Differences

This shows you the differences between two versions of the page.

--- computers:guacamole [2025/02/23 20:34] – jon
+++ computers:guacamole [2025/03/14 19:45] (current) – jon
@@ Line 40: / Line 40: @@
 Proxy Steps:
 https://kifarunix.com/configure-guacamole-ssl-tls-with-nginx-reverse-proxy/
+===== Hardening the Tomcat instance =====
+Sourced from - https://geekflare.com/cybersecurity/apache-tomcat-hardening-and-security-guide/
+==== Redirect the root index ====
+Rename index.html to index.html.backup
+vim index.jsp
+Add this line:
+<code> <% response.sendRedirect("/guacamole");%> </code>
+Now, this doesn't take care of the port 8080 but you'll need to redirect that with a port forward.
+==== Hiding the server details/error messages ====
+Make a page on the root level of the application directory named error.jsp
+<code>
+<html>
+<head>
+<title>Error Page</title>
+</head>
+<body> That's an error! </body>
+</html>
+</code>
+Then in your global config under web.xml add these lines to the bottom of the config before the </web-app> closing tag:
+<code>
+<error-page>
+<error-code>404</error-code>
+<location>/error.jsp</location>
+</error-page>
+<error-page>
+<error-code>403</error-code>
+<location>/error.jsp</location>
+</error-page>
+<error-page>
+<error-code>500</error-code>
+<location>/error.jsp</location>
+</error-page>
+</code>
+Restart tomcat for this to take effect.
 ===== Exporting the config =====
-ChatGPT did help with this.. but it has worked for me shifting over from a Pi to a VM.
+ChatGPT did help with this.. but it has worked for me shifting over from a Pi to a VM. This is based on the MysticRyuujin installer which is getting long in the tooth, but is still reliable up to Debian 11.
 Apache Guacamole Migration Plan (Debian, MySQL-Based Setup)
@@ Line 62: / Line 110: @@
 Copy the dump file to the new server:
-bash
+<code>scp guacamole_backup.sql youruser@newserver:/home/youruser/</code>
-Copy
-Edit
-scp guacamole_backup.sql youruser@newserver:/home/youruser/
 Step 2: Backup Configuration Files
 Copy essential Guacamole configuration files:
-bash
+<code>tar -czvf guac_config_backup.tar.gz /etc/guacamole /etc/guacd.conf /etc/systemd/system/guacd.service
-Copy
+scp guac_config_backup.tar.gz youruser@newserver:/home/youruser/</code>
-Edit
-tar -czvf guac_config_backup.tar.gz /etc/guacamole /etc/guacd.conf /etc/systemd/system/guacd.service
-scp guac_config_backup.tar.gz youruser@newserver:/home/youruser/
 Step 3: Install Guacamole on the New Server
 Run the installer on the new server:
-bash
-Copy
+<code>git clone https://github.com/MysticRyuujin/guac-install.git
-Edit
-git clone https://github.com/MysticRyuujin/guac-install.git
 cd guac-install
-sudo ./guac-install.sh
+sudo ./guac-install.sh</code>
-Don’t log in yet—restore the old database first.
+Don’t log in yet. Restore the old database first.
 Step 4: Restore the Database
 On the new server:
@@ Line 88: / Line 132: @@
 Temporarily grant full privileges to guacamole_user:
-bash
+<code>sudo mysql -u root -p</code>
-Copy
-Edit
-sudo mysql -u root -p
 Inside MySQL, run:
-sql
+<code>GRANT ALL PRIVILEGES ON guacamole_db.* TO 'guacamole_user'@'localhost';
-Copy
-Edit
-GRANT ALL PRIVILEGES ON guacamole_db.* TO 'guacamole_user'@'localhost';
 FLUSH PRIVILEGES;
-EXIT;
+EXIT;</code>
 Import the database dump:
-bash
+<code>mysql -u guacamole_user -p guacamole_db < guacamole_backup.sql</code>
-Copy
-Edit
-mysql -u guacamole_user -p guacamole_db < guacamole_backup.sql
 Revert guacamole_user permissions to limit access:
-bash
+<code>sudo mysql -u root -p</code>
-Copy
-Edit
-sudo mysql -u root -p
 Run:
-sql
+<code>REVOKE ALL PRIVILEGES ON guacamole_db.* FROM 'guacamole_user'@'localhost';
-Copy
-Edit
-REVOKE ALL PRIVILEGES ON guacamole_db.* FROM 'guacamole_user'@'localhost';
 GRANT SELECT, INSERT, UPDATE, DELETE ON guacamole_db.* TO 'guacamole_user'@'localhost';
 FLUSH PRIVILEGES;
-EXIT;
+EXIT;</code>
 Step 5: Restore Configuration Files
 Extract and move the config backup:
-bash
+<code>sudo tar -xzvf guac_config_backup.tar.gz -C /
-Copy
+sudo systemctl daemon-reload</code>
-Edit
-sudo tar -xzvf guac_config_backup.tar.gz -C /
-sudo systemctl daemon-reload
 Step 6: Restart Services and Verify
 Restart Guacamole services:
-bash
+<code>sudo systemctl restart guacd
-Copy
+sudo systemctl restart tomcat9</code>
-Edit
-sudo systemctl restart guacd
+Then, log in via the web interface—all users, connections, and settings should be intact.
-sudo systemctl restart tomcat9
-Then, log in via the web interface—all users, connections, and settings should be intact!