1.  wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo #下载阿里 yum 源
2.  yum makecache #生成仓库缓存

1. yum install docker -y

1. systemctl start docker #启动 docker
2. systemctl enable docker #开机启动 docker
3. systemctl status docker #查看 docker 状态

1. docker -v
   

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
    jumpserver.config
    ~~~~~~~~~~~~~~~~~

    Jumpserver project setting file

    :copyright: (c) 2014-2017 by Jumpserver Team
    :license: GPL v2, see LICENSE for more details.
"""
import os

BASE_DIR = os.path.dirname(os.path.abspath(__file__))


class Config:
    """
    Jumpserver Config File
    Jumpserver 配置文件

    Jumpserver use this config for drive django framework running,
    You can set is value or set the same envirment value,
    Jumpserver look for config order: file => env => default

    Jumpserver使用配置来驱动Django框架的运行，
    你可以在该文件中设置，或者设置同样名称的环境变量,
    Jumpserver使用配置的顺序: 文件 => 环境变量 => 默认值
    """
    # SECURITY WARNING: keep the secret key used in production secret!
    # 加密秘钥 生产环境中请修改为随机字符串，请勿外泄
    SECRET_KEY = ''2vym+ky!997d5kkcc64mnz06y1mmui3lut#(^wd=%s_qj$1%x''

    # SECURITY WARNING: keep the bootstrap token used in production secret!
    # 预共享Token coco和guacamole用来注册服务账号，不在使用原来的注册接受机制
    # BOOTSTRAP_TOKEN = ''PleaseChangeMe''

    ALLOWED_HOSTS = [''*'']

    # Development env open this, when error occur display the full process track, Production disable it
    # DEBUG 模式 开启DEBUG后遇到错误时可以看到更多日志
    DEBUG = False

    # DEBUG, INFO, WARNING, ERROR, CRITICAL can set. See https://docs.djangoproject.com/en/1.10/topics/logging/
    # 日志级别
    LOG_LEVEL = ''ERROR''
    LOG_DIR = os.path.join(BASE_DIR, ''logs'')

    # Session expiration setting, Default 24 hour, Also set expired on on browser close
    # 浏览器Session过期时间，默认24小时, 也可以设置浏览器关闭则过期
    # SESSION_COOKIE_AGE = 3600 * 24
    # SESSION_EXPIRE_AT_BROWSER_CLOSE = False
    SESSION_EXPIRE_AT_BROWSER_CLOSE = True 


    # Database setting, Support sqlite3, mysql, postgres ....
    # 数据库设置
    # See https://docs.djangoproject.com/en/1.10/ref/settings/#databases

    # SQLite setting:
    # 使用单文件sqlite数据库
    # DB_ENGINE = ''sqlite3''
    # DB_NAME = os.path.join(BASE_DIR, ''data'', ''db.sqlite3'')

    # MySQL or postgres setting like:
    # 使用Mysql作为数据库
    DB_ENGINE = ''mysql''
    DB_HOST = ''127.0.0.1''
    DB_PORT = 3306
    DB_USER = ''jumpserver''
    DB_PASSWORD = ''weakPassword''   
    DB_NAME = ''jumpserver''

    # When Django start it will bind this host and port
    # ./manage.py runserver 127.0.0.1:8080
    # 运行时绑定端口
    HTTP_BIND_HOST = ''0.0.0.0''
    HTTP_LISTEN_PORT = 8080

    # Use Redis as broker for celery and web socket
    # Redis配置
    REDIS_HOST = ''127.0.0.1''
    REDIS_PORT = 6379
    REDIS_PASSWORD = '''':
    REDIS_DB_CELERY = 3
    REDIS_DB_CACHE = 4
    
    # Use OpenID authorization
    # 使用OpenID 来进行认证设置
    # BASE_SITE_URL = ''http://localhost:8080''
    # AUTH_OPENID = False  # True or False
    # AUTH_OPENID_SERVER_URL = ''https://openid-auth-server.com/''
    # AUTH_OPENID_REALM_NAME = ''realm-name''
    # AUTH_OPENID_CLIENT_ID = ''client-id''
    # AUTH_OPENID_CLIENT_SECRET = ''client-secret''

