2025-12-13 18:02:32 +00:00
21 changed files with 1058 additions and 536 deletions
--- a/.github/ISSUE_TEMPLATE/feature_request.md
+++ b/.github/ISSUE_TEMPLATE/feature_request.md
@ -0,0 +1,17 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Describe the feature or solution you'd like to see included:**
+- Give a clear description of what you would like to see changed or added.
+
+**Is this feature request related to a problem or specific use case?:**
+- Please describe what use case or problem this new feature will help solve. 
+
+**Additional context:**
+- Please provide any additional context or background here.
--- a/.github/ISSUE_TEMPLATE/issue-report.md
+++ b/.github/ISSUE_TEMPLATE/issue-report.md
@ -0,0 +1,28 @@
+---
+name: Issue report
+about: Create an issue report to help improve the installer
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Describe the issue:**
+- Please provide a clear and concise description of what the issue is. "It doesn't work" is not enough detail!
+
+**Steps to reproduce the issue:**
+- Please provide the steps to reproduce the error or behaviour (include what you believe should happen):
+
+**Describe the software environment:**
+- OS & version
+  - Include platform i.e. physical, virtual, cloud image etc
+- List other applications present
+- List other services or tasks the system also currently provides
+- Details any other relevant background context about your OS, its location, method of management or access, firewall settings etc.
+
+**Logs / screenshots / error outputs etc**
+- Where possible, provide as much background detail as possible to help explain your problem through the outputs you have available.
+
+**Troubleshooting steps already taken?:**
+- What steps have already taken to diagnose, debug or resolve the issue?
+- Details of any testing already performed?
--- a/.github/ISSUE_TEMPLATE/paypal-donate-button.png
+++ b/.github/ISSUE_TEMPLATE/paypal-donate-button.png
--- a/1-setup.sh
+++ b/1-setup.sh
@ -6,19 +6,18 @@
 # April 2023
 #######################################################################################################################

-# To install latest code snapshot:
+# To install the latest code snapshot:
 # wget https://raw.githubusercontent.com/itiligent/Guacamole-Install/main/1-setup.sh && chmod +x 1-setup.sh && ./1-setup.sh

 # 1-setup.sh is a central script that manages all inputs, options and sequences other included 'install' scripts.
-# 2-install-guacamole is the main guts of the whole build. This script downloads and builds Guacamole from source.
-# 3-install-nginx.sh automatically installs and configures Nginx to work as an http port 80 front end to Guacamole
+# 2-install-guacamole downloads Guacamole source and exectutes all Guacamole's build instructions.
+# 3-install-nginx.sh automatically installs and configures Nginx to work as an http port 80 front end to Guacamole.
 # 4a-install-tls-self-signed-nginx.sh sets up the new Nginx/Guacamole front end with self signed TLS certificates.
 # 4b-install-tls-letsencrypt-nginx.sh sets up Nginx with public TLS certificates from LetsEncrypt.
-# Scripts with "add" in their name can be run post install to add optional features not included in the main install
+# Scripts with "add" in their name can be run post install to add optional features not included in the main install.

-# If something isn't working:
+# For troubleshooting check logs or place Guacamole in debug mode:
 #     tail -f /var/log/syslog /var/log/tomcat*/*.out guac-setup/guacamole_setup.log
-# Or for Guacamole debug mode & verbose logs in the console:
 #     sudo systemctl stop guacd && sudo /usr/local/sbin/guacd -L debug -f

 #######################################################################################################################
@ -34,34 +33,41 @@ GREYB='\033[1;37m'
 LRED='\033[0;91m'
 LGREEN='\033[0;92m'
 LYELLOW='\033[0;93m'
-LMAGENTA='\033[0;95m'
-LCYAN='\033[0;96m'
 NC='\033[0m' #No Colour

 # Make sure the user is NOT running this script as root
 if [[ $EUID -eq 0 ]]; then
    echo
-    echo -e "${LRED}This script must NOT be run as root, exiting..." 1>&2
+    echo -e "${LRED}This script must NOT be run as root, it will prompt for sudo when needed." 1>&2
    echo -e ${NC}
    exit 1
 fi

-# Make sure the user is a member of the sudo group
-if ! [[ $(id -nG "$USER" 2>/dev/null | egrep "sudo" | wc -l) -gt 0 ]]; then
+# Check if sudo is installed. (Debian does not always include sudo by default)
+if ! command -v sudo &> /dev/null; then
+    echo "${LRED}Sudo is not installed. Please install sudo."
+    echo -e ${NC}
+    exit 1
+fi
+
+# Make sure the user running setup is a member of the sudo group
+if ! id -nG "$USER" | grep -qw "sudo"; then
    echo
-    echo -e "${LRED}The current user (${USER}) must be a member of the 'sudo' group, exiting..." 1>&2
-    echo -e ${NC}
+    echo -e "${LRED}The current user (${USER}) must be a member of the 'sudo' group. Run as root: usermod -aG sudo your-username & re-login ${USER}${NC}" 1>&2
    exit 1
 fi

-# Check to see if any previous version of build/install files exist, if so stop and check to be safe.
+# Check to see if any previous version of build files exist, if so stop and check to be safe.
 if [[ "$(find . -maxdepth 1 \( -name 'guacamole-*' -o -name 'mysql-connector-j-*' \))" != "" ]]; then
    echo
-    echo -e "${LRED}Possible previous install files detected in current build path. Please review and remove old guacamole install files before proceeding.${GREY}" 1>&2
+    echo -e "${LRED}Possible previous install files detected in current build path. Please review and remove old guacamole install files before proceeding.${GREY}, exiting..." 1>&2
    echo
    exit 1
 fi

+# Query the OS version
+source /etc/os-release
+
 #######################################################################################################################
 # Core setup variables and mandatory inputs - EDIT VARIABLE VALUES TO SUIT ############################################
 #######################################################################################################################
@ -77,85 +83,90 @@ mkdir -p $DB_BACKUP_DIR
 GITHUB="https://raw.githubusercontent.com/itiligent/Guacamole-Install/main"

 # Version of Guacamole to install
-GUAC_VERSION="1.5.3"
-
-# MySQL Connector/J version to install
-MYSQLJCON="8.1.0"
-
-# Set preferred Apache CDN download link)
+GUAC_VERSION="1.6.0"
 GUAC_SOURCE_LINK="http://apache.org/dyn/closer.cgi?action=download&filename=guacamole/${GUAC_VERSION}"

-# See https://mariadb.org/mariadb/all-releases/ for available versions.
-# Provide a specific MySQL version e.g. 11.1.2 or leave blank to use distro default MySQL packages.
-MYSQL_VERSION=""
+# MySQL Connector/J version to install
+MYSQLJCON="9.3.0"
+MYSQLJCON_SOURCE_LINK="https://dev.mysql.com/get/Downloads/Connector-J/mysql-connector-j-${MYSQLJCON}.tar.gz"

-# Guacamole default install URL
+# Provide a specific MySQL version e.g. 11.1.2 or leave blank "" to use distro default MySQL packages.
+# See https://mariadb.org/mariadb/all-releases/ for available versions.
+MYSQL_VERSION=""
+MARIADB_SOURCE_LINK="https://downloads.mariadb.com/MariaDB/mariadb_repo_setup"
+
+# Reverse proxy uses this URL (Guacamole default is http://localhost:8080/guacamole/):
 GUAC_URL=http://localhost:8080/guacamole/

-# Get the default route interface IP. Manually update for multi homed systems.
+# Get the default route interface IP. May need to manually override this for multi homed systems or where cloud images may use 127.0.x.x
 DEFAULT_IP=$(ip addr show $(ip route | awk '/default/ { print $5 }') | grep "inet" | head -n 1 | awk '/inet/ {print $2}' | cut -d'/' -f1)

 # Install log Location
-INSTALL_LOG="${DOWNLOAD_DIR}/guacamole_setup.log"
+INSTALL_LOG="${DOWNLOAD_DIR}/guacamole_install.log"

 #######################################################################################################################
-# Silent setup options - true/false or specific values below prevents prompt at install. EDIT TO SUIT #################
+# Silent setup options - true/false or specific values below will skip prompt at install. EDIT TO SUIT ################
 #######################################################################################################################
-SERVER_NAME=""                  # Preferred server hostname
-LOCAL_DOMAIN=""                 # Local DNS space in use
-INSTALL_MYSQL=""                # Install locally (true/false)
+SERVER_NAME=""                  # Server hostname (blank = use the current hostname)
+LOCAL_DOMAIN=""                 # Local DNS namespace/domain suffix (blank = keep the current suffix)
+INSTALL_MYSQL=""                # Install MySQL locally (true/false)
 SECURE_MYSQL=""                 # Apply mysql secure configuration tool (true/false)
-MYSQL_HOST=""                   # Blank or localhost for a local MySQL install, a specific IP for remote MySQL option.
-MYSQL_PORT=""                   # If blank default is 3306
-GUAC_DB=""                      # If blank default is guacamole_db
-GUAC_USER=""                    # If blank default is guacamole_user
-MYSQL_ROOT_PWD=""               # Requires an entry here or at at script prompt.
-GUAC_PWD=""                     # Requires an entry here or at at script prompt.
-DB_TZ=$(cat /etc/timezone)      # MySQL timezone default=(cat /etc/timezone) or change to "UTC" if required.
-INSTALL_TOTP=""                 # Add TOTP MFA extension (true/false)
-INSTALL_DUO=""                  # Add DUO MFA extension (can't be installed simultaneously with TOTP, true/false)
+MYSQL_HOST=""                   # Blank "" = localhost MySQL install, adding a specific IP address will assume a remote MySQL instance
+MYSQL_PORT=""                   # If blank "" default is 3306
+GUAC_DB=""                      # If blank "" default is guacamole_db
+GUAC_USER=""                    # If blank "" default is guacamole_user
+MYSQL_ROOT_PWD=""               # Manadatory entry here or at script prompt
+GUAC_PWD=""                     # Manadatory entry here or at script prompt
+GUACD_ACCOUNT="guacd"           # Service account guacd will run under (and will be very heavily locked down)
+DB_TZ=$(timedatectl show -p Timezone --value) # Blank "" defaults to UTC, for local timezone: $(cat /etc/timezone)
+INSTALL_TOTP=""                 # Add TOTP MFA extension (true/false), can't be installed simultaneously with DUO)
+INSTALL_DUO=""                  # Add DUO MFA extension (true/false, can't be installed simultaneously with TOTP)
 INSTALL_LDAP=""                 # Add Active Directory extension (true/false)
-INSTALL_QCONNECT=""             # Add Guacamole console quick connect feature
-INSTALL_HISTREC=""              # Add Guacamole history recording storage feature
-HISTREC_PATH=""                 # Path to save recorded sessions, default is /var/lib/guacamole/recordings
-GUAC_URL_REDIR=""               # Redirect default Guacamole URL to http root (skip typing the extra "/guacamole" in the URL)
-INSTALL_NGINX=""                # Install and configure Guacamole behind Nginx reverse proxy (http port 80 only, true/false)
-PROXY_SITE=""                   # Local DNS name for reverse proxy and/or self signed TLS certificates
-SELF_SIGN=""                    # Add self signed TLS support to Nginx (Let's Encrypt not available with this option, true/false)
-CERT_COUNTRY="AU"               # Self signed cert setup: 2 country character code only, must not be blank
-CERT_STATE="Victoria"           # Self signed cert setup: Optional to change, must not be blank
-CERT_LOCATION="Melbourne"       # Self signed cert setup: Optional to change, must not be blank
-CERT_ORG="Itiligent"            # Self signed cert setup: Optional to change, must not be blank
-CERT_OU="I.T."                  # Self signed cert setup: Optional to change, must not be blank
-CERT_DAYS="3650"                # Self signed cert setup: Number of days until self signed certificate expiry
-LETS_ENCRYPT=""                 # Add Lets Encrypt public TLS cert for Nginx (self signed not available with this option, true/false)
-LE_DNS_NAME=""                  # Public DNS name to bind with Lets Encrypt certificates
-LE_EMAIL=""                     # Webmaster/admin email for Lets Encrypt notifications
-BACKUP_EMAIL=""                 # Email address for backup notifications
-BACKUP_RETENTION="30"           # How many days to keep SQL backups locally for
-RDP_SHARE_HOST=""               # Custom Windows RDP share host name. (e.g. RDP_SHARE_LABEL on RDP_SHARE_HOST)
-RDP_SHARE_LABEL="RDP Share"     # Custom Windows RDP share drive label (e.g. RDP_SHARE_LABEL on RDP_SHARE_HOST)
-RDP_PRINTER_LABEL="RDP Printer" # Custom Windows RDP printer label
+INSTALL_QCONNECT=""             # Add Guacamole console quick connect feature (true/false)
+INSTALL_HISTREC=""              # Add Guacamole history recording storage feature (true/false)
+HISTREC_PATH=""                 # If blank "" sets the Apache's default path of /var/lib/guacamole/recordings
+GUAC_URL_REDIR=""               # Auto redirect of host root URL http://xxx:8080 to http://xxx:8080/guacamole  (true/false)
+INSTALL_NGINX=""                # Install & configure Nginx reverse proxy http:80 frontend (true/false)
+PROXY_SITE=""                   # Local DNS name for reverse proxy site and/or self signed TLS certificates (blank "" defaults to $DEFAULT_FQDN)
+SELF_SIGN=""                    # Add self signed TLS/https support to Nginx (true/false, Let's Encrypt not available with this option)
+RSA_KEYLENGTH="2048"            # Self signed RSA TLS key length. At least 2048, must not be blank
+CERT_COUNTRY="AU"               # Self signed cert setup, 2 character country code only, must not be blank
+CERT_STATE="Victoria"           # Self signed cert setup, must not be blank
+CERT_LOCATION="Melbourne"       # Self signed cert setup, must not be blank
+CERT_ORG="Itiligent"            # Self signed cert setup, must not be blank
+CERT_OU="I.T."                  # Self signed cert setup, must not be blank
+CERT_DAYS="3650"                # Self signed cert setup, days until self signed TLS cert expiry, blank = default 3650
+LETS_ENCRYPT=""                 # Add Lets Encrypt public TLS cert for Nginx (true/false, self signed TLS not available with this option) 
+LE_DNS_NAME=""                  # Public DNS name for use with Lets Encrypt certificates, must match public DNS
+LE_EMAIL=""                     # Webmaster email for Lets Encrypt notifications
+BACKUP_EMAIL=""                 # Email address to send MySQL backup notifications to
+BACKUP_RETENTION="30"           # Days to keep SQL backups locally
+RDP_SHARE_HOST=""               # Custom RDP host name shown in Windows Explorer (eg. "RDP_SHARE_LABEL on RDP_SHARE_HOST"). Blank "" = $SERVER_NAME
+RDP_SHARE_LABEL="RDP Share"     # Custom RDP shared drive name in Windows Explorer (eg. "RDP_SHARE_LABEL on RDP_SHARE_HOST" eg. "your RDP share name on server01"
+RDP_PRINTER_LABEL="RDP Printer" # Custom RDP printer name shown in Windows
+CRON_DENY_FILE="/etc/cron.deny" # Distro's cron deny file
+FREERDP="freerdp2-dev"			# Set default FreeRDP package

 #######################################################################################################################
-# Download GitHub setup scripts. To prevent overwrite, COMMENT OUT LINES OF ANY SCRIPTS YOU HAVE EDITED. ##############
+# Download GitHub setup scripts. BEFORE RUNNING SETUP, COMMENT OUT DOWNLOAD LINES OF ANY SCRIPTS YOU HAVE EDITED ! ####
 #######################################################################################################################

 # Script branding header
 echo
-echo -e "${GREYB}Guacamole VDI & Jump Server Appliance Setup."
+echo -e "${GREYB}Guacamole ${GUAC_VERSION} Appliance Auto Installer"
 echo -e "              ${LGREEN}Powered by Itiligent"
 echo
 echo

-# Download the set of config scripts from GitHub
+# Download the suite of install scripts from GitHub
 cd $DOWNLOAD_DIR
 echo -e "${GREY}Downloading the Guacamole build suite...${DGREY}"
 wget -q --show-progress ${GITHUB}/2-install-guacamole.sh -O 2-install-guacamole.sh
 wget -q --show-progress ${GITHUB}/3-install-nginx.sh -O 3-install-nginx.sh
 wget -q --show-progress ${GITHUB}/4a-install-tls-self-signed-nginx.sh -O 4a-install-tls-self-signed-nginx.sh
 wget -q --show-progress ${GITHUB}/4b-install-tls-letsencrypt-nginx.sh -O 4b-install-tls-letsencrypt-nginx.sh
-# Download the Guacamole optional feature scripts
+
+# Download the suite of optional feature adding scripts
 wget -q --show-progress ${GITHUB}/guac-optional-features/add-auth-duo.sh -O add-auth-duo.sh
 wget -q --show-progress ${GITHUB}/guac-optional-features/add-auth-ldap.sh -O add-auth-ldap.sh
 wget -q --show-progress ${GITHUB}/guac-optional-features/add-auth-totp.sh -O add-auth-totp.sh
@ -164,88 +175,110 @@ wget -q --show-progress ${GITHUB}/guac-optional-features/add-xtra-histrecstor.sh
 wget -q --show-progress ${GITHUB}/guac-optional-features/add-smtp-relay-o365.sh -O add-smtp-relay-o365.sh
 wget -q --show-progress ${GITHUB}/guac-optional-features/add-tls-guac-daemon.sh -O add-tls-guac-daemon.sh
 wget -q --show-progress ${GITHUB}/guac-optional-features/add-fail2ban.sh -O add-fail2ban.sh
-wget -q --show-progress ${GITHUB}/guac-management/backup-guac.sh -O backup-guac.sh
-wget -q --show-progress ${GITHUB}/guac-management/upgrade-guac.sh -O upgrade-guac.sh
-wget -q --show-progress ${GITHUB}/guac-management/refresh-tls-self-signed.sh -O refresh-tls-self-signed.sh 
-# Download the (customisable) dark theme & branding template
+wget -q --show-progress ${GITHUB}/guac-management/backup-guacamole.sh -O backup-guacamole.sh
+wget -q --show-progress ${GITHUB}/upgrade-guacamole.sh -O upgrade-guacamole.sh
+
+# Download the dark theme & branding template
 wget -q --show-progress ${GITHUB}/branding.jar -O branding.jar
 chmod +x *.sh

-# Pause here to optionally customise downloaded scripts before any actual install actions have began
-echo -e "${LYELLOW}Ctrl+Z now to exit now if you wish to customise 1-setup.sh options or to setup an unattended install."
+# Pause here to optionally customise downloaded scripts before any actual install actions begin
+echo -e "${LYELLOW}Ctrl+Z now to exit now if you wish to customise 1-setup.sh options or create an unattended install."
 echo

+# This first sudo command is a trigger to pause for setup script customisation shown above, then to continue as sudo where needed.
+sudo apt-get update -qq &> /dev/null
+
 #######################################################################################################################
-# Logic for determining desired packages between distros & database options. Modify as Linux distros diverge ##########
+# Package dependency handling and workarounds for various distros, MODIFY ONLY IF NEEDED ##############################
 #######################################################################################################################

-# First lets trigger a sudo prompt to cache the admin credentials needed for the next installer steps
-sudo apt-get update -qq &>>${INSTALL_LOG}
+# Standardise on a lexicon for the different MySQL package options
+if [[ -z "${MYSQL_VERSION}" ]]; then
+    # Use Linux distro default version.
+    MYSQLSRV="default-mysql-server default-mysql-client mysql-common" # Server
+    MYSQLCLIENT="default-mysql-client" # Client
+    DB_CMD="mysql" # The mysql -v command is depricated on some versions.
+else
+    # Use official mariadb.org repo
+    MYSQLSRV="mariadb-server mariadb-client mariadb-common" # Server
+    MYSQLCLIENT="mariadb-client" # Client
+    DB_CMD="mariadb" # The mysql -v command is depricated on some versions.
+fi

-# Standardise the language used for distro versions
-source /etc/os-release
-OS_NAME=$ID
-OS_VERSION=$VERSION_ID
-OS_CODENAME=$VERSION_CODENAME
+# Standardise on a lexicon for the differing dependency package names between distros
+# Current package names for various distros are referenced at https://guacamole.apache.org/doc/gug/installing-guacamole.html
+JPEGTURBO=""
+LIBPNG=""
+if [[ ${ID,,} = "ubuntu" ]] || [[ ${ID,,} = *"ubuntu"* ]] || [[ ${ID,,} = *"linuxmint"* ]]; then
+    JPEGTURBO="libjpeg-turbo8-dev"
+    LIBPNG="libpng-dev"
+    # Just in case this repo is not present in the distro
+    sudo add-apt-repository -y universe &>>${INSTALL_LOG}
+elif [[ ${ID,,} = "debian" ]] || [[ ${ID,,} = "raspbian" ]]; then
+    JPEGTURBO="libjpeg62-turbo-dev"
+    LIBPNG="libpng-dev"
+fi

