堡垒机下载安装

堡垒机下载安装

运维还是太危险了，chatgpt直接速通了，还不用注册。

以下内容均为本地个人测试。

VMware Workstation 17 Pro

ubuntu-24.04-live-server-amd64.iso

1. 单机部署

sudo apt-get update
sudo apt update
sudo apt install openssh-server
#感觉可以不用自己下载postgresql和redis，后面部署用容器就行了
sudo apt install postgresql postgresql-contrib
sudo -u postgres psql -c "SELECT version();"
sudo -u postgres psql -c "create database jumpserver with encoding='UTF8';"
apt-get install -y wget curl tar gettext iptables

#redis
sudo apt install redis-server
systemctl restart unattended-upgrades.service
sudo systemctl start redis
sudo systemctl enable redis-server

磁盘扩容

root@jpserver:~# lsblk
NAME                      MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
sda                         8:0    0   40G  0 disk
├─sda1                      8:1    0    1M  0 part
├─sda2                      8:2    0  1.8G  0 part /boot
└─sda3                      8:3    0 18.2G  0 part
  └─ubuntu--vg-ubuntu--lv 252:0    0   10G  0 lvm  /
sr0                        11:0    1  2.6G  0 rom
root@jpserver:~# growpart /dev/sda 3
#扩容sda3

1.使用pvdisplay命令展示所有pv(物理卷)。可以看到Free PE(空闲物理扩展)为7225，表示可以进行扩展。

2. 使用vgdisplay命令展示所有vg(卷组)。

3. 使用lvdisplay命令展示所有lv(逻辑卷)。目前是10G。

lvextend -l +7225 /dev/ubuntu-vg/ubuntu-lv
#扩容根目录。lvextend -l(块数量，通过vgdisplay查看剩余pe数量。参考g) -r(递归) -L(指定具体大小)
exit

扩容

root@jpserver:~# resize2fs /dev/mapper/ubuntu--vg-ubuntu--lv
root@jpserver:~# df -h
Filesystem                         Size  Used Avail Use% Mounted on
tmpfs                              387M  1.6M  386M   1% /run
/dev/mapper/ubuntu--vg-ubuntu--lv   38G  9.1G   27G  26% /
tmpfs                              1.9G  1.1M  1.9G   1% /dev/shm
tmpfs                              5.0M     0  5.0M   0% /run/lock
/dev/sda2                          1.8G   95M  1.6G   6% /boot
tmpfs                              387M   12K  387M   1% /run/user/1000

cd /opt
curl http://10.10.51.142:9000/jumpserver-ce-v4.10.14-x86_64.tar.gz --output jumpserver-ce-v4.10.14-x86_64.tar.gz
tar -xf jumpserver-ce-v4.10.14-x86_64.tar.gz
cd jumpserver-ce-v4.10.14-x86_64
# 安装
./jmsctl.sh install

# 启动
./jmsctl.sh start
# 停止
./jmsctl.sh down

# 卸载
./jmsctl.sh uninstall
地址: http://<JumpServer服务器IP地址>:<服务运行端口>
用户名: admin
密码: ChangeMe

http://192.168.201.128/core/auth/login/?next=/ui/

2. keepalived主从架构部署

参考图

• 数据库：采用 MySQL 主主复制，确保数据一致性和高可用性。
• 缓存：配置 Redis 主从复制，提升会话数据的可靠性。
• 文件同步：通过 rsync 定时同步共享目录，保障审计和录屏文件的一致性。
• 服务切换：利用 keepalived 配置虚拟 IP（VIP），对外提供统一的服务入口，实现故障自动切换。

1. 虚拟机准备

账号 test

密码 root

ubuntu 24.04

sudo apt-get update
sudo apt update
sudo apt install openssh-server
sudo apt install net-tools
apt-get install -y wget curl tar gettext iptables

#安装 sync 
#sudo apt install rsync -y
mkdir /data
chmod 777 -R /data

sudo nano /etc/ssh/sshd_config
#找到并修改以下两项
#PermitRootLogin prohibit-password
#PasswordAuthentication no
PermitRootLogin yes
PasswordAuthentication yes

