JumpServer官方版是一款专业的企业安全终端防护软件，一款能够让每一个用户都能在软件中轻松实现不一样的安全管理，让每一个企业免收外来的攻击。JumpServer堡垒机最新版深受每一个公司企业的信赖，全心全意保护企业的安全，提供了一站式资产维护体系，用户可以在这里轻松管理，使用起来更方便。

JumpServer企业版从创立至今始终坚持开源开放，始终坚持倾听社区心声，始终坚持高质量快速迭代，并且将继续秉承这些原则，打造多云环境下更好用的堡垒机，改变世界，从一点点开始。

JumpServer官方版特色

登录认证

资源统一登录和认证；LDAP / AD 认证；RADIUS 认证；实现单点登录（OpenID 认证、CAS 认证）；SSO 对接；扫码登录（企业微信认证、钉钉认证）；

多因?认证

MFA 二次认证（Google Authenticator）；RADIUS 二次认证；

登录复核（X-Pack）

用户登录行为受管理员的监管与控制；

登录限制

用户登录来源 IP 受管理员控制（支持黑 / 白名单）；

多维度授权

可对用户、用户组、资产、资产节点、应用以及系统用户进行授权；

资产授权

资产树以树状结构进行展示；资产和节点均可灵活授权；节点内资产自动继承授权；子节点自动继承父节点授权；

数据库授权

支持 MySQL 、Oracle（X-Pack）、PostgreSQL（X-Pack） 、MariaDB （X-Pack）数据库应用授权；

应用授权

实现更细粒度的应用级授权；

Kubernetes 授权

支持用户通过 JumpServer 连接 Kubernetes 集群；

RemoteApp 远程应用（X-Pack）

针对 Windows 系统实现更细粒度的应用级授权，并对应用操作录像进行回放审计；

动作授权

实现对授权资产的文件上传、下载以及连接动作的控制；支持剪切板复制 / 粘贴（Windows 资产）；

时间授权

实现对授权资源使用时间段的限制；

特权指令

实现对特权指令的使用，支持黑白名单；

命令过滤

实现对授权系统用户所执行的命令进行控制；

文件传输与管理

支持 SFTP 文件上传 / 下载；支持 Web SFTP 文件管理；

工单管理（X-Pack）

支持对用户登录请求行为进行控制；支持授权工单申请；

组织管理（X-Pack）

实现多租户管理与权限隔离；全局组织功能；

访问控制（X-Pack）

支持对通过 SSH 和 Telnet 协议登录的资产进行复核；

JumpServer官方版支持钉钉、企业微信

JumpServer开源堡垒机正式发布v2.10.0版本。在该版本中，JumpServer支持用户通过企业微信、钉钉进行登录，满足了更多企业用户的实际需求。

这一版本的JumpServer还新增了Lion图形化连接组件，该组件主要是使用Golang和Vue.js重构了JumpServer的Guacamole组件。Lion图形化连接组件极大地优化了对系统资源的占用，增强了JumpServer对RDP/VNC协议会话的管理与控制，完善了原有的连接、终断、上传/下载、录像上传、文件上传/下载审计等功能，并且新增了Windows会话监控的功能。

JumpServer企业版附含的X-Pack增强包新增命令复核功能，针对风险命令，审批人可审批该命令是否可以执行。

1. 支持用户通过企业微信、钉钉登录到JumpServer

在JumpServer v2.10.0版本中，支持用户通过企业微信、钉钉进行登录，以满足更多企业的实际需求。管理员只需在“系统设置”→“企业微信”或者“钉钉”配置好相应的信息，用户在个人信息中点击绑定企业微信或钉钉，按要求进行扫码即可绑定成功。在登录页面点击“企业微信”或“钉钉”，扫码后即可成功登录到JumpServer。

2. 新增Lion图形化连接组件，支持RDP/VNC协议的会话监控

在JumpServer v2.10.0版本中，新增Lion图形化连接组件。该组件主要是使用Golang和Vue.js重构了JumpServer的Guacamole组件。Lion图形化连接组件极大地优化了对系统资源的占用，增强了JumpServer对RDP/VNC协议会话的管理与控制，完善了原有的连接、终断、上传/下载、录像上传、文件上传/下载审计等功能，并且新增了Windows会话监控的功能。

