ��, �� config.yml ��

$ vim config.yam
- ��
$ cd /opt/jumpserver/utils
$ sh unblock_all_user.sh
# �� unblock_all_user.sh ��
>>> from django.core.cache import cache
>>> cache.delete_pattern('_LOGIN_BLOCK_*')
>>> cache.delete_pattern('_LOGIN_LIMIT_*')
>>> exit()
4. ��
- �� jumpserver ��, ��, ��, linux �� NOPASSWD: ALL ��, Windows ��␣
,→Administrators ��, telnet �� vnc ��
(��)
160 Chapter 9. FAQ

(��)
# ��
- �� jumpserver ��, jumpserver ��, ��, ��, ��

# �� jumpserver � ��
- �� ...........
$ ./jms stop
$ ps aux | grep python3 # �� kill �
$ ./jms start -d
- �� Permission denied �� Authentication failure

# ��
- �� /usr/bin/python: not found

# �� python �� python ��, �� ubuntu ��
- ��
# ��, ��, ��
- �� timeout
.. code-block:: vim
# �� ok, �� web �� timeout, �� /etc/ssh/sshd_config � usedns � no
$ vim /etc/ssh/sshd_config
...
# UseDNS no
UseDNS no
...
# ��, �� ssh ��, ��web��
# �� , ��
# ��, ��, ��, �� koko/config.yml � ��

$ vim koko/config.yml
...
# REUSE_CONNECTION: true
REUSE_CONNECTION: false
...
5. Telnet ��
- telnet ��
# �� Web "��"-"��" ��
# � �� "tenlet" �� telnet�� "��" ��
(��)
9.5. Jms_core �� 161

(��)
- ��
$ telnet 172.16.0.1
Login authentication
login: admin
password: *********
Info: The max number or VTY users is 10, and the number
of current VTY users on line is 1.
<RA-L7-RD>
# � <RA-L7-RD> �� Web "��"-"��"-"Telnet ��" ��, �� | ��, � <RA-L7-RD>|<CHXZ-Group-

,→S7503-LB2>|success|��
# <RA-L7-RD> �� <.*> �� <RA-.*>
# RW-F1-1 �� RW-.*
# ��, ��1�|��2�|��3�|��4�|success|��
# RW-1F-1|RW-2F-1|RW-3F-1|success|��
# <RA-L7-RD>|<RA-L6-RD>|<RA-L5-RD>|success|��
# <.*>|.*>|success|��
9.6 Jms_koko ��
• Jms_koko �� https://github.com/jumpserver/koko ��
• Jms_koko �� /opt/koko �� /opt/kokodir
1. Jms_koko �� Web ��
- �� [ERRO] POST http://127.0.0.1:8080/api/v2/terminal/terminal-registrations/ failed,␣
,→get code: 403, {"detail":"��"}
# �� koko �� BOOTSTRAP_TOKEN � jumpserver � BOOTSTRAP_TOKEN ��
$ cat /opt/jumpserver/config.yml | grep BOOTSTRAP_TOKEN
# �� web - �� - �� koko �� ( �� )
# �� koko

,→jms_koko:1.5.6
# �� koko
$ rm /opt/kokodir/keys/*
$ vi /opt/kokodir/config.yml
(��)
162 Chapter 9. FAQ

(��)
...
# �� BOOTSTRAP_TOKEN � jumpserver ��

BOOTSTRAP_TOKEN: <PleasgeChangeSameWithJumpserver>
...
$ ./koko
- �� [ERRO] POST http://127.0.0.1:8080/api/v2/terminal/terminal-registrations/ failed,␣

,→get code: 400, {"name":["��"]}
# ��, �� access_key ��

...
# ��, ��Jumpserver��, ��, ��

# NAME: {{ Hostname }}
NAME: koko01 # � koko01 ��
...
$ ./koko
2. SSH �� Jms_koko
# koko �� ssh �� 2222

$ ssh admin@Jumpserver_IP -p2222
3. �� sftp ��
# SFTP��, �� /tmp, Home��

# SFTP_ROOT: /tmp
SFTP_ROOT: /
# ��Home��, �� SFTP_ROOT: Home ��
# SFTP��
# SFTP_SHOW_HIDDEN_FILE: false
- �� koko � docker ��

$ docker exec -it jms_koko /bin/sh
$ if [ ! -f "/opt/koko/config.yml" ]; then cp /opt/koko/config_example.yml /opt/koko/
,→config.yml; sed -i '5d' /opt/koko/config.yml; sed -i "5i CORE_HOST: $CORE_HOST" /opt/
,→koko/config.yml; sed -i "s/BOOTSTRAP_TOKEN: <PleasgeChangeSameWithJumpserver>/
,→BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g" /opt/koko/config.yml; sed -i "s/# LOG_LEVEL: INFO/
,→LOG_LEVEL: ERROR/g" /opt/koko/config.yml; fi
$ vi config.yml
(��)
9.6. Jms_koko �� 163

(��)
# SFTP��, �� /tmp, Home��
# SFTP_ROOT: /tmp
SFTP_ROOT: /
# SFTP��
# SFTP_SHOW_HIDDEN_FILE: false
9.7 Jms_guacamole ��
• Jms_guacamole �� https://github.com/jumpserver/docker-guacamole ��
• Jms_guacamole �� /opt/docker-guacamole
1. Jms_guacamole �� Web ��
# �� BOOTSTRAP_TOKEN � jumpserver � BOOTSTRAP_TOKEN ��

$ cat /opt/jumpserver/config.yml | grep BOOTSTRAP_TOKEN
# �� web - �� - �� guacamole �� [gua]xxxxxxx ( �� )
# �� guacamole

# �� guacamole
$ vi ~/.bashrc
...
BOOTSTRAP_TOKEN=xxxxx # �� BOOTSTRAP_TOKEN � Jumpserver ��
...
$ rm -rf /config/guacamole/keys/*
2. VNC ��
- VNC ��
# �: RealVNC Server, �� Options-Security �� Encryption � Prefer off
9.8 Windows SSH ��
Windows ��, ��, ��
164 Chapter 9. FAQ

# �� windows ��
# �� https://docs.ansible.com/ansible/latest/user_guide/windows_setup.html#windows-ssh-
,→setup ��
# � https://github.com/PowerShell/Win32-OpenSSH/releases/latest �� OpenSSH

# �� C:\Program Files\OpenSSH
# �� powershell , �� powershell ��

cd "C:\Program Files\OpenSSH"
# �� OpenSSH
powershell.exe -ExecutionPolicy Bypass -File install-sshd.ps1
# ��
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -
,→Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
# �� New-NetFirewallRule ��, ��, ��

netsh advfirewall firewall add rule name=sshd dir=in action=allow protocol=TCP␣
,→localport=22
# �� OpenSSH
net start sshd
# �� OpenSSH ��
Set-Service sshd -StartupType Automatic
# �� Windows �� (L)

# Windows 8/10/2012/2016 �� (��)(N)
# Windows 7/2008 �� (��)(L)
�� Web �� Windows ��
"IP" �� Windows �� IP ��

"��" ��, Windows 10/2012/2016/2019 �� Windows(2016), �� Windows ��
"��" �� RDP ��, �� SSH ��, ssh �� Ansible ��
"��" �� Administrators ��, ��
�� (��, �� )
"��" �� Windows ��

"��" ��
"��" �� Windows ��
"��" �� RDP
"��" ��
"��" ��
��
"��" ��, ��, ��

"��" ��
"��" �� Windows �� (�: administrator �� guest �)
"��" ��
(��)
9.8. Windows SSH �� 165

(��)
"��" ��
"��" �� (�� administrator, �� administrator ��)
��( �� )
"��" ��, ��, ��

"��" ��
"��" ��, ��
��
Windows �� Windows ��, �� - G�, �� G ��, �� Ctrl + alt + shift
9.9 ��
��
1. git pull �� error: Your local changes to the following file would be overwritten by merge
# ��, ��, ��
# �� (��)
$ git stash
$ git pull
$ git stash pop
# ��git diff -w +��
# �� (��)
# �� git checkout + ��
# � git checkout apps/jumpserver/settings.py # �� apps/jumpserver/settings.py ��
# ��, (��)
$ git reset --hard
$ git pull
2. sh make_migrations.sh �� 1064, ”You have an error in your SQL syntax; check the manual than
corresponds to your MySql server version for the right syntax to use near ’(6) NOT NULL’”
# ��, � 1.4.x �� mysql �� 5.6, mariadb �� 5.5.6

