{"id":694,"date":"2024-07-29T17:17:28","date_gmt":"2024-07-29T23:17:28","guid":{"rendered":"https:\/\/thecweb.com\/?p=694"},"modified":"2024-07-29T17:17:28","modified_gmt":"2024-07-29T23:17:28","slug":"guacamole-day-3","status":"publish","type":"post","link":"https:\/\/thecweb.com\/index.php\/2024\/07\/29\/guacamole-day-3\/","title":{"rendered":"Guacamole – Day 3"},"content":{"rendered":"\n

Ok, time to download the source and compline. I’m still following the manual located here<\/a>.<\/p>\n\n\n\n

So I’ll download<\/a> the client and server tars and decompress them to temp. <\/p>\n\n\n\n

cweb@thecweb:\/tmp$ tar -xzf guacamole-client-1.5.5.tar.gz\ncweb@thecweb:\/tmp$ tar -xzf guacamole-server-1.5.5.tar.gz\ncweb@thecweb:\/tmp$ ls guac*\nguacamole-client-1.5.5.tar.gz  guacamole-server-1.5.5.tar.gz\n\nguacamole-client-1.5.5:\nCONTRIBUTING  LICENSE  README  extensions  guacamole-common     guacamole-docker  pom.xml\nDockerfile    NOTICE   doc     guacamole   guacamole-common-js  guacamole-ext     src\n\nguacamole-server-1.5.5:\nCONTRIBUTING  LICENSE      Makefile.in  README      bin        config.h.in  configure.ac  m4   util\nDockerfile    Makefile.am  NOTICE       aclocal.m4  build-aux  configure    doc           src\ncweb@thecweb:\/tmp$<\/code><\/pre>\n\n\n\n
It looks to be the standard configure, make, make install<\/em> that is common in FOSS software.  For the server configure<\/em> got me this,<\/p>\n\n\n\n
------------------------------------------------\nguacamole-server version 1.5.5\n------------------------------------------------\n\n   Library status:\n\n     freerdp2 ............ yes\n     pango ............... yes\n     libavcodec .......... yes\n     libavformat.......... yes\n     libavutil ........... yes\n     libssh2 ............. yes\n     libssl .............. yes\n     libswscale .......... yes\n     libtelnet ........... yes\n     libVNCServer ........ yes\n     libvorbis ........... yes\n     libpulse ............ yes\n     libwebsockets ....... yes\n     libwebp ............. yes\n     wsock32 ............. no\n\n   Protocol support:\n\n      Kubernetes .... yes\n      RDP ........... yes\n      SSH ........... yes\n      Telnet ........ yes\n      VNC ........... yes\n\n   Services \/ tools:\n\n      guacd ...... yes\n      guacenc .... yes\n      guaclog .... yes\n\n   FreeRDP plugins: \/usr\/lib\/x86_64-linux-gnu\/freerdp2\n   Init scripts: no\n   Systemd units: no\n\nType \"make\" to compile guacamole-server.<\/code><\/pre>\n\n\n\n
so it looks like all the dependencies installed correctly.  make<\/em> completed without errors so now make install<\/em>.  <\/p>\n\n\n\n
sudo make install<\/em> completed without errors, so I just need to sudo ldconfig<\/em> to update the system library cache.  And add the server to systemd.  <\/p>\n\n\n\n
cweb@thecweb:\/tmp\/guacamole-server-1.5.5$ sudo guacd\nguacd[24340]: INFO:     Guacamole proxy daemon (guacd) version 1.5.5 started\n\ncweb@thecweb:\/tmp\/guacamole-server-1.5.5$ sudo systemctl enable guacd\nFailed to enable unit: Unit file guacd.service does not exist.<\/code><\/pre>\n\n\n\n
Shit.  Looks like I didn’t include the option –with-init-dir=\/etc\/init.d when I ran configure, so we’re going to be repeating a few steps.  It’s important to actually read install instructions and not just skim them.  <\/p>\n\n\n\n
Shit.  I want to use systemd not initd.  And the instructions don’t say what the option is for that.  Rather than guessing we’ll just do this<\/p>\n\n\n\n
cweb@thecweb:\/tmp\/guacamole-server-1.5.5$ cat configure | grep systemd<\/strong>\nsystemd_dir\nwith_systemd_dir\n  --with-systemd-dir<\/strong>=<path>\n                          install systemd units to the given directory\n# Check whether --with-systemd_dir was given.\nif test ${with_systemd_dir+y}\n  withval=$with_systemd_dir; systemd_dir=$withval\n if test \"x${systemd_dir}\" != \"x\"; then\n  build_systemd=\"${systemd_dir}\"\n  build_systemd=no\n   Systemd units: ${build_systemd}<\/code><\/pre>\n\n\n\n
I probably could have guessed that.  <\/p>\n\n\n\n