3. 新增命令复核功能（X-Pack增强包内）

JumpServer v2.10.0版本的X-Pack增强包新增了命令复核功能。管理员选择“命令过滤”→“命令过滤规则”，即可创建一个命令过滤复核动作的规则。管理员可以根据需要设定规则，对规则类型、规则内容、审批人等信息进行设置。然后，将该命令过滤设置给某个系统用户，当用户使用该系统用户登录资产时，输入该规则中的命令，即会发送命令复核工单给审批人。待审批人同意后，该命令才可执行。

JumpServer官方版搭建简易堡垒机

具备堡垒机的条件是，该机器有公司和私网，其中私网和机房其他机器互通

设计堡垒机思路

跳板机安全设置（iptables端口限制、登录限制sshd-config）

用户、命令权限限制（iailkit）http://blog.chinaunix.net/uid-28310119-id-3503318.htm

客户机器日志审计t http://www.68idc.cn/help/server/1inux/2014042190951.html

源码安装jailkit

cd /usr/local/src/

wget https://olivier.sessink.nl/jailkit/jailkit-2.19.tar.bz2

tar -jxvf jailkit-2.19.tar.bz2

cd jailkit-2.19/

yum install gcc -y

./configure

make && make install

创建虚拟系统的根目录，并把常用命令添加到虚拟系统的根目录下

jk_init -v -j /home/jail/ basicshell

jk_init -v -j /home/jail/ editors

jk_init -v -j /home/jail/ netutils

jk_init -v -j /home/jail/ ssh

]# cd /home/jail/

]# ls

bin dev etc lib64 usr

创建用户

]# useradd zhangsan;echo '123456' | passwd --stdin zhangsan

更改用户 zhangsan 的密码 。

passwd：所有的身份验证令牌已经成功更新。

创建sbin目录，拷贝虚拟系统 shell

]# mkdir /home/jail/usr/sbin

]# cp /usr/sbin/jk_lsh /home/jail/usr/sbin/jk_lsh

刚刚创建的用户更改为虚拟系统用户

[root@test1 jail]# jk_jailuser -m -j /home/jail zhangsan

[root@test1 jail]# cat /home/jail/etc/passwd

root:x:0:0:root:/root:/bin/bash

zhangsan:x:1001:1001::/home/zhangsan:/usr/sbin/jk_lsh

修改虚拟用户登陆 shell

]# sed -ir '/^zhangsan/s@/usr/sbin/jk_lsh@/bin/bash@' /home/jail/etc/passwd

]# cat /home/jail/etc/passwd

root:x:0:0:root:/root:/bin/bash

zhangsan:x:1001:1001::/home/zhangsan:/bin/bash

Jump Server 用户管理

修改管理员密码

右上角用户管理 --->> 快速修改 --->> 修改密码

创建管理用户(远程机器执行命令)

~]# ssh-keygen -f jumpserver

~]# sz jumpserver

创建系统用户,用于跳转到其他机器

创建管理用户

~]# useradd jumpserver

~]# cd /home/jumpserver/

]# su - jumpserver

~]$ mkdir .ssh

~]$ vim .ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDic8ywYiwEft4qDUR8fZQWgCkitHfw/dP9UdJajJ5/eoEA1Vcp1TvEL/WCnIYe5/PY8qKj8lx3QUxJy2TYJZy2eza8UTkowpS4x0ZGbg2UdKIZ0s3AIxPtwbs+ODbWiEGQ5AtUKftkm3aZpdB6O8wZhldkjIEcdjgVr4M4Bugw67FdLf4WFqClC1aQd2vUTyoY41dU6+/i1NSJL0BZPr2Ez+js4KN6LQROuWkBsDFG69bsh5qM2AyTnDre0TLZe8MrrXOuXB6/SsUwdlWS7sW9sMKbfDfEvmUkolaGi8PYf4X1fFjKfOdQ+AnWrYgZatgdjOLUQw5e0QjxRPMbZYNp root@mysql-master

~]$ cd .ssh

~]$ chmod 700 .

