The article is a little long, please read it patiently!
1 JumpServer Fortress Overview – Deploy the JumpServer runtime environment
1.1 Overview of the jumper
Jumping machine is a server, development or operation and maintenance personnel in the maintenance process must first unified login to this server, and then login to
Maintenance and operation of target equipment.
Disadvantages of jumper: there is no control and audit of operation and maintenance personnel’s operation behavior, and there will still be misoperation in the process of using the jumper.
In case of accidents caused by illegal operation, it is difficult to locate the cause and responsible person quickly.
Bastion fortress machine overview: machine, that is, in a specific network environment, in order to ensure network and data from the invasion and destruction from external and internal users, and use various technical means for real-time collection and monitoring network environment state of each component of the system, the security incidents, the network activities, in order to set alarm, timely treatment and auditing proportional amount.
Summary: Bastion machine has more functions such as real-time collection, monitoring network environment and centralized alarm than jumper machine. JumpServer Overview: JumpServer is an open source jumper system developed in Python and Django that provides authentication, authorization, auditing, and automated operations for Internet businesses. JumpServer now supports managing SSH, Telnet, RDP, and VNC protocol assets
Official Website:http://www.jumpserver.org
JumpServer 2 environment requirements:
Hardware: 4 CPU cores, 6GB RAM, 50GB hard disk (minimum)
1.2 JumpServer experimental topology
Experimental environment:
XueGod63 IP: 192.168.1.63 JumpServer Server 6GB memory
Xuegod64 IP: 192.168.1.64 resource, managed server 2G memory
1.3 Initialize the system environment
Initialize the system environment to close the firewall
[root@xuegod63 ~]# systemctl stop firewalld && systemctl disable firewalldClose the selinux
[root@xuegod63 ~]# setenforce 0Permanent shutdown (effective after reboot, first set temporary then set permanent.)
[root@xuegod63 ~]# sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config1.4 Install the relevant services required for JumpServer
Automatic deployment
/ root @ xuegod63 ~ # curl - sSL https://github.com/jumpserver/jumpserver/releases/download/v2.10.2/quick_start.sh | bash
CD goes to the installation administration directory to start JMS
[root@xuegod63 ~]# CD /opt/ jumpser-installer-v2.10.2 #./jmsctl.sh restart
Note: You do not need to configure boot because the new version of JumpServer runs as Docker. These Docker instances are automatically started after boot.
Web access, the new version provides two access addresses – one HTTP and one HTTPS
http://192.168.1.63:8080/core…User: admin Password: admin
https://192.168.1.63:8443/cor…
For the first login, you need to change the password. Here we change the password to 123456 for the test environment
2 JumpServer platform system initialization
2.1 Basic System Settings
Here to write their real URL address, or later users can not access.http://192.168.1.63, when the setting is complete,
And click the “Submit” button.
Here you can choose HTTP or HTTPS
http://192.168.1.63:8080
https://192.168.1.63:8443
We use HTTPS
2.2 Configure the mail sending server
Click the “Mail Settings” TAB at the top of the page to enter the Mail Settings page
163 mailbox configuration
Note: Please enable SMTP and POP3 services and add authorization code to your mailbox:
To enable POP3/SMTP/IMAP service:
Please log in to 163, click “Settings” at the top right corner of the page – under “Advanced”, click “POP3/SMTP/IMAP” to open it
Figure two options, and enable the client to delete the message reminder. You can unlock success. After opening can use lightning mail, Outlook and other software to receive
Sent an email.
New authorization password:
ARYAOQXHFMXGBJVR
babrziluawkibaej
My authorization code is automatically generated by the system and needs to be copied and saved
The server address: POP3 server: pop.163.com | SMTP server: smtp.163.com | IMAP service
Editor: imap.163.com
After submitting, test whether the mail can be sent normally.
Check your email in your mailbox
3. Use JumpServer to manage tens of thousands of King of Glory game servers
3.1 User Management
1. Add user groups.
The user name is the Jumpserver login account. User groups are used for asset authorization, when an asset is authorized to a user group
This asset is available to all users under the user group. Roles are used to distinguish a user from an administrator or a normal user.
Click User Management — > View User Groups — > Add User Groups
Added a new team – BBB 0 King of Glory – North China Operations Department
Look at the group you just added
2. Add users
Click User Management — > User List — > to create a user
Where, the name is the real name, and the user name is the JumpServer login account.
Then click Submit. You will receive an email saying the user created it successfully
Extension:
MFA, Multi-FactorAuthentication, is a simple and effective security authentication method. It can be
Add another layer of protection to your username and password. MFA devices, also known as dynamic password cards or Token cards, provide this kind of security authentication
Method of equipment.
MFA equipment such as:
Hardware MFA devices
The hardware MFA device is shown in the figure below. The 6-digit dynamic security code on the front is updated every 30 seconds, and the hardware MFA device is on the back
The serial number of.
Mobile phone verification code:
View the added user
To use the Traceless Browser, open a new window and log in to:
Upon successful submission of user information, JumpServer will send an email with “User Password” set to the mailbox you filled out.
