Cannot mount guacamole.properties outside docker container

[tomlawesome]

I'm trying to setup SSL between guacamole and guacd. I have the following in
guac.conf:

[ssl]
server_certificate = /certs/guacamole/guacd/guacd.pem
server_key = /certs/guacamole/guacd/guacd.key

And added the following line in guacamole.properties:

guacd-ssl: true

I'm adding the guacamole.properties and guacd.conf files as volumes in my
docker compose:

Client:
  -
$DOCKER_APPDATA/guacamole/client/guacamole.properties:/root/.guacamole/guacamole.properties

Guacd (folder where :
  - $DOCKER_APPDATA/guacamole/guacd:/etc/guacamole

I get the following error:
rm: cannot remove '/root/.guacamole/guacamole.properties': Device or
resource busy

I want to mount the settings files outside the container, for the obvious
benefit of easy persistence of data/settings. 

Anyone know if I can achieve this, and also if the  guacd commandlines must
be specified in docker-compose? If so, what they are? 



--
Sent from: 
http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/

-
To unsubscribe, e-mail: user-unsubscr...@guacamole.apache.org
For additional commands, e-mail: user-h...@guacamole.apache.org

openid connect loop problem

[quegu]

Hello

I am experiencing a looping problem with the Openid connection extension
with Keycloak. I have searched the forums and see this problem but without
any solution. I am running guacamole 1.3.0 with extension 1.3.0 . 

my experience is exactly the same as this user: 

https://issues.apache.org/jira/browse/GUACAMOLE-1251

the only thing i see in logs is:

DEBUG o.a.g.rest.RESTExceptionMapper - Client request rejected: Invalid
login.
DEBUG o.a.g.r.auth.AuthenticationService - Anonymous authentication attempt
from x.x.x.x failed.

the looping is between these two URIs:


https://keycloakexample.com/auth/realms/demo/protocol/openid-connect/auth?scope=openid+email+profile&response_type=id_token&client_id=guacamole&redirect_uri=http://example.com:8080/guacamole/%23/

http://example.com:8080/guacamole/#/&id_token=kjhkhjkj...

i see in jira :

https://issues.apache.org/jira/browse/GUACAMOLE-560

so is it possible for it to work with Keycloak currently? or its broken for
now?

thank you






--
Sent from: 
http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/

-
To unsubscribe, e-mail: user-unsubscr...@guacamole.apache.org
For additional commands, e-mail: user-h...@guacamole.apache.org

Re: Cannot mount guacamole.properties outside docker container

[tomlawesome]

To add -- I have also tried to change GUACAMOLE_HOME to an alternate
directory so that I might be able to then mount guacamole.properties into
it. 

This does not work however (I believe from the docs) because the official
guacamole image has a /root/.guacamole/ folder and guacamole looks for it
first, and if it exists it over-rides any GUACAMOLE_HOME environment
variables. 

I'm really stuck because the official guacamole image does not include
either vi, vim or nano so I'm unsure how to even edit the
guacamole.properties file directly in the container??

Any help greatly appreciated.  



--
Sent from: 
http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/

-
To unsubscribe, e-mail: user-unsubscr...@guacamole.apache.org
For additional commands, e-mail: user-h...@guacamole.apache.org

Re: Cannot mount guacamole.properties outside docker container

[Mike Jumper]

On Fri, Apr 2, 2021 at 9:35 AM tomlawesome 
wrote:

> To add -- I have also tried to change GUACAMOLE_HOME to an alternate
> directory so that I might be able to then mount guacamole.properties into
> it.
>
> This does not work however (I believe from the docs) because the official
> guacamole image has a /root/.guacamole/ folder and guacamole looks for it
> first, and if it exists it over-rides any GUACAMOLE_HOME environment
> variables.
>
> I'm really stuck because the official guacamole image does not include
> either vi, vim or nano so I'm unsure how to even edit the
> guacamole.properties file directly in the container??
>

The Docker image interprets the GUACAMOLE_HOME environment variable
independently of the web application, using the variable to represent the
location of a directory with the structure of GUACAMOLE_HOME that should be
used as the basis for the one generated by the image startup process. The
directory is used as a template. See:

http://guacamole.apache.org/doc/gug/guacamole-docker.html#guacamole-docker-guacamole-home

To provide your own guacamole.properties, you need to volume mount your own
equivalent of GUACAMOLE_HOME within the container (do not use one of the
standard locations for GUACAMOLE_HOME), and point the container's
GUACAMOLE_HOME environment variable at that. If you specify any additional
environment variables that are supported by the image, those variables will
also be taken into account when producing the merged guacamole.properties.

