docker-compose 安装部署jumpserver和常用rdp错误排查解决

偏执的太偏执、 2022-11-29 11:46 222阅读 0赞

# 参考官方文档 #

[https://docs.jumpserver.org/zh/master/install/docker\_install/][https_docs.jumpserver.org_zh_master_install_docker_install]

[https://docs.jumpserver.org/zh/1.4.8/faq\_rdp.html][https_docs.jumpserver.org_zh_1.4.8_faq_rdp.html]

# 一.环境部署 #

### 1.搭建docker环境 ###

`yum -y install docker`

### 2.安装docker-compose ###

centos 
    sudo yum-config-manager \
        --add-repo \
        http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
    
    sudo yum install docker-ce
    启动docker服务sudo systemctl start docker
    编辑sudo vi /etc/docker/daemon.json
    {
      "registry-mirrors": ["https://dockerhub.azk8s.cn"],
      "data-root": "/data/docker",
      "metrics-addr" : "0.0.0.0:9323",
      "experimental" : true ,
      "bip": "172.31.0.1/24",
      "default-address-pools":[
        {"base":"172.31.0.0/16","size":24}
      ]
    }
    
    sudo systemctl enable docker
    sudo systemctl restart docker
    
    #docker-compose下载
    sudo curl -L https://github.com/docker/compose/releases/download/1.24.1/docker-compose-`uname -s`-`uname -m` -o /usr/local/bin/docker-compose
    
    sudo chmod +x /usr/local/bin/docker-compose
    sudo ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose

### 3.创建项目目录 ###

mkdir -p /home/xxx/jms
    cd jms

### 4.下载jms的docker项目 ###

`git clone https://github.com/wojiushixiaobai/docker-compose.git`  
![Docker-compose部署jumpserver堡垒机][Docker-compose_jumpserver]

version: '3'
    services:
      mysql:
        image: jumpserver/jms_mysql:${Version}
        container_name: jms_mysql
        restart: always
        tty: true
        environment:
          DB_PORT: $DB_PORT
          DB_USER: $DB_USER
          DB_PASSWORD: $DB_PASSWORD
          DB_NAME: $DB_NAME
        volumes:
          - mysql-data:/var/lib/mysql
        networks:
          - jumpserver
    
      redis:
        image: jumpserver/jms_redis:${Version}
        container_name: jms_redis
        restart: always
        tty: true
        environment:
          REDIS_PORT: $REDIS_PORT
          REDIS_PASSWORD: $REDIS_PASSWORD
        volumes:
          - redis-data:/var/lib/redis/
        networks:
          - jumpserver
    
      core:
        image: jumpserver/jms_core:${Version}
        container_name: jms_core
        restart: always
        tty: true
        environment:
          SECRET_KEY: $SECRET_KEY
          BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN
          LOG_LEVEL: $LOG_LEVEL
          DB_HOST: $DB_HOST
          DB_PORT: $DB_PORT
          DB_USER: $DB_USER
          DB_PASSWORD: $DB_PASSWORD
          DB_NAME: $DB_NAME
          REDIS_HOST: $REDIS_HOST
          REDIS_PORT: $REDIS_PORT
          REDIS_PASSWORD: $REDIS_PASSWORD
          WINDOWS_SKIP_ALL_MANUAL_PASSWORD: "FALSE"
        depends_on:
          - mysql
          - redis
        volumes:
          - core-data:/opt/jumpserver/data
        networks:
          - jumpserver
    
      koko:
        image: jumpserver/jms_koko:${Version}
        container_name: jms_koko
        restart: always
        tty: true
        environment:
          CORE_HOST: http://core:8080
          BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN
          LOG_LEVEL: $LOG_LEVEL
        depends_on:
          - core
          - mysql
          - redis
        volumes:
          - koko-keys:/opt/koko/data/keys
        ports:
          - 2222:2222
        networks:
          - jumpserver
      guacamole:
        image: jumpserver/jms_guacamole:${Version}
        container_name: jms_guacamole
        restart: always
        tty: true
        environment:
          JUMPSERVER_SERVER: http://core:8080
          BOOTSTRAP_TOKEN: $BOOTSTRAP_TOKEN
          GUACAMOLE_LOG_LEVEL: $LOG_LEVEL
        depends_on:
          - core
          - mysql
          - redis
        volumes:
          - guacamole-keys:/config/guacamole/keys
        networks:
          - jumpserver
    