~]$ exit [root@mysql-master jumpserver]# visudo jumpserver ALL=(ALL) NOPASSWD: ALL

JumpServer官方版常见问题

1. 导入数据库报错

./jmsctl.sh restore_db /opt/jumpserver.sql

开始还原数据库: /opt/jumpserver.sql

mysql: [Warning] Using a password on the command line interface can be insecure.

ERROR 1022 (23000) at line 1237: Can't write; duplicate key in table 'xxxxxx'

ERRO[0008] error waiting for container: context canceled

read unix @->ar/run/docker.sock: read: connection reset by peer

数据库恢复失败,请检查数据库文件是否完整，或尝试手动恢复！

./jmsctl.sh stop

docker exec -it jms_mysql /bin/bash

mysql -uroot -p$MYSQL_ROOT_PASSWORD

drop database jumpserver;

create database jumpserver default charset 'utf8';

exit;

exit

./jmsctl.sh restore_db /opt/jumpserver.sql

# 注意: 确定在导入数据库的过程中没有错误

./jmsctl.sh start

2. 启动 jms_core 报错

./jmsctl.sh start

Creating network "jms_net" with driver "bridge"

Creating jms_mysql ... done

Creating jms_redis ... done

Creating jms_core ... done

ERROR: for celery Container "76b2e315f69d" is unhealthy.

ERROR: for lina Container "76b2e315f69d" is unhealthy.

ERROR: for luna Container "76b2e315f69d" is unhealthy.

ERROR: for lion Container "76b2e315f69d" is unhealthy.

ERROR: for koko Container "76b2e315f69d" is unhealthy.

ERROR: Encountered errors while bringing up the project.

docker logs -f jms_core --tail 200 # 如果没有报错就等表结构合并完毕后然后重新 start 即可

2021-02-08 14:58:53 Mon Feb 8 14:58:53 2021

2021-02-08 14:58:53 JumpServer version v2.10.4, more see https://www.jumpserver.org

- Start Gunicorn WSGI HTTP Server

2021-02-08 14:58:53 Check database connection ...

users

[ ] 0001_initial

[ ] 0002_auto_20171225_1157_squashed_0019_auto_20190304_1459 (18 squashed migrations)

[ ] 0020_auto_20190612_1825

[ ] 0021_auto_20190625_1104

[ ] 0022_auto_20190625_1105

[ ] 0023_auto_20190724_1525

[ ] 0024_auto_20191118_1612

[ ] 0025_auto_20200206_1216

[ ] 0026_auto_20200508_2105

[ ] 0027_auto_20200616_1503

[ ] 0028_auto_20200728_1805

[ ] 0029_auto_20200814_1650

[ ] 0030_auto_20200819_2041

[ ] 0031_auto_20201118_1801

2021-02-08 14:58:58 Database connect success

Operations to perform:

Apply all migrations: admin, applications, assets, audits, auth, authentication, captcha, common, contenttypes, django_cas_ng, django_celery_beat, jms_oidc_rp, ops, orgs, perms, sessions, settings, terminal, tickets, users

Running migrations:

Applying contenttypes.0001_initial... OK

Applying contenttypes.0002_remove_content_type_name... OK

Applying auth.0001_initial... OK

Applying auth.0002_alter_permission_name_max_length... OK

Applying auth.0003_alter_user_email_max_length... OK

Applying auth.0004_alter_user_username_opts... OK

Applying auth.0005_alter_user_last_login_null... OK

Applying auth.0006_require_contenttypes_0002... OK

Applying auth.0007_alter_validators_add_error_messages... OK

Applying auth.0008_alter_user_username_max_length... OK

Applying users.0001_initial... OK

Applying admin.0001_initial... OK

Applying admin.0002_logentry_remove_auto_add... OK

Applying admin.0003_logentry_add_action_flag_choices... OK

Applying users.0002_auto_20171225_1157_squashed_0019_auto_20190304_1459... OK

Applying users.0020_auto_20190612_1825... OK

Applying users.0021_auto_20190625_1104... OK

Applying users.0022_auto_20190625_1105... OK

Applying users.0023_auto_20190724_1525... OK

Applying users.0024_auto_20191118_1612... OK

Applying users.0025_auto_20200206_1216... OK

Applying users.0026_auto_20200508_2105... OK

Applying users.0027_auto_20200616_1503... OK

Applying users.0028_auto_20200728_1805... OK

Applying users.0029_auto_20200814_1650... OK

Applying users.0030_auto_20200819_2041... OK

Applying assets.0001_initial... OK

Applying perms.0001_initial... OK

Applying assets.0002_auto_20180105_1807_squashed_0009_auto_20180307_1212... OK

Applying assets.0010_auto_20180307_1749_squashed_0019_auto_20180816_1320... OK

Applying perms.0002_auto_20171228_0025_squashed_0009_auto_20180903_1132... OK

Applying perms.0003_action... OK

Applying perms.0004_assetpermission_actions... OK

Applying assets.0020_auto_20180816_1652... OK

Applying assets.0021_auto_20180903_1132... OK

Applying assets.0022_auto_20181012_1717... OK

Applying assets.0023_auto_20181016_1650... OK

Applying assets.0024_auto_20181219_1614... OK

Applying assets.0025_auto_20190221_1902... OK

Applying assets.0026_auto_20190325_2035... OK

Applying applications.0001_initial... OK

Applying perms.0005_auto_20190521_1619... OK

Applying perms.0006_auto_20190628_1921... OK

Applying perms.0007_remove_assetpermission_actions... OK

Applying perms.0008_auto_20190911_1907... OK

Applying assets.0027_auto_20190521_1703... OK

Applying assets.0028_protocol... OK

Applying assets.0029_auto_20190522_1114... OK

Applying assets.0030_auto_20190619_1135... OK

Applying assets.0031_auto_20190621_1332... OK

Applying assets.0032_auto_20190624_2108... OK

Applying assets.0033_auto_20190624_2108... OK

Applying assets.0034_auto_20190705_1348... OK

Applying assets.0035_auto_20190711_2018... OK

Applying assets.0036_auto_20190716_1535... OK

Applying assets.0037_auto_20190724_2002... OK

Applying assets.0038_auto_20190911_1634... OK

Applying perms.0009_remoteapppermission_system_users... OK

Applying assets.0039_authbook_is_active... OK

Applying assets.0040_auto_20190917_2056... OK

Applying assets.0041_gathereduser... OK

Applying assets.0042_favoriteasset... OK

Applying assets.0043_auto_20191114_1111... OK

Applying assets.0044_platform... OK

Applying assets.0045_auto_20191206_1607... OK

Applying assets.0046_auto_20191218_1705... OK

Applying applications.0002_remove_remoteapp_system_user... OK

Applying applications.0003_auto_20191210_1659... OK

Applying applications.0004_auto_20191218_1705... OK

Applying perms.0010_auto_20191218_1705... OK

Applying perms.0011_auto_20200721_1739... OK

Applying assets.0047_assetuser... OK

Applying assets.0048_auto_20191230_1512... OK

Applying assets.0049_systemuser_sftp_root... OK

Applying assets.0050_auto_20200711_1740... OK

Applying assets.0051_auto_20200713_1143... OK

Applying assets.0052_auto_20200715_1535... OK

Applying assets.0053_auto_20200723_1232... OK

Applying assets.0054_auto_20200807_1032... OK

Applying applications.0005_k8sapp... OK

Applying perms.0012_k8sapppermission... OK

Applying assets.0055_auto_20200811_1845... OK

Applying assets.0056_auto_20200904_1751... OK

Applying assets.0057_fill_node_value_assets_amount_and_parent_key...