Michael Jumper
CEO, Lead Developer
Glyptodon Inc .

Re: upgrade guacamole 1.2.0 to 1.3.0

[Mike Jumper]

On Thu, Apr 1, 2021 at 9:57 PM Golota S.V.  wrote:

> solved this problem:
> systemctl start tomcat9 guacd
>
guacd has no bearing on extensions.

> removed / var / lib / tomcat9 / webapps / guacamole
>
This is probably what ultimately solved what you were experiencing - a
cached copy of an older version of the web application.

> re-compiled server 1.3.0
>
guacamole-server and guacd have no bearing on extensions.

> Now there is a problem that throws out windows 7 from the session when you
> hover over the start button, but this is a topic for another discussion.
>
Try disabling the glyph cache. See:
https://issues.apache.org/jira/browse/GUACAMOLE-1191

Michael Jumper
CEO, Lead Developer
Glyptodon Inc .

>

Re: Cannot mount guacamole.properties outside docker container

[tomlawesome]

Hi Michael, 

Thanks for your reply, I really appreciate it. Just to be clear in my own
head, I need to create a folder on my host server with the following
structure: 

/guacamole.properties

/lib
/lib/MyLibFile1.jar
/lib/MyLibFile2.jar
etc

/extensions
/extensions/MyExtension1.jar
/extensions/MyExtension2.jar
etc

I would continue to use my environment variables as normal in
docker-compose, but add GUACAMOLE_HOME as follows?


environment:
  GUACAMOLE_HOME: /some/non-default/location
  GUACD_HOSTNAME: guacd
  TOTP_ENABLED: "true"
  LDAP_HOSTNAME: ${LDAP_HOSTNAME}
  . etc
  MYSQL_PORT: $MARIADB_PORT
  MYSQL_PASSWORD: 

Then, to finish I will mount the folder location (on my host server) to the
guacamole container:

volumes:
  - /my/host/folder/for/guac/home:/location/listed/in/envrionment/variable

Cheers,
Tom



--
Sent from: 
http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/

-
To unsubscribe, e-mail: user-unsubscr...@guacamole.apache.org
For additional commands, e-mail: user-h...@guacamole.apache.org

Random Dropped RDP sessions

[Weeks, Thomas]

Forgive my ignorant first post.. but I hadn't seen anything posted on this 
anywhere yet..

But we use a sharded Guac container config (w/external ha-proxy https front 
end) running at large scale (thousands of AWS VMs).. and since upgrading to 
v1.2, (preparing to upgrade to 1.3), but users are currently seeing dropped RDP 
sessions (multiple times/day) on both Windows(10, server 2016) as well as Linux 
(Ubuntu/Deb run xrdp).

It physically looks like this:
https://photos.app.goo.gl/zo165UeDtQHoYWST6

and in the logs:
17:22:47.909 [Thread-271] ERROR o.a.g.w.GuacamoleWebSocketTunnelEndpoint - 
Connection to guacd terminated abnormally: Connection to guacd timed out.
...
17:22:47.910 [Thread-271] INFO  o.a.g.tunnel.TunnelRequestService - User 
"f1bb5985-5f0a-4ce5-8d25-ac031d198c97" disconnected from connection 
"a609c1f6-0b59-48e0-84eb-7850b62a6ddb/b7202e69-a7eb-4a68-8762-b60ca0815d68/2d5a891b-f7e7-4d99-b583-05376e5a2f5a".
 Duration: 311400 milliseconds

Reconnecting (same session token) seems to work.

