Jumpserver堡垒机搭建（脚本自动化）

  1 #!/bin/bash
  2 # coding: utf-8
  3 # copyright (c) 2018
  4 
  5 set -e 　　　　　　 #返回值为非0时，退出脚本
  6 
  7 echo "0. 系统的一些配置"
  8 setenforce 0 || true
  9 systemctl stop iptables.service || true >/dev/null 2>&1
 10 systemctl stop firewalld.service || true >/dev/null 2>&1
 11 
 12 localedef -c -f utf-8 -i zh_cn zh_cn.utf-8
 13 export lc_all=zh_cn.utf-8
 14 echo 'lang=zh_cn.utf-8' > /etc/sysconfig/i18n
 15 
 16 echo "1. 备份yum"
 17 {
 18 for i in /etc/yum.repos.d/*.repo;do cp $i ${i%.repo}.bak;done
 19 rm -rf /etc/yum.repos.d/*.repo
 20 } || {
 21 echo "yum出错，请更换源重新运行"
 22 exit 1
 23 }
 24 
 25 echo "2. 获取网络yum"
 26 {
 27 wget -p /etc/yum.repos.d/ http://mirrors.aliyun.com/repo/centos-7.repo >/dev/null 2>&1
 28 wget -p /etc/yum.repos.d/ http://mirrors.163.com/.help/centos7-base-163.repo >/dev/null 2>&1
 29 yum clean >/dev/null 2>&1
 30 yum repolist >/dev/null 2>&1
 31 } || {
 32 echo "yum出错，请更换源重新运行"
 33 exit 1
 34 }
 35 
 36 
 37 echo "3. 安装基本依赖"
 38 {
 39 yum update -y>/dev/null && yum install wget unzip epel-release nginx sqlite-devel xz gcc automake zlib-devel openssl-devel redis mariadb mariadb-devel mariadb-server supervisor -y >/dev/null 2>&1
 40 } || {
 41 echo "yum出错，请更换源重新运行"
 42 exit 1
 43 }
 44 
 45 
 46 echo "4. 准备python"
 47 {
 48 cd /opt/
 49 wget https://www.python.org/ftp/python/3.6.1/python-3.6.1.tar.xz -o /opt/python-3.6.1.tar.xz >/dev/null 2>&1
 50 } || {
 51 echo "pyhton 依赖包下载出错，请尝试使用特殊工具进行手工下载https://www.python.org/ftp/python/3.6.1/python-3.6.1.tar.xz ，并且放至于/opt/python-3.6.1.tar.xz，如您是手工下载，请注释上面wget命令再运行本脚本"
 52 exit 1
 53 }
 54 {
 55 tar xf python-3.6.1.tar.xz && cd python-3.6.1 && ./configure>/dev/null && make>/dev/null && make install >/dev/null 2>&1 
 56 } || {
 57 echo "解压或编译python出错，请尝试使用上面的命令手工解压或编译，如手工操作成功，请注释上述代码再运行本脚本"
 58 exit 1
 59 }
 60 {
 61 python3 -m venv py3
 62 } || {
 63 echo "建立python虚拟环境出错，请尝试手工执行，如手工操作成功，请注释上述代码再运行本脚本"
 64 exit 1
 65 }
 66 
 67 echo "5. 下载jummpserver包并解压"
 68 {
 69 wget https://github.com/jumpserver/jumpserver/archive/1.0.0.zip -o /opt/jumpserver.zip >/dev/null 2>&1 
 70 } || {
 71 echo "下载jumpserver包出错，请尝试手工执行，如手工操作成功，请注释上述代码再运行本脚本"
 72 exit 1
 73 }
 74 {
 75 wget https://github.com/jumpserver/coco/archive/1.0.0.zip -o /opt/coco.zip >/dev/null 2>&1 
 76 } || {
 77 echo "下载coco包出错，请尝试手工执行，如手工操作成功，请注释上述代码再运行本脚本"
 78 exit 1
 79 }
 80 {
 81 wget https://github.com/jumpserver/luna/releases/download/v1.0.0/luna.tar.gz -o /opt/luna.tar.gz >/dev/null 2>&1 
 82 } || {
 83 echo "下载luna包出错，请尝试手工执行，如手工操作成功，请注释上述代码再运行本脚本"
 84 exit 1
 85 }
 86 {
 87 cd /opt
 88 unzip coco.zip >/dev/null && mv coco-1.0.0 coco && unzip jumpserver.zip >/dev/null && mv jumpserver-1.0.0 jumpserver && tar xzf luna.tar.gz >/dev/null 2>&1 
 89 } || {
 90 echo "解压出错，请尝试手工执行，如手工操作成功，请注释上述代码再运行本脚本"
 91 exit 1
 92 }
 93 
 94 echo "6. 安装yum依赖"
 95 {
 96 yum -y install $(cat /opt/jumpserver/requirements/rpm_requirements.txt) >/dev/null && yum -y install $(cat /opt/coco/requirements/rpm_requirements.txt) >/dev/null 2>&1
 97 } || {
 98 echo "安装jumpserver的依赖出错，请尝试手工执行，如手工操作成功，请注释上述代码再运行本脚本"
 99 exit 1
100 }
101 
102 echo "7. 安装pip依赖"
103 {
104 python3 -m venv py3 && \
105 source /opt/py3/bin/activate && pip install --upgrade pip>/dev/null && pip install -r /opt/jumpserver/requirements/requirements.txt>/dev/null && pip install -r /opt/coco/requirements/requirements.txt >/dev/null 2>&1
106 } || {
107 echo "安装jumpserver的依赖出错，请尝试手工执行，如手工操作成功，请注释上述代码再运行本脚本"
108 exit 1
109 }
110 
111 echo "8. 创建数据库"
112 mkdir -p /opt/mysql/share/mysql/
113 {
114 wget https://github.com/jumpserver/dockerfile/blob/mysql/alpine/mysql_security.sql?raw=true -o /opt/mysql/mysql_security.sql >/dev/null 2>&1
115 wget https://github.com/jumpserver/dockerfile/blob/mysql/alpine/mysql.cnf?raw=true -o /etc/my.cnf >/dev/null 2>&1