Now that I’ve got that redone, I was still getting an error because I gave the path as \/etc\/systemd instead of \/etc\/systemd\/system, but that was easy to fix.  We are now in business.<\/p>\n\n\n\n
cweb@thecweb:\/tmp\/guacamole-server-1.5.5$ sudo mv \/etc\/systemd\/guacd.service \/etc\/systemd\/system\/guacd.s<\/strong>\nervice\ncweb@thecweb:\/tmp\/guacamole-server-1.5.5$ sudo systemctl enable guacd<\/strong>\nCreated symlink \/etc\/systemd\/system\/multi-user.target.wants\/guacd.service \u2192 \/etc\/systemd\/system\/guacd.service.\ncweb@thecweb:\/tmp\/guacamole-server-1.5.5$ sudo systemctl start guacd<\/strong>\ncweb@thecweb:\/tmp\/guacamole-server-1.5.5$ sudo systemctl status guacd<\/strong>\n\u25cf guacd.service - Guacamole Server\n     Loaded: loaded (\/etc\/systemd\/system\/guacd.service; enabled; vendor preset: enabled)\n     Active: active (running) since Mon 2024-07-29 20:17:11 UTC; 7s ago<\/strong>\n       Docs: man:guacd(8)\n   Main PID: 41937 (guacd)\n      Tasks: 1 (limit: 9251)\n     Memory: 10.0M\n        CPU: 10ms\n     CGroup: \/system.slice\/guacd.service\n             \u2514\u250041937 \/usr\/local\/sbin\/guacd -f\n\nJul 29 20:17:11 thecweb.com systemd[1]: Started Guacamole Server.\nJul 29 20:17:11 thecweb.com guacd[41937]: Guacamole proxy daemon (guacd) version 1.5.5 started\nJul 29 20:17:11 thecweb.com guacd[41937]: guacd[41937]: INFO:        Guacamole proxy daemon (guacd) ver>\nJul 29 20:17:11 thecweb.com guacd[41937]: guacd[41937]: INFO:        Listening on host 127.0.0.1, port >\nJul 29 20:17:11 thecweb.com guacd[41937]: Listening on host 127.0.0.1, port 4822\ncweb@thecweb:\/tmp\/guacamole-server-1.5.5$<\/code><\/pre>\n\n\n\n
The guacamole-client files and extensions are just java files that they provide precompiled, so I’m just going to do that.  I’m just going to copy over the client without extensions now because I’m not sure which ones I want to use yet.<\/p>\n\n\n\n
cweb@thecweb:\/tmp$ sudo cp guacamole-1.5.5.war \/var\/lib\/tomcat9\/webapps\ncweb@thecweb:\/tmp$ sudo systemctl restart tomcat9\ncweb@thecweb:\/tmp$ sudo systemctl restart guacd\ncweb@thecweb:\/tmp$<\/code><\/pre>\n\n\n\n
\"\"<\/p>\n\n\n\n
Yay!  It’s working!  No, wait.  It’s not started, and starting it gives me an error.  I messed around with trying to figure out what was wrong for a little while and then just tried Undeploy and then deployed it through the app manager using the link below, and now it’s started.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Yay!!!!!!!!!!!!!!!!!  \ud83e\udd73\ud83c\udf7e\ud83d\udd7a<\/p>\n\n\n\n
Now I need to configure it behind a reverse proxy using the instructions here<\/a>.  This isn’t required but it enhances the system security by allowing the applet to run without root, and allows be to access Guacamole over port 443 instead of 8080.  Which is good because I don’t need to poke another hole in my firewall and it should also help hide the traffic from big brother while I’m at work.<\/p>\n\n\n\n
Step one is to add the bolded lines to the Tomcat server config file at \/etc\/tomcat9\/server.xml.  This is to handle non-Latin characters.  So I probably don’t really NEED it but that is what the docs say.<\/p>\n\n\n\n
<Connector port=\"8080\" protocol=\"HTTP\/1.1\"\n               connectionTimeout=\"20000\"\n               URIEncoding=\"UTF-8\"<\/strong>\n               redirectPort=\"8443\" \/><\/code><\/pre>\n\n\n\n
In the same file I need to add this stuff so Tomcat can get the remote client’s IP address.  Without this it will only see the reverse proxy’s IP.  If you’re curious why this is needed there are several paragraphs in the proxy instructions explaining it under the heading “Setting up the Remote IP Valve”.  <\/p>\n\n\n\n
<Valve className=\"org.apache.catalina.valves.RemoteIpValve\"\n               internalProxies=\"127.0.0.1\"\n               remoteIpHeader=\"x-forwarded-for\"\n               remoteIpProxiesHeader=\"x-forwarded-by\"\n               protocolHeader=\"x-forwarded-proto\" \/><\/code><\/pre>\n\n\n\n
Now I need to enable the modules to add reverse proxy support in Apache.  <\/p>\n\n\n\n