      nginx:
        image: jumpserver/jms_nginx:${Version}
        container_name: jms_nginx
        restart: always
        tty: true
        depends_on:
          - core
          - koko
          - mysql
          - redis
        volumes:
          - core-data:/opt/jumpserver/data
        ports:
          - 80:80
        networks:
          - jumpserver
    
    volumes:
      mysql-data:
      redis-data:
      core-data:
      koko-keys:
      guacamole-keys:
    
    networks:
      jumpserver:

### 5.用docker-compose启动项目 ###

`docker-compose up -d`  
![Docker-compose部署jumpserver堡垒机][Docker-compose_jumpserver 1]  
![Docker-compose部署jumpserver堡垒机][Docker-compose_jumpserver 2]

# 二.jumpserver后台配置添加主机资产并授权访问。 #

### 1.登录jump server后台，默认的登录用户名和密码均为：admin ###

![Docker-compose部署jumpserver堡垒机][Docker-compose_jumpserver 3]

### 2.配置系统用户。 ###

![Docker-compose部署jumpserver堡垒机][Docker-compose_jumpserver 4]

### 3.配置管理用户。 ###

![Docker-compose部署jumpserver堡垒机][Docker-compose_jumpserver 5]

### 4.创建用户组 ###

![Docker-compose部署jumpserver堡垒机][Docker-compose_jumpserver 6]

### 5.创建jumpserver后台用户. ###

![Docker-compose部署jumpserver堡垒机][Docker-compose_jumpserver 7]

### 6.创建资产主机。 ###

![Docker-compose部署jumpserver堡垒机][Docker-compose_jumpserver 8]

### 7.创建资产授权规则。 ###

![Docker-compose部署jumpserver堡垒机][Docker-compose_jumpserver 9]

### 8.后台web查看是否有资产并验证登录 ###

![Docker-compose部署jumpserver堡垒机][Docker-compose_jumpserver 10]  
![Docker-compose部署jumpserver堡垒机][Docker-compose_jumpserver 11]

### 9.使用xsheel登录jumpserver，登录被控主机。 ###

登录用户名为后台配置得后台用户，例如admin ：admin 登录端口为2222  
![Docker-compose部署jumpserver堡垒机][Docker-compose_jumpserver 12]  
![Docker-compose部署jumpserver堡垒机][Docker-compose_jumpserver 13]  
![Docker-compose部署jumpserver堡垒机][Docker-compose_jumpserver 14]

![Docker-compose部署jumpserver堡垒机][Docker-compose_jumpserver 15]  
![Docker-compose部署jumpserver堡垒机][Docker-compose_jumpserver 16]

# RDP 协议资产连接说明 #

RDP 协议资产连接错误排查思路

(1). 如果白屏  检查nginx配置文件的guacamole设置ip是否正确, 检查终端管理的gua状态是否在线
    (2). 如果显示没有权限 是你 终端管理里 guacamole 状态为红色或者没有注册成功
    (3). 如果显示未知问题 可能是你的资产填写的端口不对, 或者授权的系统用户的协议不是rdp
    (4). 提示无法连接服务器 一般情况下是登录的系统账户不正确或者防火墙设置有误, 资产的信息填写不正确也会报这个错误
    (5). 提示网络问题无法连接或者超时, 请检查网络连接并重试, 或联系管理员 一般情况下网络有问题

1.  检查终端是否在线

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3Njc0ODU4_size_16_color_FFFFFF_t_70][]