-# Check for the latest version of Tomcat currently supported by the distro
+#######################################################################################################################
+# Ongoing fixes and workarounds as distros diverge/change #############################################################
+#######################################################################################################################
+
+# Check for the more recent versions of Tomcat currently supported by the distro
 if [[ $(apt-cache show tomcat10 2>/dev/null | egrep "Version: 10" | wc -l) -gt 0 ]]; then
    TOMCAT_VERSION="tomcat10"
 elif [[ $(apt-cache show tomcat9 2>/dev/null | egrep "Version: 9" | wc -l) -gt 0 ]]; then
    TOMCAT_VERSION="tomcat9"
-elif [[ $(apt-cache show tomcat8 2>/dev/null | egrep "Version: 8.[5-9]" | wc -l) -gt 0 ]]; then
-    TOMCAT_VERSION="tomcat8"
 else
-    # Default to version
+    # Default to this version
    TOMCAT_VERSION="tomcat9"
 fi

-# Workaround for current Debian 12 & Tomcat 10 incompatibilities
-if [[ ${OS_NAME,,} = "debian" ]] && [[ ${OS_CODENAME,,} = *"bookworm"* ]]; then #(checks for upper and lower case)
-    # Add the oldstable repo and downgrade tomcat version install
-    echo "deb http://deb.debian.org/debian/ bullseye main" | sudo tee /etc/apt/sources.list.d/bullseye.list >/dev/null
+# Decide the appropriate FreeRDP package (Debian 13.0 has issues with FreeRDP3) 
+if [[ "${VERSION_CODENAME,,}" == "bookworm" || "${VERSION_CODENAME,,}" == "noble" ]]; then
+    FREERDP="freerdp3-dev"
+fi
+
+# Workaround for Debian incompatibilities with later Tomcat versions. (Adds the oldstable repo and downgrades the Tomcat version)
+if [[ ${ID,,} = "debian" && ${VERSION_CODENAME,,} = *"bookworm"* ]] || [[ ${ID,,} = "debian" && ${VERSION_CODENAME,,} = *"trixie"* ]]; then #(checks for upper and lower case)
+    echo "deb http://deb.debian.org/debian/ bullseye main" | sudo tee /etc/apt/sources.list.d/bullseye.list &> /dev/null
+    sudo apt-get update -qq &> /dev/null
    TOMCAT_VERSION="tomcat9"
 fi

-# Workaround for Ubuntu 23.x & Tomcat 10 incompatibilities
-if [[ ${OS_NAME,,} = "ubuntu" ]] && [[ ${OS_CODENAME,,} = *"lunar"* ]]; then  #(checks for upper and lower case)
+# Workaround for Ubuntu 23.x Tomcat 10 incompatibilities. Downgrades Tomcat to version 9 which is available from the Lunar repo.
+if [[ ${ID,,} = "ubuntu" ]] && [[ ${VERSION_CODENAME,,} = *"lunar"* ]]; then
+    TOMCAT_VERSION="tomcat9"
+fi
+
+# Workaround for Ubuntu 24.x Tomcat 10 incompatibilities. (Adds old Jammy repo and downgrades the Tomcat version)
+if [[ ${ID,,} = "ubuntu" && ${VERSION_CODENAME,,} = *"noble"* ]]; then
+    echo "deb http://archive.ubuntu.com/ubuntu/ jammy universe" | sudo tee /etc/apt/sources.list.d/jammy.list &> /dev/null
+    sudo apt-get update -qq &> /dev/null
    TOMCAT_VERSION="tomcat9"
 fi

 # Uncomment here to force a specific Tomcat version.
 # TOMCAT_VERSION="tomcat9"

-# Standardise language for the the install of MySQL packages
-if [[ -z "${MYSQL_VERSION}" ]]; then
-    # Use Linux distro default version.
-    MYSQLSRV="default-mysql-server default-mysql-client mysql-common" # Server
-    MYSQLCLIENT="default-mysql-client" # Client
-    DB_CMD="mysql" # mysql command is depricated
-else
-    # Use official mariadb.org repo
-    MYSQLSRV="mariadb-server mariadb-client mariadb-common" # Server
-    MYSQLCLIENT="mariadb-client" # Client
-    DB_CMD="mariadb" # mysql command is depricated on newer versions
-fi
-# Standardise differing dependency package names and add any extra distro repositories for these if needed
-# Current package names for various distros are referenced at https://guacamole.apache.org/doc/gug/installing-guacamole.html
-JPEGTURBO=""
-LIBPNG=""
-if [[ $OS_NAME == "ubuntu" ]] || [[ $OS_NAME == *"ubuntu"* ]]; then # potentially expand out distro choices here
-    JPEGTURBO="libjpeg-turbo8-dev"
-    LIBPNG="libpng-dev"
-    # Just in case this repo is not added by default in the distro
-    sudo add-apt-repository -y universe &>>${INSTALL_LOG}
-elif [[ $OS_NAME == "debian" ]] || [[ $OS_NAME == "raspbian" ]]; then # expand distro choices here if required
-    JPEGTURBO="libjpeg62-turbo-dev"
-    LIBPNG="libpng-dev"
+# Workaround for 1.5.4 specific bug, see issue #31. This was fixed in 1.5.5
+if [[ "${ID,,}" = "debian" && "${VERSION_CODENAME,,}" = *"bullseye"* ]] || [[ "${ID,,}" = "ubuntu" && "${VERSION_CODENAME,,}" = *"focal"* ]]; then
+    IFS='.' read -ra guac_version_parts <<< "${GUAC_VERSION}"
+    major="${guac_version_parts[0]}"
+    minor="${guac_version_parts[1]}"
+    patch="${guac_version_parts[2]}"
+    # Uncomment 2nd line and comment first line if issue returns >=1.5.4 (See https://issues.apache.org/jira/browse/GUACAMOLE-1892))
+	if (( major == 1 && minor == 5 && patch == 4 )); then
+	#if (( major > 1 || (major == 1 && minor > 5) || ( major == 1 && minor == 5 && patch >= 4 ) )); then
+      export LDFLAGS="-lrt"
+    fi
 fi

 #######################################################################################################################
 # DO NOT EDIT PAST THIS POINT! ########################################################################################
 #######################################################################################################################

-# A default dns suffix is needed for initial prompts & default starting values.
+# An intitial dns suffix is needed as a starting value for the script prompts
 get_domain_suffix() {
    echo "$1" | awk '{print $2}'
 }
@ -278,82 +311,89 @@ fi
 # Begin install menu prompts ##########################################################################################
 #######################################################################################################################

-# We need to ensure consistent default hostname and domain suffix values for TLS implementation. The below approach
-# allows the user to either hit enter at the prompt to keep current values, or to manually update values. Silent install
-# pre-set values (if provided) will bypass all prompts.
+# Consistent /etc/hosts and domain suffix values are needed for TLS implementation. The below approach
+# allows the user to either hit enter at the prompt to keep current values, or enter new values for both. Silent install
+# pre-set values (if provided) will bypass these prompts.

 # Ensure SERVER_NAME is consistent with local host entries
 if [[ -z ${SERVER_NAME} ]]; then
-    echo -e "${LYELLOW}Update Linux system HOSTNAME [Enter to keep: ${HOSTNAME}]${LGREEN}"
-    read -p "              Enter new HOSTNAME : " SERVER_NAME
+    echo -e "${LYELLOW} Update Linux system HOSTNAME? [Enter to keep: ${HOSTNAME}]${LGREEN}"
+    read -p "              Enter Linux hostname : " SERVER_NAME
    # If hit enter making no SERVER_NAME change, assume the existing hostname as current
    if [[ "${SERVER_NAME}" = "" ]]; then
        SERVER_NAME=$HOSTNAME
    fi
    echo
    # A SERVER_NAME was derived via the prompt
-    # Apply the SERVER_NAME value & remove and update any old 127.0.1.1 local host references
-    sudo hostnamectl set-hostname $SERVER_NAME &>>${INSTALL_LOG}
+    # Apply the SERVER_NAME value & remove & update any old 127.0.1.1 localhost references
+    $(sudo hostnamectl set-hostname $SERVER_NAME &>/dev/null &) &>/dev/null
+	sleep 1
    sudo sed -i '/127.0.1.1/d' /etc/hosts &>>${INSTALL_LOG}
    echo '127.0.1.1       '${SERVER_NAME}'' | sudo tee -a /etc/hosts &>>${INSTALL_LOG}
-    sudo systemctl restart systemd-hostnamed &>>${INSTALL_LOG}
+    $(sudo systemctl restart systemd-hostnamed &>/dev/null &) &>/dev/null
 else
    echo
    # A SERVER_NAME value was derived from a pre-set silent install option.
-    # Apply the SERVER_NAME value & remove and update any old 127.0.1.1 local host references
-    sudo hostnamectl set-hostname $SERVER_NAME &>>${INSTALL_LOG}
+    # Apply the SERVER_NAME value & remove & update any old 127.0.1.1 localhost references
+    $(sudo hostnamectl set-hostname $SERVER_NAME &>/dev/null &) &>/dev/null
+	sleep 1
    sudo sed -i '/127.0.1.1/d' /etc/hosts &>>${INSTALL_LOG}
    echo '127.0.1.1       '${SERVER_NAME}'' | sudo tee -a /etc/hosts &>>${INSTALL_LOG}
-    sudo systemctl restart systemd-hostnamed &>>${INSTALL_LOG}
+    $(sudo systemctl restart systemd-hostnamed &>/dev/null &) &>/dev/null
 fi

-# Ensure SERVER_NAME, LOCAL_DOMAIN suffix and host entries are all consistent
+# Ensure LOCAL_DOMAIN suffix & localhost entries are consistent
 if [[ -z ${LOCAL_DOMAIN} ]]; then
-    echo -e "${LYELLOW}Update Linux LOCAL DNS DOMAIN [Enter to keep: ${DOMAIN_SUFFIX}]${LGREEN}"
-    read -p "              Enter FULL LOCAL DOMAIN NAME: " LOCAL_DOMAIN
+    echo -e "${LYELLOW} Update Linux LOCAL DNS SUFFIX [Enter to keep: ${SERVER_NAME}.${DOMAIN_SUFFIX}]${LGREEN}"
+    read -p "              Complete this local domain suffix: $SERVER_NAME." LOCAL_DOMAIN
    # If hit enter making no LOCAL_DOMAIN name change, assume the existing domain suffix as current
    if [[ "${LOCAL_DOMAIN}" = "" ]]; then
        LOCAL_DOMAIN=$DOMAIN_SUFFIX
    fi
    echo
    # A LOCAL_DOMAIN value was derived via the prompt
-    # Remove any old hosts & resolv file values and update these with the new LOCAL_DOMAIN value
+    # Remove any old localhost & resolv file values & update these with the new LOCAL_DOMAIN value
+	$(sudo systemctl restart systemd-hostnamed &>/dev/null &) &>/dev/null
+	sleep 1
    sudo sed -i "/${DEFAULT_IP}/d" /etc/hosts
    sudo sed -i '/domain/d' /etc/resolv.conf
    sudo sed -i '/search/d' /etc/resolv.conf
-    # Refresh the /etc/hosts file with the server name and new local domain value
+    # Refresh the /etc/hosts file with the server name & new local domain value
    echo ''${DEFAULT_IP}'	'${SERVER_NAME}.${LOCAL_DOMAIN} ${SERVER_NAME}'' | sudo tee -a /etc/hosts &>>${INSTALL_LOG}
-    # Refresh /etc/resolv.conf with new domain and search suffix values
+    # Refresh /etc/resolv.conf with new domain & search suffix values
    echo 'domain	'${LOCAL_DOMAIN}'' | sudo tee -a /etc/resolv.conf &>>${INSTALL_LOG}
    echo 'search	'${LOCAL_DOMAIN}'' | sudo tee -a /etc/resolv.conf &>>${INSTALL_LOG}
-    sudo systemctl restart systemd-hostnamed &>>${INSTALL_LOG}
+    $(sudo systemctl restart systemd-hostnamed &>/dev/null &) &>/dev/null
 else
    echo
    # A LOCAL_DOMIN value was derived from a pre-set silent install option.
-    # Remove any old hosts & resolv file values and update these with the new LOCAL_DOMAIN value
+    # Remove any old localhost & resolv file values & update these with the new LOCAL_DOMAIN value
+	$(sudo systemctl restart systemd-hostnamed &>/dev/null &) &>/dev/null
+	sleep 1
    sudo sed -i "/${DEFAULT_IP}/d" /etc/hosts
    sudo sed -i '/domain/d' /etc/resolv.conf
    sudo sed -i '/search/d' /etc/resolv.conf
-    # Refresh the /etc/hosts file with the server name and new local domain value
+    # Refresh the /etc/hosts file with the server name & new local domain value
    echo ''${DEFAULT_IP}'	'${SERVER_NAME}.${LOCAL_DOMAIN} ${SERVER_NAME}'' | sudo tee -a /etc/hosts &>>${INSTALL_LOG}
-    # Refresh /etc/resolv.conf with new domain and search suffix values
+    # Refresh /etc/resolv.conf with new domain & search suffix values
    echo 'domain	'${LOCAL_DOMAIN}'' | sudo tee -a /etc/resolv.conf &>>${INSTALL_LOG}
    echo 'search	'${LOCAL_DOMAIN}'' | sudo tee -a /etc/resolv.conf &>>${INSTALL_LOG}
-    sudo systemctl restart systemd-hostnamed &>>${INSTALL_LOG}
+    $(sudo systemctl restart systemd-hostnamed &>/dev/null &) &>/dev/null
 fi

-# Now that $SERVER_NAME and $LOCAL_DOMAIN values are updated and refreshed:
-# Values are merged to build a local FQDN value (used for the default reverse proxy site name.)
+# Now that $SERVER_NAME and $LOCAL_DOMAIN values are updated and refreshed, both values are merged to build
+# a local FQDN value (this is later used for the default reverse proxy site name.)
 DEFAULT_FQDN=$SERVER_NAME.$LOCAL_DOMAIN
-# The RDP share label default can now assume the updated $SERVER_NAME value (if not manually specified in silent setup options).
+
+# Default RDP share and host labels will now use the updated $SERVER_NAME value as default (if not otherwise specified in silent setup options).
 if [[ -z ${RDP_SHARE_HOST} ]]; then
    RDP_SHARE_HOST=$SERVER_NAME
 fi

-# Prompt the user to install MySQL
+# Prompt to install MySQL
 echo -e "${LGREEN}MySQL setup options:${GREY}"
 if [[ -z ${INSTALL_MYSQL} ]]; then
-    echo -e -n "SQL: Install MySQL locally? (For a REMOTE MySQL server select 'n') [Y/n] [default y]: ${GREY}"
+    echo -e -n "SQL: Install MySQL locally? (For a REMOTE MySQL server select 'n') [y/n] [default y]: ${GREY}"
    read PROMPT
    if [[ ${PROMPT} =~ ^[Nn]$ ]]; then
        INSTALL_MYSQL=false
@ -362,9 +402,9 @@ if [[ -z ${INSTALL_MYSQL} ]]; then
    fi
 fi

-# Prompt the user to apply the Mysql secure installation locally
+# Prompt to apply the Mysql secure installation locally
 if [[ -z ${SECURE_MYSQL} ]] && [[ "${INSTALL_MYSQL}" = true ]]; then
-    echo -e -n "${GREY}SQL: Apply MySQL secure installation settings to LOCAL db? [Y/n] [default y]: ${GREY}"
+    echo -e -n "${GREY}SQL: Apply MySQL secure installation settings to LOCAL db? [y/n] [default y]: ${GREY}"
    read PROMPT
    if [[ ${PROMPT} =~ ^[Nn]$ ]]; then
        SECURE_MYSQL=false
@ -373,7 +413,7 @@ if [[ -z ${SECURE_MYSQL} ]] && [[ "${INSTALL_MYSQL}" = true ]]; then
    fi
 fi

-# Get additional MYSQL values
+# Prompt for additional MYSQL settings and values
 if [[ "${INSTALL_MYSQL}" = false ]]; then
    [[ -z "${MYSQL_HOST}" ]] &&
        read -p "SQL: Enter remote MySQL server hostname or IP: " MYSQL_HOST
@ -381,7 +421,7 @@ if [[ "${INSTALL_MYSQL}" = false ]]; then
        read -p "SQL: Enter remote MySQL server port [3306]: " MYSQL_PORT
    [[ -z "${GUAC_DB}" ]] &&
        read -p "SQL: Enter remote Guacamole database name [guacamole_db]: " GUAC_DB
-    [[-z "${GUAC_USER}" ]] &&
+    [[ -z "${GUAC_USER}" ]] &&
        read -p "SQL: Enter remote Guacamole user name [guacamole_user]: " GUAC_USER
 fi
 # Checking if a mysql host given, if not set a default
@ -401,7 +441,7 @@ if [[ -z "${GUAC_USER}" ]]; then
    GUAC_USER="guacamole_user"
 fi

-# Get MySQL root password, confirm correct password entry and prevent blank passwords. No root pw needed for remote instances.
+# Prompt for MySQL root password, confirm correct password entry and prevent blank passwords. No root pw needed for remote instances.
 if [[ -z "${MYSQL_ROOT_PWD}" ]] && [[ "${INSTALL_MYSQL}" = true ]]; then
    while true; do
        read -s -p "SQL: Enter ${MYSQL_HOST}'s MySQL ROOT password: " MYSQL_ROOT_PWD
@ -409,11 +449,11 @@ if [[ -z "${MYSQL_ROOT_PWD}" ]] && [[ "${INSTALL_MYSQL}" = true ]]; then
        read -s -p "SQL: Confirm ${MYSQL_HOST}'s MySQL ROOT password: " PROMPT2
        echo
        [[ "${MYSQL_ROOT_PWD}" = "${PROMPT2}" ]] && [[ "${MYSQL_ROOT_PWD}" != "" ]] && [[ "${PROMPT2}" != "" ]] && break
-        echo -e "${LRED}Passwords don't match or can't be null. Please try again.${LMAGENTA}" 1>&2
+        echo -e "${LRED}Passwords don't match or can't be null. Please try again.${GREY}" 1>&2
    done
 fi

-# Get Guacamole User password, confirm correct password entry and prevent blank passwords
+# Prompt for Guacamole User password, confirm correct password entry and prevent blank passwords
 if [[ -z "${GUAC_PWD}" ]]; then
    while true; do
        read -s -p "SQL: Enter ${MYSQL_HOST}'s MySQL ${GUAC_USER} password: " GUAC_PWD
@ -421,7 +461,7 @@ if [[ -z "${GUAC_PWD}" ]]; then
        read -s -p "SQL: Confirm ${MYSQL_HOST}'s MySQL ${GUAC_USER} password: " PROMPT2
        echo
        [[ "${GUAC_PWD}" = "${PROMPT2}" ]] && [[ "${GUAC_PWD}" != "" ]] && [[ "${PROMPT2}" != "" ]] && break
-        echo -e "${LRED}Passwords don't match or can't be null. Please try again.${LCYAN}" 1>&2
+        echo -e "${LRED}Passwords don't match or can't be null. Please try again.${GREY}" 1>&2
    done
 fi

@ -435,16 +475,16 @@ if [[ -z ${BACKUP_EMAIL} ]]; then
        # echo -e "${LRED}You must enter an email address. Please try again.${GREY}" 1>&2
    done
 fi
-# If no backup notification email address is given, provide a default value
+# If no backup notification email address is given, provide a non blank default value
 if [[ -z ${BACKUP_EMAIL} ]]; then
    BACKUP_EMAIL="backup-email@yourdomain.com"
 fi

 echo
-# Prompt the user to install TOTP MFA
+# Prompt to install TOTP MFA
 echo -e "${LGREEN}Guacamole authentication extension options:${GREY}"
 if [[ -z "${INSTALL_TOTP}" ]] && [[ "${INSTALL_DUO}" != true ]]; then
-    echo -e -n "AUTH: Install TOTP? (choose 'n' if you want Duo) [y/N]? [default n]: "
+    echo -e -n "AUTH: Install TOTP? (choose 'n' if you want Duo) [y/n]? [default n]: "
    read PROMPT
    if [[ ${PROMPT} =~ ^[Yy]$ ]]; then
        INSTALL_TOTP=true
@ -454,9 +494,9 @@ if [[ -z "${INSTALL_TOTP}" ]] && [[ "${INSTALL_DUO}" != true ]]; then
    fi
 fi

-# Prompt the user to install Duo MFA
+# Prompt to install Duo MFA
 if [[ -z "${INSTALL_DUO}" ]] && [[ "${INSTALL_TOTP}" != true ]]; then
-    echo -e -n "${GREY}AUTH: Install Duo? [y/N] [default n]: "
+    echo -e -n "${GREY}AUTH: Install Duo? [y/n] [default n]: "
    read PROMPT
    if [[ ${PROMPT} =~ ^[Yy]$ ]]; then
        INSTALL_DUO=true
@ -472,9 +512,9 @@ if [[ "${INSTALL_TOTP}" = true ]] && [[ "${INSTALL_DUO}" = true ]]; then
    exit 1
 fi