# ��
3. ��, ��
# ��, ��, ��, �� web ��

$ cat /opt/jumpserver/apps/jumpserver/context_processor.py | grep version
$ cat /opt/jumpserver/apps/templates/_footer.html | grep Version
# ��, �� django_migrations �
$ mysqldump -uroot -p jumpserver --ignore-table=jumpserver.django_migrations > /opt/
,→jumpserver.sql
(��)
166 Chapter 9. FAQ

(��)
$ mv /opt/jumpserver /opt/jumpserver_bak
# �� clone ��
$ cd /opt
$ git clone https://github.com/jumpserver/jumpserver.git
$ cd jumpserver
# ��, ��1.4.0
$ git checkout 1.4.0 # 1.4.0 ��, ��, � 1.3.1 �� git checkout 1.3.1
# ��
$ pip install wheel
# ��
$ mysql -uroot
> create database jumpserver01 default charset 'utf8';
> grant all on jumpserver01.* to 'jumpserver01'@'127.0.0.1' identified by 'weakPassword';
> flush privileges;
> quit
# ��
$ cp /opt/jumpserver_bak/config.py /opt/jumpserver/
$ vim /opt/jumpserver/config.py
DB_ENGINE = 'mysql'
DB_HOST = '127.0.0.1'
DB_PORT = 3306
DB_USER = 'jumpserver01'
DB_PASSWORD = 'weakPassword'
DB_NAME = 'jumpserver01'
# ��
$ sh make_migrations.sh
# ��, ��
$ mysql -uroot
> use jumpserver01;
> source /opt/jumpserver.sql
# �� jumpserver, ��
$ ./jms start
# �� web ��
$ ��
# ��(��)
$ mysql -uroot
(��)
9.9. �� 167

(��)
> drop database jumpserver;
> quit
9.10 Nginx SSL ��
# �� nginx �� https ��, ��

• �� ssl ��
• Guacamole �� jumpserver ssl ��
server {
listen 80;
server_name www.jumpserver.org; # ��
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl;
server_name demo.jumpserver.org; # ��
ssl_certificate /etc/nginx/sslkey/1_jumpserver.org_bundle.crt; # ��
ssl_certificate_key /etc/nginx/sslkey/2_jumpserver.org.key; # ��
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!
,→RC4; # ��
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # ��
ssl_prefer_server_ciphers on;
location /luna/ {
}
location /media/ {
}
location /static/ {
}
location /koko/ {
(��)
168 Chapter 9. FAQ

(��)
access_log off;
}
access_log off;
}
location /ws/ {
access_log off;
}
location / {
}
}
9.11 Firewalld ��
1. �� firewalld
2. �� IP ��
$ firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="��IP"␣

,→port protocol="tcp" port="��" accept"
$ firewall-cmd --reload # ��, ��

(��)
9.11. Firewalld �� 169

(��)
$ firewall-cmd --list-all # ��
# ��
# �� 192.168.100.166 �� 6379 ��
# �� 172.16.10.166 �� 3306 ��
# �� 10.10.10.166 �� 8080 ��
# ��( add �� remove )

$ firewall-cmd --permanent --remove-rich-rule="rule family="ipv4" source address="192.
,→168.100.166" port protocol="tcp" port="6379" accept"
$ firewall-cmd --permanent --remove-rich-rule="rule family="ipv4" source address="172.16.

$ firewall-cmd --permanent --remove-rich-rule="rule family="ipv4" source address="10.10.

3. �� IP ��
$ firewall-cmd --zone=public --add-port=��/tcp --permanent

$ firewall-cmd --list-all # ��
# ��
# �� 2222 ��
# �� 8080 ��
# ��( add �� remove )

$ firewall-cmd --zone=public --remove-port=2222/tcp --permanent
$ firewall-cmd --zone=public --remove-port=8080/tcp --permanent
9.12 ��
• jumpserver 1.4.0 ��
170 Chapter 9. FAQ