#重启ssh
sudo systemctl restart ssh
#设置密码不然无法登录 ssh root@192.168.201.129
sudo passwd root
# 防火墙放行端口，不然远程连接不了，有点多余
sudo ufw allow 3306/tcp

然后克隆一个从服务器，并按下图配置

名称	hostname	ip	os
主服务器	master	192.168.201.129	ubuntu 24.04
从服务器	slave	192.168.201.130	ubuntu 24.04
虚拟ip	无	192.168.201.135	无
测试机	test	192.168.201.133	ubuntu 24.04

改名

sudo hostnamectl set-hostname <新主机名>

2. 本地测试要配置静态路由

主服务器设置静态路由

sudo nano /etc/netplan/01-netcfg.yaml

network:
  version: 2
  renderer: networkd
  ethernets:
    ens33:
      dhcp4: no
      addresses:
        - 192.168.201.129/24
      nameservers:
        addresses: [8.8.8.8, 1.1.1.1]
      routes:
        - to: 0.0.0.0/0
          via: 192.168.201.2
          metric: 100

ctrl+o ，回车 保存文件

ctrl+X 退出

运行sudo netplan apply

同理，从服务器设置静态路由

network:
  version: 2
  renderer: networkd
  ethernets:
    ens33:
      dhcp4: no
      addresses:
        - 192.168.201.130/24
      nameservers:
        addresses: [8.8.8.8, 1.1.1.1]
      routes:
        - to: 0.0.0.0/0
          via: 192.168.201.2
          metric: 100

3. mysql配置

配置密钥同步(两台)

#登录主服务器 ssh root@192.168.201.129
root@master:~# ssh-keygen -t rsa -b 4096 -N "" -f ~/.ssh/id_rsa
ssh-copy-id -i /root/.ssh/id_rsa.pub root@192.168.201.130

#登录从服务器 ssh root@192.168.201.130
root@slave:~# ssh-keygen -t rsa -b 4096 -N "" -f /root/.ssh/id_rsa
ssh-copy-id -i /root/.ssh/id_rsa.pub root@192.168.201.129
#此时主服务器和从服务器可免密登录对方

配置数据同步

# master 上创建同步脚本 sync_to_slave.sh
[root@master ~]# nano sync_to_slave.sh
#!/bin/bash
rsync -avz /data/ root@192.168.201.130:/data/

# slave 上创建同步脚本 sync_to_master.sh
[root@slave ~]# nano sync_to_master.sh
#!/bin/bash
rsync -avz /data/ root@192.168.201.129:/data/

配置计划任务

[root@slave ~]# crontab -e
* * * * * /root/sync_to_master.sh

[root@master ~]# crontab -e
* * * * * /root/sync_to_slave.sh

安装mysql(两台)

sudo apt install mysql-server -y
sudo nano /etc/mysql/mysql.conf.d/mysqld.cnf

全选删除操作：光标移至开头，按alt+A设置锚点，然后光标移至末尾，按ctrl+K剪切

[mysqld]

# ==== 主从复制 必备 ====
server-id = 1 
#  主服务器为1，从服务器为2
bind-address = 0.0.0.0

log-bin = mysql-bin
binlog-format = ROW
expire_logs_days = 7
# 保留时间
binlog-ignore-db = mysql
binlog-ignore-db = performance_schema
binlog-ignore-db = information_schema

# ==== 字符集 ====
default_authentication_plugin = mysql_native_password
character-set-server = utf8mb4
collation-server = utf8mb4_general_ci
init_connect = 'SET NAMES utf8mb4'

# ==== 日志 & 错误 ====
log_error = /var/log/mysql/error.log
slow_query_log = 1
slow_query_log_file = /var/log/mysql/mysql-slow.log
long_query_time = 2
log-queries-not-using-indexes = 0

# ==== 性能调优 ====
max_connections = 1000
thread_cache_size = 300
tmp_table_size = 256M
max_heap_table_size = 256M

key_buffer_size = 16M

sort_buffer_size = 2M
join_buffer_size = 2M
read_buffer_size = 1M

# ==== InnoDB 调优 ====
innodb_buffer_pool_size = 2G
innodb_log_file_size = 128M
innodb_flush_log_at_trx_commit = 2
innodb_file_per_table = ON