    #
    # OTP_VALID_WINDOW = 0

    def __init__(self):
        pass

    def __getattr__(self, item):
        return None


class DevelopmentConfig(Config):
    pass


class TestConfig(Config):
    pass


class ProductionConfig(Config):
    pass


# Default using Config settings, you can write if/else for different env
config = DevelopmentConfig()

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
#

import os

BASE_DIR = os.path.dirname(__file__)


class Config:
    """
    Coco config file, coco also load config from server update setting below
    """
    # 项目名称, 会用来向Jumpserver注册, 识别而已, 不能重复
    NAME = "coco"

    # Jumpserver项目的url, api请求注册会使用
    CORE_HOST = os.environ.get("CORE_HOST") or ''http://127.0.0.1:8080''

    # Bootstrap Token, 预共享秘钥, 用来注册coco使用的service account和terminal
    # 请和jumpserver 配置文件中保持一致，注册完成后可以删除
    # BOOTSTRAP_TOKEN = "PleaseChangeMe"

    # 启动时绑定的ip, 默认 0.0.0.0
    # BIND_HOST = ''0.0.0.0''

    # 监听的SSH端口号, 默认2222
    # SSHD_PORT = 2222

    # 监听的HTTP/WS端口号，默认5000
    # HTTPD_PORT = 5000

    # 项目使用的ACCESS KEY, 默认会注册,并保存到 ACCESS_KEY_STORE中,
    # 如果有需求, 可以写到配置文件中, 格式 access_key_id:access_key_secret
    # ACCESS_KEY = None

    # ACCESS KEY 保存的地址, 默认注册后会保存到该文件中
    # ACCESS_KEY_STORE = os.path.join(BASE_DIR, ''keys'', ''.access_key'')

    # 加密密钥
    # SECRET_KEY = None

    # 设置日志级别 [''DEBUG'', ''INFO'', ''WARN'', ''ERROR'', ''FATAL'', ''CRITICAL'']
    LOG_LEVEL = ''ERROR''

    # 日志存放的目录
    # LOG_DIR = os.path.join(BASE_DIR, ''logs'')

    # Session录像存放目录
    # SESSION_DIR = os.path.join(BASE_DIR, ''sessions'')

    # 资产显示排序方式, [''ip'', ''hostname'']
    # ASSET_LIST_SORT_BY = ''ip''

    # 登录是否支持密码认证
    # PASSWORD_AUTH = True

    # 登录是否支持秘钥认证
    # PUBLIC_KEY_AUTH = True
    
    # SSH白名单
    # ALLOW_SSH_USER = ''all''  # [''test'', ''test2'']

    # SSH黑名单, 如果用户同时在白名单和黑名单，黑名单优先生效
    # BLOCK_SSH_USER = []

    # 和Jumpserver 保持心跳时间间隔
    # HEARTBEAT_INTERVAL = 5

    # Admin的名字，出问题会提示给用户
    # ADMINS = ''''
    COMMAND_STORAGE = {
        "TYPE": "server"
    }
    REPLAY_STORAGE = {
        "TYPE": "server"
    }

    # SSH连接超时时间 (default 15 seconds)
    # SSH_TIMEOUT = 15

    # 语言 = en
    LANGUAGE_CODE = ''zh''


config = Config()

server {
    listen 80;  # 代理端口,以后将通过此端口进行访问,不再通过8080端口
    # server_name demo.jumpserver.org;  # 修改成你的域名或者注释掉

    client_max_body_size 100m;  # 录像及文件上传大小限制

    location /luna/ {
        try_files $uri / /index.html;
        alias /opt/luna/;  # luna 路径,如果修改安装目录,此处需要修改
    }

    location /media/ {
        add_header Content-Encoding gzip;
        root /opt/jumpserver/data/;  # 录像位置,如果修改安装目录,此处需要修改
    }

    location /static/ {
        root /opt/jumpserver/data/;  # 静态资源,如果修改安装目录,此处需要修改
    }

    location /socket.io/ {
        proxy_pass       http://localhost:5000/socket.io/;  # 如果coco安装在别的服务器,请填写它的ip
        proxy_buffering off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        access_log off;
    }

    location /coco/ {
        proxy_pass       http://localhost:5000/coco/;  # 如果coco安装在别的服务器,请填写它的ip
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        access_log off;
    }

    location /guacamole/ {
        proxy_pass       http://localhost:8081/;  # 如果guacamole安装在别的服务器,请填写它的ip
        proxy_buffering off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        access_log off;
    }

    location / {
        proxy_pass http://localhost:8080;  # 如果jumpserver安装在别的服务器,请填写它的ip
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

