Apache Guacamole

Apache Guacamole is a Self hosted application for Remote Desktop services. Guacamole allows remote desktop services to be accessed over HTTP.

The main page for Apache Guacamole can be accessed here:

https://guacamole.apache.org/

Guacamole Installation

This guide is best suited for a Guacamole installation on Ubuntu Server 20.04 LTS

Run as Root

sudo su

Update System

apt update && apt upgrade

Install MariaDB

apt install mariadb-server

Install Dependencies

apt install -y build-essential libcairo2-dev libjpeg62-turbo-dev libpng-dev libtool-bin libossp-uuid-dev libavutil-dev libswscale-dev freerdp2-dev libpango1.0-dev libssh2-1-dev libvncserver-dev libtelnet-dev libwebsockets-dev libssl-dev libvorbis-dev libwebp-dev libpulse-dev sudo vim

Install tomcat9

sudo apt install tomcat9 -y

Enable tomcat

sudo systemctl enable --now tomcat9

sudo systemctl status tomcat9

Get Guacamole server code

wget https://dlcdn.apache.org/guacamole/1.4.0/source/guacamole-server-1.4.0.tar.gz

untar

tar -xzf guacamole-server-1.4.0.tar.gz

Install

cd guacamole-server-1.4.0/

./configure --with-systemd-dir=/etc/systemd/system/ --disable-dependency-tracking

make

make install

sudo ldconfig

sudo systemctl daemon-reload

sudo systemctl enable --now guacd

sudo systemctl status guacd

Edit Guac Config

echo GUACAMOLE_HOME=/etc/guacamole >> /etc/default/tomcat9

mkdir -p /etc/guacamole/{extensions,lib}

touch /etc/guacamole/{guacamole.properties,guacd.conf}

Set Up MariaDB

mysql -u root -p

CREATE DATABASE guacamole_db;

exit

Set Up MySQL Connector

wget </nowiki>https://dlcdn.apache.org/guacamole/1.4.0/binary/guacamole-auth-jdbc-1.4.0.tar.gz

tar -xf guacamole-auth-jdbc-1.4.0.tar.gz

cd guacamole-auth-jdbc-1.4.0/mysql/

cat schema/*.sql | mysql -u root -p guacamole_db

Connect Guac to MySQL

mysql -u root -p

CREATE USER 'guacamole_user'@'localhost' IDENTIFIED BY 'StrongPassword';

GRANT SELECT,INSERT,UPDATE,DELETE ON guacamole_db.* TO 'guacamole_user'@'localhost';

FLUSH PRIVILEGES;

exit

cd guacamole-auth-jdbc-1.4.0/mysql/

cp guacamole-auth-jdbc-mysql-1.4.0.jar /etc/guacamole/extensions/guacamole-auth-jdbc-mysql.jar

wget https://cdn.mysql.com//Downloads/Connector-J/mysql-connector-java_8.0.28-1ubuntu20.04_all.deb

dpkg -i mysql-connector-java_8.0.28-1ubuntu20.04_all.deb

cp /usr/share/java/mysql-connector-java-8.0.28.jar /etc/guacamole/lib/mysql-connector.jar

Edit Guac config to work with MySQL

Edit guacamole.properties

nano /etc/guacamole/guacamole.properties

Add the following:

mysql-hostname: localhost
mysql-port: 3306
mysql-database: guacamole_db
mysql-username: guacamole_user
mysql-password: StrongPassword

Edit guacd.conf:

nano /etc/guacamole/guacd.conf

Add the following:

[server]
bind_host = 0.0.0.0
bind_port = 4822

Restart Services

sudo systemctl restart tomcat9 guacd

Get Guacamole client

wget https://dlcdn.apache.org/guacamole/1.4.0/binary/guacamole-1.4.0.war
mv guacamole-1.4.0.war guacamole.war
cp guacamole.war /var/lib/tomcat9/webapps
ls /var/lib/tomcat9/webapps

Edit tomcat server Config

nano /etc/tomcat9/server.xml

Add the following:

<Valve className="org.apache.catalina.valves.RemoteIpValve"

           internalProxies="127.0.0.1"
           remoteIpHeader="x-forwarded-for"
           remoteIpProxiesHeader="x-forwarded-by"
           protocolHeader="x-forwarded-proto" />

sudo systemctl restart tomcat9

Apache Guacamole should now be installed and reachable at http://localhost:8080/guacamole

The default sign in credentials are username:guacadmin password:guacadmin

Add TOTP Authentication

Download the TOTP extension for Apache Guacamole and install it to the extensions folder:

wget https://dlcdn.apache.org/guacamole/1.4.0/binary/guacamole-auth-totp-1.4.0.tar.gz

tar -zxf guacamole-auth-totp-1.4.0.tar.gz guacamole-auth-totp-1.4.0/guacamole-auth-totp-1.4.0.jar

mv guacamole-auth-totp-1.4.0/guacamole-auth-totp-1.4.0.jar /etc/guacamole/extensions/

systemctl restart tomcat9

Fix RDP Connection Issues

If you have connection issues, check the logs by running:

useradd -M -d /var/lib/guacd/ -r -s /sbin/nologin -c "Guacd User" guacd

mkdir /var/lib/guacd

chown -R guacd: /var/lib/guacd

sed -i 's/daemon/guacd/' /etc/systemd/system/guacd.service

systemctl daemon-reload

systemctl restart guacd

See also

•  Reverse Proxy
•  Apache Web Server

References

• https://adamtheautomator.com/apache-guacamole/
• https://kifarunix.com/install-guacamole-on-debian-11/#fix-rdp-security-negotiation-failed
• https://kifarunix.com/configure-totp-two-factor-authentication-on-apache-guacamole/

•  
•