cweb@thecweb:\/etc\/tomcat9$ sudo a2enmod proxy<\/strong>\nEnabling module proxy.\nTo activate the new configuration, you need to run:\n  systemctl restart apache2\ncweb@thecweb:\/etc\/tomcat9$ sudo a2enmod proxy_http<\/strong>\nConsidering dependency proxy for proxy_http:\nModule proxy already enabled\nEnabling module proxy_http.\nTo activate the new configuration, you need to run:\n  systemctl restart apache2\ncweb@thecweb:\/etc\/tomcat9$ sudo a2enmod proxy_wstunnel<\/strong>\nConsidering dependency proxy for proxy_wstunnel:\nModule proxy already enabled\nEnabling module proxy_wstunnel.\nTo activate the new configuration, you need to run:\n  systemctl restart apache2\ncweb@thecweb:\/etc\/tomcat9$ sudo systemctl restart apache2<\/strong>\ncweb@thecweb:\/etc\/tomcat9$<\/code><\/pre>\n\n\n\n
For the site configuration I need to add the below to \/etc\/apache2\/sites-enabled\/chrisweber.online-le-ssl.conf to tell Apache use the reverse proxy to access Tomcat when the specific URL Location is requested.<\/p>\n\n\n\n
<Location \/sneakypete\/>\n                Order allow,deny\n                Allow from all\n                ProxyPass http:\/\/127.0.0.1:8080\/sneakypete\/ flushpackets=on\n                ProxyPassReverse http:\/\/127.0.0.1:8080\/sneakypete\/\n        <\/Location>\n\n        <Location \/sneakypete\/websocket-tunnel>\n                Order allow,deny\n                Allow from all\n                ProxyPass ws:\/\/127.0.0.1:8080\/sneakypete\/websocket-tunnel\n                ProxyPassReverse ws:\/\/127.0.0.1:8080\/sneakypete\/\/websocket-tunnel<\/code><\/pre>\n\n\n\n
Shit!  I’m getting a 404 error when trying to access https:\/\/thecweb.com\/sneakypete<\/a>.  It’s embarrising how long this took me to fix.  Probably half an hour of looking at the Guacamole manuals and the mod_proxy documentation, and then another half an hour of googling with no resolution in site I thought maybe I actually need to create the directory that location is referring to?  Yup…  I miss understood what the Location directive actually does.  I thought it just mapped the URL to the directives without referencing the servers filesystem.  Nope.  If the directory doesn’t exist, Apache doesn’t even go that far.  So a simple “sudo mkdir sneakypete” in the site’s \/var\/www directory and now I’ve got the login page.  Reverse proxy is working!<\/p>\n\n\n\n
I think I’m done for the day.  If not there will be a 3.5 post after I’ve cleared my head.  <\/p>\n","protected":false},"excerpt":{"rendered":"
Ok, time to download the source and compline. I’m still following the manual located here. So I’ll download the client and server tars and decompress them to temp. It looks to be the standard configure, make, make install that is common in FOSS software. For the server configure got me this, so it looks like […]<\/p>\n","protected":false},"author":1,"featured_media":695,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[16,17,14,30,15],"class_list":["post-694","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","tag-apache","tag-guacamole","tag-linux","tag-tinkering","tag-ubuntu"],"_links":{"self":[{"href":"https:\/\/thecweb.com\/index.php\/wp-json\/wp\/v2\/posts\/694","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thecweb.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thecweb.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thecweb.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thecweb.com\/index.php\/wp-json\/wp\/v2\/comments?post=694"}],"version-history":[{"count":3,"href":"https:\/\/thecweb.com\/index.php\/wp-json\/wp\/v2\/posts\/694\/revisions"}],"predecessor-version":[{"id":698,"href":"https:\/\/thecweb.com\/index.php\/wp-json\/wp\/v2\/posts\/694\/revisions\/698"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thecweb.com\/index.php\/wp-json\/wp\/v2\/media\/695"}],"wp:attachment":[{"href":"https:\/\/thecweb.com\/index.php\/wp-json\/wp\/v2\/media?parent=694"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thecweb.com\/index.php\/wp-json\/wp\/v2\/categories?post=694"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thecweb.com\/index.php\/wp-json\/wp\/v2\/tags?post=694"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}