# 如果终端不在线, 请检查 guacamole 的 BOOTSTRAP_TOKEN 是否与 jumpserver 一致, 如果不一致请修改后重启
    $ cat /opt/jumpserver/config.yml | grep BOOTSTRAP_TOKEN
    $ env | grep BOOTSTRAP_TOKEN
    
    $ /etc/init.d/guacd stop
    $ sh /config/tomcat8/bin/shutdown.sh
    $ rm -rf /config/guacamole/keys/*
    $ /etc/init.d/guacd start
    $ sh /config/tomcat8/bin/startup.sh
    
    # docker 部署请直接删除容器后重建, 记得一定要先在 终端管理 删除不在线的组件
    $ docker stop jms_guacamole
    $ docker rm jms_guacamole
    
    # http://<Jumpserver_url> 指向 jumpserver 的服务url, 如 http://192.168.244.144:8080
    # BOOTSTRAP_TOKEN 为 Jumpserver/config.yml 里面的 BOOTSTRAP_TOKEN
    $ docker run --name jms_guacamole -d -p 8081:8081 -e JUMPSERVER_SERVER=http://<Jumpserver_url> -e BOOTSTRAP_TOKEN=xxxxxx jumpserver/jms_guacamole:1.4.8
    
    # 正常运行后到Jumpserver 会话管理-终端管理 里面查看 gua 的状态是否为绿色(等待大概5s后刷新页面)

1.  登录要连接的windows资产, 检查远程设置和防火墙设置

# Windows 7/2008 勾选 允许运行任意版本远程桌面的计算机连接(较不安全)(L)
    # Windows 8/10/2012 只勾选 允许远程连接到此计算机(L), 其他选项请取消勾选
    
    # Windows防火墙-高级设置-入站规则 把远程桌面开头的选项 右键-启用规则
    # Windows 7/2008 启用 远程桌面(TCP-In)
    # Windows 8/10/2012 启用 远程桌面-用户模式(TCP-In)

![\_images/faq\_windows\_firewalld.jpg][images_faq_windows_firewalld.jpg]

1.  登录要连接的windows资产, 检查用户和IP信息(Windows目前还不支持推送, 所以必须使用资产上面已存在的用户进行登录)

# 注：因为 windows 暂时不支持推送, 所以必须使用资产上面已经存在的账户进行登录, 如 administrator 账户

![\_images/faq\_windows\_02.jpg][images_faq_windows_02.jpg]

1.  创建Windows资产管理用户(如果是域资产, 格式是uesr@domain.com)

# 不带域的用户直接输入用户名即可, 如 administrator
    # 域用户的用户名格式为 user@domain.com, 如 administrator@jumpserver.org

![\_images/faq\_windows\_03.jpg][images_faq_windows_03.jpg]

1.  创建Windows资产系统用户(如果是域资产, 格式是uesr@domain.com, 注意协议不要选错)

# 注：因为 windows 暂时不支持推送, 所以必须使用资产上面已经存在的账户进行登录, 如 administrator 账户
    # 不带域的用户直接输入用户名即可, 如 administrator
    # 域用户的用户名格式为 user@domain.com, 如 administrator@jumpserver.org
    # 如果想让用户登录资产时自己输入资产的账户密码, 可以点击系统用户的名称 点击清除认证信息
    # 此处必须输入能正确登录 windows 资产的 账户密码
    # 如不确实是不是因为密码或者账户信息错误导致的无法登录, 可以使用手动登录功能(在系统用户处设置)

![\_images/faq\_windows\_04.jpg][images_faq_windows_04.jpg]

1.  创建Windows资产(注意端口不要填错)

# Windows 7/8/2008/2012 "系统平台"选择 "Windows"
    # Windows 10/2016 "系统平台"选择 "Windows(2016)"

![\_images/faq\_windows\_05.jpg][images_faq_windows_05.jpg]

1.  创建授权规则

# 先定位到 windows 的资产, 然后授权, 如果资产用户密码不一致, 请不要直接在节点上授权

![\_images/faq\_windows\_06.jpg][images_faq_windows_06.jpg]