................................................................. OK

Applying perms.0013_rebuildusertreetask_usergrantedmappingnode... OK

Applying perms.0014_build_users_perm_tree... OK

Applying perms.0015_auto_20200929_1728... OK

Applying assets.0058_auto_20201023_1115... OK

Applying assets.0059_auto_20201027_1905... OK

Applying applications.0006_application... OK

Applying perms.0016_applicationpermission... OK

Applying perms.0017_auto_20210104_0435... OK

Applying applications.0007_auto_20201119_1110... OK

Applying applications.0008_auto_20210104_0435... OK

Applying assets.0060_node_full_value...

- Start migrate node value if has /

- Start migrate node full value

OK

Applying assets.0061_auto_20201116_1757... OK

Applying assets.0062_auto_20201117_1938... OK

Applying assets.0063_migrate_default_node_key...

Check old default node `key=0 value=Default` not exists

OK

Applying assets.0064_auto_20201203_1100... OK

Applying assets.0065_auto_20210121_1549... OK

Applying audits.0001_initial... OK

Applying audits.0002_ftplog_org_id... OK

Applying audits.0003_auto_20180816_1652... OK

Applying audits.0004_operatelog_passwordchangelog_userloginlog... OK

Applying audits.0005_auto_20190228_1715... OK

Applying audits.0006_auto_20190726_1753... OK

Applying audits.0007_auto_20191202_1010... OK

Applying audits.0008_auto_20200508_2105... OK

Applying audits.0009_auto_20200624_1654... OK

Applying audits.0010_auto_20200811_1122... OK

Applying audits.0011_userloginlog_backend... OK

Applying auth.0009_alter_user_last_name_max_length... OK

Applying auth.0010_alter_group_name_max_length... OK

Applying auth.0011_update_proxy_permissions... OK

Applying auth.0012_alter_user_first_name_max_length... OK

Applying authentication.0001_initial... OK

Applying authentication.0002_auto_20190729_1423... OK

Applying authentication.0003_loginconfirmsetting... OK

Applying authentication.0004_ssotoken... OK

Applying captcha.0001_initial... OK

Applying common.0001_initial... OK

Applying common.0002_auto_20180111_1407... OK

Applying common.0003_setting_category... OK

Applying common.0004_setting_encrypted... OK

Applying common.0005_auto_20190221_1902... OK

Applying common.0006_auto_20190304_1515... OK

Applying django_cas_ng.0001_initial... OK

Applying django_celery_beat.0001_initial... OK

Applying django_celery_beat.0002_auto_20161118_0346... OK

Applying django_celery_beat.0003_auto_20161209_0049... OK

Applying django_celery_beat.0004_auto_20170221_0000... OK

Applying django_celery_beat.0005_add_solarschedule_events_choices... OK

Applying django_celery_beat.0006_auto_20180322_0932... OK

Applying django_celery_beat.0007_auto_20180521_0826... OK

Applying django_celery_beat.0008_auto_20180914_1922... OK

Applying django_celery_beat.0006_auto_20180210_1226... OK

Applying django_celery_beat.0006_periodictask_priority... OK

Applying django_celery_beat.0009_periodictask_headers... OK

Applying django_celery_beat.0010_auto_20190429_0326... OK

Applying django_celery_beat.0011_auto_20190508_0153... OK

Applying django_celery_beat.0012_periodictask_expire_seconds... OK

Applying jms_oidc_rp.0001_initial... OK

Applying ops.0001_initial... OK

Applying ops.0002_celerytask... OK

Applying ops.0003_auto_20181207_1744... OK

Applying ops.0004_adhoc_run_as... OK

Applying ops.0005_auto_20181219_1807... OK

Applying ops.0006_auto_20190318_1023... OK

Applying ops.0007_auto_20190724_2002... OK

Applying ops.0008_auto_20190919_2100... OK

Applying ops.0009_auto_20191217_1713... OK

Applying ops.0010_auto_20191217_1758... OK

Applying ops.0011_auto_20200106_1534... OK