Log in to 163 to see the following email:
Click the link to jump to Change Password: 123456
Using the browser, open in traceless mode:https://192.168.1.63:8443/User: mk Password: 123456
Log in successfully.
Switch to the admin user, give the new user mk, and configure the SSH key
Users can reset their passwords as well as their SSH keys for later logins: I’m on my other Linux machine, using mk
The user generates his or her own SSH key.
[root@xuegod63 ~]# useradd mk [root@xuegod63 ~]# echo 123456 | passwd --stdin mk [root@xuegod63 ~]# su - mk [mk@xuegod63 ~]$ssh-keygen # Go all the way [mk@xuegod63 ~]$cat ~/.ssh/id_rsa.pub ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFMqCGfXDW8UW7Dd0QoXzvnny/4u9ET2sKBt2 SQf+wVVS6pLJHE3QNXzHxg+uI1KRJwVtGiPWPtOQ4yj3HiMsBSLsFjOWFoIcv1myXYtLFuw ovLfUJgyCwD/LHfSgJ821bUQ2w9uUkAKirBJtjKFC/E4l9Z+GgZmLr9ckRWfZOt3g+xD3iNlh/l D4FlTYz0U9hlb4GrpikP5WtsYZgpIImMTgPsxq3yspQGvTpzsj1ApfOgt0SEHsqd1yYv4K+2bok MDrpTSmvsHXTWCBwpXsp2NQA2s1aDKJIOTY3mDCDQdJl9aMbBAjErdYFvEoNybNdH98K TcEQeCsrCrI0SfR9 [email protected]Paste the public key generated above into this:
Submit completed
3.2 Edit the asset tree to add nodes
Log in to JumpServer with the admin user to add a node. Nodes cannot be renamed. Right-click nodes can be added, removed, and renamed
Node, and perform asset-related operations.
The name is: King of Glory – North China – server
3.3 Create administrative users
Description of each user in JumpServer:
The administrative user is root of the server, or a user with NOPASSWD: ALL sudo permissions, which is used by JumpServer
Users to push system users, access to asset hardware information.
Name: King of Glory – North China – Server Management User -root password is: 123456
Presumably, all server root users on your King of Glory — North China — server node have a password of 123456
This enables you to use this root user to administer the server.
Note: When creating the “password” for the administrative user, you need to specify the password for the real root user on the server’s Linux system.
3.4 Create system users
The system user is the user that JumpServer uses to log on to the asset, which can be interpreted as the logging on asset user, and JumpServer uses the system user to log on to the asset.
The Sudo field of the system user is filled with the program path that allows the current system user to execute without the Sudo password, such as the default /sbin/ifconfig, which means that the current system user can directly execute the ifconfig command or Sudo ifconfig without the need to input the password of the former system user. Executing other commands still requires a password for access control purposes.
The permissions here should be customized after summarizing the needs of users. In principle, the minimum permissions can be given.
When the system user is created, if automatic push is selected, JumpServer will use Ansible to automatically push the system user into the asset. If the asset (switch, Windows) does not support Ansible, please manually fill in the account password.
The Linux system protocol must select SSH. If the user already exists in the system, remove the automatic key generation and automatic push tick
Optional.
Add a name: the user who checks the health of the server;
User name: user
Jurisdiction: / sbin/ifconfig, / usr/bin/top, / usr/bin/free
Add the system administrator user
Name: System Administrator User
; User name: manager
Sudo permissions: / usr/local/sbin /, / usr/local/bin /, / usr/sbin /, / usr/bin /, / root/bin /
Note: If you are writing a directory, you do not need a specific command. Add a/at the end of the directory path to make it easier to see. Of course not /
You can do that, but sometimes you might think of /usr/local/sbin as a command. Must be separated by English commas.
3.5 Creating Assets
Note: Before adding assets, be sure to run xuegod64 first
Start the virtual machine xuegod64.cn. This machine will be added to the platform as a resource later.
Host name: game64.xuegod.cn- King of Glory – North China
IP: 192.168.1.64
System platform: Linux
Protocol group: SSH 22
Admin user: King of Glory – North China – server admin user -root(root)
Set to complete and click “Submit”.
After the asset creation information is filled in and saved, press F5 to refresh the page. You can see that the asset can be connected and the description is normal:
If the asset does not connect properly, check that the admin user’s username and key are correct and that the admin user is able to use SSH
Login correctly from the JumpServer host to the asset host.
3.6 Create authorization rules
A node, which corresponds to an asset, represents all assets under that node.
A user group, which corresponds to a user, represents all users under that user group.
System users, and users under the selected user group, can use the assets under the selected node through the system users.
Nodes, user groups, and system users have a one-to-one relationship, so when you have different types of Linux and Windows assets, you should
Create authorization rules for Linux assets and Windows assets separately.
Name: King of Glory – Huahua Zone – Server Authorization Rules
Note: Users and user groups refer to who is to be authorized. If a user group is authorized, all users in that group have permissions.