# For more information on configuration, see:
    #   * Official English Documentation: http://nginx.org/en/docs/
    #   * Official Russian Documentation: http://nginx.org/ru/docs/

    user nginx;
    worker_processes auto;
    error_log /var/log/nginx/error.log;
    pid /run/nginx.pid;

    # Load dynamic modules. See /usr/share/nginx/README.dynamic.
    include /usr/share/nginx/modules/*.conf;

    events {
        worker_connections 1024;
    }

    http {
        log_format  main  ''$remote_addr - $remote_user [$time_local] "$request" ''
                          ''$status $body_bytes_sent "$http_referer" ''
                          ''"$http_user_agent" "$http_x_forwarded_for"'';

        access_log  /var/log/nginx/access.log  main;

        sendfile            on;
        tcp_nopush          on;
        tcp_nodelay         on;
        keepalive_timeout   65;
        types_hash_max_size 2048;

        include             /etc/nginx/mime.types;
        default_type        application/octet-stream;

        # Load modular configuration files from the /etc/nginx/conf.d directory.
        # See http://nginx.org/en/docs/ngx_core_module.html#include
        # for more information.
        include /etc/nginx/conf.d/*.conf;

        #server {
            #listen       80 default_server;
            #listen       [::]:80 default_server;
            #server_name  _;
            #root         /usr/share/nginx/html;

            # Load configuration files for the default server block.
            #include /etc/nginx/default.d/*.conf;

            #location / {
           # }

            #error_page 404 /404.html;
                #location = /40x.html {
            #}

            #error_page 500 502 503 504 /50x.html;
                #location = /50x.html {
            #}
        #}

    # Settings for a TLS enabled server.
    #
    #    server {
    #        listen       443 ssl http2 default_server;
    #        listen       [::]:443 ssl http2 default_server;
    #        server_name  _;
    #        root         /usr/share/nginx/html;
    #
    #        ssl_certificate "/etc/pki/nginx/server.crt";
    #        ssl_certificate_key "/etc/pki/nginx/private/server.key";
    #        ssl_session_cache shared:SSL:1m;
    #        ssl_session_timeout  10m;
    #        ssl_ciphers HIGH:!aNULL:!MD5;
    #        ssl_prefer_server_ciphers on;
    #
    #        # Load configuration files for the default server block.
    include /etc/nginx/default.d/*.conf;
    #
    #        location / {
    #        }
    #
    #        error_page 404 /404.html;
    #            location = /40x.html {
    #        }
    #
    #        error_page 500 502 503 504 /50x.html;
    #            location = /50x.html {
    #        }
    #    }

    }

参考链接1：http://docs.jumpserver.org/zh/docs/step_by_step.html

参考链接2：http://docs.jumpserver.org/zh/docs/setup_by_centos7.html

参考链接3：https://www.cnblogs.com/bigdevilking/p/9427941.html

参考链接4：http://docs.jumpserver.org/zh/docs/faq_install.html

环境

• 系统

# cat /etc/redhat-release CentOS Linux release 7.4.1708 (Core) # uname -r 3.10.0-693.21.1.el7.x86_64

• 关闭Selinux和防火墙

# systemctl stop firewalld.service # sed -i ‘/^SELINUX/s/enforcing/disabled/g‘ /etc/selinux/config # grep -i ^selinux /etc/selinux/config SELINUX=disabled SELINUXTYPE=targeted

• 修改字符集(因为日志里打印了中文，否则肯能报错：input/output error问题)

# localedef -c -f UTF-8 -i zh_CN zh_CN.UTF-8 # export LC_ALL=zh_CN.UTF-8 # echo ‘LANG="zh_CN.UTF-8"‘ > /etc/locale.conf

准备python3和Python虚拟环境

• 安装依赖包

# yum -y install wget sqlite-devel xz gcc automake zlib-devel openssl-devel epel-release git

• 编译安装

# wget https://www.python.org/ftp/python/3.6.1/Python-3.6.1.tar.xz # tar xvf Python-3.6.1.tar.xz && cd Python-3.6.1 # ./configure && make && make install