# ==== 保留表缓存 ====
table_open_cache = 614

启用

sudo systemctl restart mysql
sudo systemctl enable mysql --now
#检查是否绑定到0.0.0.0
sudo mysql -u root -p -e "SHOW VARIABLES LIKE 'bind_address';"

创建主从复制账号(两台)

mysql -uroot -p
-- 创建主从复制账号
CREATE USER 'repl'@'%' IDENTIFIED WITH 'mysql_native_password' BY '123456';
-- 允许该账号用于复制
GRANT REPLICATION SLAVE ON *.* TO 'repl'@'%';
-- 创建jumpserver数据库和访问账号：
create database jumpserver default charset 'utf8'; 
create user 'jumpserver'@'%' identified by '123456'; 
grant all on jumpserver.* to 'jumpserver'@'%'; 
flush privileges;

在主服务器master上执行命令mysql> show master status;，记录File和Position，然后到从服务器slave上执行

CHANGE MASTER TO MASTER_HOST='192.168.201.129',MASTER_USER='repl',MASTER_PASSWORD='123456',MASTER_LOG_FILE='mysql-bin.000001',MASTER_LOG_POS=157;
start slave;

在从服务器slave上执行命令mysql> show master status;，记录File和Position，然后到主服务器master上执行

CHANGE MASTER TO MASTER_HOST='192.168.201.130',MASTER_USER='repl',MASTER_PASSWORD='123456',MASTER_LOG_FILE='mysql-bin.000001',MASTER_LOG_POS=157;
start slave;

检查复制状态，如果Slave_IO_Running和Slave_SQL_Running都是Yes代表复制OK

mysql> SHOW SLAVE STATUS\G

4. redis配置

#两台服务器安装redis
sudo apt install redis-server -y
redis-server --version
# 7.0.15

#备份一下
sudo cp /etc/redis/redis.conf /etc/redis/redis.conf.bak

#主服务器
sudo nano /etc/redis/redis.conf
#将对应配置修改成如下
bind 0.0.0.0
requirepass 123456
masterauth 123456
maxmemory-policy allkeys-lru

# 从服务器
sudo nano /etc/redis/redis.conf
#将对应配置修改成如下
bind 0.0.0.0
requirepass 123456
masterauth 123456
maxmemory-policy allkeys-lru
replicaof 192.168.201.129 6379

requirepass 是客户端连接 Redis 时的登录密码

masterauth 是从库连接主库时的密码

策略	淘汰范围	淘汰规则	内存满时写入新数据
noeviction（默认）	无	不淘汰任何 key	❌ 写入失败
allkeys‑lru	所有 key	最近最少使用的 key 先淘汰	✔️ 自动淘汰旧数据以写入新数据

两台机子重启redis

sudo systemctl restart redis-server
systemctl enable redis-server --now
sudo systemctl status redis-server

检查同步状态

root@master:~# redis-cli -a 123456 -p 6379 info replication
Warning: Using a password with '-a' or '-u' option on the command line interface may not be safe.
# Replication
role:master
connected_slaves:1
slave0:ip=192.168.201.130,port=6379,state=online,offset=224,lag=1
master_failover_state:no-failover
master_replid:98f9c7e620b7c5d62ed433acb5c1e24b5b996595
master_replid2:0000000000000000000000000000000000000000
master_repl_offset:224
second_repl_offset:-1
repl_backlog_active:1
repl_backlog_size:1048576
repl_backlog_first_byte_offset:1
repl_backlog_histlen:224

root@slave:~# redis-cli -a 123456 -p 6379 info replication
Warning: Using a password with '-a' or '-u' option on the command line interface may not be safe.
# Replication
role:slave
master_host:192.168.201.129
master_port:6379
master_link_status:up
master_last_io_seconds_ago:8
master_sync_in_progress:0
slave_read_repl_offset:266
slave_repl_offset:266
slave_priority:100
slave_read_only:1
replica_announced:1
connected_slaves:0
master_failover_state:no-failover
master_replid:98f9c7e620b7c5d62ed433acb5c1e24b5b996595
master_replid2:0000000000000000000000000000000000000000
master_repl_offset:266
second_repl_offset:-1
repl_backlog_active:1
repl_backlog_size:1048576
repl_backlog_first_byte_offset:1
repl_backlog_histlen:266