-# Prompt the user to install Duo MFA
+# Prompt to install Duo MFA
 if [[ -z "${INSTALL_LDAP}" ]]; then
-    echo -e -n "${GREY}AUTH: Install LDAP? [y/N] [default n]: "
+    echo -e -n "${GREY}AUTH: Install LDAP? [y/n] [default n]: "
    read PROMPT
    if [[ ${PROMPT} =~ ^[Yy]$ ]]; then
        INSTALL_LDAP=true
@ -484,10 +524,10 @@ if [[ -z "${INSTALL_LDAP}" ]]; then
 fi

 echo
-# Prompt the user to install the Quick Connect feature (some higher security use cases may not want this)
+# Prompt to install the Quick Connect feature (some higher security use cases may not want this)
 echo -e "${LGREEN}Guacamole console optional extras:${GREY}"
 if [[ -z "${INSTALL_QCONNECT}" ]]; then
-    echo -e -n "${GREY}EXTRAS: Install Quick Connect feature? [y/N] [default n]: "
+    echo -e -n "${GREY}EXTRAS: Install Quick Connect feature? [y/n] [default n]: "
    read PROMPT
    if [[ ${PROMPT} =~ ^[Yy]$ ]]; then
        INSTALL_QCONNECT=true
@ -496,9 +536,9 @@ if [[ -z "${INSTALL_QCONNECT}" ]]; then
    fi
 fi

-# Prompt the user to install the History Recorded Storage feature
+# Prompt to install the History Recorded Storage feature
 if [[ -z "${INSTALL_HISTREC}" ]]; then
-    echo -e -n "${GREY}EXTRAS: Install History Recorded Storage (session replay console integration) [y/N] [default n]: "
+    echo -e -n "${GREY}EXTRAS: Install History Recorded Storage feature [y/n] [default n]: "
    read PROMPT
    if [[ ${PROMPT} =~ ^[Yy]$ ]]; then
        INSTALL_HISTREC=true
@ -515,7 +555,7 @@ if [[ -z ${HISTREC_PATH} ]] && [[ "${INSTALL_HISTREC}" = true ]]; then
    done
 fi

-# If no custom path is given, lets assume the default path on hitting enter
+# If no custom path is given, assume the Apache default path on hitting enter
 if [[ -z "${HISTREC_PATH}" ]]; then
    HISTREC_PATH="${HISTREC_PATH_DEFAULT}"
 fi
@ -524,7 +564,7 @@ echo
 # Prompt for Guacamole front end reverse proxy option
 echo -e "${LGREEN}Reverse Proxy & front end options:${GREY}"
 if [[ -z ${INSTALL_NGINX} ]]; then
-    echo -e -n "FRONT END: Protect Guacamole behind Nginx reverse proxy [y/N]? [default n]: "
+    echo -e -n "FRONT END: Protect Guacamole behind Nginx reverse proxy [y/n]? [default n]: "
    read PROMPT
    if [[ ${PROMPT} =~ ^[Yy]$ ]]; then
        INSTALL_NGINX=true
@ -534,14 +574,14 @@ if [[ -z ${INSTALL_NGINX} ]]; then
    fi
 fi

-# Prompt to remove the trailing /guacamole dir from the default front end url
-if [[ "${INSTALL_NGINX}" = false ]]; then
-    echo -e -n "FRONT END: Redirect the Tomcat http root url to /guacamole [Y/n]? [default y]: "
+# Prompt to redirect http://root:8080 to http://root:8080/guacamole if not installing reverse proxy
+if [[ -z ${GUAC_URL_REDIR} ]] && [[ "${INSTALL_NGINX}" = false ]]; then
+    echo -e -n "FRONT END: Redirect http://domain.root:8080 to /guacamole (Warning: redirect may break DUO) [y/n]? [default n]: "
    read PROMPT
-    if [[ ${PROMPT} =~ ^[Nn]$ ]]; then
-        GUAC_URL_REDIR=false
-    else
+    if [[ ${PROMPT} =~ ^[Yy]$ ]]; then
        GUAC_URL_REDIR=true
+    else
+        GUAC_URL_REDIR=false
    fi
 fi

@ -564,38 +604,42 @@ fi
 # Prompt for self signed TLS reverse proxy option
 if [[ -z ${SELF_SIGN} ]] && [[ "${INSTALL_NGINX}" = true ]]; then
    # Prompt the user to see if they would like to install self signed TLS support for Nginx, default of no
-    echo -e -n "FRONT END: Add self signed TLS support to Nginx? [y/N]? (choose 'n' for Let's Encrypt)[default n]: "
+    echo -e -n "FRONT END: Add self signed TLS support to Nginx? [y/n]? (choose 'n' for Let's Encrypt)[default n]: "
    read PROMPT
    if [[ ${PROMPT} =~ ^[Yy]$ ]]; then
        SELF_SIGN=true
+        LETS_ENCRYPT=false
    else
        SELF_SIGN=false
    fi
 fi

-# Optional prompt to manually enter a self sign TLS certificate expiry date, un-comment to force manual entry
-#if [[ "${SELF_SIGN}" = true ]]; then
-#	read - p "PROXY: Enter number of days till TLS certificate expires [default 3650]: " CERT_DAYS
-#fi
-
+# Prompt to enter a self sign TLS certificate expiry
+if [[ -z "${CERT_DAYS}" ]] && [[ "${SELF_SIGN}" = true ]]; then
+    while true; do
+    read -p "FRONT END: Enter number of days till TLS certificates will expire [Enter for ${CERT_DAYS}]: " CERT_DAYS
+        [[ "${CERT_DAYS}" = "" ]] || [[ "${CERT_DAYS}" != "" ]] && break
+    done
+fi
 # If no self sign TLS certificate expiry given, lets assume a generous 10 year default certificate expiry
 if [[ -z "${CERT_DAYS}" ]]; then
    CERT_DAYS="3650"
 fi

 # Prompt for Let's Encrypt TLS reverse proxy configuration option
-if [[ -z ${LETS_ENCRYPT} ]] && [[ "${INSTALL_NGINX}" = true ]] && [[ "${SELF_SIGN}" = "false" ]]; then
-    echo -e -n "FRONT END: Add Let's Encrypt TLS support to Nginx reverse proxy [y/N] [default n]: ${GREY}"
+if [[ -z ${LETS_ENCRYPT} ]] && [[ "${INSTALL_NGINX}" = true ]] && [[ "${SELF_SIGN}" = false ]]; then
+    echo -e -n "FRONT END: Add Let's Encrypt TLS support to Nginx reverse proxy [y/n] [default n]: ${GREY}"
    read PROMPT
    if [[ ${PROMPT} =~ ^[Yy]$ ]]; then
        LETS_ENCRYPT=true
+        SELF_SIGN=false
    else
        LETS_ENCRYPT=false
    fi
 fi

 # Prompt for Let's Encrypt public dns name
-if [[ -z ${LE_DNS_NAME} ]] && [[ "${LETS_ENCRYPT}" = true ]]; then
+if [[ -z ${LE_DNS_NAME} ]] && [[ "${LETS_ENCRYPT}" = true ]] && [[ "${SELF_SIGN}" = false ]]; then
    while true; do
        read -p "FRONT END: Enter the PUBLIC FQDN for your proxy site : " LE_DNS_NAME
        [[ "${LE_DNS_NAME}" != "" ]] && break
@ -604,7 +648,7 @@ if [[ -z ${LE_DNS_NAME} ]] && [[ "${LETS_ENCRYPT}" = true ]]; then
 fi

 # Prompt for Let's Encrypt admin email
-if [[ -z ${LE_EMAIL} ]] && [[ "${LETS_ENCRYPT}" = true ]]; then
+if [[ -z ${LE_EMAIL} ]] && [[ "${LETS_ENCRYPT}" = true ]] && [[ "${SELF_SIGN}" = false ]]; then
    while true; do
        read -p "FRONT END: Enter the email address for Let's Encrypt notifications : " LE_EMAIL
        [[ "${LE_EMAIL}" != "" ]] && break
@ -618,7 +662,7 @@ fi

 clear
 echo
-echo -e "${GREYB}Guacamole VDI & Jump Server Appliance Setup."
+echo -e "${GREYB}Guacamole ${GUAC_VERSION} Auto Installer."
 echo -e "              ${LGREEN}Powered by Itiligent"
 echo
 echo
@ -626,17 +670,17 @@ echo
 echo -e "${LGREEN}Beginning Guacamole setup...${GREY}"
 echo

-echo -e "${GREY}Synchronising the install script suite with selected settings for later standalone use..."
+echo -e "${GREY}Synchronising the install script suite with the selected installation options..."
 # Sync the various manual config scripts with the relevant variables selected at install
 # This way scripts can be run at a later time without modification to match the original install
-sed -i "s|MYSQL_HOST=|MYSQL_HOST='${MYSQL_HOST}'|g" $DOWNLOAD_DIR/backup-guac.sh
-sed -i "s|MYSQL_PORT=|MYSQL_PORT='${MYSQL_PORT}'|g" $DOWNLOAD_DIR/backup-guac.sh
-sed -i "s|GUAC_USER=|GUAC_USER='${GUAC_USER}'|g" $DOWNLOAD_DIR/backup-guac.sh
-sed -i "s|GUAC_PWD=|GUAC_PWD='${GUAC_PWD}'|g" $DOWNLOAD_DIR/backup-guac.sh
-sed -i "s|GUAC_DB=|GUAC_DB='${GUAC_DB}'|g" $DOWNLOAD_DIR/backup-guac.sh
-sed -i "s|DB_BACKUP_DIR=|DB_BACKUP_DIR='${DB_BACKUP_DIR}'|g" $DOWNLOAD_DIR/backup-guac.sh
-sed -i "s|BACKUP_EMAIL=|BACKUP_EMAIL='${BACKUP_EMAIL}'|g" $DOWNLOAD_DIR/backup-guac.sh
-sed -i "s|BACKUP_RETENTION=|BACKUP_RETENTION='${BACKUP_RETENTION}'|g" $DOWNLOAD_DIR/backup-guac.sh
+sed -i "s|MYSQL_HOST=|MYSQL_HOST='${MYSQL_HOST}'|g" $DOWNLOAD_DIR/backup-guacamole.sh
+sed -i "s|MYSQL_PORT=|MYSQL_PORT='${MYSQL_PORT}'|g" $DOWNLOAD_DIR/backup-guacamole.sh
+sed -i "s|GUAC_USER=|GUAC_USER='${GUAC_USER}'|g" $DOWNLOAD_DIR/backup-guacamole.sh
+sed -i "s|GUAC_PWD=|GUAC_PWD='${GUAC_PWD}'|g" $DOWNLOAD_DIR/backup-guacamole.sh
+sed -i "s|GUAC_DB=|GUAC_DB='${GUAC_DB}'|g" $DOWNLOAD_DIR/backup-guacamole.sh
+sed -i "s|DB_BACKUP_DIR=|DB_BACKUP_DIR='${DB_BACKUP_DIR}'|g" $DOWNLOAD_DIR/backup-guacamole.sh
+sed -i "s|BACKUP_EMAIL=|BACKUP_EMAIL='${BACKUP_EMAIL}'|g" $DOWNLOAD_DIR/backup-guacamole.sh
+sed -i "s|BACKUP_RETENTION=|BACKUP_RETENTION='${BACKUP_RETENTION}'|g" $DOWNLOAD_DIR/backup-guacamole.sh

 sed -i "s|CERT_COUNTRY=|CERT_COUNTRY='${CERT_COUNTRY}'|g" $DOWNLOAD_DIR/add-tls-guac-daemon.sh
 sed -i "s|CERT_STATE=|CERT_STATE='${CERT_STATE}'|g" $DOWNLOAD_DIR/add-tls-guac-daemon.sh
@ -645,13 +689,18 @@ sed -i "s|CERT_ORG=|CERT_ORG='${CERT_ORG}'|g" $DOWNLOAD_DIR/add-tls-guac-daemon.
 sed -i "s|CERT_OU=|CERT_OU='${CERT_OU}'|g" $DOWNLOAD_DIR/add-tls-guac-daemon.sh
 sed -i "s|CERT_DAYS=|CERT_DAYS='${CERT_DAYS}'|g" $DOWNLOAD_DIR/add-tls-guac-daemon.sh

-sed -i "s|INSTALL_MYSQL=|INSTALL_MYSQL='${INSTALL_MYSQL}'|g" $DOWNLOAD_DIR/upgrade-guac.sh
-sed -i "s|MYSQL_HOST=|MYSQL_HOST='${MYSQL_HOST}'|g" $DOWNLOAD_DIR/upgrade-guac.sh
-sed -i "s|MYSQL_PORT=|MYSQL_PORT='${MYSQL_PORT}'|g" $DOWNLOAD_DIR/upgrade-guac.sh
-sed -i "s|GUAC_DB=|GUAC_DB='${GUAC_DB}'|g" $DOWNLOAD_DIR/upgrade-guac.sh
-sed -i "s|MYSQL_ROOT_PWD=|MYSQL_ROOT_PWD='${MYSQL_ROOT_PWD}'|g" $DOWNLOAD_DIR/upgrade-guac.sh
-sed -i "s|GUAC_USER=|GUAC_USER='${GUAC_USER}'|g" $DOWNLOAD_DIR/upgrade-guac.sh
-sed -i "s|GUAC_PWD=|GUAC_PWD='${GUAC_PWD}'|g" $DOWNLOAD_DIR/upgrade-guac.sh
+sed -i "s|INSTALL_MYSQL=|INSTALL_MYSQL='${INSTALL_MYSQL}'|g" $DOWNLOAD_DIR/upgrade-guacamole.sh
+sed -i "s|MYSQL_HOST=|MYSQL_HOST='${MYSQL_HOST}'|g" $DOWNLOAD_DIR/upgrade-guacamole.sh
+sed -i "s|MYSQL_PORT=|MYSQL_PORT='${MYSQL_PORT}'|g" $DOWNLOAD_DIR/upgrade-guacamole.sh
+sed -i "s|GUAC_DB=|GUAC_DB='${GUAC_DB}'|g" $DOWNLOAD_DIR/upgrade-guacamole.sh
+sed -i "s|MYSQL_ROOT_PWD=|MYSQL_ROOT_PWD='${MYSQL_ROOT_PWD}'|g" $DOWNLOAD_DIR/upgrade-guacamole.sh
+sed -i "s|GUAC_USER=|GUAC_USER='${GUAC_USER}'|g" $DOWNLOAD_DIR/upgrade-guacamole.sh
+sed -i "s|GUAC_PWD=|GUAC_PWD='${GUAC_PWD}'|g" $DOWNLOAD_DIR/upgrade-guacamole.sh
+sed -i "s|GUACD_ACCOUNT=|GUACD_ACCOUNT='${GUACD_ACCOUNT}'|g" $DOWNLOAD_DIR/upgrade-guacamole.sh
+
+sed -i "s|RDP_SHARE_HOST=|RDP_SHARE_HOST='${RDP_SHARE_HOST}'|g" $DOWNLOAD_DIR/upgrade-guacamole.sh
+sed -i "s|RDP_SHARE_LABEL=|RDP_SHARE_LABEL='${RDP_SHARE_LABEL}'|g" $DOWNLOAD_DIR/upgrade-guacamole.sh
+sed -i "s|RDP_PRINTER_LABEL=|RDP_PRINTER_LABEL='${RDP_PRINTER_LABEL}'|g" $DOWNLOAD_DIR/upgrade-guacamole.sh

 sed -i "s|PROXY_SITE=|PROXY_SITE='${PROXY_SITE}'|g" $DOWNLOAD_DIR/3-install-nginx.sh
 sed -i "s|INSTALL_LOG=|INSTALL_LOG='${INSTALL_LOG}'|g" $DOWNLOAD_DIR/3-install-nginx.sh
@ -668,15 +717,7 @@ sed -i "s|CERT_DAYS=|CERT_DAYS='${CERT_DAYS}'|g" $DOWNLOAD_DIR/4a-install-tls-se
 sed -i "s|GUAC_URL=|GUAC_URL='${GUAC_URL}'|g" $DOWNLOAD_DIR/4a-install-tls-self-signed-nginx.sh
 sed -i "s|INSTALL_LOG=|INSTALL_LOG='${INSTALL_LOG}'|g" $DOWNLOAD_DIR/4a-install-tls-self-signed-nginx.sh
 sed -i "s|DEFAULT_IP=|DEFAULT_IP='${DEFAULT_IP}'|g" $DOWNLOAD_DIR/4a-install-tls-self-signed-nginx.sh
-
-sed -i "s|CERT_COUNTRY=|CERT_COUNTRY='${CERT_COUNTRY}'|g" $DOWNLOAD_DIR/refresh-tls-self-signed.sh
-sed -i "s|CERT_STATE=|CERT_STATE='${CERT_STATE}'|g" $DOWNLOAD_DIR/refresh-tls-self-signed.sh
-sed -i "s|CERT_LOCATION=|CERT_LOCATION='${CERT_LOCATION}'|g" $DOWNLOAD_DIR/refresh-tls-self-signed.sh
-sed -i "s|CERT_ORG=|CERT_ORG='${CERT_ORG}'|g" $DOWNLOAD_DIR/refresh-tls-self-signed.sh
-sed -i "s|CERT_OU=|CERT_OU='${CERT_OU}'|g" $DOWNLOAD_DIR/refresh-tls-self-signed.sh
-sed -i "s|PROXY_SITE=|PROXY_SITE='${PROXY_SITE}'|g" $DOWNLOAD_DIR/refresh-tls-self-signed.sh
-sed -i "s|DEFAULT_IP=|DEFAULT_IP='${DEFAULT_IP}'|g" $DOWNLOAD_DIR/refresh-tls-self-signed.sh
-sed -i "s|CERT_DAYS=|CERT_DAYS='${CERT_DAYS}'|g" $DOWNLOAD_DIR/refresh-tls-self-signed.sh
+sed -i "s|RSA_KEYLENGTH=|RSA_KEYLENGTH='${RSA_KEYLENGTH}'|g" $DOWNLOAD_DIR/4a-install-tls-self-signed-nginx.sh

 sed -i "s|DOWNLOAD_DIR=|DOWNLOAD_DIR='${DOWNLOAD_DIR}'|g" $DOWNLOAD_DIR/4b-install-tls-letsencrypt-nginx.sh
 sed -i "s|PROXY_SITE=|PROXY_SITE='${PROXY_SITE}'|g" $DOWNLOAD_DIR/4b-install-tls-letsencrypt-nginx.sh
@ -694,12 +735,18 @@ else
    echo
 fi

-# For flexibility, export the relevant variable selections to child install scripts
+# Export the required variables for use by child install scripts
 export DOWNLOAD_DIR="${DOWNLOAD_DIR}"
 export GUAC_VERSION=$GUAC_VERSION
 export GUAC_SOURCE_LINK=$GUAC_SOURCE_LINK
+export ID=$ID
+export VERSION_ID=$VERSION_ID
+export FREERDP=$FREERDP
+export VERSION_CODENAME=$VERSION_CODENAME
 export MYSQLJCON=$MYSQLJCON
+export MYSQLJCON_SOURCE_LINK=$MYSQLJCON_SOURCE_LINK
 export MYSQL_VERSION=$MYSQL_VERSION
+export MARIADB_SOURCE_LINK=$MARIADB_SOURCE_LINK
 export MYSQLSRV=$MYSQLSRV
 export MYSQLCLIENT=$MYSQLCLIENT
 export DB_CMD=$DB_CMD
@ -716,6 +763,7 @@ export GUAC_DB=$GUAC_DB
 export GUAC_USER=$GUAC_USER
 export MYSQL_ROOT_PWD="${MYSQL_ROOT_PWD}"
 export GUAC_PWD="${GUAC_PWD}"
+export GUACD_ACCOUNT=$GUACD_ACCOUNT
 export DB_TZ="${DB_TZ}"
 export INSTALL_TOTP=$INSTALL_TOTP
 export INSTALL_DUO=$INSTALL_DUO
@ -726,6 +774,7 @@ export HISTREC_PATH="${HISTREC_PATH}"
 export GUAC_URL_REDIR=$GUAC_URL_REDIR
 export INSTALL_NGINX=$INSTALL_NGINX
 export PROXY_SITE=$PROXY_SITE
+export RSA_KEYLENGTH=$RSA_KEYLENGTH
 export DEFAULT_IP=$DEFAULT_IP
 export CERT_COUNTRY=$CERT_COUNTRY
 export CERT_STATE="${CERT_STATE}"
@ -740,8 +789,10 @@ export RDP_SHARE_HOST="${RDP_SHARE_HOST}"
 export RDP_SHARE_LABEL="${RDP_SHARE_LABEL}"
 export RDP_PRINTER_LABEL="${RDP_PRINTER_LABEL}"
 export LOCAL_DOMAIN=$LOCAL_DOMAIN
+export DOMAIN_SUFFIX=$DOMAIN_SUFFIX
+export CRON_DENY_FILE=$CRON_DENY_FILE