>>> from assets.models import Asset
>>> from orgs.models import Organization
>>> dev_org = Organization.objects.create(name='��')
>>> user = User.objects.create(name='��', username='user', email='user@jumpserver.org')
>>> user.set_password('PassWord')
>>> user.save()
>>> dev_org.admins.add(user)
>>> dev_org.users.add(user)
>>> exit()
# �� user �� jumpserver ��
��
>>> dev_org = Organization.objects.get(name='��')
>>> user = User.objects.get(username='admin')
>>> dev_org.admins.add(user)
>>> exit()
��
>>> exit()
��
>>> user = User.objects.create(name='��', username='test', email='test@jumpserver.org')
>>> user.set_password('PassWord')
(��)
9.12. �� 171

(��)
>>> user.save()
>>> exit()
9.13 ��
1. ��
# �� jumpserver��, ��jumpserver��, ��

# �� jumpserver��, Linux��root� NOPASSWD: ALL sudo
��, Jumpserver�� '��'�'��'��Windows��, ��
# �� jumpserver��, Linux��,
Windows��
2. luna ��
# �� Web�� Luna��, �� 8080 �� jumpserver, �� nginx ��

# �� Web�� 403 Forbidden��, ��nginx��luna��, ��
# �� Web�� 502 Bad Gateway��, ��selinux��, ��nginx�errorlog��
3. ��
$ vi /opt/jumpserver/config.yml
# ��(�� django �� session ��), ��

# SESSION_EXPIRE_AT_BROWSER_CLOSE: false
# ��, �� cookie ��, ��

# 86400 ��(s)
4. ��
��

��
5. Web Terminal ��
# ��luna��, ��, ��

# ��, �� 502 koko
# ��nginx��, ��(��)
$ vi /etc/nginx/conf.d/jumpserver.conf # ��, ��
... # ��
location /koko/ {
proxy_pass http://��url��/koko/;
(��)
172 Chapter 9. FAQ

(��)
access_log off; # �� log
}
proxy_pass http://��url��/guacamole/;
access_log off; # �� log
}
location /ws/ {
}
...
# ��, �� demo ��

server {
listen 80;
server_name demo.jumpserver.org;
location / {
# ��IP��IP
proxy_pass http://192.168.244.144;
proxy_read_timeout 150;
}
location /koko/ {
(��)
9.13. �� 173

(��)
proxy_pass http://192.168.244.144/koko/;
}
proxy_pass http://192.168.244.144/guacamole/;
}
location /ws/ {
proxy_pass http://192.168.244.144/ws/;
}
}
6. �� Jumpserver, ��502 �� 403�
# �� selinux ��, �� jms ��
7. �� Jumpserver ��(��)
# �� admin �� public_key ��

>>> user.public_key = '��key'
>>> user.save()
8. ��
(��)
174 Chapter 9. FAQ

(��)
$ sh unblock_all_user.sh
# �� unblock_all_user.sh ��
>>> from django.core.cache import cache
>>> cache.delete_pattern('_LOGIN_BLOCK_*')
>>> cache.delete_pattern('_LOGIN_LIMIT_*')
>>> exit()
9. ��celery��(��, ��........��, ��zh_CN.UTF-8)
$ celery -A ops purge -f
# ��, ��jumpserver��, ��kill��jumpserver��, ��jumpserver��
9.13. �� 175

176 Chapter 9. FAQ

CHAPTER 10
��
10.1 1.5.6
2020�1�2�
��
• �� MFA ��
��
• �� IPv6
• ��
• Windows ��
• ��Swift�Ceph
• ��
• ��
��
• ��/�� Terminal ��
• ��
• ��DEFAULT��
• ��
• �� Form ��RemoteApp�DatabaseApp�
• ��
• ��
• ��
• API �� serializer_classes ��default, display�
177
• �� Tab ��
• ��nav�� message ��
• ��
• ��layzproperty��
• ��
• ��Ops Task��
• �� Encryptjsonfield
• �� Adhoc �� become ��
• ��API��
• ��
• ��
• ��ES�� required
• ��
• �� Web ��
• �� Web ��
• �� SSH ��
��Bug
• ��LDAP��
• ��
• �� id ��
• ��
• ��MFA��
• ��
• ��
• ��S3��
• ��
��
• psutil==5.6.5
• go-elasticsearch v6.8.5
10.2 1.5.5
2019�12�4�
��
• ��
• ��
178 Chapter 10. ��

• ��MFA Radius�
• ��
• �� Windows ��
��
• LDAP/AD ��
• ��
• ��
• ��
• ��
• ��
• ��Windows�
• ��
• ��
• ��
��Bug
• ��/��
• ��
• �� telnet ��
10.3 1.5.4
2019�10�23�
��
• �� -> ��
• LDAP �� config_example.yml �� AUTH_LDAP_USER_LOGIN_ONLY_IN_USERS�
��
• �� LDAP ��/��
• ��
• �� select2 js/css ��(4.0.10)��
• �� celery log �� Websocket ��
• �� API��
• �� name ��
• ��get_no_parent_nodes.py
• ��/��->��
• �� API � get_queryset ��
• �� API ��
10.3. 1.5.4 179

• �� session �� protocol ��
• �� form serializer ��
• ��
• �� Auth info �� MFA ��
• ��
• ��
• ��
• �� api ��
• �� table ��
• �� jms ��stop ��
• ��00:00:00��23:59:59
• ��
• ��X-pack ��
��Bug
• �� API � Connectivity is not JSON serializable � Bug
• �� es ��
• �� MAPPING�elasticsearch -> es�
• �� invalid:false �� 500 ��
• �� csv ��
• �� favorite � empty ��
• ��
• ��/��X-pack ��
• ��X-pack ��
��
• select2 �� 4.0.10��
10.4 1.5.3
2019�9�24�
��
• � v1.5.3 �� v1.5.3� �Koko �� Coco � Jumpserver �� Coco ��
��
• �� API Key �� -> API Key�
• �� RDP Session
• ��
��
180 Chapter 10. ��

• ��
• ��
• �� asset modal table
• �� URL ��
• �� Swagger
• ��
• ��
• ��telnet (beta) => telnet
• WebTerminal ��
��Bug
• ��
• ��
• ��
• ��
• ��
• �� request ��
• ��initial_data ��
• ��
• �� Session ��
• ��
• �� NVMe ��
• ��
��
• �� jQuery v3.1.1
10.5 1.5.2
2019�7�16�
��
• ��-��
��
• ��
• ��API��
• ��
• ��/��
��Bug
10.5. 1.5.2 181

• ��
• ��
• ��)
• ��
• ��
• ��
• ��
• ��
• ��8��
• ��
• ��
• ��
• ��
• ��
10.6 1.5.1
2019�7�6�
��
• ��
��
• ��
• ��API��
• ��
• ��
• ��API/CSV, ��
• ��SMTP��
• ��
• ��(coco/guacamole)��Session/FTP�� name�username��
• Windows��SSH��
• Windows��
• ��windows��
• ��
• ��coco/guamole��Default��
• ��/��/��
182 Chapter 10. ��

��Bug
• ��excel��
• ��/��Bug
10.7 1.5.0
2019�5�29�
��
• ��MFA��
• ��
• ��(��)
• (��/��/��/��/��)��csv��
• LDAP��SSL (pem�� jumpserver/data/certs/ldap_ca.pem)
• ��Option��API��HTTP��
• ��RemoteApp
��
• ��ip��host��
• OpenID Middleware��
• ��API��search��
• ��ldap��is_active��bool��(��LDAP��Jumpserver��)
Bug��
• ��””��bug
10.8 1.4.10
2019�4�30�
��
• ��
��
• ��
• Luna��Luna��
Bug��
• ��API��bug
• ��luna��OpeID��bug
• ��azure��bug
10.7. 1.5.0 183

• ��bug
• ��Azure�bug
10.9 1.4.9
2019�3�26�
Bug��
• ��
• ��celery��bug
• ��
• ��token��
• ��bug
��
• sudo��
• ��users��authentication
• ��migrations
• ��
• docker build��Mysql client��
• coco,guacamole��api, ��
��
• ��
• ��
• ��
• ��
• ��ssl
• ldap��
coco
• ��
• ��
• ��sftp��bug
• ��decode��
• ��
luna
• ��
184 Chapter 10. ��

10.10 1.4.8
2019�2�22�
• ��command filter ��
• LDAP��
• ��ceph, s3��cepht
• gunicorn��
• telnet��
• ��session 10��
10.11 1.4.7
2019�1�29�
• �� radius��
• ��coco�host key, ��coco�� Host key
• ��
• �� yml��
• ��
• ��
• ��, ��
• sftp��home��, ��
• ��luna��bug
• luna��
10.12 1.4.6
2018�12�19�
• ��home��
• ��, ��
• coco� p��
• ��, ��
• ��bug
10.13 1.4.5
2018�12�12�
• ��migrations��
10.10. 1.4.8 185

