{"id":3032,"date":"2019-12-01T17:39:48","date_gmt":"2019-12-01T16:39:48","guid":{"rendered":"https:\/\/kudzia.eu\/b\/?p=3032"},"modified":"2019-12-01T19:55:58","modified_gmt":"2019-12-01T18:55:58","slug":"guacamole-under-debian","status":"publish","type":"post","link":"https:\/\/kudzia.eu\/b\/2019\/12\/guacamole-under-debian\/","title":{"rendered":"guacamole under Debian"},"content":{"rendered":"<p>Apache Guacamole is a clientless remote desktop gateway &#8211; with it you can access RDP-enabled Windows PC using ordinary web browser and HTTP[S]. below &#8211; notes taken while setting it up under Debian 10.<\/p>\n<p><!--more--><\/p>\n<h2>docker<\/h2>\n<p>commands taken from <a href=\"https:\/\/www.digitalocean.com\/community\/tutorials\/how-to-install-and-use-docker-on-debian-10\">this guide<\/a>, just the first step:<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\napt-get update\r\napt-get install apt-transport-https ca-certificates curl gnupg2 software-properties-common\r\ncurl -fsSL https:\/\/download.docker.com\/linux\/debian\/gpg | apt-key add -\r\nadd-apt-repository &quot;deb &#x5B;arch=amd64] https:\/\/download.docker.com\/linux\/debian $(lsb_release -cs) stable&quot;\r\napt-get update\r\napt-cache policy docker-ce\r\napt-get install docker-ce\r\n<\/pre>\n<h2>guacamole installation<\/h2>\n<p>taken from <a href=\"https:\/\/www.linode.com\/docs\/applications\/remote-desktop\/remote-desktop-using-apache-guacamole-on-docker\/#initialize-guacamole-authentication-with-mysql\">here<\/a><\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\ndocker pull guacamole\/guacamole\r\ndocker pull guacamole\/guacd\r\ndocker pull mysql\/mysql-server\r\ndocker run --rm guacamole\/guacamole \/opt\/guacamole\/bin\/initdb.sh --mysql &gt; initdb.sql\r\ndocker run --name example-mysql -e MYSQL_RANDOM_ROOT_PASSWORD=yes -e MYSQL_ONETIME_PASSWORD=yes -d mysql\/mysql-server\r\n# get the initial mysql password, write it down:\r\ndocker logs example-mysql 2&gt;&amp;1 |grep &quot;GENERATED ROOT PASSWORD&quot;\r\ndocker cp initdb.sql example-mysql:\/guac_db.sql\r\ndocker exec -it example-mysql bash\r\n# now you're in a shell of a container with mysql \r\n# log in to mysql with password grep'ed in the the earlier step\r\nmysql -u root -p\r\n# set a new password; don't copy &amp; paste this literally - come up with something better\r\nALTER USER 'root'@'localhost' IDENTIFIED BY 'new_root_password';\r\nCREATE DATABASE guacamole_db;\r\n# also below be more creative - come up with complex pass\r\nCREATE USER 'guacamole_user'@'%' IDENTIFIED BY 'guacamole_user_password';\r\nGRANT SELECT,INSERT,UPDATE,DELETE ON guacamole_db.* TO 'guacamole_user'@'%';\r\nFLUSH PRIVILEGES;\r\nexit;\r\n# create schemas needed for guacamole\r\ncat guac_db.sql | mysql -u root -p guacamole_db\r\n# exit the mysql container\r\nexit\r\n\r\ndocker run --name example-guacd -d guacamole\/guacd\r\n\r\n# below - provide credentials for the newly created mysql user\r\ndocker run --name example-guacamole --link example-guacd:guacd --link example-mysql:mysql -e MYSQL_DATABASE='guacamole_db' -e MYSQL_USER='guacamole_user' -e MYSQL_PASSWORD='guacamole_user_password' -d -p 127.0.0.1:8080:8080 guacamole\/guacamole\r\n<\/pre>\n<p>at this stage guacamole is ready for use, but it listens only on the loop-back.<\/p>\n<h2>nginx<\/h2>\n<p>to expose it to the internet i&#8217;ve set up nginx with https cert from lets encrypt<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\napt-get install nginx python-certbot-nginx\r\n<\/pre>\n<p>change the server_name in \/etc\/nginx\/sites-enabled\/default to FQDN <\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\nservice nginx restart\r\ncertbot\r\n# follow the steps to issue https cert for the chosen domain name\r\n<\/pre>\n<p>in \/etc\/nginx\/sites-enabled\/default add this in the https vhost section:<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\nlocation \/ {\r\nproxy_pass http:\/\/localhost:8080\/guacamole\/;\r\nproxy_buffering off;\r\nproxy_http_version 1.1;\r\nproxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\r\nproxy_set_header Upgrade $http_upgrade;\r\nproxy_set_header Connection $http_connection;\r\n}\r\n<\/pre>\n<p>and another nginx restart to apply that change:<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\nservice nginx restart\r\n<\/pre>\n<h2>guacamole use<\/h2>\n<p>if all went fine https:\/\/my.domain\/ should give access to guacamole&#8217;s web interface. the default credentials are guacadmin\/guacadmin. after logging in change them to something more secure via menu > settings > preferences. <\/p>\n<p>to make Windows Server 2016 reachable from guacamole i had to go to its control panel > system > remote settings and un-tick [ ] allow connections only from computers running remote desktop with network level authentication.<\/p>\n<p>in gaucamole&#8217;s admin panel under settings > connections create a new one, select:<\/p>\n<ul>\n<li>protocol &#8211; rdp<\/li>\n<li>maximum number of connections &#8211; 1<\/li>\n<li>maximum number of connections for user &#8211; 1<\/li>\n<li>hostname &#8211; address of the windows server that&#8217;s reachable over RDP<\/li>\n<li>port &#8211; likely 3389<\/li>\n<li>username, password &#8211; windows credentials<\/li>\n<li>security mode &#8211; any<\/li>\n<li>ignore server certificate [x] tick <\/li>\n<\/ul>\n<p>save, connect from guacamole&#8217;s home page. it works surprisingly well!<\/p>\n<p>disclaimer &#8211; it&#8217;s a rough sketch how to get the initial setup done. i strongly suggest to secure it by:<\/p>\n<ul>\n<li>having http-auth on the nginx level for whole URI reverse-proxied to guacamole<\/li>\n<li>adding firewall on the linux server preventing incoming\/outgoing traffic besides the absolute necessities [ incoming 443, outgoing 3389 + perhaps http for unattended debian updates ]<\/li>\n<li>firewall on the windows server preventing any incoming traffic except RDP from the server hosting guacamole<\/li>\n<\/ul>\n<p>i assumed that connection between guacamole and the RDP server is secure &#8211; hence ignoring the server&#8217;s certificate. you might want to revisit it.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Apache Guacamole is a clientless remote desktop gateway &#8211; with it you can access RDP-enabled Windows PC using ordinary web browser and HTTP[S]. below &#8211; notes taken while setting it up under Debian 10.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[51],"tags":[],"class_list":["post-3032","post","type-post","status-publish","format-standard","hentry","category-unimportant"],"_links":{"self":[{"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/posts\/3032","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/comments?post=3032"}],"version-history":[{"count":11,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/posts\/3032\/revisions"}],"predecessor-version":[{"id":3043,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/posts\/3032\/revisions\/3043"}],"wp:attachment":[{"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/media?parent=3032"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/categories?post=3032"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/tags?post=3032"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}