【Docker项目实战】使用Docker部署OneTerm堡垒机一、OneTerm介绍1.1 OneTerm 堡垒机简介1.2 OneTerm 堡垒机特点1.3 OneTerm 堡垒机使用场景二、本地环境介绍2.1 本地环境规划2.2 本次实践介绍三、本地环境检查3.1 检查Docker服务状态3.2 检查Docker版本3.3 检查docker compose 版本四、下载OneTerm镜像五、部署OneTerm应用5.1 拉取OneTerm项目5.2 查看部署文件5.3 创建OneTerm容器5.4 检查OneTerm容器状态六、访问OneTerm首页6.1 进入OneTerm登录页6.2 访问OneTerm首页一、OneTerm介绍1.1 OneTerm 堡垒机简介OneTerm堡垒机是一款高度集成的安全管理平台专为企业提供全面的IT运维安全管理解决方案。它基于4A认证、授权、账号、审计理念设计旨在通过严格的访问控制和详尽的操作审计确保企业内部网络环境的安全性与合规性。OneTerm 不仅能够有效防止内部人员的误操作或恶意行为还能对外部攻击进行有效的防御是企业IT内控和安全合规的重要工具。1.2 OneTerm 堡垒机特点统一身份认证支持多种认证方式如用户名/密码、双因素认证、生物识别等确保每个用户的身份真实可靠。精细权限控制基于角色的访问控制RBAC可以为不同岗位的人员分配不同的权限实现最小权限原则降低风险。实时会话监控提供实时的会话监控和录像功能可以即时查看和回放用户操作过程便于事后追溯和分析。操作审计与报告记录所有用户的登录、操作和退出信息生成详细的审计日志和报告满足合规性要求。资源访问控制对服务器、数据库、应用系统等资源的访问进行严格控制防止未授权访问和数据泄露。智能告警机制当检测到异常操作或潜在威胁时系统自动触发告警及时通知管理员采取措施。1.3 OneTerm 堡垒机使用场景金融行业金融机构需要严格遵守各种法规OneTerm 堡垒机可以帮助其实现对敏感数据和系统的严格访问控制满足合规要求。政府机构政府信息系统存储大量公民个人信息使用OneTerm 可以有效保护这些数据免受内部和外部威胁。医疗保健医疗行业涉及患者隐私OneTerm 的细粒度权限管理和操作审计功能有助于保护患者数据的安全。大型企业对于拥有复杂IT环境和众多员工的大公司OneTerm 提供了统一的平台来管理多样的IT资产减少安全漏洞。教育机构学校和研究机构可以通过OneTerm 来控制对学术资源的访问保护研究成果不被非法获取。云服务提供商云服务商需要向客户提供高安全性的服务OneTerm 能够帮助他们实现这一目标增强客户信任。二、本地环境介绍2.1 本地环境规划本次实践为个人测试环境操作系统版本为centos7.6。hostnameIP地址操作系统版本Docker版本jeven192.168.3.166centos 7.620.10.172.2 本次实践介绍1.本次实践部署环境为个人测试环境生产环境请谨慎2.使用Docker部署OneTerm堡垒机。三、本地环境检查3.1 检查Docker服务状态检查Docker服务是否正常运行确保Docker正常运行。[rootjeven ~]# systemctl status docker● docker.service - Docker Application Container Engine Loaded: loaded(/usr/lib/systemd/system/docker.service;enabled;vendor preset: disabled)Active: active(running)since Wed2024-07-0321:07:37 CST;1day 21h ago Docs: https://docs.docker.com Main PID:11950(dockerd)Tasks:10Memory:138.3M CGroup: /system.slice/docker.service └─11950 /usr/bin/dockerd-Hfd://--containerd/run/containerd/containerd.sock3.2 检查Docker版本检查Docker版本[rootjeven ~]# docker -vDocker version20.10.17, build 100c7013.3 检查docker compose 版本检查Docker compose版本确保2.0以上版本。[rootjeven ~]# docker compose versionDocker Compose version v2.6.0四、下载OneTerm镜像拉取oneterm相关容器镜像dockerpull registry.cn-hangzhou.aliyuncs.com/veops/oneterm-api:24.3dockerpull registry.cn-hangzhou.aliyuncs.com/veops/oneterm-ssh:24.3.1dockerpull registry.cn-hangzhou.aliyuncs.com/veops/oneterm-guacd:24.3dockerpull registry.cn-hangzhou.aliyuncs.com/veops/mysql:latestdockerpull registry.cn-hangzhou.aliyuncs.com/veops/redis:latestdockerpull registry.cn-hangzhou.aliyuncs.com/veops/oneterm-ui:24.3dockerpull registry.cn-hangzhou.aliyuncs.com/veops/acl-api:1.1五、部署OneTerm应用5.1 拉取OneTerm项目执行以下命令拉取OneTerm项目。gitclone https://github.com/veops/oneterm.git5.2 查看部署文件进入OneTerm项目查看docker-compose.yml部署文件。[rootjeven ~]# cd oneterm/[rootjeven oneterm]# lsbackend docker-compose.yaml docs LICENSE oneterm-ui README_cn.md README.md默认的部署文件内容如下可自行修改宿主机映射端口。version:3.0services: oneterm-api: image: registry.cn-hangzhou.aliyuncs.com/veops/oneterm-api:24.3 container_name: oneterm-api volumes: - file-data:/replay - ./docs/api.yaml:/oneterm/config.yaml depends_on: - mysql - redis - oneterm-guacd restart: always networks: new: aliases: - oneterm-api oneterm-ssh: image: registry.cn-hangzhou.aliyuncs.com/veops/oneterm-ssh:24.3.1 container_name: oneterm-ssh ports: -12229:12228restart: always tty:truevolumes: - ./docs/ssh.yaml:/oneterm/config.yaml - ./docs/scripts/entrypoint.sh:/oneterm/entrypoint.sh - ssh-data:/root/.ssh entrypoint: ./entrypoint.sh depends_on: - oneterm-api networks: new: aliases: - oneterm-ssh oneterm-guacd: image: registry.cn-hangzhou.aliyuncs.com/veops/oneterm-guacd:24.3 container_name: oneterm-guacd user: root restart: always volumes: - file-data:/replay networks: new: aliases: - oneterm-guacd mysql: image: registry.cn-hangzhou.aliyuncs.com/veops/mysql:latest#image: mysql:8.0.30container_name: oneterm-mysql environment: TZ: Asia/Shanghai MYSQL_ROOT_PASSWORD:123456MYSQL_DATABASE:onetermvolumes: - db-data:/var/lib/mysql - ./docs/mysqld.cnf:/etc/mysql/conf.d/mysqld.cnf - ./docs/acl.sql:/docker-entrypoint-initdb.d/2-acl.sql - ./docs/api.sql:/docker-entrypoint-initdb.d/3-api.sql - ./docs/create-users.sql:/docker-entrypoint-initdb.d/1-create-users.sql command: --character-set-serverutf8mb4 --collation-serverutf8mb4_unicode_ci restart: always networks: new: aliases: - mysql ports: -23306:3306redis: image: registry.cn-hangzhou.aliyuncs.com/veops/redis:latest container_name: oneterm-redis#command: redis-server --requirepass tyrj5QVP9rHsrestart: always environment: TZ: Asia/Shanghai networks: new: aliases: - redis oneterm-ui: image: registry.cn-hangzhou.aliyuncs.com/veops/oneterm-ui:24.3 container_name: oneterm-ui depends_on: - oneterm-api environment: TZ: Asia/Shanghai ONETERM_API_HOST: oneterm-api:8080 ACL_API_HOST: acl-api:5000 NGINX_PORT:80volumes: - ./docs/nginx.oneterm.conf.example:/etc/nginx/conf.d/nginx.oneterm.conf.example restart: always command: - /bin/sh --c-|envsubst$$ONETERM_API_HOST $$ACL_API_HOST $$NGINX_PORT/etc/nginx/conf.d/nginx.oneterm.conf.example/etc/nginx/conf.d/oneterm.conf nginx-gdaemon off;networks: - new ports: -8000:80acl-api: image: registry.cn-hangzhou.aliyuncs.com/veops/acl-api:1.1 container_name: oneterm-acl-api environment:#TZ: Asia/ShanghaiWAIT_HOSTS: mysql:3306, redis:6379 volumes: - ./docs/settings.py:/data/app/acl/settings.py - ./docs/.env:/data/apps/acl/.env - ./docs/nginx.oneterm.conf.example:/etc/nginx/conf.d/nginx.oneterm.conf.example restart: always command: - /bin/sh --c-|sleep2flask db-setup flask init-acl flask init-department gunicorn--workers3autoapp:app-b0.0.0.0:5000-D--access-logfile logs/access.log --error-logfile logs/error.log celery-Acelery_worker.celery worker-E-Qacl_async--logfileone_acl_async.log--autoscale2,1depends_on: - mysql - redis networks: new: aliases: - acl-api volumes: db-data: driver:localname: oneterm_db-data file-data: driver:localname: oneterm_file-data ssh-data: driver:localname: oneterm_ssh networks: new: driver: bridge name: oneterm_network ipam: config: - subnet:172.30.0.0/245.3 创建OneTerm容器使用docker-compose.yaml文件创建OneTerm容器dockercompose up-d5.4 检查OneTerm容器状态检查OneTerm容器状态确保OneTerm容器正常启动。[rootjeven oneterm]# docker compose psNAME COMMAND SERVICE STATUS PORTS oneterm-acl-api/bin/sh -c sleep 2…acl-api running oneterm-api./api run -c ./conf…oneterm-api running oneterm-guacd/bin/sh -c /opt/gu…oneterm-guacd running(starting)4822/tcp oneterm-mysqldocker-entrypoint.s…mysql running0.0.0.0:23306-3306/tcp, :::23306-3306/tcp oneterm-redisdocker-entrypoint.s…redis running6379/tcp oneterm-ssh./entrypoint.shoneterm-ssh running0.0.0.0:12229-12228/tcp, :::12229-12228/tcp oneterm-ui/docker-entrypoint.…oneterm-ui running0.0.0.0:8000-80/tcp, :::8000-80/tcp六、访问OneTerm首页6.1 进入OneTerm登录页访问地址http://192.168.3.166:8000将IP替换为自己服务器IP地址进入到OneTerm初始页。如果无法访问则检查服务器防火墙是否设置云服务器的安全组端口是否放行等。6.2 访问OneTerm首页默认的登录账号Miami如下username: adminpassword: 123456