This is an old revision of the document!
Apache Guacamole
What is it, and why should you use it?
Apache Guacamole is an client-less server appliance that leverages current remote access protocols on the back end and allows you to just use an Apache based web interface to remotely access your computers or servers. No need to expose RDP to the outside world (which no one should do, EVER), or anything other than one port to allow http traffic.
Benefits
Covers RDP, VNC, SSH protocols, and requires no client software on any machine. Just need to turn on the respective services on the destination device and configure authentication along with a host name/IP.
Risks
Apache Tomcat Web Server vulnerabilities are your biggest concern if you expose to the outside. As long as that is maintained, there are no other concerns. I would advise using a non-standard port number, MFA authentication, and perhaps even fail2ban to cut down any login risks.
Caveats
macOS and VNC on Guacamole is a little choppy, even over a wire. I an hoping there is a safe port of RDP that could be leveraged safely for use on macOS.
SSH connections via Guacamole are a little outdated in terms of the libssh2 package used. It requires ssh-dss, or ssh-rsa, both of which are depreciated, and insecure by today’s standards on the servers you need to connect to with Guacamole. OpenSSH typically leaves at least ssh-rsa open. As an additional issue, there are a few insecure MACs that are needed to allow Guacamole to connect. I ended up using hmac-sha2-512 as an enabled MAC. SSH Shared Key connections require you to use the older ssh-rsa PEM style key. When generating your key on the Guac server, use
ssh-keygen -t rsa -b 4096 -m PEM
To generate the key. YOU MUST ENTER A PASSPHRASE FOR THE KEY. Then put the public key in authorized_keys on each of the servers you need to connect with the key, and then the full private key (id_rsa) is used to paste into Guac as the key for each of the connections.
RDP connections will fail if guacd is ran as daemon user. You need to add a service account to guacd to allow the app to write to a home dir - https://kifarunix.com/install-guacamole-on-debian-11/#fix-rdp-security-negotiation-failed
Script Installer: https://github.com/MysticRyuujin/guac-install
GPG Key error when updating Buster-Backports: https://unix.stackexchange.com/questions/75807/no-public-key-available-on-apt-get-update#205732
Useful quick guide: https://jasoncoltrin.com/2017/10/04/setup-guacamole-remote-desktop-gateway-on-ubuntu-with-one-script/
Config Docs: https://guacamole.apache.org/doc/0.9.1/gug/configuring-guacamole.html#user-mapping
Proxy Steps: https://kifarunix.com/configure-guacamole-ssl-tls-with-nginx-reverse-proxy/