Apache Guacamole
Apache Guacamole is a self hosted web application for Remote Desktop services. Guacamole allows remote desktop services to be accessed over HTTP.
The main page for Apache Guacamole can be accessed here:
Guacamole Installation
This guide is best suited for a Guacamole installation on Ubuntu Server 20.04 LTS
Run as Root
sudo su
Update System
apt update && apt upgrade
Install MariaDB
apt install mariadb-server
Install Dependencies
apt install -y build-essential libcairo2-dev libjpeg62-turbo-dev libpng-dev libtool-bin libossp-uuid-dev libavutil-dev libswscale-dev freerdp2-dev libpango1.0-dev libssh2-1-dev libvncserver-dev libtelnet-dev libwebsockets-dev libssl-dev libvorbis-dev libwebp-dev libpulse-dev sudo vim
Install tomcat9
sudo apt install tomcat9 -y
Enable tomcat
sudo systemctl enable --now tomcat9
sudo systemctl status tomcat9
Get Guacamole server code
wget https://dlcdn.apache.org/guacamole/1.4.0/source/guacamole-server-1.4.0.tar.gz
untar
tar -xzf guacamole-server-1.4.0.tar.gz
Install
cd guacamole-server-1.4.0/
./configure --with-systemd-dir=/etc/systemd/system/ --disable-dependency-tracking
make
make install
sudo ldconfig
sudo systemctl daemon-reload
sudo systemctl enable --now guacd
sudo systemctl status guacd
Edit Guac Config
echo GUACAMOLE_HOME=/etc/guacamole >> /etc/default/tomcat9
mkdir -p /etc/guacamole/{extensions,lib}
touch /etc/guacamole/{guacamole.properties,guacd.conf}
Set Up MariaDB
mysql -u root -p
CREATE DATABASE guacamole_db;
exit
Set Up MySQL Connector
wget </nowiki>https://dlcdn.apache.org/guacamole/1.4.0/binary/guacamole-auth-jdbc-1.4.0.tar.gz
tar -xf guacamole-auth-jdbc-1.4.0.tar.gz
cd guacamole-auth-jdbc-1.4.0/mysql/
cat schema/*.sql | mysql -u root -p guacamole_db
Connect Guac to MySQL
mysql -u root -p
CREATE USER 'guacamole_user'@'localhost' IDENTIFIED BY 'StrongPassword';
GRANT SELECT,INSERT,UPDATE,DELETE ON guacamole_db.* TO 'guacamole_user'@'localhost';
FLUSH PRIVILEGES;
exit
cd guacamole-auth-jdbc-1.4.0/mysql/
cp guacamole-auth-jdbc-mysql-1.4.0.jar /etc/guacamole/extensions/guacamole-auth-jdbc-mysql.jar
wget https://cdn.mysql.com//Downloads/Connector-J/mysql-connector-java_8.0.28-1ubuntu20.04_all.deb
dpkg -i mysql-connector-java_8.0.28-1ubuntu20.04_all.deb
cp /usr/share/java/mysql-connector-java-8.0.28.jar /etc/guacamole/lib/mysql-connector.jar
Edit Guac config to work with MySQL
Edit guacamole.properties
nano /etc/guacamole/guacamole.properties
Add the following:
mysql-hostname: localhost
mysql-port: 3306
mysql-database: guacamole_db
mysql-username: guacamole_user
mysql-password: StrongPassword
Edit guacd.conf:
nano /etc/guacamole/guacd.conf
Add the following:
[server]
bind_host = 0.0.0.0
bind_port = 4822
Restart Services
sudo systemctl restart tomcat9 guacd
Get Guacamole client
wget https://dlcdn.apache.org/guacamole/1.4.0/binary/guacamole-1.4.0.war
mv guacamole-1.4.0.war guacamole.war
cp guacamole.war /var/lib/tomcat9/webapps
ls /var/lib/tomcat9/webapps
Edit tomcat server Config
nano /etc/tomcat9/server.xml
Add the following:
<Valve className="org.apache.catalina.valves.RemoteIpValve"
internalProxies="127.0.0.1"
remoteIpHeader="x-forwarded-for"
remoteIpProxiesHeader="x-forwarded-by"
protocolHeader="x-forwarded-proto" />
sudo systemctl restart tomcat9
Apache Guacamole should now be installed and reachable at http://localhost:8080/guacamole
The default sign in credentials are username:guacadmin password:guacadmin
Add TOTP Authentication
Download the TOTP extension for Apache Guacamole and install it to the extensions folder:
wget https://dlcdn.apache.org/guacamole/1.4.0/binary/guacamole-auth-totp-1.4.0.tar.gz
tar -zxf guacamole-auth-totp-1.4.0.tar.gz guacamole-auth-totp-1.4.0/guacamole-auth-totp-1.4.0.jar
mv guacamole-auth-totp-1.4.0/guacamole-auth-totp-1.4.0.jar /etc/guacamole/extensions/
systemctl restart tomcat9
Fix RDP Connection Issues
If you have connection issues, check the logs by running:
useradd -M -d /var/lib/guacd/ -r -s /sbin/nologin -c "Guacd User" guacd
mkdir /var/lib/guacd
chown -R guacd: /var/lib/guacd
sed -i 's/daemon/guacd/' /etc/systemd/system/guacd.service
systemctl daemon-reload
systemctl restart guacd
See also
References
- https://adamtheautomator.com/apache-guacamole/
- https://kifarunix.com/install-guacamole-on-debian-11/#fix-rdp-security-negotiation-failed
- https://kifarunix.com/configure-totp-two-factor-authentication-on-apache-guacamole/