-# Run the Guacamole install script
+# Run the Guacamole install script (with all exported variables from this current shell)
 sudo -E ./2-install-guacamole.sh
 if [[ $? -ne 0 ]]; then
    echo -e "${LRED}2-install-guacamole.sh FAILED. See ${INSTALL_LOG}${GREY}" 1>&2
@ -752,13 +803,13 @@ else
    echo -e "${LGREEN}Guacamole install complete\nhttp://${PROXY_SITE}:8080/guacamole - login user/pass: guacadmin/guacadmin\n${LYELLOW}***Be sure to change the password***${GREY}"
 fi

-# Add a Guacamole database backup (mon-fri 12:00am) into the current user's cron
-mv $DOWNLOAD_DIR/backup-guac.sh $DB_BACKUP_DIR
+# Add a Guacamole database backup (Mon-Fri 12:00am) into the current user's cron
+mv $DOWNLOAD_DIR/backup-guacamole.sh $DB_BACKUP_DIR
 crontab -l >cron_1
-# Remove any existing entry just in case
+# Remove any pre-existing entry just in case
 sed -i '/# backup guacamole/d' cron_1
 # Create the backup job
-echo "0 0 * * 1-5 ${DB_BACKUP_DIR}/backup-guac.sh # backup guacamole" >>cron_1
+echo "0 0 * * 1-5 ${DB_BACKUP_DIR}/backup-guacamole.sh # backup guacamole" >>cron_1
 # Overwrite the old cron settings and cleanup
 crontab cron_1
 rm cron_1
@ -767,22 +818,22 @@ rm cron_1
 # Start optional setup actions   ######################################################################################
 #######################################################################################################################

-# Install Nginx reverse proxy front end to Guacamole if option is selected
+# Install Nginx reverse proxy front end to Guacamole if option is selected (with all exported variables from this current shell)
 if [[ "${INSTALL_NGINX}" = true ]]; then
    sudo -E ./3-install-nginx.sh
    echo -e "${LGREEN}Nginx install complete\nhttp://${PROXY_SITE} - admin login: guacadmin pass: guacadmin\n${LYELLOW}***Be sure to change the password***${GREY}"
 fi

-# Apply self signed TLS certificates to Nginx reverse proxy if option is selected
-if [[ "${INSTALL_NGINX}" = true ]] && [[ "${SELF_SIGN}" = true ]]; then
-    sudo -E ./4a-install-tls-self-signed-nginx.sh ${PROXY_SITE} ${CERT_DAYS} ${DEFAULT_IP} | tee -a ${INSTALL_LOG}
-    echo -e "${LGREEN}Self signed certificate configured for Nginx \n${LYELLOW}https:${LGREEN}//${PROXY_SITE} - admin login: guacadmin pass: guacadmin\n${LYELLOW}***Be sure to change the password***${GREY}"
+# Apply self signed TLS certificates to Nginx reverse proxy if option is selected (with all exported variables from this current shell)
+if [[ "${INSTALL_NGINX}" = true ]] && [[ "${SELF_SIGN}" = true ]] && [[ "${LETS_ENCRYPT}" != true ]]; then
+    sudo -E ./4a-install-tls-self-signed-nginx.sh ${PROXY_SITE} ${CERT_DAYS} ${DEFAULT_IP} | tee -a ${INSTALL_LOG} # Logged to capture client cert import instructions
+    echo -e "${LGREEN}Self signed certificate configured for Nginx \n${LYELLOW}https:${LGREEN}//${PROXY_SITE}  - login user/pass: guacadmin/guacadmin\n${LYELLOW}***Be sure to change the password***${GREY}"
 fi

-# Apply Let's Encrypt TLS certificates to Nginx reverse proxy if option is selected
-if [[ "${INSTALL_NGINX}" = true ]] && [[ "${LETS_ENCRYPT}" = true ]]; then
+# Apply Let's Encrypt TLS certificates to Nginx reverse proxy if option is selected (with all exported variables from this current shell)
+if [[ "${INSTALL_NGINX}" = true ]] && [[ "${LETS_ENCRYPT}" = true ]] && [[ "${SELF_SIGN}" != true ]]; then
    sudo -E ./4b-install-tls-letsencrypt-nginx.sh
-    echo -e "${LGREEN}Let's Encrypt TLS configured for Nginx \n${LYELLOW}https:${LGREEN}//${LE_DNS_NAME} - admin login: guacadmin pass: guacadmin\n${LYELLOW}***Be sure to change the password***${GREY}"
+    echo -e "${LGREEN}Let's Encrypt TLS configured for Nginx \n${LYELLOW}https:${LGREEN}//${LE_DNS_NAME}  - login user/pass: guacadmin/guacadmin\n${LYELLOW}***Be sure to change the password***${GREY}"
 fi

 # Duo Settings reminder - If Duo is selected you can't login to Guacamole until this extension is fully configured
@ -799,11 +850,20 @@ if [[ $INSTALL_LDAP == "true" ]]; then
    echo -e "See https://guacamole.apache.org/doc/gug/ldap-auth.html"
 fi

-# Tidy up. (Installer and Nginx scripts can't be run again or standalone without modification, so removing.)
+# Tidy up
+echo
+echo -e "${GREY}Removing build-essential package & cleaning up..."
 mv $USER_HOME_DIR/1-setup.sh $DOWNLOAD_DIR
-apt-get -y autoremove &>>${INSTALL_LOG}
+sudo apt remove -y build-essential &>>${INSTALL_LOG} # Lets not leave build resources installed on a secure system
+sudo apt-get -y autoremove &>>${INSTALL_LOG}
+if [[ $? -ne 0 ]]; then
+    echo -e "${LRED}Failed. See ${INSTALL_LOG}${GREY}" 1>&2
+    exit 1
+else
+    echo -e "${LGREEN}OK${GREY}"
+    echo
+fi

 # Done
-echo
 printf "${LGREEN}Guacamole ${GUAC_VERSION} install complete! \n${NC}"
 echo -e ${NC}
--- a/2-install-guacamole.sh
+++ b/2-install-guacamole.sh
@ -15,25 +15,31 @@ LGREEN='\033[0;92m'
 LYELLOW='\033[0;93m'
 NC='\033[0m' #No Colour

-# Apply MySQL client or server packages, and don't clobber any pre-existing database installation accidentally
-if [[ "${INSTALL_MYSQL}" = true ]]; then
-    MYSQLPKG="${MYSQLSRV}"
-elif [ -x "$(command -v mysql)" ]; then
-     MYSQLPKG=""
-else
-    MYSQLPKG="${MYSQLCLIENT}"
-fi
-
-# Pre-seed MySQL root password values for Linux Distro default packages only
-if [[ "${INSTALL_MYSQL}" = true ]] && [[ -z "${MYSQL_VERSION}" ]]; then
-    debconf-set-selections <<<"mysql-server mysql-server/root_password password ${MYSQL_ROOT_PWD}"
-    debconf-set-selections <<<"mysql-server mysql-server/root_password_again password ${MYSQL_ROOT_PWD}"
-fi

 # Update everything but don't do the annoying prompts during apt installs
 echo -e "${GREY}Updating base Linux OS..."
 export DEBIAN_FRONTEND=noninteractive
-apt-get upgrade -qq -y &>>${INSTALL_LOG}
+spinner() {
+  local pid=$1
+  local delay=0.15
+  local spinstr='|/-\'
+  tput civis
+  while ps -p $pid > /dev/null; do
+    for i in $(seq 0 3); do
+      tput sc
+      printf "[%c]" "${spinstr:$i:1}"
+      tput rc
+      sleep $delay
+    done
+  done
+  tput cnorm
+  printf "       "
+  tput rc
+}
+# We already ran apt-get update from the 1st setup script, now we begin to upgrade packages
+apt-get upgrade -qq -y &>>${INSTALL_LOG} &
+command_pid=$!
+spinner $command_pid
 if [[ $? -ne 0 ]]; then
    echo -e "${LRED}Failed. See ${INSTALL_LOG}${GREY}" 1>&2
    exit 1
@ -42,12 +48,18 @@ else
    echo
 fi

+# Pre-seed MySQL root password values for Linux Distro default packages only
+if [[ "${INSTALL_MYSQL}" = true ]] && [[ -z "${MYSQL_VERSION}" ]]; then
+    debconf-set-selections <<<"mysql-server mysql-server/root_password password ${MYSQL_ROOT_PWD}"
+    debconf-set-selections <<<"mysql-server mysql-server/root_password_again password ${MYSQL_ROOT_PWD}"
+fi
+
 # Install official MariaDB repo and MariaDB version if a specific version number was provided.
 if [[ -n "${MYSQL_VERSION}" ]]; then
    echo -e "${GREY}Adding the official MariaDB repository and installing version ${MYSQL_VERSION}..."
    # Add the Official MariaDB repo.
    apt-get -qq -y install curl gnupg2 &>>${INSTALL_LOG}
-    curl -LsS -O https://downloads.mariadb.com/MariaDB/mariadb_repo_setup &>>${INSTALL_LOG}
+    curl -LsS -O ${MARIADB_SOURCE_LINK} &>>${INSTALL_LOG}
    bash mariadb_repo_setup --mariadb-server-version=$MYSQL_VERSION &>>${INSTALL_LOG}
    if [[ $? -ne 0 ]]; then
        echo -e "${LRED}Failed. See ${INSTALL_LOG}${GREY}" 1>&2
@ -58,12 +70,40 @@ if [[ -n "${MYSQL_VERSION}" ]]; then
    fi
 fi

-# Install Guacamole build dependencies.
+# Select the appropriate MySQL client or server packages, and don't clobber any pre-existing database installation accidentally
+if [[ "${INSTALL_MYSQL}" = true ]]; then
+    MYSQLPKG="${MYSQLSRV}"
+elif [ -x "$(command -v ${DB_CMD})" ]; then
+     MYSQLPKG=""
+else
+    MYSQLPKG="${MYSQLCLIENT}"
+fi
+
+# Install Guacamole build dependencies (pwgen needed for duo config only, expect is auto removed after install)
 echo -e "${GREY}Installing dependencies required for building Guacamole, this might take a few minutes..."
-apt-get -qq -y install ${MYSQLPKG} ${TOMCAT_VERSION} ${JPEGTURBO} ${LIBPNG} ufw pwgen wget expect \
+spinner() {
+  local pid=$1
+  local delay=0.15
+  local spinstr='|/-\'
+  tput civis
+  while ps -p $pid > /dev/null; do
+    for i in $(seq 0 3); do
+      tput sc
+      printf "[%c]" "${spinstr:$i:1}"
+      tput rc
+      sleep $delay
+    done
+  done
+  tput cnorm
+  printf "       "
+  tput rc
+}
+apt-get -qq -y install ${MYSQLPKG} ${TOMCAT_VERSION} ${JPEGTURBO} ${LIBPNG} ${FREERDP} ufw pwgen expect \
    build-essential libcairo2-dev libtool-bin uuid-dev libavcodec-dev libavformat-dev libavutil-dev \
-    libswscale-dev freerdp2-dev libpango1.0-dev libssh2-1-dev libtelnet-dev libvncserver-dev libwebsockets-dev \
-    libpulse-dev libssl-dev libvorbis-dev libwebp-dev ghostscript &>>${INSTALL_LOG}
+    libswscale-dev libpango1.0-dev libssh2-1-dev libtelnet-dev libvncserver-dev libwebsockets-dev \
+    libpulse-dev libssl-dev libvorbis-dev libwebp-dev ghostscript &>>${INSTALL_LOG} &
+command_pid=$!
+spinner $command_pid
 if [[ $? -ne 0 ]]; then
    echo -e "${LRED}Failed. See ${INSTALL_LOG}${GREY}" 1>&2
    exit 1
@ -74,7 +114,26 @@ fi

 # Install Postfix with default settings for smtp email relay
 echo -e "${GREY}Installing Postfix MTA for backup email notifications and alerts, see separate SMTP relay configuration script..."
-DEBIAN_FRONTEND="noninteractive" apt-get install postfix mailutils -qq -y &>>${INSTALL_LOG}
+spinner() {
+  local pid=$1
+  local delay=0.15
+  local spinstr='|/-\'
+  tput civis
+  while ps -p $pid > /dev/null; do
+    for i in $(seq 0 3); do
+      tput sc
+      printf "[%c]" "${spinstr:$i:1}"
+      tput rc
+      sleep $delay
+    done
+  done
+  tput cnorm
+  printf "       "
+  tput rc
+}
+DEBIAN_FRONTEND="noninteractive" apt-get install postfix mailutils -qq -y &>>${INSTALL_LOG} &
+command_pid=$!
+spinner $command_pid
 if [[ $? -ne 0 ]]; then
    echo -e "${LRED}Failed. See ${INSTALL_LOG}${GREY}" 1>&2
    exit 1
@ -103,21 +162,21 @@ if [[ $? -ne 0 ]]; then
    echo -e "${GUAC_SOURCE_LINK}/binary/guacamole-${GUAC_VERSION}.war${GREY}"
    exit 1
 else
-    echo -e "${LGREEN}Downloaded guacamole-${GUAC_VERSION}.war (Guacamole client)${GREY}"
+    echo -e "${LGREEN}Downloaded guacamole-${GUAC_VERSION}.war${GREY}"
 fi

 # Download MySQL connector/j
-wget -q --show-progress -O mysql-connector-j-${MYSQLJCON}.tar.gz https://dev.mysql.com/get/Downloads/Connector-J/mysql-connector-j-${MYSQLJCON}.tar.gz
+wget -q --show-progress -O mysql-connector-j-${MYSQLJCON}.tar.gz ${MYSQLJCON_SOURCE_LINK}
 if [[ $? -ne 0 ]]; then
    echo -e "${LRED}Failed to download mysql-connector-j-${MYSQLJCON}.tar.gz" 1>&2
-    echo -e "https://dev.mysql.com/get/Downloads/Connector-J/mysql-connector-j-${MYSQLJCON}}.tar.gz${GREY}"
+    echo -e "${MYSQLJCON_SOURCE_LINK}${GREY}"
    exit 1
 else
    tar -xzf mysql-connector-j-${MYSQLJCON}.tar.gz
    echo -e "${LGREEN}Downloaded mysql-connector-j-${MYSQLJCON}.tar.gz${GREY}"
 fi

-# Download Guacamole authentication extensions
+# Download Guacamole database auth extension
 wget -q --show-progress -O guacamole-auth-jdbc-${GUAC_VERSION}.tar.gz ${GUAC_SOURCE_LINK}/binary/guacamole-auth-jdbc-${GUAC_VERSION}.tar.gz
 if [[ $? -ne 0 ]]; then
    echo -e "${LRED}Failed to download guacamole-auth-jdbc-${GUAC_VERSION}.tar.gz" 1>&2
@ -128,7 +187,7 @@ else
    echo -e "${LGREEN}Downloaded guacamole-auth-jdbc-${GUAC_VERSION}.tar.gz${GREY}"
 fi

-# Download TOTP extension
+# Download TOTP auth extension
 if [[ "${INSTALL_TOTP}" = true ]]; then
    wget -q --show-progress -O guacamole-auth-totp-${GUAC_VERSION}.tar.gz ${GUAC_SOURCE_LINK}/binary/guacamole-auth-totp-${GUAC_VERSION}.tar.gz
    if [[ $? -ne 0 ]]; then
@ -141,7 +200,7 @@ if [[ "${INSTALL_TOTP}" = true ]]; then
    fi
 fi

-# Download DUO extension
+# Download DUO auth extension
 if [[ "${INSTALL_DUO}" = true ]]; then
    wget -q --show-progress -O guacamole-auth-duo-${GUAC_VERSION}.tar.gz ${GUAC_SOURCE_LINK}/binary/guacamole-auth-duo-${GUAC_VERSION}.tar.gz
    if [[ $? -ne 0 ]]; then
@ -154,7 +213,7 @@ if [[ "${INSTALL_DUO}" = true ]]; then
    fi
 fi

-# Download LDAP extension
+# Download LDAP auth extension
 if [[ "${INSTALL_LDAP}" = true ]]; then
    wget -q --show-progress -O guacamole-auth-ldap-${GUAC_VERSION}.tar.gz ${GUAC_SOURCE_LINK}/binary/guacamole-auth-ldap-${GUAC_VERSION}.tar.gz
    if [[ $? -ne 0 ]]; then
@ -200,7 +259,7 @@ echo -e "Source download complete.${GREY}"

 # Add customised RDP share names and printer labels, remove Guacamole default labelling
 sed -i -e 's/IDX_CLIENT_NAME, "Guacamole RDP"/IDX_CLIENT_NAME, "'"${RDP_SHARE_HOST}"'"/' ${DOWNLOAD_DIR}/guacamole-server-${GUAC_VERSION}/src/protocols/rdp/settings.c
-sed -i -e 's/IDX_DRIVE_NAME, "Guacamole Filesystem"/IDX_CLIENT_NAME, "'"${RDP_SHARE_LABEL}"'"/' ${DOWNLOAD_DIR}/guacamole-server-${GUAC_VERSION}/src/protocols/rdp/settings.c
+sed -i -e 's/IDX_DRIVE_NAME, "Guacamole Filesystem"/IDX_DRIVE_NAME, "'"${RDP_SHARE_LABEL}"'"/' ${DOWNLOAD_DIR}/guacamole-server-${GUAC_VERSION}/src/protocols/rdp/settings.c
 sed -i -e 's/IDX_PRINTER_NAME, "Guacamole Printer"/IDX_PRINTER_NAME, "'"${RDP_PRINTER_LABEL}"'"/' ${DOWNLOAD_DIR}/guacamole-server-${GUAC_VERSION}/src/protocols/rdp/settings.c

 # Make Guacamole directories
@ -209,24 +268,55 @@ rm -rf /etc/guacamole/extensions/
 mkdir -p /etc/guacamole/lib/
 mkdir -p /etc/guacamole/extensions/

-# Fix for #196 see https://github.com/MysticRyuujin/guac-install/issues/196
-mkdir -p /usr/sbin/.config/freerdp
-chown daemon:daemon /usr/sbin/.config/freerdp
+# Create a custom guacd service account and heavily lock it down
+adduser "${GUACD_ACCOUNT}" --disabled-password --disabled-login --gecos "" > /dev/null 2>&1
+gpasswd -d "${GUACD_ACCOUNT}" users > /dev/null 2>&1
+echo -e "\nMatch User ${GUACD_ACCOUNT}\n    X11Forwarding no\n    AllowTcpForwarding no\n    PermitTTY no\n    ForceCommand cvs server" | sudo tee -a /etc/ssh/sshd_config > /dev/null 2>&1
+systemctl restart ssh
+touch "${CRON_DENY_FILE}"
+chmod 644 "${CRON_DENY_FILE}"
+chown root:root "${CRON_DENY_FILE}"
+if ! grep -q "^${GUACD_ACCOUNT}$" "${CRON_DENY_FILE}"; then
+   echo "$GUACD_ACCOUNT" | sudo tee -a "$CRON_DENY_FILE" > /dev/null 2>&1
+fi

-# Fix for #197 see https://github.com/MysticRyuujin/guac-install/issues/197
+# Setup freerdp profile permissions for storing certificates
+mkdir -p /home/"${GUACD_ACCOUNT}"/.config/freerdp
+chown ${GUACD_ACCOUNT}:${GUACD_ACCOUNT} /home/"${GUACD_ACCOUNT}"/.config/freerdp
+
+# Setup guacamole permissions
 mkdir -p /var/guacamole
-chown daemon:daemon /var/guacamole
+chown "${GUACD_ACCOUNT}":"${GUACD_ACCOUNT}" /var/guacamole

 # Make and install guacd (Guacamole-Server)
-cd guacamole-server-${GUAC_VERSION}/
 echo
 echo -e "${GREY}Compiling Guacamole-Server from source with with GCC $(gcc --version | head -n1 | grep -oP '\)\K.*' | awk '{print $1}'), this might take a few minutes...${GREY}"

-# Fix for warnings see #222 https://github.com/MysticRyuujin/guac-install/issues/222
+cd guacamole-server-${GUAC_VERSION}/
+# Skip any deprecated software warnings various distros may throw during build
 export CFLAGS="-Wno-error"