User: No need to write User Group: King of Honor – North China Operations Department Note that assets and nodes can be authorized individually or on a node basis. If the North China node is authorized, all servers under the North China node are authorized. Asset: Node: /Default/ King of Glory – North China – Server Action: Check permissions, click to assign detailed permissions.
For other options, use the default and submit.
Note: the meaning of this authorization is: as long as the person in the group of “King of Glory – North China Operation and Maintenance Department”, the node “King of Glory – Hua”
All servers in North Region – Server have the privileges of System Administrator User.
After successful authorization, you can manually check it on XueGod64:
[root@xuegod64 ~]# tail /etc/passwd -n 5 dbus:x:81:81:System message bus:/:/sbin/nologin polkitd:x:999:998:User for polkitd:/:/sbin/nologin sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin Postfix: x: : 89-89: / var/spool/postfix: / sbin/nologin manager: x: 1000-1000: the system administrator users: / home/manager: / bin/bash # automatically push one account, [root@xuegod64 ~]# visudo #sudo () Manager ALL=(ALL) NOPASSWD: /usr/local/sbin,/usr/local/bin,/usr/sbin,/usr/bin,/root/bin3.7 User’s use of assets
Login Jumpserver:https://192.168.1.63:8443User: mk Password: 123456
When creating the authorization rule, the user group was selected, so you need to log in to the user below the selected user group to see the corresponding assets
Production.
Using the Traceless Browser, open another window and log in:
The page after the user has logged in correctly:
1. Use the Web interface to connect the assets, and click the Web Terminal on the left side of the page:
Open the node where the asset resides:
Double-click the asset name to connect the asset:
If the connection timeout is shown, check that the system user username and key assigned to the asset are correct and that the Linux operator is selected correctly
System, protocol SSH, port 22, and whether the firewall policy of the asset is properly configured.
Next, you can manipulate the asset.
3.8 Connect to the JumpServer administration server under the Xshell character terminal
[root@xuegod63 ~]# ssh-p2222 tag # Link to JumpServer or use Xshell to connect to JumpServer
Enter JumpServer user mk and password 123456
Click OK to start the connection
192.168.1.64: Opt> = 192.168.1.64: Opt> = 192.168.1.64
Connecting to mailto:[email protected] King of Glory – North China 0.3
Last login: Thu Jun 7 23:15:13 1718 from xuegod63.cn
[manager@xuegod64 ~]$whoami # Found that the login is using the system user manager
manager
[manager@xuegod64 ~]$ exit
logout
Opt> p # displays the hosts you have permissions on
Opt> g # displays the host group you have permissions on
3.9 View the historical command record
3.10 View the history session and play back the video
Online session
Session history
3.11 File management function
From here, you can create new folders or upload files to the server. These created files and uploaded files, there will be a target
Server/TMP directory
[root@xuegod64 ~]# ls /tmp/3.12 Operation center
1. Tasks list
A job is an instruction that JumpServer sends to an asset under its management, for example, to test asset connectivity, to get asset hardware messages
, test management user connectivity, and test system user connectivity. Displays the last 7 days of job records by default.
Click on the job name to view the details of the job, the historical version of the job, and the history of the job execution
2. Batch command
Through this function, you can quickly issue commands to assets. Currently, only the assets that can be managed by Ansible are supported, and the system user is required to log in
Equation is automatic login
For more information, you can parameter the official manual:
https://jumpserver.readthedoc…
https://docs.jumpserver.org/z…
4 Use JumpServer to manage the MySQL database
4.1 Install the MariaDB database
[root@xuegod64 ~]# yum install -y mariadb-server [perl ~]# systemctl enable --now mariadb set root password [root@xuegod64 ~]# mysqladmin-uroot password "123456" Create an ecshop database and a xuegod user. To specify a xuegod user, you can log into the MySQL database from anywhere. [root@xuegod64 ~]# mysql -uroot -p123456 MariaDB [(none)]> create database ecshop; MariaDB [(none)]> use ecshop; Ecshop MariaDB [(none)]> create table user(id int (20),name char(40)); GRANT ALL PRIVILEGES ON *.* TO 'xuegod'@'%' IDENTIFIED BY '123456';4.2 JumpServer manages the database
Mysql > add user to Mysql system
Name: xuegod – mysql
Login mode: automatic login
The account information is the authorized user created after installing the database
User name: xuegod
Password: 123456
Create an
Name: xuegod – mysql
Host: 192.168.1.64
Port: 3306
Note: Here the database refers to the MySQL library, we test the environment select the MySQL database.
Specify the database to use after logging in: ecshop
Application of authorization
Name: xuegod – mysql
User Group: King of Glory – North China Operation and Maintenance Department
Application: xuegod – mysql
System user: xuegod-mysql
Once the authorization is complete, log in as an MK user and you can manage your MySQL application from your Web terminal.
Conclusion:
17.1 JumpServer Fortress Overview – Deploy the JumpServer runtime environment
17.2 JumpServer platform system initialization
17.3 Practice: Use JumpServer to manage tens of thousands of King of Glory game servers
17.4 Use JumpServer to manage the MySQL database
If you want to get the video tutorial, +V reply: “JumpServer” to get it!