• 建立Python虚拟环境

# cd /opt # python3 -m venv py3 # source /opt/py3/bin/activate

看到下面的提示符代表成功，以后运行 Jumpserver 都要先运行以上 source 命令，以下所有命令均在该虚拟环境中运行
(py3) [[email protected] py3]

• 自动载入Phthon虚拟环境
  防止运行Jumpserver时忘记载入Python虚拟环境导致无法运行。

# cd /opt # git clone git://github.com/kennethreitz/autoenv.git # echo ‘source /opt/autoenv/activate.sh‘ >> ~/.bashrc # source ~/.bashrc

安装Jumpserver

• 下载或者Clone项目
  可以自行选择下载zip包或者直接Clone到本地

# cd /opt/ # git clone https://github.com/jumpserver/jumpserver.git && cd jumpserver && git checkout master # echo "source /opt/py3/bin/activate" > /opt/jumpserver/.env # 进入 jumpserver 目录时将自动载入 python 虚拟环境

• 安装依赖RPM包

# cd /opt/jumpserver/requirements # yum -y install $(cat rpm_requirements.txt) # 如果没有任何报错请继续

• 安装Python库依赖
  默认的Python库是国外站点，因为网络原因，可能会下载缓慢。这里更改使用国内源。

# pip install -r requirements.txt -i http://pypi.douban.com/simple --trusted-host pypi.douban.com

以上仅为临时使用，如果想配置成默认的源，方法如下：

需要创建或修改配置文件（一般都是创建）

Linux 在 ~/.pip/pip.conf/

修改内容为：

[global] index-url = http://pypi.douban.com/simple [install] trusted-host=pypi.douban.com

• 安装Redis，Jumpserver使用Redis做cache和celery broke

# yum -y install redis # systemctl enable redis # systemctl start redis

• 安装MysqL

# yum -y install mariadb mariadb-devel mariadb-server # systemctl enable mariadb # systemctl start mariadb

• 初始化MysqL，创建数据库Jumpserver并授权

# MysqL_secure_installation #设置root登录密码，然后一路回车 # MysqL -uroot -p123456 > create database jumpserver default charset ‘utf8‘; > grant all on jumpserver.* to ‘jumpserver‘@‘127.0.0.1‘ identified by ‘123456‘; > flush privileges;

• 修改Jumpserver配置文件

# cd /opt/jumpserver # cp config_example.py config.py # vim config.py

注意：配置文件是Python格式，不要用TAB，而要用空格

""" jumpserver.config ~~~~~~~~~~~~~~~~~ Jumpserver project setting file :copyright: (c) 2014-2017 by Jumpserver Team :license: GPL v2,see LICENSE for more details. """ import os BASE_DIR = os.path.dirname(os.path.abspath(__file__)) class Config: # Use it to encrypt or decrypt data # Jumpserver 使用 SECRET_KEY 进行加密，请务必修改以下设置 # SECRET_KEY = os.environ.get(‘SECRET_KEY‘) or ‘2vym+ky!997d5kkcc64mnz06y1mmui3lut#(^wd=%s_qj$1%x‘ SECRET_KEY = ‘2vym+ky!997d5kkcc64mnz06y1mmui3lut#(^wd=%s_qj$1%x‘ ‘请随意输入随机字符串（推荐字符大于等于 50位）‘ # Django security setting,if your disable debug model,you should setting that ALLOWED_HOSTS = [‘*‘] # DEBUG 模式 True为开启 False为关闭，默认开启，生产环境推荐关闭 # 注意：如果设置了DEBUG = False，访问8080端口页面会显示不正常，需要搭建 Nginx 代理才可以正常访问 DEBUG = False # 日志级别，默认为DEBUG，可调整为INFO,WARNING,ERROR,CRITICAL，默认INFO LOG_LEVEL = ‘WARNING‘ LOG_DIR = os.path.join(BASE_DIR,‘logs‘) # 使用的数据库配置，支持sqlite3,MysqL,postgres等，默认使用sqlite3 # See https://docs.djangoproject.com/en/1.10/ref/settings/#databases # 默认使用sqlite3，如果使用其他数据库请注释下面两行 # DB_ENGINE = ‘sqlite3‘ # DB_NAME = os.path.join(BASE_DIR,‘data‘,‘db.sqlite3‘) # 如果需要使用MysqL或postgres，请取消下面的注释并输入正确的信息,本例使用MysqL做演示(mariadb也是MysqL) DB_ENGINE = ‘MysqL‘ DB_HOST = ‘127.0.0.1‘ DB_PORT = 3306 DB_USER = ‘jumpserver‘ DB_PASSWORD = ‘123456‘ DB_NAME = ‘jumpserver‘ # Django 监听的ip和端口，生产环境推荐把0.0.0.0修改成127.0.0.1，这里的意思是允许x.x.x.x访问，127.0.0.1表示仅允许自身访问 # ./manage.py runserver 127.0.0.1:8080 HTTP_BIND_HOST = ‘127.0.0.1‘ HTTP_LISTEN_PORT = 8080 # Redis 相关设置 REdis_HOST = ‘127.0.0.1‘ REdis_PORT = 6379 REdis_PASSWORD = ‘‘ REdis_DB_CELERY = 3 REdis_DB_CACHE = 4 def __init__(self): pass def __getattr__(self,item): return None class DevelopmentConfig(Config): pass class TestConfig(Config): pass class ProductionConfig(Config): pass # Default using Config settings,you can write if/else for different env config = DevelopmentConfig()