 # Configure Guacamole Server source
-./configure --with-systemd-dir=/etc/systemd/system &>>${INSTALL_LOG}
+spinner() {
+  local pid=$1
+  local delay=0.15
+  local spinstr='|/-\'
+  tput civis
+  while ps -p $pid > /dev/null; do
+    for i in $(seq 0 3); do
+      tput sc
+      printf "[%c]" "${spinstr:$i:1}"
+      tput rc
+      sleep $delay
+    done
+  done
+  tput cnorm
+  printf "       "
+  tput rc
+}
+./configure --with-systemd-dir=/etc/systemd/system &>>${INSTALL_LOG} &
+command_pid=$!
+spinner $command_pid
 if [[ $? -ne 0 ]]; then
    echo "Failed to configure guacamole-server"
    echo "Trying again with --enable-allow-freerdp-snapshots"
@ -241,7 +331,26 @@ else
 fi

 echo -e "${GREY}Running make and building the Guacamole-Server application..."
-make &>>${INSTALL_LOG}
+spinner() {
+  local pid=$1
+  local delay=0.15
+  local spinstr='|/-\'
+  tput civis
+  while ps -p $pid > /dev/null; do
+    for i in $(seq 0 3); do
+      tput sc
+      printf "[%c]" "${spinstr:$i:1}"
+      tput rc
+      sleep $delay
+    done
+  done
+  tput cnorm
+  printf "       "
+  tput rc
+}
+make &>>${INSTALL_LOG} &
+command_pid=$!
+spinner $command_pid
 if [[ $? -ne 0 ]]; then
    echo -e "${LRED}Failed. See ${INSTALL_LOG}${GREY}" 1>&2
    exit 1
@ -390,7 +499,7 @@ if [[ "${INSTALL_HISTREC}" = true ]]; then
    chmod 664 /etc/guacamole/extensions/guacamole-history-recording-storage-${GUAC_VERSION}.jar
    #Setup the default recording path
    mkdir -p ${HISTREC_PATH}
-    chown daemon:tomcat ${HISTREC_PATH}
+    chown ${GUACD_ACCOUNT}:tomcat ${HISTREC_PATH}
    chmod 2750 ${HISTREC_PATH}
    echo "recording-search-path: ${HISTREC_PATH}" >>/etc/guacamole/guacamole.properties
    if [[ $? -ne 0 ]]; then
@ -428,7 +537,7 @@ fi
 # Set Tomcat to start at boot
 systemctl enable ${TOMCAT_VERSION}

-# Begin the MySQL database config if this is a local MYSQL install only.
+# Begin the MySQL database config only if this is a local MYSQL install.
 if [[ "${INSTALL_MYSQL}" = true ]]; then
    # Set MySQL password
    export MYSQL_PWD=${MYSQL_ROOT_PWD}
@ -447,7 +556,8 @@ ALTER USER 'root'@'localhost' IDENTIFIED BY '$MYSQL_ROOT_PWD';"
        echo
    fi

-    # Find the location of the MySQL or MariaDB config files. (Add to this list for more potential candidates.)
+   # A simple method to find the correct file containing the default MySQL timezone setting from a potential list of candidates. 
+   # Add to this array if your distro uses a different path to the .cnf containing the default_time_zone value.
    for x in /etc/mysql/mariadb.conf.d/50-server.cnf \
        /etc/mysql/mysql.conf.d/mysqld.cnf \
        /etc/mysql/my.cnf; do
@ -472,7 +582,7 @@ ALTER USER 'root'@'localhost' IDENTIFIED BY '$MYSQL_ROOT_PWD';"
        else
            timezone=${DB_TZ}
            if [[ -z "${DB_TZ}" ]]; then
-                echo -e "Couldn't find system timezone, using UTC$"
+                echo -e "No timezone specified, using UTC"
                timezone="UTC"
            fi
            echo -e "Setting MySQL database timezone as ${timezone}${GREY}"
@ -489,10 +599,9 @@ ALTER USER 'root'@'localhost' IDENTIFIED BY '$MYSQL_ROOT_PWD';"
        echo
    fi

-    # This should stay as localhost in most local MySQL install situations. This setting determines from WHERE the new ${GUAC_USER}
-    # will be able to login to the database (either from specific remote IPs or from localhost only.)
-    #  However this setting can be a quick and hacky way to build a backend guacamole database server for use behind another guac application server, albeit with the full application suite installed). To do this, set GUAC_USERHost="%" for login access from all IPs, (or e.g. 192.168.1.% for an IP range.)
-    # You will also need to set the MySQL binding away from the default 127.0.0.1 to 0.0.0.0 or a specific external facing network interface to allow remote login.
+    # This below block should stay as "localhost" for all local MySQL install situations and it is driven by the $MYSQL_HOST setting. 
+    # $GUAC_USERHost determines from WHERE the new ${GUAC_USER} will be able to login to the database (either from specific remote IPs 
+    # or from localhost only.) 
    if [[ "${MYSQL_HOST}" != "localhost" ]]; then
        GUAC_USERHost="%"
        echo -e "${LYELLOW}${GUAC_USER} is set to accept db logins from any host, you may wish to limit this to specific IPs.${GREY}"
@ -508,7 +617,7 @@ CREATE DATABASE IF NOT EXISTS ${GUAC_DB};
 CREATE USER IF NOT EXISTS '${GUAC_USER}'@'${GUAC_USERHost}' IDENTIFIED BY \"${GUAC_PWD}\";
 GRANT SELECT,INSERT,UPDATE,DELETE ON ${GUAC_DB}.* TO '${GUAC_USER}'@'${GUAC_USERHost}';
 FLUSH PRIVILEGES;"
-    echo ${SQLCODE} | mysql -u root -D mysql -h ${MYSQL_HOST} -P ${MYSQL_PORT}
+    echo ${SQLCODE} | $DB_CMD -u root -D mysql -h ${MYSQL_HOST} -P ${MYSQL_PORT}
    if [[ $? -ne 0 ]]; then
        echo -e "${LRED}Failed${GREY}" 1>&2
        exit 1
@ -593,6 +702,9 @@ fi

 # Ensure guacd is started
 echo -e "${GREY}Starting guacd service & enable at boot..."
+# Update the systemd unit file the default daemon to the chosen service account 
+sudo sed -i "s/\bdaemon\b/${GUACD_ACCOUNT}/g" /etc/systemd/system/guacd.service
+systemctl daemon-reload
 systemctl enable guacd
 systemctl stop guacd 2>/dev/null
 systemctl start guacd
@ -644,6 +756,7 @@ rm -rf mysql-connector-j-*
 rm -rf mariadb_repo_setup
 unset MYSQL_PWD
 apt-get -y remove expect &>>${INSTALL_LOG}
+apt-get -y autoremove &>>${INSTALL_LOG}
 if [[ $? -ne 0 ]]; then
    echo -e "${LRED}Failed. See ${INSTALL_LOG}${GREY}" 1>&2
    exit 1
--- a/3-install-nginx.sh
+++ b/3-install-nginx.sh
@ -27,9 +27,7 @@ fi

 echo
 echo
-echo -e "${LGREEN}Installing Nginx...${DGREY}"
-echo
-
+echo -e "${GREY}Installing Nginx..."
 TOMCAT_VERSION=$(ls /etc/ | grep tomcat)
 # Below variables are automatically updated by the 1-setup.sh script with the respective values given at install (manually update if blank)
 PROXY_SITE=
@ -37,16 +35,39 @@ INSTALL_LOG=
 GUAC_URL=

 # Install Nginx
-apt-get update -qq &>>${INSTALL_LOG}
-apt-get install nginx -qq -y &>>${INSTALL_LOG}
+spinner() {
+  local pid=$1
+  local delay=0.15
+  local spinstr='|/-\'
+  tput civis
+  while ps -p $pid > /dev/null; do
+    for i in $(seq 0 3); do
+      tput sc
+      printf "[%c]" "${spinstr:$i:1}"
+      tput rc
+      sleep $delay
+    done
+  done
+  tput cnorm
+  printf "       "
+  tput rc
+}
+apt-get update -qq &> /dev/null && apt-get install nginx -qq -y &>>${INSTALL_LOG} &
+command_pid=$!
+spinner $command_pid
+if [[ $? -ne 0 ]]; then
+    echo -e "${LRED}Failed. See ${INSTALL_LOG}${GREY}" 1>&2
+    exit 1
+else
+    echo -e "${LGREEN}OK${GREY}"
+    echo
+fi

 echo -e "${GREY}Configuring Nginx as a reverse proxy for Guacamole's Apache Tomcat front end...${DGREY}"
 # Configure /etc/nginx/sites-available/(local dns site name)
 cat <<EOF | tee /etc/nginx/sites-available/$PROXY_SITE
 server {
    listen 80 default_server;
-    root /var/www/html;
-    index index.html index.htm index.nginx-debian.html;
    server_name $GUAC_URL;
    location / {
        proxy_pass $GUAC_URL;
@ -69,15 +90,15 @@ fi

 # Force nginx to require tls1.2 and above
 sed -i -e '/ssl_protocols/s/^/#/' /etc/nginx/nginx.conf
-sed -i "/SSL Settings/a \        ssl_protocols TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE" /etc/nginx/nginx.conf
+sed -i "/SSL Settings/a \        ssl_protocols TLSv1.2 TLSv1.3;" /etc/nginx/nginx.conf

-# Symlink from sites-available to sites-enabled
+# Symlink new reverse proxy site config from sites-available to sites-enabled
 ln -s /etc/nginx/sites-available/$PROXY_SITE /etc/nginx/sites-enabled/

-# Make sure default Nginx site is unlinked
+# Make sure the default Nginx site is unlinked
 unlink /etc/nginx/sites-enabled/default

-# Do mandatory Nginx tweaks for logging actual client IPs through a proxy IP of 127.0.0.1 - DO NOT CHANGE COMMAND FORMATING!
+# Do mandatory Nginx tweaks for logging actual client IPs through a proxy IP of 127.0.0.1 - DO NOT CHANGE COMMAND FORMATTING!
 echo -e "${GREY}Configuring Apache Tomcat valve for pass through of client IPs to Guacamole logs...${GREY}"
 sed -i '/pattern="%h %l %u %t &quot;%r&quot; %s %b"/a        \        <!-- Allow host IP to pass through to guacamole.-->\n        <Valve className="org.apache.catalina.valves.RemoteIpValve"\n               internalProxies="127\.0\.0\.1|0:0:0:0:0:0:0:1"\n               remoteIpHeader="x-forwarded-for"\n               remoteIpProxiesHeader="x-forwarded-by"\n               protocolHeader="x-forwarded-proto" />' /etc/$TOMCAT_VERSION/server.xml
 if [[ $? -ne 0 ]]; then
@ -90,7 +111,7 @@ fi

 # Allow large file transfers through Nginx
 sed -i '/client_max_body_size/d' /etc/nginx/nginx.conf  # remove this line if it already exists to prevent duplicates
-sed -i "/Basic Settings/a \        client_max_body_size 100000000M;" /etc/nginx/nginx.conf # Add the larger file transfer size
+sed -i "/Basic Settings/a \        client_max_body_size 1000000000M;" /etc/nginx/nginx.conf # Add larger file transfer size, should be enough!
 echo -e "${GREY}Boosting Nginx's 'maximum body size' parameter to allow large file transfers...${GREY}"
 if [[ $? -ne 0 ]]; then
    echo -e "${LRED}Failed. See ${INSTALL_LOG}${GREY}" 1>&2
--- a/4a-install-tls-self-signed-nginx.sh
+++ b/4a-install-tls-self-signed-nginx.sh
@ -1,6 +1,6 @@
 #!/bin/bash
 #######################################################################################################################
-# Add self signed TLS certificates to Guacamole with Nginx reverse proxy
+# Add self-signed TLS certificates to Guacamole with Nginx reverse proxy
 # For Ubuntu / Debian / Raspbian
 # 4a of 4
 # David Harrop
@ -13,7 +13,7 @@
 # e.g. sudo -E ./4a-install-tls-self-signed-nginx.sh proxy.domain.local 365 192.168.1.50

 # Alternatively, run the script without any command arguments and the default variables below will apply
-# e.g. sudo - E ./4a-install-tls-self-signed-nginx.sh
+# e.g. sudo -E ./4a-install-tls-self-signed-nginx.sh

 # Prepare text output colours
 GREY='\033[0;37m'
@ -36,7 +36,6 @@ DIR_SSL_CERT="/etc/nginx/ssl/cert"
 DIR_SSL_KEY="/etc/nginx/ssl/private"

 TOMCAT_VERSION=$(ls /etc/ | grep tomcat)
-
 # Below variables are automatically updated by the 1-setup.sh script with the respective values given at install (manually update if blank)
 DOWNLOAD_DIR=
 CERT_COUNTRY=
@ -49,9 +48,10 @@ INSTALL_LOG=
 PROXY_SITE=
 CERT_DAYS=
 DEFAULT_IP=
+RSA_KEYLENGTH=

 # Create a place to save the certs so we don't overwrite any earlier versions
-CERT_DIR_NAME=tls-certs-$(date +%y.%m.%d-%H_%M)
+CERT_DIR_NAME=tls-certs-$(date +%y.%m.%d)
 CERT_DIR=$DOWNLOAD_DIR/$CERT_DIR_NAME
 mkdir -p $CERT_DIR
 cd $CERT_DIR
@ -61,9 +61,8 @@ TLSNAME=$1
 TLSDAYS=$2
 TLSIP=$3

-# Assume the values set the guacamole installer if the script is run without any command line options
-# Assume the values set the guacamole installer if the script is run without any command line options
-if [[ -z "$1" ]] | [[ -z "$2" ]] | [[ -z "$3" ]]; then
+# Assume the values set by the main installer if the script is run without any command line options
+if [[ -z "$1" ]] || [[ -z "$2" ]] || [[ -z "$3" ]]; then
    TLSNAME=$PROXY_SITE
    TLSDAYS=$CERT_DAYS
    TLSIP=$DEFAULT_IP
@ -71,7 +70,7 @@ fi

 echo
 echo
-echo -e "${LGREEN}Setting up self signed TLS certificates for Nginx...${GREY}"
+echo -e "${LGREEN}Setting up self-signed TLS certificates for Nginx...${GREY}"
 echo

 # Make directories to place TLS Certificate if they don't exist
@ -83,7 +82,7 @@ if [[ ! -d $DIR_SSL_CERT ]]; then
    mkdir -p $DIR_SSL_CERT
 fi

-echo -e "${GREY}New self signed TLS certificate attributes are shown below...${DGREY}"
+echo -e "${GREY}New self-signed TLS certificate attributes are shown below...${DGREY}"
 # Display the new TLS cert parameters.
 cat <<EOF | tee cert_attributes.txt
 [req]
@ -98,7 +97,7 @@ ST                  = $CERT_STATE
 L                   = $CERT_LOCATION
 O                   = $CERT_ORG
 OU                  = $CERT_OU
-CN                  = $TLSNAME
+CN                  = *.$(echo $TLSNAME | cut -d. -f2-)

 [v3_req]
 keyUsage            = nonRepudiation, digitalSignature, keyEncipherment
@ -107,12 +106,13 @@ subjectAltName      = @alt_names

 [alt_names]
 DNS.1               = $TLSNAME
+DNS.2               = *.$(echo $TLSNAME | cut -d. -f2-)
 IP.1                = $TLSIP
 EOF

 echo
-echo "{$GREY}Creating a new Nginx TLS Certificate..."
-openssl req -x509 -nodes -newkey rsa:2048 -keyout $TLSNAME.key -out $TLSNAME.crt -days $TLSDAYS -config cert_attributes.txt
+echo -e "${GREY}Creating a new Nginx TLS Certificate..."
+openssl req -x509 -nodes -newkey rsa:$RSA_KEYLENGTH -keyout $TLSNAME.key -out $TLSNAME.crt -days $TLSDAYS -config cert_attributes.txt
 if [[ $? -ne 0 ]]; then
    echo -e "${LRED}Failed. See ${INSTALL_LOG}${GREY}" 1>&2
    exit 1
@ -126,7 +126,7 @@ cp $TLSNAME.key $DIR_SSL_KEY/$TLSNAME.key
 cp $TLSNAME.crt $DIR_SSL_CERT/$TLSNAME.crt

 # Create a PFX formatted key for easier import to Windows hosts
-echo -e "${GREY}Converting client certificates for Windows & Linux...${GREY}"
+echo -e "${GREY}Converting client certificate to Windows pfx format...${GREY}"
 openssl pkcs12 -export -out $TLSNAME.pfx -inkey $TLSNAME.key -in $TLSNAME.crt -password pass:1234
 if [[ $? -ne 0 ]]; then
    echo -e "${LRED}Failed. See ${INSTALL_LOG}${GREY}" 1>&2
@ -154,13 +154,12 @@ fi
 fi

 # Update Nginx config to accept the new certificates
-echo -e "${GREY}Configuring Nginx proxy to use the self signed TLS certificate and setting up HTTP redirect...${DGREY}"
+echo -e "${GREY}Configuring Nginx proxy to use the self-signed TLS certificate and setting up HTTP redirect...${DGREY}"
 cat <<EOF | tee /etc/nginx/sites-available/$TLSNAME
 server {
-    #listen 80 default_server;
-    root /var/www/html;
-    index index.html index.htm index.nginx-debian.html;
-    server_name $TLSNAME;
+    # HTTPS site
+    listen 443 ssl;
+    server_name _;
    location / {
        proxy_pass $GUAC_URL;
        proxy_buffering off;
@ -170,29 +169,21 @@ server {
        proxy_set_header Connection \$http_connection;
        access_log off;
    }
-    listen 443 ssl;
    ssl_certificate      /etc/nginx/ssl/cert/$TLSNAME.crt;
    ssl_certificate_key  /etc/nginx/ssl/private/$TLSNAME.key;
    ssl_session_cache shared:SSL:1m;
    ssl_session_timeout  5m;
 }
+
 server {
-    return 301 https://\$host\$request_uri;
+    # Redirect all other traffic to the HTTPS site
    listen 80 default_server;
-    root /var/www/html;
-    index index.html index.htm index.nginx-debian.html;
-    server_name $TLSNAME;
    location / {
-        proxy_pass $GUAC_URL;
-        proxy_buffering off;
-        proxy_http_version 1.1;
-        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
-        proxy_set_header Upgrade \$http_upgrade;
-        proxy_set_header Connection \$http_connection;
-        access_log off;
+        return 301 https://\$host\$request_uri;
    }
 }
 EOF
+
 if [[ $? -ne 0 ]]; then
    echo -e "${LRED}Failed. See ${INSTALL_LOG}${GREY}" 1>&2
    exit 1
@ -203,7 +194,7 @@ fi

 # Find all enabled sites containing the $GUAC_URL and remove them to avoid conflicts
 for x in /etc/nginx/sites-enabled/*; do
-    # Check inside each site candidate to see if the $GUAC_URL exists.
+    # Check inside each enabled site to see if the $GUAC_URL exists.
    if [[ -f "${x}" ]]; then
        if grep -qE "${GUAC_URL}" "${x}"; then
            found_sites+=("${x}")
@ -251,14 +242,14 @@ else
    echo
 fi

-# Hack to assist with displaying "$" symbols and " ' quotes in a (cut/paste-able) bash screen output format
+# A simple hack to display special characters in a cut & paste-able format directly to stdout.
 SHOWASTEXT1='$mypwd'
 SHOWASTEXT2='"Cert:\LocalMachine\Root"'

 printf "${GREY}+-------------------------------------------------------------------------------------------------------------
 ${LGREEN}+ WINDOWS CLIENT SELF SIGNED TLS BROWSER CONFIG - SAVE THIS BEFORE CONTINUING!${GREY}
 +
-+ 1. In ${DOWNLOAD_DIR} is a Windows version of the new certificate ${LYELLOW}$TLSNAME.pfx${GREY}
+ 1. In $CERT_DIR is a Windows version of the new certificate ${LYELLOW}$TLSNAME.pfx${GREY}
 + 2. Import this PFX file into your Windows client with the below PowerShell commands (as Administrator):
 \n"
 echo -e "${SHOWASTEXT1} = ConvertTo-SecureString -String "1234" -Force -AsPlainText"
@ -266,12 +257,12 @@ echo -e "Import-pfxCertificate -FilePath $TLSNAME.pfx -Password "${SHOWASTEXT1}"
 printf "${GREY}+-------------------------------------------------------------------------------------------------------------
 ${LGREEN}+ LINUX CLIENT SELF SIGNED TLS BROWSER CONFIG - SAVE THIS BEFORE CONTINUING!${GREY}
 +
-+ 1. In ${DOWNLOAD_DIR} is a new Linux native OpenSSL certificate ${LYELLOW}$TLSNAME.crt${GREY}
+ 1. In $CERT_DIR is a new Linux native OpenSSL certificate ${LYELLOW}$TLSNAME.crt${GREY}
 + 2. Import the CRT file into your Linux client certificate store with the below command:
 \n"
 echo -e "(If certutil is not installed, run apt-get install libnss3-tools)"
-echo -e "mkdir -p $HOME/.pki/nssdb && certutil -d $HOME/.pki/nssdb -N"
-echo -e "certutil -d sql:$HOME/.pki/nssdb -A -t "CT,C,c" -n $TLSNAME -i $TLSNAME.crt"
+echo -e "mkdir -p \$HOME/.pki/nssdb && certutil -d \$HOME/.pki/nssdb -N"
+echo -e "certutil -d sql:\$HOME/.pki/nssdb -A -t "CT,C,c" -n $TLSNAME -i $TLSNAME.crt"
 printf "+-------------------------------------------------------------------------------------------------------------\n"
 echo -e "${LYELLOW}The above TLS browser config instructions are saved in ${LGREEN}$INSTALL_LOG${GREY}"

--- a/4b-install-tls-letsencrypt-nginx.sh
+++ b/4b-install-tls-letsencrypt-nginx.sh
@ -8,7 +8,7 @@
 #######################################################################################################################