Anyone seen this or know if it's related to a known issue?  Never happened on 
older guac (v 0.95)

--
T.Weeks
VirginiaCyberRange.org

Re: Random Dropped RDP sessions

[Mike Jumper]

On Fri, Apr 2, 2021 at 10:22 AM Weeks, Thomas  wrote:

> Forgive my ignorant first post.. but I hadn't seen anything posted on this
> anywhere yet..
>
> But we use a sharded Guac container config (w/external ha-proxy https
> front end) running at large scale (thousands of AWS VMs).. and since
> upgrading to v1.2, (preparing to upgrade to 1.3), but users are currently
> seeing dropped RDP sessions (multiple times/day) on both Windows(10, server
> 2016) as well as Linux (Ubuntu/Deb run xrdp).
>
> It physically looks like this:
> https://photos.app.goo.gl/zo165UeDtQHoYWST6
>
> and in the logs:
>
> 17:22:47.909 [Thread-271] ERROR o.a.g.w.GuacamoleWebSocketTunnelEndpoint -
> Connection to guacd terminated abnormally: Connection to guacd timed out.
> ...
> 17:22:47.910 [Thread-271] INFO  o.a.g.tunnel.TunnelRequestService - User
> "f1bb5985-5f0a-4ce5-8d25-ac031d198c97" disconnected from connection
> "a609c1f6-0b59-48e0-84eb-7850b62a6ddb/b7202e69-a7eb-4a68-8762-b60ca0815d68/2d5a891b-f7e7-4d99-b583-05376e5a2f5a".
> Duration: 311400 milliseconds
>
>
> Reconnecting (same session token) seems to work.
>
> Anyone seen this or know if it's related to a known issue?  Never happened
> on older guac (v 0.95)
>

The error displayed on the screen in your photo ("The Guacamole server is
not currently reachable. Please check your network and try again.")
indicates network disruption between the browser and the Guacamole server.
The logs noting connection timeout also suggest that a network disruption
resulted in a lack of communication from the client, with guacd ultimately
closing the connection.

The most likely cause of what you're seeing is a transient network failure
or something between the browser and the server interfering with the
connection, perhaps closing what it considers to be too long-running.

Michael Jumper
CEO, Lead Developer
Glyptodon Inc .

Re: Cannot mount guacamole.properties outside docker container

[tomlawesome]

The docs state that the .jar files will auto-populate on build, so I created
the folder structure without any .jars, but with my guacamole.properties
within the rigid defined structure. 

I mounted it to /home/guacamole
I can see the mounted folder, included the folders and my copy of
guacamole.properties inside the container. 
I have defined the environment variable:

GUACAMOLE_HOME: /home/guacamole

But the logs for guacamole show it is still using /root/.guacamole

02-Apr-2021 17:28:58.191 INFO [localhost-startStop-1]
org.apache.jasper.servlet.TldScanner.scanJars At least one JAR was scanned
for TLDs yet contained no TLDs. Enable debug logging for this logger for a
complete list of JARs that were scanned but no TLDs were found in them.
Skipping unneeded JARs during scanning can improve startup time and JSP
compilation time.
17:28:58.907 [localhost-startStop-1] INFO 
o.a.g.environment.LocalEnvironment - GUACAMOLE_HOME is "/root/.guacamole".
17:28:59.011 [localhost-startStop-1] INFO 
o.a.g.rest.auth.HashTokenSessionMap - Sessions will expire after 20 minutes
of inactivity.
17:28:59.318 [localhost-startStop-1] INFO 
o.a.g.environment.LocalEnvironment - GUACAMOLE_HOME is "/root/.guacamole".
17:29:00.753 [localhost-startStop-1] INFO  o.a.g.extension.ExtensionModule -
Extension "MySQL Authentication" loaded.
17:29:00.760 [localhost-startStop-1] INFO 
o.a.g.environment.LocalEnvironment - GUACAMOLE_HOME is "/root/.guacamole".
17:29:01.030 [localhost-startStop-1] WARN  o.a.g.e.LanguageResourceService -
Overlay language resource "de" does not exist.
17:29:01.032 [localhost-startStop-1] INFO  o.a.g.extension.ExtensionModule -
Extension "LDAP Authentication" loaded.
17:29:01.035 [localhost-startStop-1] INFO 
o.a.g.environment.LocalEnvironment - GUACAMOLE_HOME is "/root/.guacamole".