• 生成数据库表结构和初始化数据

# cd /opt/jumpserver/utils # bash make_migrations.sh

• 运行Jumpserver

# cd /opt/jumpserver # ./jms start all # 后台运行使用 -d 参数./jms start all -d

运行不报错，浏览器访问http://IP地址:8080 默认账号：admin 密码：admin

安装SSH Server和WebSocket Server:Coco

• 下载或CLone项目
  新开一个终端，别忘了

souce /opt/py3/bin/activate

# cd /opt # source /opt/py3/bin/activate # git clone https://github.com/jumpserver/coco.git && cd coco && git checkout master # echo "source /opt/py3/bin/activate" > /opt/coco/.env # 进入 coco 目录时将自动载入 python 虚拟环境

• 安装依赖

# cd /opt/coco/requirements # yum -y install $(cat rpm_requirements.txt) # pip install -r requirements.txt

• 修改配置文件并运行

# cd /opt/coco # cp conf_example.py conf.py # 如果 coco 与 jumpserver 分开部署，请手动修改 conf.py # vim conf.py

#!/usr/bin/env python3 # -*- coding: utf-8 -*- # import os BASE_DIR = os.path.dirname(__file__) class Config: """ Coco config file,coco also load config from server update setting below """ # 项目名称,会用来向Jumpserver注册,识别而已,不能重复 # NAME = "localhost" NAME = "coco" # Jumpserver项目的url,api请求注册会使用,如果Jumpserver没有运行在127.0.0.1:8080，请修改此处 # CORE_HOST = os.environ.get("CORE_HOST") or ‘http://127.0.0.1:8080‘ CORE_HOST = ‘http://127.0.0.1:8080‘ # 启动时绑定的ip,默认 0.0.0.0 # BIND_HOST = ‘0.0.0.0‘ # 监听的SSH端口号,默认2222 # SSHD_PORT = 2222 # 监听的HTTP/WS端口号，默认5000 # HTTPD_PORT = 5000 # 项目使用的ACCESS KEY,默认会注册,并保存到 ACCESS_KEY_STORE中,# 如果有需求,可以写到配置文件中,格式 access_key_id:access_key_secret # ACCESS_KEY = None # ACCESS KEY 保存的地址,默认注册后会保存到该文件中 # ACCESS_KEY_STORE = os.path.join(BASE_DIR,‘keys‘,‘.access_key‘) # 加密密钥 # SECRET_KEY = None # 设置日志级别 [‘DEBUG‘,‘INFO‘,‘WARN‘,‘ERROR‘,‘FATAL‘,‘CRITICAL‘] # LOG_LEVEL = ‘INFO‘ LOG_LEVEL = ‘WARN‘ # 日志存放的目录 # LOG_DIR = os.path.join(BASE_DIR,‘logs‘) # Session录像存放目录 # SESSION_DIR = os.path.join(BASE_DIR,‘sessions‘) # 资产显示排序方式,[‘ip‘,‘hostname‘] # ASSET_LIST_SORT_BY = ‘ip‘ # 登录是否支持密码认证 # PASSWORD_AUTH = True # 登录是否支持秘钥认证 # PUBLIC_KEY_AUTH = True # 和Jumpserver 保持心跳时间间隔 # HEARTBEAT_INTERVAL = 5 # Admin的名字，出问题会提示给用户 # ADMINS = ‘‘ COMMAND_STORAGE = { "TYPE": "server" } REPLAY_STORAGE = { "TYPE": "server" } config = Config()