 # If run as standalone and not from the main installer script, check the below variables are correct.
-# To run standalone: sudo ./4b-install-tls-letsencrypt-nginx.sh
+# To run standalone: sudo -E ./4b-install-tls-letsencrypt-nginx.sh

 # Prepare text output colours
 GREY='\033[0;37m'
@ -30,12 +30,34 @@ INSTALL_LOG=

 echo
 echo
-echo -e "${LGREEN}Installing Let's Encrypt TLS configuration for Nginx...${GREY}"
-echo
-
-# Install nginx
-apt-get update -qq &>>${INSTALL_LOG}
-apt-get install nginx certbot python3-certbot-nginx -qq -y &>>${INSTALL_LOG}
+echo -e "${GREY}Installing Nginx & Lets Encrypt Certbot..."
+spinner() {
+  local pid=$1
+  local delay=0.15
+  local spinstr='|/-\'
+  tput civis
+  while ps -p $pid > /dev/null; do
+    for i in $(seq 0 3); do
+      tput sc
+      printf "[%c]" "${spinstr:$i:1}"
+      tput rc
+      sleep $delay
+    done
+  done
+  tput cnorm
+  printf "       "
+  tput rc
+}
+apt-get update -qq &> /dev/null && apt-get install nginx certbot python3-certbot-nginx -qq -y &>>${INSTALL_LOG} &
+command_pid=$!
+spinner $command_pid
+if [[ $? -ne 0 ]]; then
+    echo -e "${LRED}Failed. See ${INSTALL_LOG}${GREY}" 1>&2
+    exit 1
+else
+    echo -e "${LGREEN}OK${GREY}"
+    echo
+fi

 # Backup the current Nginx config
 echo
@ -77,7 +99,7 @@ else
    echo
 fi

-# Update general ufw rules so force traffic via reverse proxy. Only Nginx and SSH will be available over the network.
+# Update general ufw rules to force traffic via reverse proxy. Only Nginx and SSH will be available over the network.
 echo -e "${GREY}Updating firewall rules to allow only SSH and tcp 80/443..."
 ufw default allow outgoing >/dev/null 2>&1
 ufw default deny incoming >/dev/null 2>&1
@ -93,7 +115,7 @@ else
    echo
 fi

-# Reload the new Nginx config so as certbot can further ajust
+# Reload the new Nginx config so as certbot can read the new config and update it
 systemctl restart nginx

 # Run certbot to create and associate certificates with current public IP (must have tcp 80 and 443 open to work!)
@ -108,8 +130,8 @@ else
    echo
 fi

-# Select a random daily time to schedule a daily check for Let's Encrypt certificates due to expire in next 30 days.
-# If are any due to expire within a 30 day window, Certbot will attempt to renew automatically renew.
+# Select a random daily time to schedule a daily check for a Let's Encrypt certificate due to expire in next 30 days.
+# If due to expire within a 30 day window, certbot will attempt to renew automatically each day.
 echo -e "${GREY}Scheduling automatic certificate renewals for certificates with < 30 days till expiry.)${GREY}"
 #Dump out the current crontab
 crontab -l >cron_1
@ -131,7 +153,7 @@ else
 fi

 # Reload everything once again
-echo -e "${GREY}Restaring Guacamole & Ngnix..."
+echo -e "${GREY}Restarting Guacamole & Ngnix..."
 systemctl restart $TOMCAT_VERSION
 systemctl restart guacd
 systemctl restart nginx
--- a/ACTIVE-DIRECTORY-HOW-TO.md
+++ b/ACTIVE-DIRECTORY-HOW-TO.md
@ -1,20 +1,19 @@
+## Integrating Guacamole With Active Directory

-# Integrating Guacamole With Active Directory
-
-## :arrows_clockwise: **Step 1: Ensure two-way LDAP traffic is available to the Guacamole application server**
+### :arrows_clockwise: **Step 1: Ensure two-way LDAP traffic is available to the Guacamole application server**

 - If Guacamole is operating in a separate network from your Active Directory Servers, allow TCP 389 between all Guacamole application servers and all Active Directory Domain Controllers nominated in the config script settings below.

-## :key: **Step 2: Establish the required accounts to bind with Active Directory**
+### :key: **Step 2: Establish the required accounts to bind with Active Directory**

 - An account with only **Domain Users** rights is sufficient for Guacamole to read and bind with Active Directory. 

-   - a. In the Guacamole application, create a new Guacamole account with full admin rights to the Guacamole application, e.g., `guacbind-ad`, and assign it an appropriately strong password. (Then log in with this new account and disable the default guacadmin account)
+   - a. In the Guacamole application, create a new Guacamole account with full admin rights to the Guacamole application, e.g. `guacbind-ad`, and assign it an appropriately strong password. (Then log in with this new account and disable the default guacadmin account)
   - b. Create a new Active Directory domain account with EXACTLY THE SAME NAME as the new full admin account named above, only this time assign a DIFFERENT strong password than what was used above. 

-## :pencil: **Step 3: Edit the provided configuration script to reflect your specific Active Directory environment**
+### :pencil: **Step 3: Edit the provided configuration script to reflect your specific Active Directory environment**

-Below is the EXACT format to follow in editing the `$USER_HOME_DIR/guac-setup/add-ldap-auth-guacamole.sh` script. Be careful not to introduce new lines, spaces at the ends of lines, or carriage returns, as anything outside of this format will cause the LDAP auth extension to fail. You have been warned! 
+Below is the EXACT format to follow in editing the `$USER_HOME_DIR/guac-setup/add-ldap-auth-guacamole.sh` script. Be careful not to introduce new lines, spaces at the ends of lines or carriage returns. Anything outside of this format will cause the LDAP auth extension to fail. You have been warned! 

 ```
 ldap-hostname: dc1.yourdomain.com dc2.yourdomain.com dc3.yourdomain.com
@ -30,7 +29,7 @@ ldap-max-search-results:200
 mysql-auto-create-accounts: true
 ```

-**Edit only the following values from the above example to suit your environment, then save the script:**
+**Edit only the following values from the above example to suit your environment, then save the add-ldap-auth-guacamole.sh script:**

 ```
 ldap-hostname:
@ -42,31 +41,65 @@ mysql-auto-create-accounts: true
 ldap-max-search-results:200
 ```

- **_Important note on `ldap-user-base-dn:`_** This value sets a position in the directory as a relative root to search within. All Guacamole users to be authenticated by Active Directory must be placed in a lower position within the directory tree than this value. This line can be added multiple times to more efficiently search across multiple branches of a directory tree.
+- **Important note on `ldap-user-base-dn:`** This value sets a position in the directory as a relative root to search within. All Guacamole users to be authenticated by Active Directory must be placed in a lower position within the directory tree than this value. This line can be added multiple times to more efficiently search across multiple branches of a directory tree.

- **_Important note on `ldap-max-search-results:`_** Yes, there is no space before the `:200` value. In larger environments managing the directory efficiently requires that we don't query every object in the tree for every user lookup. You may need to adjust this number depending on the number of objects in your tree.
+- **Important note on `ldap-max-search-results:`** Yes, there is no space before the default `:200` value. In larger environments managing the directory efficiently requires that we don't query every object in the tree for every user lookup. You may need to adjust this number depending on the number of objects in the above relative root search path.

- **_Important note on `mysql-auto-create-accounts:`_** This line is optional and can be deleted. This line ensures that all Active Directory user accounts will have a matching user account created in the Guacamole db at first logon. Local Guacamole accounts are NOT necessarily needed for access to Guacamole connections - these are only necessary when deploying MFA or you want to assign other settings specific to individual users. Domain users can be provisioned access to Guacamole sessions connections without creating local users in the Guacamole db. For many use cases, manually creating a small number of Guacamole user accounts to match their domain accounts may be more preferable than all users inheriting access to establish a local account in the Guacamole db. See below for manual account setup.
+- **Important note on `mysql-auto-create-accounts:`** This line is optional and can be deleted if using Active Directory authentication without Guacamole's implementation of MFA. This line ensures that all Active Directory user accounts will have a matching user account created in the Guacamole database at thier first Guacmaole logon with thier AD accout. Only if Gucamole's MFA feature is to be provisioned is a local Guacamole account required, and automating this step can aid MFA deployment. If you want to provision Guacamole MFA access to just a limited selection of Active Diretory users, you may remove this line and manually create the passwordless Guacamole database local account pairings as needed. [See below for more.](https://github.com/itiligent/Guacamole-Install/blob/main/ACTIVE-DIRECTORY-HOW-TO.md#busts_in_silhouette-manually-creating-and-configuring-new-guacamole-users-for-active-directory-authentication-with-mfa) 

-## :computer: **Step 4: Run the (now customised) LDAP configuration script**
+#### If your AD has TLS implemented via a self signed certificate you must also apply the extra TLS tasks A to E below, else skip to Step 4 ... For more info see [#18](https://github.com/itiligent/Guacamole-Install/issues/18)
+
+TLS task A. Adjust this line in the above template for add-ldap-auth-guacamole.sh (Values can be none, ssl or stattls) 
+```
+ldap-encryption-method: starttls 
+```
+TLS task B. Next, you must obtain your AD TLS cert. 
+```
+openssl s_client -connect X.X.X.X:389 \
+              -starttls ldap \
+              -showcerts < /dev/null | \
+              openssl x509 -text | \
+              sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'
+```
+TLS task C. Copy the certificate contents from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE----- and paste this into a file (e.g. adcert.pem as per below)
+```
+sudo nano /etc/ssl/certs/adcert.pem  # then paste certificate output
+```
+
+TLS task D. Now import the AD cert file into the Java keystore
+```
+sudo keytool -importcert -alias adcert \
+	-file /etc/ssl/certs/adcert.pem \
+	-keystore /usr/lib/jvm/java-11-openjdk-amd64/lib/security/cacerts \
+	-storepass changeit \
+	-noprompt
+```
+TLS task E. Restart Apache Tomcat
+````
+TOMCAT=$(ls /etc/ | grep tomcat) && sudo systemctl restart ${TOMCAT}
+````
+
+### :computer: **Step 4: Run the (now customised) LDAP configuration script**

 ```shell
 sudo $USER_HOME_DIR/guac-setup/add-ldap-auth-guacamole.sh
 ```

-## :door: **Step 5: Logging on to Guacamole with the new guacbind-ad account**

- When logging in to Guacamole as the new Active Directory account and password created above, that domain user now passed through to Guacamole as both a Guacamole admin and a Domain User. If all is working correctly, all the users located below the directory tree position set in **ldap-user-base-dn** will be listed under **Settings | Users** of the Guacamole management console.

-## :busts_in_silhouette: **Step 6: Manually creating and configuring new Guacamole users for Active Directory authentication**
+### :door: **Step 5: Log on to Guacamole with the new guacbind-ad account**

- If not using the **mysql-auto-create-accounts** directive, manually re-create the exact user account names in Guacamole as those in the directory you wish to give Guacamole access. **DO NOT configure a Guacamole password for any users that will be exclusively authenticating via Active directory**. Guacamole local user accounts without a password are first given an MFA challenge by the local Guacamole application (only if MFA is configured for that user) and then will be brokered to Active Directory for their authentication challenge. Guacamole local user accounts that are given passwords in Guacamole will always refer to the local db for authentication, never Active Directory. This design allows for a matrix of local, domain, MFA & non-MFA access use cases to be deployed.
+- When logging in to Guacamole as the new Active Directory account and password created above, that domain user is passed through to Guacamole as both a Guacamole admin and a Domain User. If all is working correctly, all the users located below the directory tree position set in **ldap-user-base-dn** will be listed under **Settings | Users** of the Guacamole management console.

-## :key: **Step 7: Logging on using either the local vs. the domain guacbind-ad account**
+### :busts_in_silhouette: **Manually creating and configuring new Guacamole users for Active Directory authentication with MFA.**
+
+- If not using the **mysql-auto-create-accounts** directive, manually re-create the exact user account names in Guacamole as those in the directory that you wish to give specific local adminstrative permissions and/or provision Guacamole's MFA access. **DO NOT configure a Guacamole password for any users that will be exclusively authenticating via Active directory**. Guacamole database local user accounts without a password are first given an MFA challenge by the local Guacamole application (Only where the local passwordless Guacamole account is configured for MFA) and then will be brokered to Active Directory for their Kerberos authentication challenge. Guacamole database local user accounts that are given passwords in Guacamole will always refer to the local database account for authentication, never Active Directory. This design allows for a matrix of local, domain, MFA & non-MFA access use cases to be deployed.
+
+### :key: **Logging in using Gucamole local vs. domain guacbind-ad account**

 - As described above, logging on with the Guacamole admin user password will authenticate with the local Guacamole admin account, conversely if the Guacamole admin domain account password is given, the domain account is authenticated via Active Directory and then passed through as authorized to administer Guacamole. It may sometimes be necessary to log on with the local Guacamole admin account to manage some application functions, but be aware that when doing so you will not be able to view and search the user list from Active Directory. Only when logged on with the domain version of the Guacamole admin account can domain user permissions to various Guacamole sessions and objects be delegated and managed.

-## :gear: **Step 8: Creating a quasi Single Sign-On user experience for Windows RDP access**
+### :gear: **Creating a quasi Single Sign-On user experience for Windows RDP access**

 - Create a Global Security domain group (e.g., Guac_Users) and populate it with selected domain users as required. 
 - Now add this new security group to the built-in “Remote Desktop Users” domain group.
@ -75,4 +108,4 @@ sudo $USER_HOME_DIR/guac-setup/add-ldap-auth-guacamole.sh
  - Add the parameter token `${GUAC_PASSWORD}` to the Password field for each connection profile
 - If the user has been given directory rights to the Guacamole session object, Guacamole will first authenticate the user to the Guacamole application (via a brokered Active Directory challenge) and then seamlessly pass the user's same domain credentials through to the Guacamole remote desktop session, thus avoiding any further remote desktop authentication prompts.
 - For more info on other dynamic connection settings see [Guacamole Documentation](https://guacamole.apache.org/doc/gug/configuring-guacamole.html#parameter-tokens)
- For full SSO, the SAML authentication extension must be used. As the Guacamole SAML extension requires a very bespoke approach to configuring login providers and login behaviors, the SAML authentication feature is beyond the scope of this project. If your organization already uses SAML within your infrastructure then you likely already know what to do to implement.
+- Additional extensions are required for full SSO, but because centralised authentication / authorisation extensions require a bespoke approach to service providers and login behaviors, the SSO features are currently beyond the scope of this project. Here's some links for info on configuring [SAML](https://guacamole.apache.org/doc/gug/saml-auth.html#) and [OpenID Connect](https://guacamole.apache.org/doc/gug/openid-auth.html)
--- a/README.md
+++ b/README.md
@ -1,113 +1,156 @@
-# Guacamole 1.5.3 VDI/Jump Server Appliance Build Script
+<div align="center">

-<img src="https://github.githubassets.com/images/icons/emoji/sparkles.png" width="35"> This repo makes setting up a Guacamole a breeze. Its got installer support for TLS reverse proxy, Active Directory integration, multi-factor authentication, Quick Connect & History Recording Storage UI enhancements, dark mode and custom UI templates, auto database backup, O365 email alerts and even fail2ban and internal daemon security hardening options. There's also code in here to get you up and running with an enterprise high availability deployment if that's your thing!
+![GitHub release version](https://img.shields.io/github/v/release/itiligent/Easy-Guacamole-Installer?style=flat-square&color=orange&labelColor=black)
+![GitHub stars](https://img.shields.io/github/stars/itiligent/Easy-Guacamole-Installer?style=flat-square&color=yellow&labelColor=black)
+![GitHub forks](https://img.shields.io/github/forks/itiligent/Easy-Guacamole-Installer?style=flat-square&color=blue&labelColor=black)
+
+# 🥑 Easy Guacamole Installer
+
+
+
+</div>
+
+<p align="center">
+<a href="https://www.paypal.com/donate/?business=PSZ878JBJDMB8&amount=10&no_recurring=0&item_name=Thankyou+for+your+support+in+maintaining+this+project&currency_code=AUD">
+  <img src="https://github.com/itiligent/Guacamole-Install/raw/main/.github/ISSUE_TEMPLATE/paypal-donate-button.png" width="125" />
+</a>
+</p>
+
+## Introduction
+
+#### v1.6.0 is working. Issues and notes are tracked in https://github.com/itiligent/Easy-Guacamole-Installer/issues/78
+
+This install script automatically sets up a Guacamole jump-host with optional for TLS reverse proxy (self-signed or Let's Encrypt), Active Directory integration, multi-factor authentication, Quick Connect & History Recording Storage UI enhancements. Other options also include a custom UI dark themed template, auto database backups, email alerts and internal hardening options including fail2ban for defence against brute force attacks. There is also facility for enterprise deployment similar to [Amazon's Guacamole Bastion Cluster](http://netcubed-ami.s3-website-us-east-1.amazonaws.com/guaws/v2.3.1/cluster/).

 ## Automatic Installation

-<img src="https://github.githubassets.com/images/icons/emoji/rocket.png" width="35"> To start building your Guacamole appliance, paste the below link into a terminal and just follow the prompts **(no need for sudo, but the user must be a member of the sudo group)**:
+🚀 Move to you your home directory, paste the below link, then follow the prompts (**do NOT run as root, the script will prompt for sudo**): 

 ```shell
 wget https://raw.githubusercontent.com/itiligent/Guacamole-Install/main/1-setup.sh && chmod +x 1-setup.sh && ./1-setup.sh
 ```
+---

-## Prerequisites (Yes! Debian 12 is now supported!)
+## Prerequisites

-<img src="https://github.githubassets.com/images/icons/emoji/lock.png" width="35"> **Before diving in, make sure you have:**
+📋 **You will need:**
+  - **Supported OS: Debian 12 or 13** | **Ubuntu LTS 22.x or 24.x** | **Raspbian**
+  - **1 CPU core + 2GB RAM for every 25 users (plus minimum RAM & disk space for your selected OS).**
+- **Open TCP ports: 22, 80, and 443 (no other services using 80, 8080 & 443)**
+- **For both TLS reverse proxy options you will need a PRIVATE DNS record for the internal proxy site, and an additional PUBLIC DNS record for the Let's Encrypt option.**
+- **Sudo & wget packages installed**
+- **The user running `1-setup.sh` must have sudo permissions.**

- **A compatible OS:**
-    - **Debian 12, 11 or 10**
-    - **Ubuntu 23.04, 22.04, 20.04 & 18.04**
-    - **Raspbian Buster & Bullseye**
-    - **Official vendor cloud images equivalent to the above.**
- Minimum 8GB RAM and 40GB HDD.
- DNS entries matching your default appliance network interface IP (essential for TLS).
- Open TCP ports: 22, 80, and 443.
+---

-## Installation Menu
+## Setup Script Menu

-<img src="https://github.githubassets.com/images/icons/emoji/wrench.png" width="35"> **The main script guides you through the installation process in the following steps:**
+🔧 **The main `1-setup.sh` script guides the installation with the following steps:**

-1. Confirm your system hostname and local DNS domain suffix. (Must be consistent for TLS proxy)
-2. Choose a locally installed or remote MySQL instance, set database security preferences.
-3. Pick an authentication extension: DUO, TOTP, LDAP, or none.
+1. Setup the system hostname & local DNS name (Local DNS must be consistent for TLS proxy).
+2. Select either a local MySQL install or use a pre-existing local or remote MySQL instance.
+3. Pick an authentication extension: DUO, TOTP, LDAP/Active Directory, or none.
 4. Select optional console features: Quick Connect & History Recorded Storage UI integrations.
-5. Decide on the Guacamole front end: Nginx reverse proxy (http or https) or keep the native Guacamole interface
+5. Select the Guacamole front end: Nginx reverse proxy (HTTP or HTTPS) or use the native Guacamole interface on port 8080.
+   - If you opt to install Nginx with self-signed TLS:
+     - New server & client browser certificates are saved to `$HOME/guac-setup/tls-certs/[date-time]/`.
+     - Optionally follow on-screen instructions for client certificate import to avoid https browser warnings.