Applying ops.0012_auto_20200108_1659... OK

Applying ops.0013_auto_20200108_1706... OK

Applying ops.0014_auto_20200108_1749... OK

Applying ops.0015_auto_20200108_1809... OK

Applying ops.0016_commandexecution_org_id... OK

Applying ops.0017_auto_20200306_1747... OK

Applying ops.0018_auto_20200509_1434... OK

Applying ops.0019_adhocexecution_celery_task_id... OK

Applying orgs.0001_initial... OK

Applying orgs.0002_auto_20180903_1132... OK

Applying orgs.0003_auto_20190916_1057... OK

Applying orgs.0004_organizationmember... OK

Applying orgs.0005_auto_20200721_1937... OK

Applying orgs.0006_auto_20200721_1937... OK

Applying orgs.0007_auto_20200728_1805... OK

Applying orgs.0008_auto_20200819_2041... OK

Applying orgs.0009_auto_20201023_1628... OK

Applying sessions.0001_initial... OK

Applying settings.0001_initial... OK

Applying terminal.0001_initial... OK

Applying terminal.0002_auto_20171228_0025_squashed_0009_auto_20180326_0957... OK

Applying terminal.0010_auto_20180423_1140... OK

Applying terminal.0011_auto_20180807_1116... OK

Applying terminal.0012_auto_20180816_1652... OK

Applying terminal.0013_auto_20181123_1113... OK

Applying terminal.0014_auto_20181226_1441... OK

Applying terminal.0015_auto_20190923_1529... OK

Applying terminal.0016_commandstorage_replaystorage... OK

Applying terminal.0017_auto_20191125_0931... OK

Applying terminal.0018_auto_20191202_1010... OK

Applying terminal.0019_auto_20191206_1000... OK

Applying terminal.0020_auto_20191218_1721... OK

Applying terminal.0021_auto_20200213_1316... OK

Applying terminal.0022_session_is_success... OK

Applying terminal.0023_command_risk_level... OK

Applying terminal.0024_auto_20200715_1713... OK

Applying terminal.0025_auto_20200810_1735... OK

Applying terminal.0026_auto_20201027_1905... OK

Applying terminal.0027_auto_20201102_1651... OK

Applying terminal.0028_auto_20201110_1918... OK

Applying terminal.0029_auto_20201116_1757... OK

Applying terminal.0030_terminal_type... OK

Applying terminal.0031_auto_20210113_1356... OK

Applying tickets.0001_initial... OK

Applying tickets.0002_auto_20200728_1146... OK

Applying tickets.0003_auto_20200804_1551... OK

Applying tickets.0004_ticket_comment... OK

Applying tickets.0005_ticket_meta_confirmed_system_users... OK

Applying tickets.0006_auto_20201023_1628... OK

Applying tickets.0007_auto_20201224_1821... OK

Applying users.0031_auto_20201118_1801... OK

2021-02-08 14:59:31 [cache INFO] CACHE: Send refresh task .('nodes_amount',)

Operations to perform:

Apply all migrations: admin, applications, assets, audits, auth, authentication, captcha, common, contenttypes, django_cas_ng, django_celery_beat, jms_oidc_rp, ops, orgs, perms, sessions, settings, terminal, tickets, users

Running migrations:

No migrations to apply.

- Start Flower as Task Monitor

- Start Daphne ASGI WS Server

2021-02-08 15:01:02 Check service status: gunicorn -> running at 38

2021-02-08 15:01:02 Check service status: flower -> running at 44

2021-02-08 15:01:02 Check service status: daphne -> running at 54

./jmsctl.sh start

3. Table 'xxxxxx' already exists

./jmsctl.sh stop

if grep -q 'COLLATE=utf8_bin' /opt/jumpserver.sql; then

cp /opt/jumpserver.sql /opt/jumpserver_bak.sql

sed -i 's@COLLATE=utf8_bin@@g' /opt/jumpserver.sql

sed -i 's@COLLATE utf8_bin@@g' /opt/jumpserver.sql

else

echo "备份数据库字符集正确";

fi

docker exec -it jms_mysql /bin/bash

mysql -uroot -p$MYSQL_ROOT_PASSWORD

drop database jumpserver;

create database jumpserver default charset 'utf8';

exit;

exit

./jmsctl.sh restore_db /opt/jumpserver.sql

# 注意: 确定在导入数据库的过程中没有错误

./jmsctl.sh start