# ./cocod start # 后台运行使用 -d 参数./cocod start -d

启动成功后去Jumpserver 会话管理-终端管理（http://IP地址:8080/terminal/terminal/） 接受coco的注册。

安装Web Terminal 前端:Luna

Luna已改为纯前端，需要Nginx来运行访问

• 下载并解压Luna

# cd /opt # wget https://github.com/jumpserver/luna/releases/download/1.3.3/luna.tar.gz # tar xvf luna.tar.gz # chown -R root:root luna

安装Windows支持组件（若不需要可以跳过）

因为手动安装 guacamole 组件比较复杂，这里提供打包好的 docker 使用,启动 guacamole

• Docker安装

# yum remove docker-latest-logrotate docker-logrotate docker-selinux dockdocker-engine # yum install -y yum-utils device-mapper-persistent-data lvm2 # yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo # rpm --import http://mirrors.aliyun.com/docker-ce/linux/centos/gpg # yum makecache fast # yum -y install docker-ce # systemctl start docker # systemctl status docker

• 启动 Guacamole

这里所需要注意的是 guacamole 暴露出来的端口是 8081，若与主机上其他端口冲突请自定义

启动成功后去Jumpserver 会话管理-终端管理（http://IP地址:8080/terminal/terminal/） 接受[Gua]开头的一个注册

# docker run --name jms_guacamole -d -p 8081:8080 -v /opt/guacamole/key:/config/guacamole/key -e JUMPSERVER_KEY_DIR=/config/guacamole/key -e JUMPSERVER_SERVER=http://IP地址 jumpserver/guacamole:latest

配置Nginx整合各组件

• 安装Nginx

# yum -y install Nginx

• 修改配置文件

# vim /etc/Nginx/Nginx.conf

... 省略
# 把默认server配置块改成这样，原有的内容请保持不动 server { listen 80; # 代理端口，以后将通过此端口进行访问，不再通过8080端口 location /luna/ { try_files $uri / /index.html; alias /opt/luna/; # luna 路径，如果修改安装目录，此处需要修改 } location /media/ { add_header content-encoding gzip; root /opt/jumpserver/data/; # 录像位置，如果修改安装目录，此处需要修改 } location /static/ { root /opt/jumpserver/data/; # 静态资源，如果修改安装目录，此处需要修改 } location /socket.io/ { proxy_pass http://localhost:5000/socket.io/; # 如果coco安装在别的服务器，请填写它的ip proxy_buffering off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; access_log off; } location /guacamole/ { proxy_pass http://localhost:8081/; # 如果guacamole安装在别的服务器，请填写它的ip proxy_buffering off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; access_log off; client_max_body_size 100m; # Windows 文件上传大小限制 } location / { proxy_pass http://localhost:8080; # 如果jumpserver安装在别的服务器，请填写它的ip proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } } ... 省略

• 运行Nginx

# Nginx -t # 确保配置没有问题,有问题请先解决

# systemctl start Nginx # systemctl enable Nginx

• 开始使用Jumpserver
  检查应用是否正常运行

# cd /opt/jumpserver # ./jms status # 确定jumpserver已经运行，如果没有运行请重新启动jumpserver # cd /opt/coco # ./cocod status # 确定jumpserver已经运行，如果没有运行请重新启动coco # 如果安装了 Guacamole # docker ps # 检查容器是否已经正常运行，如果没有运行请重新启动Guacamole

服务全部启动后，访问http://ip，访问Nginx代理的端口，不要再通过8080端口访问。

如果部署过程中，没有接受应用的注册，需要到Jumpserver的会话管理-终端管理 接受Coco Guacamode等应用的注册。

测试连接

如果登录客户端是 macOS 或 Linux ，登录语法如下
$ ssh -p2222 [email protected] $ sftp -P2222 [email protected] 密码: admin 如果登录客户端是 Windows ，Xshell Terminal 登录语法如下 $ ssh [email protected] 2222 $ sftp [email protected] 2222 密码: admin 如果能登陆代表部署成功  # sftp默认上传的位置在资产的 /tmp 目录下 # windows拖拽上传的位置在资产的 Guacamole RDP上的 G 目录下