Настройка веб-шлюза Apache Guacamole

Обновляем пакеты

sudo apt update

sudo apt install make gcc g++ libcairo2-dev libjpeg-turbo8-dev libpng-dev libtool-bin libossp-uuid-dev libavcodec-dev libavutil-dev libswscale-dev freerdp2-dev libpango1.0-dev libssh2-1-dev libvncserver-dev libtelnet-dev libssl-dev libvorbis-dev libwebp-dev

sudo apt install openjdk-11-jdk

Создаем отдельного пользователя для работы с Tomcat

sudo useradd -m -U -d /etc/tomcat -s /bin/false tomcat

wget https://dlcdn.apache.org/tomcat/tomcat-9/v9.0.82/bin/apache-tomcat-9.0.82.tar.gz -P /tmp

sudo tar -xf /tmp/apache-tomcat-9.0.82.tar.gz -C /etc/tomcat/

sudo ln -s /etc/tomcat/apache-tomcat-9.0.82 /etc/tomcat/lastv

sudo chown -R tomcat: /etc/tomcat

sudo sh -c \'chmod +x /etc/tomcat/lastv/bin/*.sh'

nano /etc/systemd/system/tomcat.service

[Unit]
Description=Tomcat 9
After=network.target

[Service]
Type=forking

User=tomcat
Group=tomcat

Environment="JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64"
Environment="JAVA_OPTS=-Djava.security.egd=file:///dev/urandom -Djava.awt.headless=true"

Environment="CATALINA_BASE=/etc/tomcat/lastv"
Environment="CATALINA_HOME=/etc/tomcat/lastv"
Environment="CATALINA_PID=/etc/tomcat/lastv/temp/tomcat.pid"
Environment="CATALINA_OPTS=-Xms512M -Xmx1024M -server -XX:+UseParallelGC"

ExecStart=/etc/tomcat/lastv/bin/startup.sh
ExecStop=/etc/tomcat/lastv/bin/shutdown.sh

[Install]
WantedBy=multi-user.target

systemctl restart tomcat

systemctl enable tomcat

systemctl status tomcat

Скачиваем и распаковываем guacamole server

wget https://downloads.apache.org/guacamole/1.5.3/source/guacamole-server-1.5.3.tar.gz -P /tmp

cd /tmp

tar -xzf guacamole-server-1.5.3.tar.gz

cd guacamole-server-1.5.3/

./configure --with-init-dir=/etc/init.d

sudo make 

sudo make install

sudo ldconfig

sudo systemctl enable guacd

sudo systemctl start guacd

systemctl status guacd

Создаем важные каталоги

sudo mkdir /etc/guacamole

sudo mkdir /etc/guacamole/extensions

sudo mkdir /etc/guacamole/lib

Скачиваем клиент и делаем символьную ссылку

wget https://downloads.apache.org/guacamole/1.5.3/binary/guacamole-1.5.3.war -P /etc/guacamole

ln -s /etc/guacamole/guacamole-1.5.3.war /etc/tomcat/lastv/webapps/guacamole.war

Установка и назначение пароля

sudo apt install mariadb-server

sudo mysql_secure_installation

mysql -u root -p

CREATE DATABASE guacamole_test CHARACTER SET UTF8;

CREATE USER guacamole_test@localhost IDENTIFIED BY 'password123456';

GRANT SELECT,INSERT,UPDATE,DELETE ON guacamole_test.* TO 'guacamole_test'@'localhost';

FLUSH PRIVILEGES;

exit

Соединяем базу данных и guacamole

sudo nano /etc/guacamole/guacamole.properties

mysql-hostname: localhost
mysql-port: 3306
mysql-database: guacamole_test
mysql-username: guacamole_test
mysql-password: password123456
guacd-port: 4822
user-mapping: /etc/guacamole/user-mapping.xml
auth-provider: net.sourceforge.guacamole.net.basic.BasicFileAuthenticationProvider

wget https://dev.mysql.com/get/Downloads/Connector/mysql-connector-java-8.0.30.tar.gz -P /tmp

wget https://downloads.apache.org/guacamole/1.5.3/binary/guacamole-auth-jdbc-1.5.3.tar.gz -P /tmp

cd /tmp

tar -xzf mysql-connector-java-8.0.30.tar.gz

tar -xzf guacamole-auth-jdbc-1.5.3.tar.gz

sudo cp /tmp/mysql-connector-java-8.0.30/mysql-connector-java-8.0.30.jar /etc/guacamole/lib/

sudo cp /tmp/guacamole-auth-jdbc-1.5.3/mysql/guacamole-auth-jdbc-mysql-1.5.3.jar /etc/guacamole/extensions/

cd /tmp/guacamole-auth-jdbc-1.5.3/mysql/

cat schema/*.sql | mysql -u root -p guacamole_test

Открываем файл

nano /etc/guacamole/user-mapping.xml

<user-mapping>
 <authorize
      username="guacadmin"
      password="5cbd438413e8e3ca0e14e200fde621a9"
      encoding="md5">
   <!-- SSH -->
   <connection name="Имя вашего сервера">
       <protocol>ssh</protocol>
         <param name="hostname">ваш_ip</param>
         <param name="port">22</param>
   </connection>
   <!-- RDP -->
   <connection name="Имя вашего сервера">
       <protocol>rdp</protocol>
         <param name="hostname">ваш_ip</param>
         <param name="port">3389</param>
         <param name="username">Имя пользователя</param>
         <param name="ignore-cert">true</param>
   </connection>
 </authorize>
</user-mapping>

systemctl restart tomcat guacd

Установка nginx

apt install nginx

nano /etc/nginx/sites-available/guacamole.conf

server {
        listen 80;
        server_name ваш_ip;
        access_log  /var/log/nginx/guac_access.log;
        error_log  /var/log/nginx/guac_error.log;

        location / {
                    proxy_pass http://ваш_ip:8080/guacamole/;
                    proxy_buffering off;
                    proxy_http_version 1.1;
                    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                    proxy_set_header Upgrade $http_upgrade;
                    proxy_set_header Connection $http_connection;
                    proxy_cookie_path /guacamole/ /;
        }

}

Делаем символьную ссылку

ln -s /etc/nginx/sites-available/guacamole.conf /etc/nginx/sites-enabled/

systemctl restart nginx

Нужно зайти

http://Ваш_ip

• Логин - guacadmin
• пароль - guacadmin