Guacamole – Road to MFA – DB auth

I’ve decided with all the convience features I’ve got setup on the computers I remote into, that I should probably attempt to setup TOTP on the site to improve the security of the system. The password and username I use hasn’t been involved in any leaks that I know of, and both are unique to the site, plus you’d need the passwords to the actual computers too, but I figure it’s better safe than sorry.

The first step is to configure a database authentication extension. One nice thing about this change is that it will allow me to modify connections and user settings in the web interface, instead of connecting to SSH and modifying an XML file, and then restarting guacd.

The first step is to install the JDBC connector for mysql, which went without a hitch with

sudo apt install /media/store/mysql-connector-j_9.1.0-1ubuntu24.04_all.deb

Now to create the database, which they are providing scripts to create the schema which saves a whole lot of copy/pasting. So, sign into mysql as root, create the DB, and import the schema.

cweb@thecweb:/media/store/mysql$ sudo mysql -u root
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 3362
Server version: 8.0.39-0ubuntu0.24.04.2 (Ubuntu)

Copyright (c) 2000, 2024, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> CREATE DATABASE guacamole_db;
Query OK, 1 row affected (0.01 sec)

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| cwOLzion           |
| guacamole_db       |
| information_schema |
| mysql              |
| performance_schema |
| sys                |
| wordpress          |
+--------------------+
7 rows in set (0.00 sec)

mysql> quit
Bye
cweb@thecweb:/media/store/mysql$ cat schema/*.sql | sudo mysql -u root guacamole_db
cweb@thecweb:/media/store/mysql$

Create the DB user.

cweb@thecweb:/media/store/mysql$ sudo mysql -u root
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 3371
Server version: 8.0.39-0ubuntu0.24.04.2 (Ubuntu)

Copyright (c) 2000, 2024, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> CREATE USER 'guacamole_user'@'localhost' IDENTIFIED BY '****';
Query OK, 0 rows affected (0.02 sec)

mysql> GRANT SELECT,INSERT,UPDATE,DELETE ON guacamole_db.* TO 'guacamole_user'@'localhost';
Query OK, 0 rows affected (0.01 sec)

mysql> FLUSH PRIVILEGES;
Query OK, 0 rows affected (0.00 sec)

Seems like that went welll, so copying over the JDBC driver and guac extension.

cweb@thecweb:/media/store/mysql$ sudo cp guacamole-auth-jdbc-mysql-1.5.5.jar /etc/guacamole/extensions/
cweb@thecweb:/usr/share/java$ sudo mkdir /etc/guacamole/extensions/lib
cweb@thecweb:/usr/share/java$ sudo cp mysql-connector-j-9.1.0.jar /etc/guacamole/extensions/lib/

No surprises there, but I’m going to heed this warning message about restarting guac, because I’m at work and I don’t want to kill my session if I have something configured or installed incorrectly.

It’s config time

The basic config is just telling guacd how to connect to the DB, so we just need to specify the DB server, DB, user, and password. So creating the /etc/guacamole/guacamole.properties and adding that info.

# MySQL properties
mysql-hostname: localhost
mysql-database: guacamole_db
mysql-username: guacamole_user
mysql-password: ******

And that is it for now. I need to restart the servlet, which will disconnect me, and if I configured things incorrect, also prevent me from signing back in. I’m going to research cooking a turkey for now, and maybe later I will see if this is working. I can always poke holes in the firewall for SSH, and forward port 22, but I’d rather not just because of the immediate hacking attacks that will likely insue.

Part 2

Ok, I got bored with reddit so I poked some holes for SSH and restarted everything, and it came back up fine. Looking at /var/log/auth.log, I was a little surprised to find my paranoia was unfounded and I didn’t see a single authentication attempt during the five minutes my stupid little SSH server was accessible from the internet. Though, I guess it’s pretty unlikely that I would happened to be scanned during that short amount of time.

Now for the bad news… I can’t sign in with the guacadmin account it supposedly created in the DB. To the log files!

I checked the mysql log first, and found not connection attempts. I then checked the tomcat logs and found that the JDBC driver is not loading for some reason.

[2024-11-08 06:41:39] [info] 06:41:39.629 [main] ERROR o.a.g.extension.ProviderFactory - authentication provider extension failed to start: No JDBC driver for MySQL/MariaDB is installed.

So I first go to check permissions on the file and realize that I copied the jar file to /etc/guacamole/extensions/lib instead of /etc/guacamole/lib, so fixing that and restarting everything again.

And it works! I had to recreate my user account and all the connections, but it was a lot easier with the admin GUI.

Taking another break to read about TOTP setup and reddit.