+---

-## Managing self signed TLS certs with Nginx (the easy way!)
+## Customising The Build

-   - **To change the reverse proxy dns name or IP:** 
-     - Just re-run ` 4a-install-tls-self-signed-nginx.sh`as many times as you like (accompanying server and browser client certs will also be updated) 
-   - **To renew certificates only, or change IP only:**
-     - Simply run `refresh-tls-self-signed-nginx.sh` as needed.
-   - **Above scripts will also:**
-     - Create and save new client browser certificates to `$HOME/guac-setup`
-     - Provide on-screen instructions for client certificate import (no more pesky browser warnings and that pro look). 
+⚙️ **To customise the many available script options:**

+- Exit `1-setup.sh` at the first prompt.
+- All configurable script options are shown under **Silent setup options** at the start of `1-setup.sh`. 
+- Certain combinations of the **Silent setup options** will allow for a fully unattended install supporting mass deployment or highly customised docker builds.
+- Re-run your edited script locally after making changes (do not re-run the automatic install web link - see below). 
+
+**Other custom install notes:**
+- **Caution:** Re-running the auto-installer link re-downloads the suite of scripts which will overwrite any custom script edits. You must run 1-setup.sh LOCALLY after editing. If any child scripts are edited, their corresponding download links in 1-setup.sh script must also be commented out.
+- Upgrade scripts are **automatically customised with your specifc installation settings** for consistent future updates.
+- Nginx reverse proxy is configured to default to at least TLS 1.2. For ancient systems, see commented sections of the `/etc/nginx/nginx.conf` file after install.
+- A daily MySQL backup job is automatically configured under the script owner's crontab.
+- The Quick Connect option brings some extra security implications, be aware of potential risks in your environment.
+
+**Post-install manual hardening options:**
+
+- `add-fail2ban.sh`: Adds a lockdown policy for Guacamole to guard against brute force password attacks.
+- `add-tls-guac-daemon.sh`: Wraps internal traffic between the guac server & guac application in TLS.
+- `add-auth-ldap.sh`: Template script for simplified Active Directory integration.
+- `add-smtp-relay-o365.sh`: Template script for email alert integration with MSO65 (BYO app password).
+
+---
+
+## Branding The Guacamole UI Theme
+
+🎨 **Follow the theme and branding instructions** [here](https://github.com/itiligent/Guacamole-Install/tree/main/guac-custom-theme-builder). To revert to the default theme, simply delete the branding.jar file from `/etc/guacamole/extensions`, clear your browser cache and restart.
+
+---
+
+## Managing Self-Signed TLS Certs With Nginx
+
+**To renew self-signed certificates or change the reverse proxy local DNS name/IP address:** 
+- Re-run `4a-install-tls-self-signed-nginx.sh` to create a new Nginx certificate (new browser client certificates will also be created for re-import). Always clear your browser cache after changing certificates.
+
+---

 ## Active Directory Integration

-<img src="https://github.githubassets.com/images/icons/emoji/key.png" width="35"> **Need help with Active Directory authentication?** Check [here](https://github.com/itiligent/Guacamole-Install/blob/main/ACTIVE-DIRECTORY-HOW-TO.md).
+🔑 See [here](https://github.com/itiligent/Guacamole-Install/blob/main/ACTIVE-DIRECTORY-HOW-TO.md).

-## Customise & Brand Your Guacamole Theme
+---

-<img src="https://github.githubassets.com/images/icons/emoji/art.png" width="35"> **Want to give Guacamole your personal touch? Follow the theme and branding instructions** [here](https://github.com/itiligent/Guacamole-Install/tree/main/custom-theme-builder).
-
-## Installation Instructions
-
-<img src="https://github.githubassets.com/images/icons/emoji/unicode/2699.png" width="35"> 
-
-### **Paste and the wget autorun link, thats it! *But if* you want to make Guacamole your own and customise...**
-**Exit `1-setup.sh` at the first prompt**. All the configurable options can be found at the start of `1-setup.sh`. Certain combinations of edits will even produce an unattended install!
-
-**Other useful install notes:**
- **Caution: Be aware that running the auto-run link again re-downloads the suite of scripts and will overwrite your changes. You must run setup locally after editing the setup script.** (Also be sure to comment out the download links in the setup script for any other scripts you want to edit, but there should be little need to touch these.)
- Many of the scripts in the suite are **automatically adjusted with your chosen installation settings** to form a matched & transportable set. This allows you to add extra features after installation whilst avoiding mismatches with the original install.
- Nginx is automatically configured to use TLS 1.2 or above (so really old browser versions may not work.)
- A daily MySQL backup job will be automatically configured under the script owner's crontab.
- **Security info:** The Quick Connect and History Recorded Storage options bring a few security implications; so be aware of potential risks in your particular environment.
-
-**For the more security minded, there's several post-install hardening script options available:**
-
- `add-fail2ban.sh`: Adds a lockdown policy for Guacamole to guard against brute force attacks.
- `add-tls-guac-daemon.sh`: Wraps internal server daemon <--> guac application traffic in TLS.
- `add-auth-ldap.sh`: A template script for Active Directory integration.
- `add-smtp-relay-o365.sh`: A template script for email alerts integrated with MSO65 (BYO app password).
+## SS0 Extensions (Radius, Base, CAS, OpenID, SAML, Dist)
+🔑 See [here](https://github.com/itiligent/Guacamole-Installer/blob/main/SSO-EXTENSIONS-HOW-TO.md)

+---

 ## Upgrading Guacamole

-<img src="https://github.githubassets.com/images/icons/emoji/globe_with_meridians.png" width="35"> To upgrade Guacamole, edit `upgrade-guac.sh` to relfect the latest versions of Guacamole and MySQL connector/J before running it. This script will also automatically update the installed extensions.
+🌐 To upgrade Guacamole, edit `upgrade-guacamole.sh` to reflect the latest versions of Guacamole & MySQL connector/J before running. This script will automatically update TOTP, DUO, LDAP, Quick Connect, and History Recorded Storage extensions if present.
+
+---
+
+## High Availability Deployment
+
+- 👔 **For a separate DATABASE layer:** Use the `install-mysql-backend-only.sh` [here](https://github.com/itiligent/Guacamole-Install/tree/main/guac-enterprise-build) to install a standalone instance of the Guacamole MySQL database.
+- 👔 **For a separate APPLICATION layer:** Run `1-setup.sh` and point new installations to your separate database instance. Just say **no** to the "Install MySQL locally" option and any other local reverse proxy install options.
+- 👔 **For a separate FRONT END layer:** Use the included Nginx installer scripts to build out a separate Nginx front end layer, and then apply your preferred TLS load balancing technique. Alternatively, AWS/Azure/GCP load balancers or [HA Proxy](https://www.haproxy.org/) may provide superior session persistence & affinity compared to [Open Source Nginx](https://www.nginx.com/products/nginx/compare-models/).
+
+---
+
+### Script Download Manifest
+
+📦 **The autorun link downloads these files into `$HOME/guac-setup`:**
+
+- `1-setup.sh`: The parent setup script.
+- `2-install-guacamole.sh`: Guacamole source build & installer script.
+- `3-install-nginx.sh`: Nginx installation script.
+- `4a-install-tls-self-signed-nginx.sh`: Install/refresh self-signed TLS certificates script.
+- `4b-install-tls-letsencrypt-nginx.sh`: Let's Encrypt for Nginx installer script.
+- `add-auth-duo.sh`: Duo MFA extension install script.
+- `add-auth-ldap.sh`: Active Directory extension installer template script.
+- `add-auth-totp.sh`: TOTP MFA extension installer script.
+- `add-xtra-quickconnect.sh`: Quick Connect console extension installer script.
+- `add-xtra-histrecstore.sh`: History Recorded Storage extension installer script.
+- `add-smtp-relay-o365.sh`: Script for O365 SMTP auth relay setup (BYO app password).
+- `add-tls-guac-daemon.sh`: Wrap internal traffic between guacd server & Guacamole web app in TLS.
+- `add-fail2ban.sh`: Fail2ban (& Guacamole protection policy) installer script.
+- `backup-guacamole.sh`: MySQL backup setup script.
+- `upgrade-guacamole.sh`: Guacamole application, extension, and MySQL connector upgrade script.
+- `branding.jar`: Base template for customizing Guacamole's UI theme.
+
+😄🥑
+
+
+

-## Enterprise Scale Out & High Availability 

-<img src="https://github.githubassets.com/images/icons/emoji/unicode/1f454.png" width="35"> For Enterprise deployments, did you know that Guacamole can be run in a load balanced farm? To achieve this, the database, application and front end components are usually **split into 2 or 3 layers.** (VLANs & firewalls between the layers helps with security too.) See [here](https://github.com/itiligent/Guacamole-Install/tree/main/guac-enterprise-build) for how to get started.
- **For the DATABASE layer:** Find the included `install-mysql-backend-only.sh` to install a standalone instance of the Guacamole MySQL database for your backend.
- **For the APPLICATION layer:** Simply use the main setup script to build as many application servers as you like, just use the installer to point these to the backend database, making sure to **say no to both the "Install MySQL locally" option and any Nginx install options**.
- **For the Front end**: There are so many choices available that are already very well documented. You could even take the (portable) Nginx scripts to build a separate TLS front end layer. Be aware that [HA Proxy](https://www.haproxy.org/) generally provides far superior session affinity and persistence under load balanced conditions [when compared to Open Source Nginx](https://www.nginx.com/products/nginx/compare-models/) as only Nginx Plus subscribers get all the proper load balancing stuff!)

-### Installer script download manifest



-<img src="https://github.githubassets.com/images/icons/emoji/package.png" width="35"> The autorun link downloads these repo files into `$HOME/guac-setup`:

- `1-setup.sh`: The installation script.
- `2-install-guacamole.sh`: Guacamole main source build installation script.
- `3-install-nginx.sh`: Installs Nginx for reverse proxy (optional).
- `4a-install-tls-self-signed-nginx.sh`: Configures self-signed TLS for Nginx (optional).
- `4b-install-tls-letsencrypt-nginx.sh`: Installs Let's Encrypt for Nginx (optional).
- `add-auth-duo.sh`: Adds Duo MFA extension (optional).
- `add-auth-ldap.sh`: Adds Active Directory extension (optional).
- `add-auth-totp.sh`: Adds TOTP MFA extension (optional).
- `add-xtra-quickconnect.sh`: Adds Quick Connect console feature (optional).
- `add-xtra-histrecstore.sh`: Adds History Recorded Storage feature (optional).
- `add-smtp-relay-o365.sh`: Sets up SMTP auth relay with O365 for backup messages, monitoring & alerts (BYO app password).
- `add-tls-guac-daemon.sh`: Adds TLS wrapper for guacd server daemon (optional).
- `add-fail2ban.sh`: Adds a fail2ban policy for brute force protection.
- `backup-guacamole.sh`: A MySQL Guacamole backup script.
- `upgrade-guac.sh`: Upgrades Guacamole and MySQL connector.
- `refresh-tls-self-signed`: Generates and installs updated TLS certificates for Nginx.
- `branding.jar`: An example template for customising Guacamole's theme. Delete to keep the default UI.

-Happy Guacamole-ing! 😄🥑
--- a/SSO-EXTENSIONS-HOW-TO.md
+++ b/SSO-EXTENSIONS-HOW-TO.md
@ -0,0 +1,74 @@
+
+
+
+### How to build all Guacamole client extensions:
+Licensing prevents some extensions being supplied in binary form, therefore these must be built from source. To achieve this, follow the exact order below on a fresh Linux system **WITHOUT JVM INSTALLED**. 
+
+#### 1. Obtain the specific JDK dependency
+Download jdk-8u411-linux-x64.tar.gz from [Oracle](https://www.oracle.com/java/technologies/javase/javase8u211-later-archive-downloads.html) (needs an Oracle sign in, select the Linux x64 compressed archive and copy it to your Linux home dir) A backup of this file is achived [here]( https://1drv.ms/u/s!Asccp3ag4RnQj-dAGYyfqwf-Rf5mTg?e=uRy1DM).
+
+### 2. Install the JDK
+```
+sudo mkdir -p /usr/lib/jvm
+sudo tar zxvf jdk-8u411-linux-x64.tar.gz -C /usr/lib/jvm
+sudo update-alternatives --install "/usr/bin/java" "java" "/usr/lib/jvm/jdk1.8.0_411/bin/java" 1
+sudo update-alternatives --set java /usr/lib/jvm/jdk1.8.0_411/bin/java
+```
+### 3. Clone Guacamole client source
+```sudo apt update && sudo apt -y install git
+git clone https://github.com/apache/guacamole-client.git
+cd guacamole-client
+git checkout 1.5.5 # or whatever version
+```
+### 4. Install Maven and build all the client binaries (with Radius support)
+```
+sudo apt -y install maven
+mvn clean package -Plgpl-extensions
+```
+Build output should show:
+```
+[INFO] Reactor Summary for guacamole-client 1.5.5:
+[INFO] guacamole-client ................................... SUCCESS [ 18.363 s]
+[INFO] guacamole-common ................................... SUCCESS [ 10.902 s]
+[INFO] guacamole-ext ...................................... SUCCESS [  6.032 s]
+[INFO] guacamole-common-js ................................ SUCCESS [ 14.552 s]
+[INFO] guacamole .......................................... SUCCESS [01:04 min]
+[INFO] extensions ......................................... SUCCESS [  0.132 s]
+[INFO] guacamole-auth-duo ................................. SUCCESS [  5.207 s]
+[INFO] guacamole-auth-header .............................. SUCCESS [  0.793 s]
+[INFO] guacamole-auth-jdbc ................................ SUCCESS [  0.143 s]
+[INFO] guacamole-auth-jdbc-base ........................... SUCCESS [  3.314 s]
+[INFO] guacamole-auth-jdbc-mysql .......................... SUCCESS [  1.208 s]
+[INFO] guacamole-auth-jdbc-postgresql ..................... SUCCESS [  1.008 s]
+[INFO] guacamole-auth-jdbc-sqlserver ...................... SUCCESS [  1.004 s]
+[INFO] guacamole-auth-jdbc-dist ........................... SUCCESS [  1.072 s]
+[INFO] guacamole-auth-json ................................ SUCCESS [  2.648 s]
+[INFO] guacamole-auth-ldap ................................ SUCCESS [  8.882 s]
+[INFO] guacamole-auth-quickconnect ........................ SUCCESS [  1.704 s]
+[INFO] guacamole-auth-sso ................................. SUCCESS [  0.132 s]
+[INFO] guacamole-auth-sso-base ............................ SUCCESS [  0.667 s]
+[INFO] guacamole-auth-sso-cas ............................. SUCCESS [  5.205 s]
+[INFO] guacamole-auth-sso-openid .......................... SUCCESS [  1.237 s]
+[INFO] guacamole-auth-sso-saml ............................ SUCCESS [  3.801 s]
+[INFO] guacamole-auth-sso-dist ............................ SUCCESS [  1.312 s]
+[INFO] guacamole-auth-totp ................................ SUCCESS [  2.780 s]
+[INFO] guacamole-history-recording-storage ................ SUCCESS [  0.646 s]
+[INFO] guacamole-vault .................................... SUCCESS [  0.117 s]
+[INFO] guacamole-vault-base ............................... SUCCESS [  1.005 s]
+[INFO] guacamole-vault-ksm ................................ SUCCESS [  5.242 s]
+[INFO] guacamole-vault-dist ............................... SUCCESS [  1.050 s]
+[INFO] guacamole-auth-radius .............................. SUCCESS [ 11.777 s] 
+[INFO] guacamole-example .................................. SUCCESS [  2.080 s]
+[INFO] guacamole-playback-example ......................... SUCCESS [  0.883 s]
+[INFO] ------------------------------------------------------------------------
+[INFO] BUILD SUCCESS
+[INFO] ------------------------------------------------------------------------
+[INFO] Total time:  02:59 min
+[INFO] Finished at: 2024-10-29T11:38:19+11:00
+[INFO] ------------------------------------------------------------------------
+```
+
+### 5 Move your new extension to the Guacamole server  
+1. As sudo, copy the new `extension.jar` file (found in `guacamole-client/extensions/guacamole-auth-radius/target/`) to `/etc/guacamole/extensions` on your Guacamole server.
+2. Adjust permissions on the new `extension.jar` file with `sudo chmod 664 /etc/guacamole/extensions/extension.jar`
+3. Restart and continue configuring the new extension as per the Guacmole official documentation [here](https://guacamole.apache.org/doc/gug/).
--- a/guac-custom-theme-builder/README.MD
+++ b/guac-custom-theme-builder/README.MD
@ -15,8 +15,17 @@ sudo systemctl restart guacd && sudo systemctl restart ${TOMCAT}

 ## Theme customisation hints: ##
  - Do not change any of the theme's directory structure or file names. File contents can be carefully edited according to the following constraints:
-      - `MANIFEST.MF`: All values in here can be updated. Be aware that the "Name:" value MUST use same value in front of the the .jar creation command shown above in the 1st line e.g. `Name: branding` expects branding.jar
-      - `guac-manifest.json`: The "name:" value in here can be changed to anything. The "namespace:" value MUST match the namespace image path line found in `custom-theme.css`, eg.`background-image: url('app/ext/custom-namespace/images/logo.png');`
+      - `META-INF/MANIFEST.MF`: All values in here can be updated, **BUT** be aware that `Name: branding` is linked to the commands above e.g. `Name: branding` expects `branding.jar` as the .jar filename
+      - `guac-manifest.json`: The "name:" value in here can be changed to anything **BUT** the `"namespace" : "custom-namespace"` value MUST match the namespace image path line found in `custom-theme.css`, eg:
+```
+.login-ui .login-dialog .logo {
+    background-image: url('app/ext/custom-namespace/images/logo.png');
+    width: 7em;
+    height:	7em;
+    -webkit-background-size: 7em auto;
+
+}
+```
  - It is preferable to give css a range of logo sizes as shown in the template. The "smallIcon" value in `guac-manifest.json` is used for browser tab favicons. As such this file can be kept to < 80x80 pixels. The example used is 64x64 pixels.
  - Within `custom-theme.css`, you may need to experiment with the the height and width values under `.login-ui .login-dialog .logo` to scale your particular logo neatly within the dialog box. Another option is to make the login dialog box larger. Under `.login-ui .login-dialog`, experiment with adding a `max-width: 4in;` or similar. There's a ton of css options available and this template is just starting point, Google is your friend!
  - An easy way to debug and preview potential style changes is to tweak various values by setting your browser to developer mode. 
--- a/guac-enterprise-build/install-mysql-backend-only.sh
+++ b/guac-enterprise-build/install-mysql-backend-only.sh
@ -1,6 +1,6 @@
 #!/bin/bash
 #######################################################################################################################
-# Guacamole MySQL backend install script. (For split DB and guacamole application layers.)
+# Guacamole MySQL backend install script. (For split DB and guacamole application layers.
 # For Ubuntu / Debian / Raspbian
 # David Harrop
 # September 2023
@ -9,7 +9,7 @@
 # This script is for separating the Guacamole architecture into a scaled out three tiered system.
 # Layer 1 = DATABASE - This script
 # Layer 2 = GUAC SERVER & APPLICATION - use the main setup script, and select remote MYSQL DB option.
-# Layer 3 = FRONT END REV PROXY (Potentially load balanced & HA) - approach TBA
+# Layer 3 = FRONT END REV PROXY (Potentially load balanced & HA) - Up to you!

 #######################################################################################################################
 # Script pre-flight checks and settings ###############################################################################
@ -54,13 +54,13 @@ mkdir -p $DOWNLOAD_DIR
 chown -R $SUDO_USER:root $DOWNLOAD_DIR

 # Version of Guacamole auth jdbc database schema to use
-GUAC_VERSION="1.5.3"
+GUAC_VERSION="1.5.5"

 # Set preferred Apache CDN download link)
 GUAC_SOURCE_LINK="http://apache.org/dyn/closer.cgi?action=download&filename=guacamole/${GUAC_VERSION}"

 # Install log Location
-INSTALL_LOG="${DOWNLOAD_DIR}/guacamole_${GUAC_VERSION}_mysql_install.log"
+INSTALL_LOG="${DOWNLOAD_DIR}/mysql_install.log"

 clear

@ -75,9 +75,9 @@ echo
 # Setup options. ######################################################################################################
 #######################################################################################################################

-BACKEND_MYSQL="true"       # True: Allow $GUAC_USER remote login. False or "": Limits $GUAC_USER to localhost only login.
-FRONTEND_NET=""            # "" = allow login from any IP or wildcards e.g. 192.168.1.% (Needs BACKEND_SQL="true", else ignored)
-MYSQL_BIND_ADDR="0.0.0.0"  # Bind MySQL to this IP. (127.0.0.1, a specific IP or 0.0.0.0 for all interfaces)
+BACKEND_MYSQL="true"       # True: For separated MySQL layer. False/blank: Add MySQL to existing guac server (replace XML user map)
+FRONTEND_NET=""            # IPs guac server can login from. Blank = any IP or wildcard 192.168.1.% (ignored if BACKEND_SQL="false")
+MYSQL_BIND_ADDR="0.0.0.0"  # Binds MySQL instance to this IP. (127.0.0.1, a specific IP or 0.0.0.0) (ignored if BACKEND_SQL="false")
 SECURE_MYSQL="true"        # Apply the mysql secure configuration tool (true/false)
 MYSQL_PORT="3306"          # Default is 3306
 GUAC_DB="guacamole_db"     # Default is guacamole_db
@ -85,6 +85,7 @@ GUAC_USER="guacamole_user" # Default is guacamole_user
 GUAC_PWD="test"            # Requires an entry
 MYSQL_ROOT_PWD="test"      # Requires an entry.
 DB_TZ=$(cat /etc/timezone) # Typically system default (cat /etc/timezone) or change to "UTC" if required.
+MYSQL_VERSION=""           # Blank "" will use distro default MySQL packages. Enter a specific MySQL version for official Maria repo eg. 11.1.2. See https://mariadb.org/mariadb/all-releases/ for available versions.

