国密改造

“应相关单位要求，本文以沃通证书为例”

1 操作过程

1.1 配置 JumpServer

  1. vi /opt/jumpserver/config/config.txt
  1. ```nginx hl_lines="4"
  2. ...
  4. # 使用国密算法
  5. SECURITY_DATA_CRYPTO_ALGO=gm
  6. ```
  8. ```sh
  9. # 重启 JumpServer 服务
  10. ./jmsctl.sh restart
  11. ```

1.2 配置 Nginx

  1. # Nginx 镜像下载
  2. docker pull wojiushixiaobai/wotrus_nginx:v1.20.2
  3. docker tag wojiushixiaobai/wotrus_nginx:v1.20.2 jumpserver/wotrus_nginx:v1.20.2
  4. docker rmi wojiushixiaobai/wotrus_nginx:v1.20.2
  1. # 解压 ssl 证书
  2. ll /opt/sslkey
  4. 总用量 24
  5. -rw-r--r--. 1 root root 6281 12月  2 19:34 test.domain.localhost_bundle.crt
  6.     -rw-r--r--. 1 root root 1675 12月  2 19:34 test.domain.localhost_RSA.key
  7.     -rw-r--r--. 1 root root 3048 12月  2 19:11 test.domain.localhost_sm2_encrypt_bundle.crt
  8.     -rw-r--r--. 1 root root  227 12月  2 19:11 test.domain.localhost_SM2.key
  9.     -rw-r--r--. 1 root root 3048 12月  2 19:11 test.domain.localhost_sm2_sign_bundle.crt
  1. #  Nginx 配置文件编辑
  2. vi /opt/default.conf

Nginx

  1.     server {
  2.         listen 80;
  3.         server_name test.domain.localhost;  # 自行修改成你的域名
  4.         return 301 https://$server_name$request_uri;
  5.     }
  7.     server {
  8.         listen 443 ssl;
  9.         server_name test.domain.localhost;  # 自行修改成你的域名
  11.         ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  12.         ssl_ciphers ECC-SM4-SM3:ECDH:AESGCM:HIGH:MEDIUM:!RC4:!DH:!MD5:!aNULL:!eNULL;  # 算法
  13.         ssl_verify_client off;
  14.         ssl_session_timeout 5m;
  15.         ssl_prefer_server_ciphers on;
  17.         # ssl_certificate sslkey/test.domain.localhost_bundle.crt;             # rsa 证书，过渡使用
  18.         # ssl_certificate_key sslkey/test.domain.localhost_RSA.key;
  20.         ssl_certificate sslkey/test.domain.localhost_sm2_sign_bundle.crt;      # 配置国密签名证书/私钥
  21.         ssl_certificate_key sslkey/test.domain.localhost_SM2.key;
  23.         ssl_certificate sslkey/test.domain.localhost_sm2_encrypt_bundle.crt;   # 配置国密加密证书/私钥
  24.         ssl_certificate_key sslkey/test.domain.localhost_SM2.key;
  26.         client_max_body_size 5000m;  # 上传文件大小限制
  28.         location / {
  29.             proxy_pass http://192.168.100.100;  # 后端 jumpserver 访问地址
  30.             proxy_buffering off;
  31.             proxy_request_buffering off;
  32.             proxy_http_version 1.1;
  33.             proxy_set_header Host $host;
  34.             proxy_set_header Upgrade $http_upgrade;
  35.             proxy_set_header Connection $http_connection;
  36.             proxy_set_header X-Forwarded-For $remote_addr;
  38.             proxy_ignore_client_abort on;
  39.             proxy_connect_timeout 600;
  40.             proxy_send_timeout 600;
  41.             proxy_read_timeout 600;
  42.             send_timeout 6000;
  43.         }
  44.     }

1.3 启动容器

  1.     docker run --name nginx -d --restart=always \
  2.       -p 80:80 -p 443:443 \
  3.       -v /opt/sslkey:/etc/nginx/sslkey \
  4.       -v /opt/default.conf:/etc/nginx/conf.d/default.conf \
  5.       jumpserver/wotrus_nginx:v1.20.2