116 wget https://github.com/jumpserver/dockerfile/blob/mysql/alpine/errmsg.sys?raw=true -o /opt/mysql/share/mysql/errmsg.sys >/dev/null 2>&1
117 } || {
118 echo "下载数据库依赖文件出错，请尝试手工执行，如手工操作成功，请注释上述代码再运行本脚本"
119 exit 1
120 }
121 
122 echo "9. 准备文件"
123 {
124 wget https://github.com/jumpserver/dockerfile/blob/mysql/alpine/nginx.conf?raw=true -o /etc/nginx/nginx.conf >/dev/null 2>&1
125 wget https://github.com/jumpserver/dockerfile/blob/mysql/alpine/supervisord.conf?raw=true -o /etc/supervisord.conf >/dev/null 2>&1
126 wget https://github.com/jumpserver/dockerfile/blob/mysql/alpine/jumpserver_conf.py?raw=true -o /opt/jumpserver/config.py >/dev/null 2>&1
127 wget https://github.com/jumpserver/dockerfile/blob/mysql/alpine/coco_conf.py?raw=true -o /opt/coco/conf.py >/dev/null 2>&1
128 wget https://github.com/jumpserver/dockerfile/blob/mysql/alpine/start_jms.sh?raw=true -o /opt/start_jms.sh >/dev/null 2>&1
129 } || {
130 echo "下载配置文件出错，请尝试手工执行，如手工操作成功，请注释上述代码再运行本脚本"
131 exit 1
132 }
133 
134 echo "10. 安装docker"
135 yum check-update >/dev/null 2>&1
136 {
137 yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo >/dev/null && yum clean all>/dev/null && yum repolist >/dev/null 2>&1
138 yum -y install epel-release docker-ce >/dev/null 2>&1
139 systemctl start docker
140 tee -a /etc/sysctl.conf <<-eof    
141 net.bridge.bridge-nf-call-ip6tables = 1
142 net.bridge.bridge-nf-call-iptables = 1
143 eof
144 sysctl -p >/dev/null 2>&1
145 
146 tee -a /etc/docker/daemon.json <<-eof
147 {
148 "registry-mirrors": [
149 "https://registry.docker-cn.com"
150 ]
151 }
152 eof
153 } || {
154 echo "安装docker 出错，请尝试手工执行，如手工操作成功，请注释上述代码再运行本脚本"
155 exit 1
156 }
157 
158 systemctl daemon-reload 
159 systemctl restart docker
160 
161 
162 echo "11. 安装guacamole"
163 host_ip=`python -c "import socket;print([(s.connect(('8.8.8.8', 53)), s.getsockname()[0], s.close()) for s in [socket.socket(socket.af_inet, socket.sock_dgram)]][0][1])"`
164 
165 docker run --name jms_guacamole -d \
166 --restart always \
167 -p 8081:8080 -v /opt/guacamole/key:/config/guacamole/key \
168 -e jumpserver_key_dir=/config/guacamole/key \
169 -e jumpserver_server=http://$host_ip:8080 \
170 registry.jumpserver.org/public/guacamole:1.0.0
171 
172 echo "12. 配置nginx"
173 yum -y install nginx >/dev/null 2>&1
174 cat << eof > /etc/nginx/conf.d/jumpserver.conf
175 server {
176 listen 80;
177 
178 proxy_set_header x-real-ip $remote_addr;
179 proxy_set_header host $host;
180 proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
181 
182 location /luna/ {
183 try_files $uri / /index.html;
184 alias /opt/luna/;
185 }
186 
187 location /media/ {
188 add_header content-encoding gzip;
189 root /opt/jumpserver/data/;
190 }
191 
192 location /static/ {
193 root /opt/jumpserver/data/;
194 }
195 
196 location /socket.io/ {
197 proxy_pass http://localhost:5000/socket.io/; # 如果coco安装在别的服务器，请填写它的ip
198 proxy_buffering off;
199 proxy_http_version 1.1;
200 proxy_set_header upgrade $http_upgrade;
201 proxy_set_header connection "upgrade";
202 }
203 
204 location /guacamole/ {
205 proxy_pass http://localhost:8081/; # 如果guacamole安装在别的服务器，请填写它的ip
206 proxy_buffering off;
207 proxy_http_version 1.1;
208 proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
209 proxy_set_header upgrade $http_upgrade;
210 proxy_set_header connection $http_connection;
211 access_log off;
212 }
213 
214 location / {
215 proxy_pass http://localhost:8080; # 如果jumpserver安装在别的服务器，请填写它的ip
216 }
217 }
218 
219 eof
220 
221 mkdir -p /opt/nginx/log && chmod -r 777 /opt/nginx
222 {
223 systemctl restart nginx
224 systemctl enable nginx
225 } || {
226 service restart nginx
227 } || {
228 nginx -s reload
229 } || {
230 echo "请检查nginx的启动命令"
231 exit 1
232 }
233 
234 chmod +x /opt/start_jms.sh
235 echo " 安装完成，请运行/opt/start_jms.sh启动jumpserver"