Quick start with Docker
The quickest way to try Casvisor is the all-in-one image casbin/casvisor-all-in-one. Besides Casvisor it carries MariaDB for the database and guacd for Telnet, so it runs on its own. The only thing it needs from outside is a Casdoor to sign in with.
1. Prepare Casdoor
Casvisor has no login of its own.
Casdoor v4.10 and later. Casvisor currently checks Casdoor's tokens with a key compiled into it, and a Casdoor installed from v4.10 on signs with a key of its own. Until the certificate can be set in configuration, using such a Casdoor means building Casvisor from source with your certificate, as Connect Casdoor explains; the Docker images will not sign you in.
If you already run Casdoor, create an application for Casvisor as described in Connect Casdoor and come back with its client ID and secret.
If you do not, start one next to it:
docker run -d --name casdoor -p 8000:8000 casbin/casdoor-all-in-oneOpen http://<your-ip>:8000, sign in as admin / 123, change that password, and create the application as in Connect Casdoor. Use the machine's IP address or host name rather than localhost throughout: Casvisor's container calls Casdoor at the same address your browser uses, and inside the container localhost is the container itself.
2. Write app.conf
Download the default configuration:
curl -fsSLo app.conf https://raw.githubusercontent.com/casvisor/casvisor/master/conf/app.confand change the five Casdoor keys to your own:
casdoorEndpoint = http://192.168.1.20:8000
clientId = <client ID of the application>
clientSecret = <client secret of the application>
casdoorOrganization = "<organization of the application>"
casdoorApplication = "<name of the application>"Leave dataSourceName and guacamoleEndpoint as they are: they point at the MariaDB and guacd inside the image. Configuration lists every key.
3. Start Casvisor
docker run -d --name casvisor -p 19000:19000 \
-v "$PWD/app.conf:/conf/app.conf" \
-v casvisor-db:/var/lib/mysql \
casbin/casvisor-all-in-oneThe second volume keeps the database when the container is replaced. On first start Casvisor creates the casvisor database and its tables.
4. Sign in
Open http://<your-ip>:19000. You are sent to Casdoor and back. Sign in with an account that is an administrator of the application's organization (Is admin on the user in Casdoor) to see the management pages; other users only get the workbench.
If Casdoor says the redirect URI is not allowed, add http://<your-ip>:19000/callback to the application's Redirect URLs.
5. Add a server and connect
- Go to Assets, click Add, and fill in the protocol, host, port and, if you like, the account to log in with. See Assets.
- Click Connect on the asset. A new tab opens with the terminal or desktop.
As an administrator you can reach every asset. To let other people in, create a permission that names them, or a Casdoor group they are in.
Without the all-in-one image
casbin/casvisor is the same Casvisor without MariaDB and guacd. Use it when you already have a MySQL server, and run guacd beside it if you need Telnet:
docker run -d --name guacd -p 4822:4822 guacamole/guacd
docker run -d --name casvisor -p 19000:19000 -v "$PWD/app.conf:/conf/app.conf" casbin/casvisorThen set dataSourceName to your MySQL server and guacamoleEndpoint to the guacd container, by an address the Casvisor container can reach. The repository's docker-compose.yml starts the three together.
Introduction
Casvisor is an open-source bastion host. It gives people browser access to servers over SSH, RDP, VNC and Telnet, signs them in through Casdoor, checks each connection against Casbin permissions and keeps a record of every session.
Connect Casdoor
Casvisor signs people in through Casdoor. Create an organization and an application for it, set the redirect URL and certificate, and copy the client ID and secret into app.conf.