Differences

This shows you the differences between two versions of the page.

--- computers:guacamole [2023/02/02 04:26] – jon
+++ computers:guacamole [2025/03/14 19:45] (current) – jon
@@ Line 18: / Line 18: @@
 macOS and VNC on Guacamole is a little choppy, even over a wire. I an hoping there is a safe port of RDP that could be leveraged safely for use on macOS.
+Debian 12 comes shipped with Tomcat 10, any automated script installers out there will probably fail unless they specifically rebuild with Tomcat 9. Apache Foundation is still behind the times and has not gotten Guacamole to work with Tomcat 10. I've had to stay back at Debian 11 for now, with the possibility of shifting over to Rocky/Alma Linux as an alternative.
 SSH connections via Guacamole are a little outdated in terms of the libssh2 package used. It requires ssh-dss, or ssh-rsa, both of which are depreciated, and insecure by today’s standards on the servers you need to connect to with Guacamole. OpenSSH typically leaves at least ssh-rsa open.
@@ Line 39: / Line 41: @@
 https://kifarunix.com/configure-guacamole-ssl-tls-with-nginx-reverse-proxy/
+===== Hardening the Tomcat instance =====
+Sourced from - https://geekflare.com/cybersecurity/apache-tomcat-hardening-and-security-guide/
+==== Redirect the root index ====
+Rename index.html to index.html.backup
+vim index.jsp
+Add this line:
+<code> <% response.sendRedirect("/guacamole");%> </code>
+Now, this doesn't take care of the port 8080 but you'll need to redirect that with a port forward.
+==== Hiding the server details/error messages ====
+Make a page on the root level of the application directory named error.jsp
+<code>
+<html>
+<head>
+<title>Error Page</title>
+</head>
+<body> That's an error! </body>
+</html>
+</code>
+Then in your global config under web.xml add these lines to the bottom of the config before the </web-app> closing tag:
+<code>
+<error-page>
+<error-code>404</error-code>
+<location>/error.jsp</location>
+</error-page>
+<error-page>
+<error-code>403</error-code>
+<location>/error.jsp</location>
+</error-page>
+<error-page>
+<error-code>500</error-code>
+<location>/error.jsp</location>
+</error-page>
+</code>
+Restart tomcat for this to take effect.
+===== Exporting the config =====
+ChatGPT did help with this.. but it has worked for me shifting over from a Pi to a VM. This is based on the MysticRyuujin installer which is getting long in the tooth, but is still reliable up to Debian 11.
+Apache Guacamole Migration Plan (Debian, MySQL-Based Setup)
+Step 1: Backup the MySQL Database
+On the old server:
+Find Guacamole's MySQL credentials:
+<code>cat /etc/guacamole/guacamole.properties | grep mysql</code>
+Note down the values for mysql-database, mysql-username, and mysql-password.
+Dump the database using --single-transaction to avoid locking issues:
+<code>mysqldump -u guacamole_user -p --single-transaction guacamole_db > guacamole_backup.sql</code>
+(Enter the password when prompted)
+Copy the dump file to the new server:
+<code>scp guacamole_backup.sql youruser@newserver:/home/youruser/</code>
+Step 2: Backup Configuration Files
+Copy essential Guacamole configuration files:
+<code>tar -czvf guac_config_backup.tar.gz /etc/guacamole /etc/guacd.conf /etc/systemd/system/guacd.service
+scp guac_config_backup.tar.gz youruser@newserver:/home/youruser/</code>
+Step 3: Install Guacamole on the New Server
+Run the installer on the new server:
+<code>git clone https://github.com/MysticRyuujin/guac-install.git
+cd guac-install
+sudo ./guac-install.sh</code>
+Don’t log in yet. Restore the old database first.
+Step 4: Restore the Database
+On the new server:
+Temporarily grant full privileges to guacamole_user:
+<code>sudo mysql -u root -p</code>
+Inside MySQL, run:
+<code>GRANT ALL PRIVILEGES ON guacamole_db.* TO 'guacamole_user'@'localhost';
+FLUSH PRIVILEGES;
+EXIT;</code>
+Import the database dump:
+<code>mysql -u guacamole_user -p guacamole_db < guacamole_backup.sql</code>
+Revert guacamole_user permissions to limit access:
+<code>sudo mysql -u root -p</code>
+Run:
+<code>REVOKE ALL PRIVILEGES ON guacamole_db.* FROM 'guacamole_user'@'localhost';
+GRANT SELECT, INSERT, UPDATE, DELETE ON guacamole_db.* TO 'guacamole_user'@'localhost';
+FLUSH PRIVILEGES;
+EXIT;</code>
+Step 5: Restore Configuration Files
+Extract and move the config backup:
+<code>sudo tar -xzvf guac_config_backup.tar.gz -C /
+sudo systemctl daemon-reload</code>
+Step 6: Restart Services and Verify
+Restart Guacamole services:
+<code>sudo systemctl restart guacd
+sudo systemctl restart tomcat9</code>
+Then, log in via the web interface—all users, connections, and settings should be intact.