How to install Guacamole 0.9.8 for Ubuntu 14.04 and secure with Nginx ssl

Guacamole is a pretty straightforward RDP/VNC/SFTP utility that requires no plugins on client systems. It utilizes HTML5 to serve up the connections directly over a browser.

This is a pretty standard install to connect to a windows RDP host. We will be securing the server with UFW, fail2ban and SSL using NGINX as a reverse proxy.

First, enable the firewall and allow the following ports:

sed -i 's/ENABLED=no/ENABLED=yes/g' /etc/ufw/ufw.conf

ufw allow 22 && ufw allow 8080

Install the prerequisite software

apt-get update && apt-get install -y fail2ban build-essential htop libcairo2-dev libjpeg62-dev libpng12-dev libossp-uuid-dev tomcat7

apt-get install -y libfreerdp-dev libpango1.0-dev libssh2-1-dev libtelnet-dev libvncserver-dev libpulse-dev libssl-dev libvorbis-dev

Download and extract the guacamole server files

cd ~

wget http://sourceforge.net/projects/guacamole/files/current/source/guacamole-server-0.9.8.tar.gz

tar -xzf guacamole-server-0.9.8.tar.gz && cd guacamole-server-0.9.8/

Compile and make the program (this may take some time depending on your hardware).

./configure --with-init-dir=/etc/init.d && make && make install

Now we want to update the library cache and update the init scripts so it will start on bootup

ldconfig && update-rc.d guacd defaults

Create the main Guacamole configuration folder and file

cd ~ && mkdir /etc/guacamole

Vi (or, you can use Nano/your file editor of choice) the main configuration which provides the location of the user-mapping.xml file.

vi /etc/guacamole/guacamole.properties

# Hostname and port of guacamole proxy
guacd-hostname: localhost
guacd-port: 4822

# Location to read extra .jar's from
lib-directory: /var/lib/tomcat7/webapps/guacamole/WEB-INF/classes

# Authentication provider class
auth-provider: net.sourceforge.guacamole.net.basic.BasicFileAuthenticationProvider

# Properties used by BasicFileAuthenticationProvider
basic-user-mapping: /etc/guacamole/user-mapping.xml

For the Guacamole client, we are going to add a simple RDP connection. This is highly configurable, so be sure to read up on their site to see all the variables.

The Guacamole website will have a username of guacadmin and a password of guacpass.

For our purposes we are going to connect to a windows box, 192.168.0.25 with the username: winuser and the password winpassword on the standard port 3389. Change these fields to the Windows box you want to connect to.

vi /etc/guacamole/user-mapping.xml

<user-mapping>
 <authorize username="guacadmin" password="guacpass">
  <protocol>rdp</protocol>
  <param name="hostname">192.168.0.25</param>
  <param name="port">3389</param>
  <param name="username">winuser</param>
  <param name="password">winpass</param>
 </authorize>
</user-mapping>

You may need to adjust your remote desktop settings to allow connections from non-NLA authenticated servers, such as this.

Update tomcat to point to the user authentication files.

mkdir /usr/share/tomcat7/.guacamole

ln -s /etc/guacamole/guacamole.properties /usr/share/tomcat7/.guacamole

wget http://sourceforge.net/projects/guacamole/files/current/binary/guacamole-0.9.8.war

cp guacamole-0.9.8.war /var/lib/tomcat7/webapps/guacamole.war

Restart the tomcat and guacamole services

service guacd start && service tomcat7 restart

You should now be able to access your server via port 8080. For instance, my server which is 192.168.0.24

http://192.168.0.24:8080/guacamole/

Log in with the guacadmin/guacpass credentials and it will automatically log you into windows using the credentials you supplied in the user-mapping.xml file.

If you do not want it running in the /guacamole subfolder and want to place it in the server root

service tomcat7 stop

mv /var/lib/tomcat7/webapps/ROOT /var/lib/tomcat7/webapps/ROOT.bkp

mv /var/lib/tomcat7/webapps/guacamole /var/lib/tomcat7/webapps/ROOT

service tomcat7 start

You should now be able to access it via the ip and port: http://192.168.0.24:8080

To further strengthen the server and allow https over a standard port, nginx can be installed side-by-side with tomcat to provide a reverse proxy and allow encryption.

apt-get install -y nginx

Don't forget to update the firewall to allow port 443 and remove port 8080

ufw allow 443 && ufw delete allow 8080

Generate the SSL keys

mkdir /etc/nginx/ssl && openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/ssl/guacamole.key -out /etc/nginx/ssl/guacamole.crt

If you are using a DNS name to access the server, or anything other than an IP address, make sure you include the FQDN.

We want to clear out the default nginx configuration and add our own

mv /etc/nginx/sites-available/default /etc/nginx/sites-available/default.bkp

rm /etc/nginx/sites-enabled/default

vi /etc/nginx/sites-available/guacamole

server {
        listen 443 ssl;
        server_name 192.168.0.24;

        access_log   /var/log/nginx/guacamole.access.log ;
        error_log    /var/log/nginx/guacamole.error.log info ;

        ssl_certificate /etc/nginx/ssl/guacamole.crt;
        ssl_certificate_key /etc/nginx/ssl/guacamole.key;

        location / {
        proxy_buffering off;
        proxy_pass  http://127.0.0.1:8080;
        }
}

ln -s /etc/nginx/sites-available/guacamole /etc/nginx/sites-enabled/guacamole

Restart nginx

service nginx restart

You should now be able to access the server via the standard https port

https://192.168.0.24