主从切换脚本：Keepalived切换IP的时候需要把redis的状态切换过去。

#将当前节点切换为从，指定主库的IP为192.168.201.130
redis-cli -a 123456 -p 6379 slaveof 192.168.201.130 6379
#切换为主
redis-cli -a 123456 -p 6379 SLAVEOF NO ONE
#查看主从同步状态
redis-cli -a 123456 -p 6379 info replication

5. Keepalived 配置

#两台机子下载
sudo apt install keepalived -y
keepalived -v
# Keepalived v2.2.8
sudo nano /etc/keepalived/keepalived.conf

! Configuration File for keepalived

global_defs {
    script_user root
}

vrrp_script checkredis {
    script "/root/check_port_listen.sh 6379" # redis
    interval 3
    weight -20
}

vrrp_instance VI_1 {
    state MASTER      # MASTER 表示主机，BACKUP 表示备机
    interface ens33  # 网卡名称，根据实际网卡名称调整
    virtual_router_id 11 #标识虚拟路由器的唯一 ID
    priority 200       # 主机优先级更高，从机填100就行
    advert_int 1 # 指定 VRRP 状态更新的广播间隔为 1 秒
    authentication {
        auth_type PASS
        auth_pass 123456  # 设置虚拟路由器的认证密码
    }
    virtual_ipaddress {
        192.168.201.135   # 虚拟IP地址，根据需要修改
    }

    track_script {
        checkredis      # 监控 Redis 状态
    }

    notify_master "/root/redis_master.sh"  #主机成为 master 时执行的脚本
    notify_backup "/root/redis_slave.sh"   #备机成为 backup 时执行的脚本
}

两台机子

sudo nano /root/redis_master.sh #切换成主节点

#!/bin/bash

LOG=/var/log/redis_switch.log

date >> $LOG
echo ">> Switching to MASTER <<" >> $LOG

# 切换为主节点
/usr/bin/redis-cli -a 123456 -p 6379 SLAVEOF NO ONE >> $LOG 2>&1

if [[ $? -eq 0 ]]; then
    echo "Redis successfully switched to MASTER." >> $LOG
else
    echo "Failed to switch Redis to MASTER." >> $LOG
    exit 1
fi

echo ">> MASTER switch complete <<" >> $LOG
exit 0

两台机子

sudo mkdir -p /data/paraview/esc/log/
sudo chown root:root /data/paraview/esc/log/
sudo chmod 755 /data/paraview/esc/log/
sudo nano /root/redis_slave.sh

#!/bin/bash

LOG=/data/paraview/esc/log/redis_switch.log
MASTER_IP="192.168.201.130"     # 这里互相写对方的IP地址

date >> $LOG
echo ">> Switching to SLAVE <<" >> $LOG

# 切换为从节点
/usr/bin/redis-cli -a 123456 -p 6379 slaveof $MASTER_IP 6379 >> $LOG 2>&1

if [[ $? -eq 0 ]]; then
    echo "Redis successfully switched to SLAVE of $MASTER_IP." >> $LOG
else
    echo "Failed to switch Redis to SLAVE." >> $LOG
    exit 1
fi

echo ">> SLAVE switch complete <<" >> $LOG
exit 0

两台机子

sudo nano /root/check_port_listen.sh

#!/bin/sh

PORT=$1

pro_count=`netstat -na | grep ":$PORT " | grep LISTEN | wc -l`

if [ "$pro_count"z != "0"z ];then
        exit 0
else
        exit 1
fi

两台机子对以上脚本赋予执行权限

sudo chmod +x /root/redis_master.sh
sudo chmod +x /root/redis_slave.sh
sudo chmod +x /root/check_port_listen.sh
sudo chmod +x /root/sync_to_slave.sh
sudo chmod +x /root/sync_to_master.sh
ls -al /root