Can I get around this by telling guacamole to use a different user/PID/GUID? 




--
Sent from: 
http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/

-
To unsubscribe, e-mail: user-unsubscr...@guacamole.apache.org
For additional commands, e-mail: user-h...@guacamole.apache.org

Re: Cannot mount guacamole.properties outside docker container

[Mike Jumper]

On Fri, Apr 2, 2021 at 10:34 AM tomlawesome 
wrote:

> The docs state that the .jar files will auto-populate on build, so I
> created
> the folder structure without any .jars, but with my guacamole.properties
> within the rigid defined structure.
>
> I mounted it to /home/guacamole
> I can see the mounted folder, included the folders and my copy of
> guacamole.properties inside the container.
> I have defined the environment variable:
>
> GUACAMOLE_HOME: /home/guacamole
>
> But the logs for guacamole show it is still using /root/.guacamole
>

Yes - it will continue to use /root/.guacamole after copying the contents
of your custom GUACAMOLE_HOME in there as a basis.

Specifying GUACAMOLE_HOME for the Docker image does not change the
GUACAMOLE_HOME used by the web application. It serves as a template that is
copied into /root/.guacamole during startup, to serve as the basis for the
generated GUACAMOLE_HOME.

Michael Jumper
CEO, Lead Developer
Glyptodon Inc .

Re: Problem with TOTP registering between 1.3.0 and github/master ?

[Mike Jumper]

This should be fixed now on git master via
https://issues.apache.org/jira/browse/GUACAMOLE-1298

Michael Jumper
CEO, Lead Developer
Glyptodon Inc .


On Mon, Mar 29, 2021 at 1:27 PM Philippe MARASSE
 wrote:

> Le 29/03/2021 à 18:38, Nick Couchman a écrit :
>
> On Mon, Mar 29, 2021 at 10:01 AM Philippe MARASSE
> 
>  wrote:
>
>> Never done a git bisect before :-) after 7 steps, its done :
>>
>> $ git bisect bad
>> f21a7c63ebc105eb26eb5adf91c8e65e1f99e014 is the first bad commit
>> commit f21a7c63ebc105eb26eb5adf91c8e65e1f99e014
>> Author: Michael Jumper  
>> Date:   Thu May 28 19:01:13 2020 -0700
>>
>> GUACAMOLE-1298: Migrate to latest version of Guice and Jersey 2.x
>>
>> :04 04 3abc05f30b6fc345a06ecd31c7c946d94bb5a687
>> bb8145256d75dc5c98e2d0ba0fbc72680e463962 Mguacamole
>>
>> Luckily, the issue is straigthforward to test : no need to reset database
>> between tests, just bisect, mvn clean package, deploy, restart tomcat and
>> login.
>>
>>
> Thanks for tracking this down. I wonder if there needs to be something
> done for the extensions that provide their own REST endpoints (TOTP,
> QuickConnect, etc.)?
>
> One more request for you, Philippe - can you watch the browser network
> console to see if there's any HTTP error that occurs when trying to
> retrieve the code? I can probably spin it up myself and try it, but if
> you're able to reproduce it quickly that would be helpful.
>
> -Nick
>
> I've rebuilt commit f21a7c63, from login page to enrollment :
>
>
>
> On the last request, the answer carries the QRCode and secret :
>
> {
>   "message": "TOTP enrollment must be completed before authentication can
> continue",
>   "translatableMessage": {
> "key": "TOTP.INFO_ENROLL_REQUIRED",
> "variables": null
>   },
>   "statusCode": null,
>   "expected": [
> {
>   "name": "guac-totp",
>   "type": "GUAC_TOTP_CODE",
>   "options": null,
>   "digits": 6,
>   "secret": "FC5OK7YUC6MU42PNPT4NGUBBPD46GLS2",
>   "username": "guacadmin",
>   "period": 30,
>   "issuer": "CHL TEST Telem",
>   "mode": "SHA1",
>   "keyURI":
> "otpauth://totp/CHL%20TEST%20Telem:guacadmin?secret=FC5OK7YUC6MU42PNPT4NGUBBPD46GLS2&issuer=CHL+TEST+Telem&algorithm=SHA1&digits=6&period=30",
>   "qrcode": "data:image/png;base64,iVBORw0KGg...ErkJggg=="
> }
>   ],
>   "type": "INSUFFICIENT_CREDENTIALS"
> }
>
> Regards.
>
> --
> Philippe MARASSE
>
> Responsable pôle Infrastructures - DSIO
> Centre Hospitalier Henri Laborit
> CS 10587 - 370 avenue Jacques Cœur
> 86021 Poitiers Cedex
> Tel : 05.49.44.57.19
>
>

