Month: November 2024

  • Guacamole – Road to MFA – TOTP

    Guacamole – Road to MFA – TOTP

    Well, that was easy. I literally just copied over the jar file and restarted guacd, apache2, and tomcat9. After that I just logged out and back in to enroll in TOTP.

    I did find unfortunately that the KeePass app I’m using on Android doesn’t seem to sync things both ways. Entries I create on my phone do not see to be able to sync to google drive, but that just took me a second to work around. It’s not really a big deal but it meant I had to manually enter in the secret key and such. Guac TOTP supports QR codes, and I was able to add it with my phone, but wasn’t able to get it to sync back to my computer(after five minutes of trying). That may be a project for another day.

  • Guacamole – Road to MFA – DB auth

    Guacamole – Road to MFA – DB auth

    I’ve decided with all the convience features I’ve got setup on the computers I remote into, that I should probably attempt to setup TOTP on the site to improve the security of the system. The password and username I use hasn’t been involved in any leaks that I know of, and both are unique to the site, plus you’d need the passwords to the actual computers too, but I figure it’s better safe than sorry.

    The first step is to configure a database authentication extension. One nice thing about this change is that it will allow me to modify connections and user settings in the web interface, instead of connecting to SSH and modifying an XML file, and then restarting guacd.

    The first step is to install the JDBC connector for mysql, which went without a hitch with

    sudo apt install /media/store/mysql-connector-j_9.1.0-1ubuntu24.04_all.deb

    Now to create the database, which they are providing scripts to create the schema which saves a whole lot of copy/pasting. So, sign into mysql as root, create the DB, and import the schema.

    cweb@thecweb:/media/store/mysql$ sudo mysql -u root
    Welcome to the MySQL monitor.  Commands end with ; or \g.
    Your MySQL connection id is 3362
    Server version: 8.0.39-0ubuntu0.24.04.2 (Ubuntu)
    
    Copyright (c) 2000, 2024, Oracle and/or its affiliates.
    
    Oracle is a registered trademark of Oracle Corporation and/or its
    affiliates. Other names may be trademarks of their respective
    owners.
    
    Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
    
    mysql> CREATE DATABASE guacamole_db;
    Query OK, 1 row affected (0.01 sec)
    
    mysql> show databases;
    +--------------------+
    | Database           |
    +--------------------+
    | cwOLzion           |
    | guacamole_db       |
    | information_schema |
    | mysql              |
    | performance_schema |
    | sys                |
    | wordpress          |
    +--------------------+
    7 rows in set (0.00 sec)
    
    mysql> quit
    Bye
    cweb@thecweb:/media/store/mysql$ cat schema/*.sql | sudo mysql -u root guacamole_db
    cweb@thecweb:/media/store/mysql$

    Create the DB user.

    cweb@thecweb:/media/store/mysql$ sudo mysql -u root
    Welcome to the MySQL monitor.  Commands end with ; or \g.
    Your MySQL connection id is 3371
    Server version: 8.0.39-0ubuntu0.24.04.2 (Ubuntu)
    
    Copyright (c) 2000, 2024, Oracle and/or its affiliates.
    
    Oracle is a registered trademark of Oracle Corporation and/or its
    affiliates. Other names may be trademarks of their respective
    owners.
    
    Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
    
    mysql> CREATE USER 'guacamole_user'@'localhost' IDENTIFIED BY '****';
    Query OK, 0 rows affected (0.02 sec)
    
    mysql> GRANT SELECT,INSERT,UPDATE,DELETE ON guacamole_db.* TO 'guacamole_user'@'localhost';
    Query OK, 0 rows affected (0.01 sec)
    
    mysql> FLUSH PRIVILEGES;
    Query OK, 0 rows affected (0.00 sec)

    Seems like that went welll, so copying over the JDBC driver and guac extension.

    cweb@thecweb:/media/store/mysql$ sudo cp guacamole-auth-jdbc-mysql-1.5.5.jar /etc/guacamole/extensions/
    cweb@thecweb:/usr/share/java$ sudo mkdir /etc/guacamole/extensions/lib
    cweb@thecweb:/usr/share/java$ sudo cp mysql-connector-j-9.1.0.jar /etc/guacamole/extensions/lib/

    No surprises there, but I’m going to heed this warning message about restarting guac, because I’m at work and I don’t want to kill my session if I have something configured or installed incorrectly.

    It’s config time

    not sure this really applies since I’ve been using vi since the late 1900s

    The basic config is just telling guacd how to connect to the DB, so we just need to specify the DB server, DB, user, and password. So creating the /etc/guacamole/guacamole.properties and adding that info.

    # MySQL properties
    mysql-hostname: localhost
    mysql-database: guacamole_db
    mysql-username: guacamole_user
    mysql-password: ******

    And that is it for now. I need to restart the servlet, which will disconnect me, and if I configured things incorrect, also prevent me from signing back in. I’m going to research cooking a turkey for now, and maybe later I will see if this is working. I can always poke holes in the firewall for SSH, and forward port 22, but I’d rather not just because of the immediate hacking attacks that will likely insue.

    Part 2

    Ok, I got bored with reddit so I poked some holes for SSH and restarted everything, and it came back up fine. Looking at /var/log/auth.log, I was a little surprised to find my paranoia was unfounded and I didn’t see a single authentication attempt during the five minutes my stupid little SSH server was accessible from the internet. Though, I guess it’s pretty unlikely that I would happened to be scanned during that short amount of time.

    Now for the bad news… I can’t sign in with the guacadmin account it supposedly created in the DB. To the log files!

    I checked the mysql log first, and found not connection attempts. I then checked the tomcat logs and found that the JDBC driver is not loading for some reason.

    [2024-11-08 06:41:39] [info] 06:41:39.629 [main] ERROR o.a.g.extension.ProviderFactory - authentication provider extension failed to start: No JDBC driver for MySQL/MariaDB is installed.

    So I first go to check permissions on the file and realize that I copied the jar file to /etc/guacamole/extensions/lib instead of /etc/guacamole/lib, so fixing that and restarting everything again.

    And it works! I had to recreate my user account and all the connections, but it was a lot easier with the admin GUI.

    Fancy that!

    Taking another break to read about TOTP setup and reddit.

  • Trump again…

    I’m not really surprised he won. I mean the poll numbers were pretty clear that he was going to win. I thought I would be a lot more disappointed, but I find myself overcome with morbid curiosity. I don’t really believe he’ll be able to get a second term, or turn America into a dictatorship, so I’m going to really enjoy reading about all the escapades of his administration.

    Of course I could be wrong about that too, so who knows.