两台机子

sudo systemctl enable keepalived --now
sudo systemctl restart keepalived
sudo systemctl status keepalived

VIP切换测试

查看VIP位置：ip a s | grep 192.168.201

root@master:~# ip a s | grep 192.168.201
    inet 192.168.201.129/24 brd 192.168.201.255 scope global ens33
    inet 192.168.201.135/32 scope global ens33
    inet 192.168.201.132/24 metric 100 brd 192.168.201.255 scope global secondary dynamic ens33

root@slave:~# ip a s | grep 192.168.201
    inet 192.168.201.130/24 brd 192.168.201.255 scope global ens33
    inet 192.168.201.132/24 metric 100 brd 192.168.201.255 scope global secondary dynamic ens33

停止主机的keepalived，可以看到VIP地址切换到了备机，同时备机的Redis状态变为了master。然后开启主机的keepalived，备机的Redis又变为slave了。

root@slave:~# redis-cli -a 123456 info replication
Warning: Using a password with '-a' or '-u' option on the command line interface may not be safe.
# Replication
role:master

6. jumpserver安装

上传jumpserver-ce-v4.10.14-x86_64.tar.gz 到 /root/

tar -xf jumpserver-ce-v4.10.14-x86_64.tar.gz

cd jumpserver-ce-v4.10.14-x86_64

修改配置文件对应部分：nano config-example.txt

SECRET_KEY=manbaOut123 
# 要其他 JumpServer 服务器一致 (*)
BOOTSTRAP_TOKEN=manbaOut123       
# 要其他 JumpServer 服务器一致 (*)
SESSION_EXPIRE_AT_BROWSER_CLOSE=True        
# 关闭浏览器 session 过期

DB_ENGINE=mysql
DB_HOST=192.168.201.129
# 从服务器是192.168.201.130，也可以填写VIP的地址
DB_PORT=3306
DB_USER=jumpserver
DB_PASSWORD=123456
DB_NAME=jumpserver

REDIS_HOST=192.168.201.135
# redis填写VIP的地址
REDIS_PORT=6379
REDIS_PASSWORD=123456

SHARE_ROOM_TYPE=redis                      
# KoKo Lion 使用 redis 共享
REUSE_CONNECTION=False                     
# Koko 禁用连接复用

两台机器安装：./jmsctl.sh install

注意以下选项，其他默认就好

3. Configure DB
Do you want to use external MySQL? (y/n)  (default y): y
Please enter DB server IP (default 192.168.201.129):
# 从机是192.168.201.130
Please enter DB server port (default 3306):
Please enter DB database name (default jumpserver):
Please enter DB username (default jumpserver):
Please enter DB password (default 123456):
complete

4. Configure Redis
Please enter Redis Engine? (redis/sentinel)  (default redis):
Do you want to use external Redis? (y/n)  (default y): y
Please enter Redis server IP (default 192.168.201.135):
Please enter Redis server port (default 6379):
Please enter Redis password (default 123456):
complete

启动jumpserver

jmsctl start

Default username: admin Default password: ChangeMe

admin123

7. 灾备测试

使用firefox测试

192.168.201.129，192.168.201.135，192.168.201.130均可访问，且在主服务器或者从服务器的数据都会同步到对方机器上。

关掉主服务器，保留从服务器，192.168.201.135依然可以访问并正常使用。

关掉从服务器，保留主服务器，192.168.201.135依然可以访问并正常使用。

参考

https://zhuanlan.zhihu.com/p/1893033431660740653

https://blog.fit2cloud.com/?p=a60970fc-bfc6-4262-a0ce-089f95968af6

jumpserver： https://docs.jumpserver.org/zh/v4/installation/setup_linux_standalone/offline_install/#1

postgresql： https://cloud.tencent.com/developer/article/1632506

nano

ctrl+W 搜索字符串
ctrl+O+回车 保存
ctrl+X 退出
alt+A 设置锚点
alt+K 剪切