Introduction to cloud bastion machine
The bastion host, that is, in a specific network environment, in order to protect the network and data from intrusion and damage from external and internal users, various technical means are used to monitor and record the operation and maintenance personnel's access to servers, network devices, Operational behavior of security equipment, database and other equipment for centralized alarm, timely processing and audit determination.
Cloud Bastion Host (CBH) is a 4A unified security management and control platform that provides centralized account (Account), authorization (Authorization), authentication (Authentication) and audit (Audit) management services for enterprises.
Cloud Bastion Host is a cloud security service that can provide efficient operation and maintenance, authentication management, access control, security audit and report analysis functions. Cloud tenant O&M personnel can complete asset O&M and operation audit through the cloud bastion machine. The bastion host can record the data flow of common operation and maintenance protocols such as SSH, Windows remote desktop, and SFTP through the forward proxy based on the protocol, and then replay the video by resetting the data flow to achieve the purpose of operation and maintenance audit.
The cloud bastion machine provides cloud computing security management and control systems and components, including functional modules such as departments, users, resources, policies, operation and maintenance, and auditing, and integrates single sign-on, unified asset management, multi-terminal access protocols, file transfer, session collaboration, etc. All in one. Through a unified operation and maintenance login portal, based on protocol forward proxy technology and remote access isolation technology, centralized management and operation and maintenance audit of cloud resources such as servers, cloud hosts, databases, and application systems are realized.
The cloud bastion machine does not need to be installed and deployed, and can connect and manage multiple cloud servers through HTML5 technology. Enterprise users only need to use mainstream browsers or mobile APP s to achieve efficient operation and maintenance anytime, anywhere. The cloud bastion machine supports multiple protocols such as RDP/SSH/Telnet/VNC, and can access all Windows, Linux/Unix operating systems. Enterprise users can manage multiple cloud servers through the cloud bastion host to meet the requirements of the third-level protection for user identity authentication, access control, and security auditing.
In terms of function, it integrates the two main functions of core system operation and maintenance and security audit control. End computer access to networks and servers. Figuratively speaking, the terminal computer's access to the target needs to be translated by the operation and maintenance security audit. To use an analogy, the operation and maintenance security audit acts as a gatekeeper, and all requests for network devices and servers must pass through this gate. Therefore, the operation and maintenance security audit can intercept illegal access and malicious attacks, block illegal commands, filter out all illegal access behaviors to target devices, and audit and monitor internal personnel misoperations and illegal operations for post-event responsibility tracking .
Use the provided software package to configure the Yum source, and download the jumpserver.tar.gz software package to the /root directory of the Jumpserver node through the address
[root@jumpserver ~]# ls jumpserver.tar.gz
Unzip to the /opt directory
[root@jumpserver ~]# tar -zxvf jumpserver.tar.gz -C /opt/ [root@jumpserver ~]# cd /opt/ [root@jumpserver opt]# ls compose config docker docker.service images jumpserver jumpserver-repo static.env
Configure YUM source
[root@jumpserver ~]# cd /etc/yum.repos.d/ [root@jumpserver yum.repos.d]# mkdir bak [root@jumpserver yum.repos.d]# mv CentOS-* bak/ [root@jumpserver yum.repos.d]# cat local.repo [centos] name=centos baseurl=ftp://192.168.200.10/centos gpgcheck=0 [jumpserver ] name=jumpserver baseurl=file:///opt/jumpserver-repo gpgcheck=0
Install dependent environment
Install the pyhton database
[root@jumpserver ~]# yum install python2 -y
Install and configure the Docekr environment
[root@jumpserver opt]# cp -rf /opt/docker/* /usr/bin/ [root@jumpserver opt]# chmod 775 /usr/bin/docker* [root@jumpserver opt]# cp -rf /opt/docker.service /etc/systemd/system [root@jumpserver opt]# chmod 775 /etc/systemd/system/docker.service [root@jumpserver opt]# systemctl daemon-reload [root@jumpserver opt]# systemctl enable docker --now Created symlink from /etc/systemd/system/multi-user.target.wants/docker.service to /etc/systemd/system/docker.service.