Re: openid connect loop problem

[Mike Jumper]

On Fri, Apr 2, 2021 at 8:16 AM quegu  wrote:

> Hello
>
> I am experiencing a looping problem with the Openid connection extension
> with Keycloak. I have searched the forums and see this problem but without
> any solution. I am running guacamole 1.3.0 with extension 1.3.0 .
>
> my experience is exactly the same as this user:
>
> https://issues.apache.org/jira/browse/GUACAMOLE-1251
>
> the only thing i see in logs is:
>
> DEBUG o.a.g.rest.RESTExceptionMapper - Client request rejected: Invalid
> login.
> DEBUG o.a.g.r.auth.AuthenticationService - Anonymous authentication attempt
> from x.x.x.x failed.
>
> the looping is between these two URIs:
>
>
>
> https://keycloakexample.com/auth/realms/demo/protocol/openid-connect/auth?scope=openid+email+profile&response_type=id_token&client_id=guacamole&redirect_uri=http://example.com:8080/guacamole/%23/
>
> http://example.com:8080/guacamole/#/&id_token=kjhkhjkj...
>
>
Can you provide your full Guacamole logs? Is the system clock of your
Guacamole server correct? What values are you providing for the various
OpenID configuration properties in guacamole.properties?

If Keycloak is sending you back to Guacamole with an ID token, and
Guacamole is sending you back to Keycloak to get a new token, this means
that Guacamole is unable to verify the token provided by Keycloak. If the
token appears to be invalid, Guacamole redirects you back to the IdP with
the expectation that the token is just stale and you will be sent back with
a valid token.

i see in jira :
>
> https://issues.apache.org/jira/browse/GUACAMOLE-560
>
> so is it possible for it to work with Keycloak currently? or its broken
> for now?
>

It's not broken and should work. The JIRA issue you point to deals with
adding support for the optional "state" request parameter that Okta's
OpenID implementation requires. If Keycloak is sending you back to
Guacamole with an ID token, then it has accepted the authentication request
and verified your identity. If it required the "state" parameter, it would
have rejected the request for authentication would not have sent you back
with a token.

Michael Jumper
CEO, Lead Developer
Glyptodon Inc .

Re: Cannot mount guacamole.properties outside docker container

[tomlawesome]

Thanks Michael, this works exactly as you said and I can now see my changes
appearing in the guacamole.properties file in the /root/.guacamole/ location
:)

I am having trouble still connecting via SSL though:

guacd[7]: ERROR:Guacamole protocol violation. Perhaps the version of
guacamole-client is incompatible with this version of guacd?
guacd[7]: DEBUG:Error reading "select": Instruction parse error





--
Sent from: 
http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/

-
To unsubscribe, e-mail: user-unsubscr...@guacamole.apache.org
For additional commands, e-mail: user-h...@guacamole.apache.org

Re: Cannot mount guacamole.properties outside docker container

[tomlawesome]

Actually the above new error now looks like it may be an issue somewhere else
in my config, because RDP to a Windows machine is working beautifully with
SSL/TLS enabled on the connection. Woop.

Thanks again Michael, I will dig further into my other issue, which is with
SSH. 