1.  使用web terminal登录(如果登录报错, 检查防火墙的设置, 可以参考FAQ)

![\_images/faq\_windows\_07.jpg][images_faq_windows_07.jpg]

1.  Windows 资产文件上传和下载

# 直接拖拽文件到 windows 窗口即可, 文件上传后在 Guacamole RDP上的 G 目录查看
    # 下载在 luna 页面, 按 ctrl+alt+shift, 选择文件下载即可

![\_images/faq\_windows\_08.jpg][images_faq_windows_08.jpg]

[https_docs.jumpserver.org_zh_master_install_docker_install]: https://docs.jumpserver.org/zh/master/install/docker_install/
[https_docs.jumpserver.org_zh_1.4.8_faq_rdp.html]: https://docs.jumpserver.org/zh/1.4.8/faq_rdp.html
[Docker-compose_jumpserver]: /images/20221124/5e11df0c9599458c87932adc473b1c36.png
[Docker-compose_jumpserver 1]: /images/20221124/42f23eea3cef40cea45e9f4ca3a2e6d8.png
[Docker-compose_jumpserver 2]: /images/20221124/c235692875244da198fdb705db0af022.png
[Docker-compose_jumpserver 3]: /images/20221124/977f46629a9b48e5b634d62183b41fef.png
[Docker-compose_jumpserver 4]: /images/20221124/259ef74dd43e44dd9a380a929046c331.png
[Docker-compose_jumpserver 5]: /images/20221124/2f1c9be3c21d4644b073828ec4501b07.png
[Docker-compose_jumpserver 6]: /images/20221124/c0017297141b4b9e915cbec1a12365bf.png
[Docker-compose_jumpserver 7]: /images/20221124/9c9ca9b3f0f8415a978bb81dff84c5bd.png
[Docker-compose_jumpserver 8]: /images/20221124/fc8f6e35c162428ba6916a9453f411e1.png
[Docker-compose_jumpserver 9]: /images/20221124/a1783abdbe0a40e39db77361a8a97dbd.png
[Docker-compose_jumpserver 10]: /images/20221124/97ad4ef6793140748269a074f821454d.png
[Docker-compose_jumpserver 11]: /images/20221124/926ca8e6826943d58bc50e912e9df7b5.png
[Docker-compose_jumpserver 12]: /images/20221124/bab8d2099545445e943355f1a6d2c281.png
[Docker-compose_jumpserver 13]: /images/20221124/1ce78c9c143a4f31b69b5f1b4a4e3412.png
[Docker-compose_jumpserver 14]: /images/20221124/8d2630859a7d451e83ddef03dccf5004.png
[Docker-compose_jumpserver 15]: /images/20221124/fa62f16df97e4e529321a0178303cfa6.png
[Docker-compose_jumpserver 16]: /images/20221124/4e3d3aa1b81d4e50a3b3ee43052290be.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3Njc0ODU4_size_16_color_FFFFFF_t_70]: /images/20221124/c87bb02381f44ccb908297a31f333c48.png
[images_faq_windows_firewalld.jpg]: /images/20221124/08129245b46a4c58a73412f45e207f94.png
[images_faq_windows_02.jpg]: /images/20221124/9482e420dc71498da800ccbd11677e8c.png
[images_faq_windows_03.jpg]: /images/20221124/260d9c561a024d69bd5833c097c293a4.png
[images_faq_windows_04.jpg]: /images/20221124/051d4cff6f0b40dab5a0eba8b5aa02f9.png
[images_faq_windows_05.jpg]: /images/20221124/a4db4564e6ec43ccb4f2fc112d47071d.png
[images_faq_windows_06.jpg]: /images/20221124/07969a4faeb84e05b99efffb90528b52.png
[images_faq_windows_07.jpg]: /images/20221124/0c8c852c4bf148dabdaa4c48bf079eaa.png
[images_faq_windows_08.jpg]: /images/20221124/0030eab8b08d42f5a0187c3c6966a27a.png