Verify service status
[root@jumpserver opt]# docker -v Docker version 18.06.3-ce, build d7080c1 [root@jumpserver opt]# docker-compose -v docker-compose version 1.27.4, build 40524192 [root@jumpserver opt]#
Install the Jumpserver service
[root@jumpserver images]# ls jumpserver_core_v2.11.4.tar jumpserver_lion_v2.11.4.tar jumpserver_nginx_alpine2.tar jumpserver_koko_v2.11.4.tar jumpserver_luna_v2.11.4.tar jumpserver_redis_6-alpine.tar jumpserver_lina_v2.11.4.tar jumpserver_mysql_5.tar load.sh [root@jumpserver images]# cat load.sh #!/bin/bash docker load -i jumpserver_core_v2.11.4.tar docker load -i jumpserver_koko_v2.11.4.tar docker load -i jumpserver_lina_v2.11.4.tar docker load -i jumpserver_lion_v2.11.4.tar docker load -i jumpserver_luna_v2.11.4.tar docker load -i jumpserver_mysql_5.tar docker load -i jumpserver_nginx_alpine2.tar docker load -i jumpserver_redis_6-alpine.tar [root@jumpserver images]# sh load.sh
Create Jumpserver service component directory
[root@jumpserver images]# mkdir -p /opt/jumpserver/{core,koko,lion,mysql,nginx,redis} [root@jumpserver images]# cp -rf /opt/config /opt/jumpserver/
The environment variable static.env takes effect, and the Jumpserver service is started using the provided script up.sh
[root@jumpserver compose]# ls config_static docker-compose-lb.yml docker-compose-network.yml down.sh docker-compose-app.yml docker-compose-mysql-internal.yml docker-compose-redis-internal.yml up.sh docker-compose-es.yml docker-compose-mysql.yml docker-compose-redis.yml docker-compose-external.yml docker-compose-network_ipv6.yml docker-compose-task.yml [root@jumpserver compose]# source /opt/static.env [root@jumpserver compose]# sh up.sh Creating network "jms_net" with driver "bridge" Creating jms_redis ... done Creating jms_mysql ... done Creating jms_core ... done Creating jms_lina ... done Creating jms_nginx ... done Creating jms_celery ... done Creating jms_lion ... done Creating jms_luna ... done Creating jms_koko ... done [root@jumpserver compose]#
Browser access http://192.168.200.30, Jumpserver Web login (admin/admin)
After successful login, you will be prompted to set a new password
change Password
After logging in to the platform, click the drop-down menu in the upper right corner of the page to switch the Chinese character setting
At this point, the Jumpserver installation is complete
manage assets
Log in to the Jumpserver management platform as the administrator admin user, click the left navigation bar, expand the "Asset Management" item, select "Manage User", and click the "Create" button on the right
manage users
Create a remote connection user, the user name is root and the password is "000000", click the "Submit" button to create
Create administrative user
Select "System User", click the "Create" button on the right to create a system user, select the host protocol "SSH", set the user name root, password is the server SSH password and click the "Submit" button
create system user
Click the left navigation bar, expand the "Asset Management" item, select "Asset List", and click the "Create" button on the right

Create an asset and add the cloud platform host (controller) to the asset
Create an asset controller
Asset Authorization
Click the navigation bar on the left, expand the "Rights Management" item, select "Asset Authorization", click the "Create" button on the right to create an asset authorization rule
Create asset authorization rules
test connection
Click the administrator user drop-down menu in the upper right corner and select "User Interface"
Create asset authorization rules
If the asset host under the Default project does not appear, click the "Refresh" button after favorites to refresh
Click on the left navigation bar, select "Web Terminal" to enter the remote connection page
Click Default on the left, expand the folder, click the controller host, and successfully connect to the host on the right