--
Sent from: 
http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/

-
To unsubscribe, e-mail: user-unsubscr...@guacamole.apache.org
For additional commands, e-mail: user-h...@guacamole.apache.org

Re: Unable to access Guacamole panel when a connection it's in use with 1.3.0 (it worked with 1.2.0)

[Mike Jumper]

On Thu, Mar 18, 2021 at 1:29 PM fed  wrote:

> Hi,
>
> Maybe my question was not clear but it's very simple.
>
> With 1.3.0 have you disabled the use of "Guacamole menu" with
> ctrl-alt-shift in some situations after the user login?
>
> Like I said the ctrl-alt-shift command doesn't open any menu when you have
> a message window like the one about a connection not available in the front
> (maybe because it has reached its max connections/max users limits).
>
> If the user has more than one connection on the message you have the
> "Home" button so the user can return to its home but otherwise you can't go
> back to the Home because the "Guacamole menu" doesn't open with
> ctrl-alt-shift.
>
> As I said this behaviour is different from 1.2.0.
>

Hello,

This was not specifically an intentional change between 1.2.0 and 1.3.0.
Running a git bisect between the releases, the change in behavior started
as of the following commit:

commit f3101688e253c7eac136821900c706e40bec1bab
Author: Michael Jumper 
Date:   Sun Nov 1 20:22:52 2020 -0800

GUACAMOLE-221: Prompt user to provide additional parameters when
"required" instruction is received.


GUACAMOLE-221 dealt with providing an input prompt for the user when
additional parameters are required to complete the connection, such as a
username and password. This prompt uses the same notification subsystem as
the progress notifications you see when starting a connection. Since
handling keyboard events like Ctrl+Alt+Shift would prevent interaction with
normal input fields that may be within the prompt, keyboard handling was
disabled while any notification is displayed:

https://github.com/apache/guacamole-client/blob/bc76efc250bba0155612898233ebfc786e429708/guacamole/src/main/webapp/app/index/controllers/indexController.js#L104-L107
https://github.com/apache/guacamole-client/blob/bc76efc250bba0155612898233ebfc786e429708/guacamole/src/main/webapp/app/index/controllers/indexController.js#L123-L126

If this were narrowed to only disabling keyboard while a notification with
prompts is shown, the menu would resume working as you describe.

Michael Jumper
CEO, Lead Developer
Glyptodon Inc .

Re: Guacamole can't connect to anything anymore

[Mike Jumper]

On Thu, Mar 18, 2021 at 1:40 PM Tom Lawson 
wrote:

>
> No there is nothing between them on the network. The communicate directly.
>

Nothing at all? What about a firewall or network bridge, software or
otherwise?

I read that the select 1 ping issue can be something to do with MYSQL.
>

Not in this case - "SELECT 1" is a SQL ping used for MySQL and other
databases, yes, but the error in this case deals with Guacamole's "select"
instruction. This is not SQL, but a Guacamole protocol instruction sent
from the Guacamole web application to guacd to direct guacd to use a
particular underlying protocol (VNC, RDP, etc.) or to share an established
connection:

http://guacamole.apache.org/doc/gug/guacamole-protocol.html#guacamole-protocol-handshake

...
> Guacamole is served by reverse proxy traefik, but this setup was working
> perfectly and I can’t understand how an URL redirect would affected guacd
> communications? I don’t know much about Java though.
>

It wouldn't. The only thing that would affect this is the network between
the web application and guacd, or perhaps some sort of failure that occurs
very early in the connection process on the web application side.

What about the Guacamole logs? Anything interesting in there when this
occurs?

Michael Jumper
CEO, Lead Developer
Glyptodon Inc .

Re: upgrade guacamole 1.2.0 to 1.3.0

[Golota S.V.]

Thanks Michael it helped! tell me you don’t know how to apply this fix 
to all settings (globally) taking into account that strings are stored 
in mysql?



02.04.2021 22:16, Mike Jumper пишет:
On Thu, Apr 1, 2021 at 9:57 PM Golota S.V. > wrote:


solved this problem:
systemctl start tomcat9 guacd

guacd has no bearing on extensions.

removed / var / lib / tomcat9 / webapps / guacamole

This is probably what ultimately solved what you were experiencing - a 
cached copy of an older version of the web application.


re-compiled server 1.3.0

guacamole-server and guacd have no bearing on extensions.

Now there is a problem that throws out windows 7 from the session
when you hover over the start button, but this is a topic for
another discussion.

Try disabling the glyph cache. See: 
https://issues.apache.org/jira/browse/GUACAMOLE-1191 



Michael Jumper
CEO, Lead Developer
Glyptodon Inc .