keybox是基于web的ssh终端管理软件,在生产和测试环境中,服务器一般放在内网中,想要通过外网远程连接就需要先连接有外网的代理服务器,然后再ssh内网的机器,有了keybox就免去其中的麻烦。
一、安装
1、安装java环境,官方建议使用1.8以上的Java JDK
$ yum localinstall -y jdk-8u45-linux-x64.rpm # jdk路径 $ ls /usr/java/jdk1.8.0_45/ bin COPYRIGHT db include javafx-src.zip jre lib LICENSE man README.html release src.zip THIRDPARTYLICENSEREADME-JAVAFX.txt THIRDPARTYLICENSEREADME.txt $ vim /etc/profile.d/java_env.sh 1 export JAVA_HOME=/usr/java/jdk1.8.0_45 2 export PATH=$JAVA_HOME/bin:$JAVA_HOME/jre/bin:$PATH $ exec bash # 查看java的版本 $ java -version java version "1.8.0_45" Java(TM) SE Runtime Environment (build 1.8.0_45-b14) Java HotSpot(TM) 64-Bit Server VM (build 25.45-b02, mixed mode)
2、安装keybox,直接到github上下载keybox压缩包:https://github.com/skavanagh/KeyBox/releases/
$ tar xf keybox-jetty-v2.89_00.tar.gz -C /usr/local $ cd /usr/local/ $ mv KeyBox-jetty keybox $ cd keybox && ls jetty LICENSE.md README.md startKeyBox.bat startKeyBox.sh
二、启动keybox
# 初始化并启动 $ ./startKeyBox.sh 2017-05-10 14:13:02.374:INFO::main: Logging initialized @813ms to org.eclipse.jetty.util.log.StdErrLog 2017-05-10 14:13:02.764:INFO:oejs.Server:main: jetty-9.4.2.v20170220 2017-05-10 14:13:02.812:INFO:oejdp.ScanningAppProvider:main: Deployment monitor [file:///tmp/KeyBox-jetty/jetty/webapps/] at interval 1 2017-05-10 14:13:05.084:INFO:oeja.AnnotationConfiguration:main: Scanning elapsed time=1866ms 2017-05-10 14:13:05.478:INFO:oejs.session:main: DefaultSessionIdManager workerName=node0 2017-05-10 14:13:05.478:INFO:oejs.session:main: No SessionScavenger set, using defaults 2017-05-10 14:13:05.483:INFO:oejs.session:main: Scavenging every 660000ms # 新建数据库密码 Please enter database password: Please confirm database password: Setting KeyBox SSH public/private key pair Finger print: 12:70:18:ad:01:45:f5:dd:e2:ac:44:d4:e3:8e:65:d9 KeyBox Generated Global Public Key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDfC1IZiTNKgSZZtTHiL8Y8fWTfPlkA/3CUahUs3bp0oZStJNYPAAu6mUAYkDjs6FCoASqrC/WwSVamu504ZUHBID/tKJ1gV4bvjdrlkUDIo3tyhmTl2DpwAPYhaHh+NSvhVyyCFSmicVONhdll2m74p/M7jU/V8jKygNM90FMR9U GdNa7K4VpK1MW6XFax5LlskMVnN93tfwfUXCgWg18/ShbuGF6JLJibMnBI8sVsS3/PTjI/tp+MtvYLqzN3G5BHfj31lSIIk5mMcIuLK0u6D8N8ITt3+OvNvNNIeUD2A9op1swb9v8Y92RQ9WnVPQnIeHgRVZJnl3sLyr47ERsb [email protected]_key 2017-05-10 14:13:13.610:INFO:oejsh.ContextHandler:main: Started [email protected]{/,file:///tmp/KeyBox-jetty/jetty/keybox/,AVAILABLE}{/tmp/KeyBox-jetty/jetty/keybox} 2017-05-10 14:13:13.628:INFO:oejus.SslContextFactory:main: [email protected](jetty,h=[],w=[]) for [email protected](file:///tmp/KeyBox-jetty/jetty/etc/keystore,file:///tmp/KeyBox-jetty/jetty/etc/keyst ore)2017-05-10 14:13:13.660:INFO:oejs.AbstractConnector:main: Started [email protected]{SSL,[ssl, http/1.1]}{0.0.0.0:8443} 2017-05-10 14:13:13.660:INFO:oejs.Server:main: Started @12100ms # 查看8443端口 $ ss -tnl | grep 8443 LISTEN 0 50 :::8443 :::* # keybox启动脚本的使用方法 $ /usr/local/keybox/jetty/bin/jetty.sh Usage: jetty.sh [-d] {start|stop|run|restart|check|supervise} [ CONFIGS ... ]
三、访问keybox
1、使用浏览器打开
2、输入默认的用户名admin,密码changeme登录
四、新建用户并配置免密钥ssh访问
本次使用的是通过脚本配合ansible来新建和配置
1、安装ansible并配置
$ yum install -y ansible $ vim /etc/ansible/hosts # 示例 [proxy] 192.168.1.201 [web] 192.168.1.202 192.168.1.203 [mysql] 192.168.1.204 192.168.1.205
2、配置root与ansible配置文件中的主机免密钥ssh访问,这里就不多赘述了,通过ssh-keygen与ssh-copy-id即可完成
3、在多台主机上新建用户密码并免密钥ssh登录
# 新建用户 $ vim user_add.sh for name in test{1..5} do ansible all -m user -a "name=$name generate_ssh_key=yes ssh_key_bits=2048 ssh_key_file=.ssh/id_rsa state=present group=java" done $ ./user_add.sh # 配置密码 $ vim passwd_add.sh for i in test{1..5} do ansible all -m shell -a "echo ‘123456‘ | passwd --stdin $i" done $ ./passwd_add.sh # 免密钥ssh配置 $ yum install -y expect $ vim ssh_add.sh for user in test{1..5} do pass=‘123456‘ for ip in `cat /etc/ansible/hosts | grep "^[^([|#)].*"`; do /usr/bin/expect << EOF set timeout 300 spawn ssh-copy-id -i /home/$user/.ssh/id_rsa.pub [email protected]$ip expect { "(yes/no)" {send "yes\r"; exp_continue} "password:" {send "$pass\r"} } expect eof EOF done done $ ./ssh_add.sh
五、将相关用户与主机信息写入keybox数据库
1、将/usr/local/keybox/jetty/中的keybox文件夹复制到桌面
2、下载H2数据库console(keybox使用的是H2数据库):http://www.h2database.com/html/quickstart.html
3、连接数据库
其中JDBC 1、URL:jdbc:h2:file:C:\Users\Administrator\Desktop\keybox\WEB-INF\classes\keydb\keybox;CIPHER=AES;
2、用户名为默认的:keybox
3、密码格式为"filepassword空格userpassword":filepwd 初始化时新建的密码
4、进入数据库
5、新建数据
主要需要新建数据的表有5个,分别是
·PROFILES:用户空间 示例:INSERT INTO PROFILES (NM,DESC) VALUES (‘test1‘,‘test1 space‘);
·SYSTEM:用户和hosts的ssh信息 示例:INSERT INTO SYSTEM(DISPLAY_NM,USER,HOST,PORT,AUTHORIZED_KEYS,STATUS_CD) values (‘proxy‘,‘test1‘,‘192.168.1.201‘,22,‘/home/test1/.ssh/authorized_keys‘,‘SUCCESS‘);
·SYSTEM_MAP:PROFILE和SYSTEM通过ID进行关联 示例:INSERT INTO SYSTEM_MAP(PROFILE_ID,SYSTEM_ID) VALUES (1,1);
·USERS:用户信息,默认已有admin 示例:INSERT INTO USERS (USERNAME,USER_TYPE) VALUES (‘test5‘,‘A‘);
·USER_MAP:PROFILE和USER通过ID进行关联 示例:INSERT INTO USER_MAP (USER_ID,PROFILE_ID) VALUES (2,1);
六、配置数据并访问
使用admin用户登录,配置test1-5的密码,然后使用test1-5中的用户登录keybox后就可以使用了。