• ��, �� jumpserver

• coco, guacamole��, ��, ��
• ��
• ldap��
• ��
• ��
• luna��, ��
• rdp��
10.14 1.4.4
2018�11�11�
• ��, ��
• ��luna��
• ��
• ��
• ��openid��
10.15 1.4.3
2018�10�12�
• ��
10.16 1.4.2
2018�10�8�
• ��web sftp, ��
• ��
10.17 1.4.1
2018�9�4�
• ��
• ��
• ��
• ��, ��
• ��zmodem��
186 Chapter 10. ��

• ��
• ��session��
• ��ssh��
• luna��IP
• ��
10.18 1.4.0
2018�8�7�
• ��, ��, ��
• Sftp�� .��
• Luna��IP��
• ��ip
• ��bug��
10.19 1.3.3
2018�7�17�
• ��telnet��
• ��, ��Jumpserver
• ��
• session��
• ��bug
• ��
10.20 1.3.2
2018�6�11�
• ��, ��
• ��MFA
• ��EMAIL��
• ��
• ��BUG
• ��
• ��requirements��
• ��luna��, ��
• ��luna��
10.18. 1.4.0 187

• ��bug
• ��bug
10.21 1.3.1
2018�5�24�
• ��
• ��window��
• ��bug
• �� 0��, ��0 ��1
• ��
• ��, ��
10.22 1.3.0
2018�5�2�
• ��(Google Authenticator)
• ��bug
• ��
10.23 1.2.0
2018�4�13�
• sftp��
• ��sftp��
10.24 1.1.1
2018�4�6�
• ��
• ��
• ��
10.25 1.1.0
2018�4�3�
• ��
188 Chapter 10. ��

• ��
• ��
• rdp gateway��
• ��bug
10.26 1.0.0
2018�3�15�
• Windows��
• ��
• ��
• ��/��OSS/S3�ES
• ��
• ��
• ��
• ��
• Web Terminal��
• ��
• LDAP��
10.27 0.5.0beta
2017�5�21�
• coco�luna��
• ��
• ��
• ��
• ��bug��
10.28 0.4.0beta
2017�5�21�
• ��Python�Django�� Python3.6.1, Django 1.11
• �� Django Class Base View��
• ��, ��
• ��Restful API
• �� Jumpserver, terminal, web termial�� Jumpserver, coco, luna�coco�luna��, ��
10.26. 1.0.0 189

• ��, ��+��
• Ansible�� 2.1 ��
• ��
• ��
• ��
• ��
• ��
• ��connect��, �� ssh server, ��
• web terminal ��
• ��, ��
• ��
10.29 0.3.3
2016�12�14�
• ��bug
10.30 0.3.2
2016�4�5�
• ��
• ��
• ��, ip��
10.31 0.3.1
2016�3�31�
• ��ssh��
• ��web terminal��
• ��
• ��
• ��
• ��Kill��
• ��bug
190 Chapter 10. ��

10.32 0.3.0
2015�12�20�
• ��
• ��
• ��ID��
• ��
• ��ansible��
• ��
• ��web terminal
• ��web��
• ��
• ��
• ��Excel��
• ��
• ��(��, �dev, dba�)
• ��
• ��
• ��sudo��
• ��
• ��
• ��web��
10.33 0.2.0
2015�04�19�
• ��paramiko��ssh��(��pexpect��)
• ��
• ��, ��
• ��
• ��
• Web��
• ��
• ��
• ��, ��, ��
• ��, ��
• �� map, ��ldap��
10.32. 0.3.0 191

• ��, sudo��
• ��, ��
• ��, ��
• ��
• ��web��
• ��
• ��
• ��
• ��
• ��
• ��
10.34 0.1.1
2014�11�14�
• ��shell��, ��
• ��
• ��Web��sudo
• ��Web��
• ��Web��session��
• ��Web��session
• ��
• ��web��
• ��
• ��
• ��web��
• ��admin��
• ��IDC
• ��
• admin��key
10.35 0.1.0
2014�8�15�
• ��
• bootstrap��
• ��
192 Chapter 10. ��

• ��
• ��
• pexpect��, ��
• ��ldap, ��
• ��
193

Jumpserver Readthedocs Io ZH Docs PDF

Загружено:

Сведения о документе

Оригинальное название

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

Jumpserver Readthedocs Io ZH Docs PDF

Загружено:

Авторское право:

Доступные форматы

√ √

���� Jumpserver ���

• ������������� ���� �� docker ����, ������������������

$ echo -e "\033[31m 1. ��� Selinux �� \033[0m" \

,→tcp --permanent; firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source␣

,→address="172.17.0.0/16" port protocol="tcp" port="8080" accept"; firewall-cmd --reload;

$ echo -e "\033[31m 2. ���� \033[0m" \

&& yum makecache fast \

,→nginx_signing.key" > /etc/yum.repos.d/nginx.repo \

&& rpm --import https://nginx.org/keys/nginx_signing.key \

&& systemctl enable redis mariadb nginx docker \

$ echo -e "\033[31m 3. ���� \033[0m" \

&& if [ ! -f "/opt/luna.tar.gz" ]; then wget https://demo.jumpserver.org/download/luna/

&& yum -y install $(cat /opt/jumpserver/requirements/rpm_requirements.txt) \

&& source /opt/py3/bin/activate \

&& curl -sSL https://get.daocloud.io/daotools/set_mirror.sh | sh -s http://f1361db2.m.

&& systemctl restart docker \

$ echo -e "\033[31m 4. ������ \033[0m" \

&& if [ "$SECRET_KEY" = "" ]; then SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 |␣

&& if [ "$BOOTSTRAP_TOKEN" = "" ]; then BOOTSTRAP_TOKEN=`cat /dev/urandom | tr -dc A-

&& if [ ! -d "/var/lib/mysql/jumpserver" ]; then mysql -uroot -e "create database␣

,→' identified by '$DB_PASSWORD';flush privileges;"; fi \

&& if [ ! -f "/opt/jumpserver/config.yml" ]; then cp /opt/jumpserver/config_example.

,→jumpserver/config.yml; sed -i "s/BOOTSTRAP_TOKEN:/BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN/g"␣

,→/opt/jumpserver/config.yml; sed -i "s/# DEBUG: true/DEBUG: false/g" /opt/jumpserver/

,→config.yml; sed -i "s/# LOG_LEVEL: DEBUG/LOG_LEVEL: ERROR/g" /opt/jumpserver/config.

,→yml; sed -i "s/# SESSION_EXPIRE_AT_BROWSER_CLOSE: false/SESSION_EXPIRE_AT_BROWSER_

,→CLOSE: true/g" /opt/jumpserver/config.yml; sed -i "s/DB_PASSWORD: /DB_PASSWORD: $DB_

$ echo -e "\033[31m 5. �� Jumpserver \033[0m" \

&& docker run --name jms_guacamole -d -p 127.0.0.1:8081:8080 -e JUMPSERVER_

&& echo -e "\033[31m �������� $DB_PASSWORD \033[0m" \

$ echo -e "\033[31m 6. ���� \033[0m" \

,→chmod 755 /usr/lib/systemd/system/jms.service; systemctl enable jms; fi

$ yum -y install wget

Jumpserver ����� All in one Docker, �������������������, ������ Database � Redis

$ if [ "$BOOTSTRAP_TOKEN" = "" ]; then BOOTSTRAP_TOKEN=`cat /dev/urandom | tr -dc A-Za-

,→$BOOTSTRAP_TOKEN; else echo $BOOTSTRAP_TOKEN; fi

$ docker run --name jms_all -d -p 80:80 -p 2222:2222 -e SECRET_KEY=$SECRET_KEY -e␣

# macOS ���� key ��������

,→else echo $SECRET_KEY; fi

$ if [ "$BOOTSTRAP_TOKEN" = "" ]; then BOOTSTRAP_TOKEN=`LC_CTYPE=C tr -dc A-Za-z0-9 < /

,→echo $BOOTSTRAP_TOKEN; else echo $BOOTSTRAP_TOKEN; fi

$ docker run --name jms_all -d \

• Jumpserver �����, ������� Web ���������������������, ������ Web ��������, �������

• Jumpserver �� Web ��� 8080/tcp, �� WS ��� 8070/tcp, ���� jumpserver/config.yml

Protocol Server name Port

# ��� � selinux ����, ������� ��� � Selinux ��������

$ firewall-cmd --reload # ������

# �� Redis, Jumpserver �� Redis � cache � celery broke

# �� MySQL, ����� Mysql ������ Mysql �����, ��sqlite3, mysql, postgres�

$ systemctl enable mariadb

# �� Nginx, ��������� Jumpserver �����

$ yum -y install nginx

# ����� Python3 ����

# ������������, ���� Jumpserver ������� source ��, �����������������������

$ SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 50` # ����SECRET_KEY

$ sed -i "s/SECRET_KEY:/SECRET_KEY: $SECRET_KEY/g" /opt/jumpserver/config.yml

$ sed -i "s/# DEBUG: true/DEBUG: false/g" /opt/jumpserver/config.yml

$ sed -i "s/DB_PASSWORD: /DB_PASSWORD: $DB_PASSWORD/g" /opt/jumpserver/config.yml

$ echo -e "\033[31m ��SECRET_KEY� $SECRET_KEY \033[0m"

# SECURITY WARNING: keep the secret key used in production secret!

# SECURITY WARNING: keep the bootstrap token used in production secret!

# DEBUG, INFO, WARNING, ERROR, CRITICAL can set. See https://docs.djangoproject.com/en/1.

�� Jumpserver ��

• �� docker ��, ��

$ echo -e "\033[31m 1. �� Selinux �� \033[0m" \

$ echo -e "\033[31m 2. �� \033[0m" \

$ echo -e "\033[31m 3. �� \033[0m" \

$ echo -e "\033[31m 4. �� \033[0m" \

&& echo -e "\033[31m �� $DB_PASSWORD \033[0m" \

$ echo -e "\033[31m 6. �� \033[0m" \

Jumpserver �� All in one Docker, ��, �� Database � Redis

# macOS �� key ��

• Jumpserver ��, �� Web ��, �� Web ��, ��

• Jumpserver �� Web �� 8080/tcp, �� WS �� 8070/tcp, �� jumpserver/config.yml

# �� selinux ��, �� Selinux ��

$ firewall-cmd --reload # ��

# �� MySQL, �� Mysql �� Mysql ��, ��sqlite3, mysql, postgres�

# �� Nginx, �� Jumpserver ��

# �� Python3 ��

# ��, �� Jumpserver �� source ��, ��

$ SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 50` # ��SECRET_KEY

# �� ip �� 8080 ��, (�� ip ��)

$ echo -e "\033[31m ��IP� $Server_IP \033[0m"

# http://<Jumpserver_url> �� jumpserver ��, � http://192.168.244.144:8080

# �� Web Terminal ��: Luna �� Nginx �� (https://github.com/jumpserver/luna/releases)��␣

client_max_body_size 100m; # ��

# �� http://192.168.244.144 (�� :8080 �� nginx ��)

# �� Windows �, Xshell Terminal ��

# sftp�� /tmp ��

�� FAQ

# �� selinux ��, �� Selinux ��

$ firewall-cmd --reload # ��

# �� MySQL, �� Mysql �� Mysql ��, ��sqlite3, mysql, postgres�

# �� Nginx, �� Jumpserver ��

# �� Python3 ��

# ��, �� Jumpserver �� source ��, ��

$ SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 50` # ��SECRET_KEY

# �� ip �� 8080 ��, (�� ip ��)

$ echo -e "\033[31m ��IP� $Server_IP \033[0m"

# http://<Jumpserver_url> �� jumpserver ��, � http://192.168.244.144:8080

# �� Web Terminal ��: Luna �� Nginx �� (https://github.com/jumpserver/luna/releases)��␣

client_max_body_size 100m; # ��

# �� http://192.168.244.144 (�� :8080 �� nginx ��)

# �� Windows �, Xshell Terminal ��

# sftp�� /tmp ��

�� FAQ

2.3.5 ��(��Ubuntu 18.04)

Ubuntu 18.04 ��

�. �� Python3 � Python ��

1.4 �� Jumpserver ��

$ DB_PASSWORD=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 24` # ��

1.6 �� Python ��

# ��, �� Jumpserver �� source ��, ��

2.1 �� Clone ��

2.3 �� Python ��

2.4 �� Jumpserver ��

$ SECRET_KEY=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 50` # ��SECRET_KEY