 # For a remotely accessed back end DB instance, keep this script set to BACKEND_MYSQL="true".
 # Other options are fairly straight forward. For a typical back end server only the $FRONTEND_NET and $MYSQL_BIND_ADDR
@ -98,8 +99,7 @@ DB_TZ=$(cat /etc/timezone) # Typically system default (cat /etc/timezone) or cha
 # Start install actions  ##############################################################################################
 #######################################################################################################################

-# Choose a specific MySQL version e.g. 11.1.2 See https://mariadb.org/mariadb/all-releases/ for available versions.
-MYSQL_VERSION="" # Blank "" forces distro default MySQL packages.
+# Standardise on a lexicon for the different MySQL package options
 if [[ -z "${MYSQL_VERSION}" ]]; then
    # Use Linux distro default version.
    MYSQLPKG="default-mysql-server default-mysql-client mysql-common"
@ -155,7 +155,7 @@ else
    echo
 fi

-# Set the root password without a reliance on debconf.
+# Set the MySQL root password without a reliance on debconf (may not be present in all distros).
 echo -e "${GREY}Setting MySQL root password..."
 SQLCODE="
 FLUSH PRIVILEGES;
@ -169,7 +169,8 @@ else
    echo
 fi

-# Find the location of the MySQL or MariaDB config files. (Add to this list for more potential candidates.)
+# A simple method to find the correct file containing the default MySQL timezone setting from a potential list of candidates.
+# and then update that timzone value. Add to this array if your distro uses a different path to the .cnf contaiing the default_time_zone value.
 for x in /etc/mysql/mariadb.conf.d/50-server.cnf \
    /etc/mysql/mysql.conf.d/mysqld.cnf \
    /etc/mysql/my.cnf; do
@ -211,9 +212,22 @@ else
    echo
 fi

-# Set the MySQL binding IP address to whatever the setup variable is set to.
-echo -e "${GREY}Setting MySQL IP address binding to ${MYSQL_BIND_ADDR}..."
-sed -i "s/^bind-address[[:space:]]*=[[:space:]]*.*/bind-address = ${MYSQL_BIND_ADDR}/g" ${mysqlconfig}
+# Establish the appropriate form of Guacamole user account access (remote or localhost login permissions)
+echo -e "${GREY}Setting up database access parameters for the Guacamole user ..."
+if [[ "${BACKEND_MYSQL}" = true ]] && [[ -z "${FRONTEND_NET}" ]]; then
+    echo -e "${LYELLOW}${GUAC_USER} is set to accept db logins from any host, you may wish to limit this to specific IPs.${GREY}"
+    GUAC_USERHost="%" # Allow guacamole access from all IPs where $FRONTEND_NET is left blank
+elif [[ "${BACKEND_MYSQL}" = true ]] && [[ -n "${FRONTEND_NET}" ]]; then
+    echo -e "${LYELLOW}${GUAC_USER} is set to accept db logins from ${FRONTEND_NET}.${GREY}"
+    GUAC_USERHost="${FRONTEND_NET}" # Allow guacamole access from the given value in $FRONTEND_NET
+elif [[ "${BACKEND_MYSQL}" = false ]] || [[ -z "${BACKEND_MYSQL}" ]]; then
+    echo -e "${LYELLOW}${GUAC_USER} is set to accept db logins from localhost only.${GREY}"
+    GUAC_USERHost=localhost # Assume a localhost only install
+    MYSQL_BIND_ADDR="127.0.0.1"
+else
+    echo -e "${LYELLOW}${GUAC_USER} is set to accept db logins from localhost only.${GREY}"
+    GUAC_USERHost=localhost # Assume a localhost only install
+fi
 if [[ $? -ne 0 ]]; then
    echo -e "${LRED}Failed${GREY}" 1>&2
    exit 1
@ -222,22 +236,9 @@ else
    echo
 fi

-# Establish the appropriate form of Guacamole user account access (remote or localhost login permissions)
-echo -e "${GREY}Setting up database access parameters for the Guacamole user ..."
-if [[ "${BACKEND_MYSQL}" = true ]] && [[ -z "${FRONTEND_NET}" ]]; then
-    echo -e "${LYELLOW}${GUAC_USER} is set to accept db logins from any host, you may wish to limit this to specific IPs.${GREY}"
-    # e.g. RENAME USER '${GUAC_USER}'@'%' TO '${GUAC_USER}'@'xx.xx.xx.%';"
-    GUAC_USERHost="%" # Allow all IPs
-elif [[ "${BACKEND_MYSQL}" = true ]] && [[ -n "${FRONTEND_NET}" ]]; then
-    echo -e "${LYELLOW}${GUAC_USER} is set to accept db logins from ${FRONTEND_NET}.${GREY}"
-    GUAC_USERHost="${FRONTEND_NET}" # Apply the given range
-elif [[ "${BACKEND_MYSQL}" = false ]] || [[ -z "${BACKEND_MYSQL}" ]]; then
-    echo -e "${LYELLOW}${GUAC_USER} is set to accept db logins from localhost only.${GREY}"
-    GUAC_USERHost=localhost # Assume a localhost only install
-else
-    echo -e "${LYELLOW}${GUAC_USER} is set to accept db logins from localhost only.${GREY}"
-    GUAC_USERHost=localhost # Assume a localhost only install
-fi
+# Set the MySQL binding IP address according to setup variables given.
+echo -e "${GREY}Setting MySQL IP address binding to ${MYSQL_BIND_ADDR}..."
+sed -i "s/^bind-address[[:space:]]*=[[:space:]]*.*/bind-address = ${MYSQL_BIND_ADDR}/g" ${mysqlconfig}
 if [[ $? -ne 0 ]]; then
    echo -e "${LRED}Failed${GREY}" 1>&2
    exit 1
--- a/guac-enterprise-build/upgrade-mysql-backend-only.sh
+++ b/guac-enterprise-build/upgrade-mysql-backend-only.sh
@ -1,13 +1,17 @@
 #!/bin/bash
 ######################################################################################################################
-# Guacamole appliance upgrade script
+# Guacamole appliance mysql upgrade script
 # For Ubuntu / Debian / Raspbian
 # David Harrop
 # April 2023
 #######################################################################################################################

-# The Guacamole schema have not been updated since late 2021, suggesting that its now quite mature and there will be
-# little need to use this, but just in case. Update the database packages separately via apt.
+### IMPORTANT ###
+# Update you MySQL database packages separately first via your package manager first 
+# You only need to run this script if the Guacamole schema have changed between versions (this has not been updated since late 2021 with 1.0, suggesting 
+# that Guacamole is now quite mature and changes may be rare in future. 
+# To acertain if there are schema changes required for an upgraded version, check inside the guacamole-auth-jdbc-GUAC_VERSION.tar.gz 
+# file under /mysql/schema/upgrade/ to find any relevant updates. Only run this script if there are. 

 #######################################################################################################################
 # Script pre-flight checks and settings ###############################################################################
@ -52,16 +56,16 @@ mkdir -p $DOWNLOAD_DIR
 chown -R $SUDO_USER:root $DOWNLOAD_DIR

 # Version of Guacamole to upgrade to. See https://guacamole.apache.org/releases/ for latest version info.
-NEW_GUAC_VERSION="1.5.3"
+NEW_GUAC_VERSION="1.5.5"

 # The currently installed Guacamole schema version is needed to evaluate the required schema upgrades.
-OLD_GUAC_VERSION="1.5.0"
+OLD_GUAC_VERSION="1.5.4"

 # Set preferred Apache CDN download link)
 GUAC_SOURCE_LINK="http://apache.org/dyn/closer.cgi?action=download&filename=guacamole/${NEW_GUAC_VERSION}"

 # Install log Location
-INSTALL_LOG="${DOWNLOAD_DIR}/guacamole_${NEW_GUAC_VERSION}_mysql_install.log"
+INSTALL_LOG="${DOWNLOAD_DIR}/mysql_upgrade.log"

 # Database details
 GUAC_DB="guacamole_db"
@ -80,6 +84,7 @@ echo
 # Start install actions  ##############################################################################################
 #######################################################################################################################

+
 # Download and extract the Guacamole SQL authentication extension containing the database schema
 wget -q --show-progress -O guacamole-auth-jdbc-${NEW_GUAC_VERSION}.tar.gz ${GUAC_SOURCE_LINK}/binary/guacamole-auth-jdbc-${NEW_GUAC_VERSION}.tar.gz
 if [[ $? -ne 0 ]]; then
--- a/guac-management/backup-guacamole.sh
+++ b/guac-management/backup-guacamole.sh
@ -30,7 +30,7 @@ BACKUP_EMAIL=
 BACKUP_RETENTION=

 # Protect disk space and remove backups older than {BACKUP_RETENTION} days
-find ${DB_BACKUP_DIR} -mtime +${BACKUP_RETENTION} -delete
+find ${DB_BACKUP_DIR} -type f -name "*.gz" -mtime +${BACKUP_RETENTION} -delete

 # Backup code
 mkdir -p ${DB_BACKUP_DIR}
@ -43,8 +43,8 @@ mysqldump -h ${MYSQL_HOST} \
    -u ${GUAC_USER} \
    -p"${GUAC_PWD}" \
    ${GUAC_DB} \
-    --single-transaction --quick --lock-tables=false >${DB_BACKUP_DIR}${GUAC_DB}-${TODAY}.sql
-SQLFILE=${DB_BACKUP_DIR}${GUAC_DB}-${TODAY}.sql
+    --single-transaction --quick --lock-tables=false >${DB_BACKUP_DIR}/${GUAC_DB}-${TODAY}.sql
+SQLFILE=${DB_BACKUP_DIR}/${GUAC_DB}-${TODAY}.sql
 if [[ $? -ne 0 ]]; then
    echo -e "${LRED}Backup failed.${GREY}" 1>&2
    exit 1
@ -59,7 +59,6 @@ if [[ $? -ne 0 ]]; then
    exit 1
 else
    echo -e "${LGREEN}${GUAC_DB} backup was successfully copied to ${DB_BACKUP_DIR}"
-    #mailx -s "Guacamomle Database Backup Success" ${BACKUP_EMAIL}
    echo "${GUAC_DB} backup was successfully copied to $DB_BACKUP_DIR" | mailx -s "Guacamole backup " ${BACKUP_EMAIL}
 fi

--- a/guac-management/refresh-tls-self-signed.sh
+++ b/guac-management/refresh-tls-self-signed.sh
@ -37,7 +37,7 @@ echo

 # Create a place to save the certs so we don't overwrite any earlier versions
 USER_HOME_DIR=$(eval echo ~${SUDO_USER})
-CERT_DIR_NAME=tls-certs-$(date +%y.%m.%d-%H_%M)
+CERT_DIR_NAME=tls-certs-$(date +%y.%m.%d)
 CERT_DIR=$USER_HOME_DIR/guac-setup/$CERT_DIR_NAME
 mkdir -p $CERT_DIR
 cd $CERT_DIR
@ -60,9 +60,10 @@ CERT_OU=
 PROXY_SITE=
 CERT_DAYS=
 DEFAULT_IP=
+RSA_KEYLENGTH=

-# Assume the values set the guacamole installer if the script is run without any command line options
-if [[ -z "$1" ]] | [[ -z "$2" ]] | [[ -z "$3" ]]; then
+# Assume the values set by the main installer if the script is run without any command line options
+if [[ -z "$1" ]] || [[ -z "$2" ]] || [[ -z "$3" ]]; then
    TLSNAME=$PROXY_SITE
    TLSDAYS=$CERT_DAYS
    TLSIP=$DEFAULT_IP
@ -92,7 +93,7 @@ ST                  = $CERT_STATE
 L                   = $CERT_LOCATION
 O                   = $CERT_ORG
 OU                  = $CERT_OU
-CN                  = $TLSNAME
+CN                  = *.$(echo $TLSNAME | cut -d. -f2-)

 [v3_req]
 keyUsage            = nonRepudiation, digitalSignature, keyEncipherment
@ -101,13 +102,14 @@ subjectAltName      = @alt_names

 [alt_names]
 DNS.1               = $TLSNAME
+DNS.2               = *.$(echo $TLSNAME | cut -d. -f2-)
 IP.1                = $TLSIP
 EOF

 echo
 # Create the new certificates
-echo "{$GREY}Creating a new TLS Certificate..."
-openssl req -x509 -nodes -newkey rsa:2048 -keyout $TLSNAME.key -out $TLSNAME.crt -days $TLSDAYS -config cert_attributes.txt
+echo -e "${GREY}Creating a new TLS Certificate..."
+openssl req -x509 -nodes -newkey rsa:$RSA_KEYLENGTH -keyout $TLSNAME.key -out $TLSNAME.crt -days $TLSDAYS -config cert_attributes.txt
 if [[ $? -ne 0 ]]; then
    echo -e "${LRED}Failed.${GREY}" 1>&2
    exit 1
@ -132,7 +134,7 @@ else
 fi

 # Change of permissions so certs can be copied via WinSCP.
-chown -R $SUDO_USER:root $WORKING_DIR
+chown -R $SUDO_USER:root $CERT_DIR

 # Reload everything
 echo -e "${GREY}New certificate created, restating Guacamole & Ngnix..."
@ -155,7 +157,7 @@ SHOWASTEXT2='"Cert:\LocalMachine\Root"'
 printf "${GREY}+-------------------------------------------------------------------------------------------------------------
 ${LGREEN}+ WINDOWS CLIENT SELF SIGNED TLS BROWSER CONFIG - SAVE THIS BEFORE CONTINUING!${GREY}
 +
-+ 1. In ${WORKING_DIR} is a Windows version of the new certificate ${LYELLOW}$TLSNAME.pfx${GREY}
+ 1. In ${CERT_DIR} is a Windows version of the new certificate ${LYELLOW}$TLSNAME.pfx${GREY}
 + 2. Import this PFX file into your Windows client with the below Powershell commands (as Administrator):
 \n"
 echo -e "${SHOWASTEXT1} = ConvertTo-SecureString -String "1234" -Force -AsPlainText"
@ -163,7 +165,7 @@ echo -e "Import-pfxCertificate -FilePath $TLSNAME.pfx -Password "${SHOWASTEXT1}"
 printf "${GREY}+-------------------------------------------------------------------------------------------------------------
 ${LGREEN}+ LINUX CLIENT SELF SIGNED TLS BROWSER CONFIG - SAVE THIS BEFORE CONTINUING!${GREY}
 +
-+ 1. In ${WORKING_DIR} is a new Linux native OpenSSL certificate ${LYELLOW}$TLSNAME.crt${GREY}
+ 1. In ${CERT_DIR} is a new Linux native OpenSSL certificate ${LYELLOW}$TLSNAME.crt${GREY}
 + 2. Import the CRT file into your Linux client certificate store with the below command:
 \n"
 echo -e "(If certutil is not installed, run apt-get install libnss3-tools)"
--- a/guac-management/useful-config-info.txt
+++ b/guac-management/useful-config-info.txt
@ -90,3 +90,36 @@ Nginx load / DoS testing
 https://ourcodeworld.com/articles/read/949/how-to-perform-a-dos-attack-slow-http-with-slowhttptest-test-your-server-slowloris-protection-in-kali-linux
 slowhttptest -c 10000 -H -g -o ./output_file -i 3 -r 500 -t GET -u http://jumpbox.domain.com -x 24 -p 2

+
+#####################################################
+Allow local browser microphone redirect without TLS
+#####################################################
+chrome://flags/#unsafely-treat-insecure-origin-as-secure
+
+
+#####################################################
+Build Custom Console
+####################################################
+# clone and edit source
+sudo apt update && sudo apt install git
+git clone https://github.com/apache/guacamole-client.git
+Wdit the en.json file to the values you need
+
+# Install Older Java 8 prerequisites
+https://www.oracle.com/java/technologies/javase/javase8u211-later-archive-downloads.html (needs oracle sign in)
+sudo mkdir -p /usr/lib/jvm
+sudo tar zxvf jdk-8u411-linux-x64.tar.gz -C /usr/lib/jvm
+sudo update-alternatives --install "/usr/bin/java" "java" "/usr/lib/jvm/jdk1.8.0_411/bin/java" 1
+sudo update-alternatives --set java /usr/lib/jvm/jdk1.8.0_411/bin/java
+
+# Install maven to build the new war file
+sudo apt install maven
+cd ~/guacamole-client
+mvn package
+new .war file is found in guacamole-client/guacamole/target
+
+# Install the bew .war file into Guacamole
+sudo mv -f guacamole-1.5.5.war /etc/guacamole/guacamole.war # copy and rename the new war file
+sudo chmod 664 /etc/guacamole/guacamole.war
+sudo ln -sf /etc/guacamole/guacamole.war /var/lib/tomcat9/webapps/
+sudo systemctl restart tomcat9 && sudo systemctl restart guacd
--- a/guac-optional-features/add-fail2ban.sh
+++ b/guac-optional-features/add-fail2ban.sh
@ -3,7 +3,7 @@
 # Add fail2ban restrictions to Guacamole
 # For Ubuntu / Debian / Raspbian
 # David Harrop
-# April 2023
+# December 2024
 #######################################################################################################################

 # Prepare text output colours
@ -21,6 +21,7 @@ clear
 if ! [[ $(id -u) = 0 ]]; then
    echo
    echo -e "${LGREEN}Please run this script as sudo or root${NC}" 1>&2
+	echo
    exit 1
 fi

@ -30,12 +31,16 @@ FAIL2BAN_GUAC=""
 FAIL2BAN_NGINX=""
 FAIL2BAN_SSH=""
 TOMCAT_VERSION=$(ls /etc/ | grep tomcat)
+TOMCAT_SERVICE_FILE="/usr/lib/systemd/system/$TOMCAT_VERSION.service"
+# Tomcat service file logging lines that must exist
+OUTPUT_LINE="StandardOutput=append:/var/log/$TOMCAT_VERSION/catalina.out"
+ERROR_LINE="StandardError=append:/var/log/$TOMCAT_VERSION/catalina.out"

 #Clean up from any previous runs
-rm -f /tmp/fail2ban.conf
+rm -f /tmp/fail2ban.temp1
+rm -f /tmp/fail2ban.temp2
 rm -f /tmp/ip_list.txt
 rm -f /tmp/netaddr.txt
-rm -f /tmp/fail2ban.update

 #######################################################################################################################
 # Start setup prompts #################################################################################################
@ -92,18 +97,23 @@ fi

 # Install base fail2ban base application, and whitelist the local subnet as the starting baseline (no policy defined yet)
 if [[ "${FAIL2BAN_BASE}" = true ]]; then
-
+echo
    #Update and install fail2ban (and john for management of config file updates, and not overwrite any existing settings)
-    apt-get update -qq >/dev/null 2>&1
-    apt-get install fail2ban john -qq -y >/dev/null 2>&1
+    apt-get update -qq 
+    apt-get install fail2ban john -qq -y

-    # Create the basic jail.local template and local subnet whitelist
-    cat >/tmp/fail2ban.conf <<EOF
+    # Create the basic jail.local template local subnet whitelist
+	echo
+    cat >/tmp/fail2ban.temp1 <<EOF
 [DEFAULT]
 destemail = yourname@example.com
 sender = yourname@example.com
 action = %(action_mwl)s
 ignoreip =
+
+[sshd]
+backend = systemd
+enabled = true
 EOF

    # We need to discover all interfaces to ascertain what network ranges to add to fail2ban "ignoreip" policy override defaults
@ -177,26 +187,23 @@ if [[ "${FAIL2BAN_BASE}" = true ]]; then
    # Finally assemble the entire syntax of the ignoreip whitelist for insertion into the base fail2ban config
    SED_IGNORE=$(echo "ignoreip = ")
    SED_NETADDR=$(cat /tmp/netaddr.txt)
-    sed -i "s|ignoreip \=|${SED_IGNORE}${SED_NETADDR}|g" /tmp/fail2ban.conf
+	sed -i "s|ignoreip \=|${SED_IGNORE}${SED_NETADDR}|g" /tmp/fail2ban.temp1

    # Move the new base fail2ban config to the jail.local file
    touch /etc/fail2ban/jail.local

    # Apply the base config, keeping any pre-existing settings
-    sudo bash -c 'cat /tmp/fail2ban.conf /etc/fail2ban/jail.local | unique /tmp/fail2ban.update ; cat /tmp/fail2ban.update > /etc/fail2ban/jail.local'
-
-    # Clean up
-    rm -f /tmp/fail2ban.conf
-    rm -f /tmp/ip_list.txt
-    rm -f /tmp/netaddr.txt
-    rm -f /tmp/fail2ban.update
+	sudo bash -c 'cat /tmp/fail2ban.temp1 > /etc/fail2ban/jail.local'

    # bounce the service to reload the new config
    systemctl restart fail2ban
 	
-    # Done
+	# Display the new config
+	echo "New base /etc/fail2ban/jail.local config:"
+	cat /etc/fail2ban/jail.local
+
    echo
-    echo -e "${LGREEN}Fail2ban installed...${GREY}"
+    echo -e "${LGREEN}Fail2ban base installed...${GREY}"
    echo

 else
@ -208,21 +215,22 @@ fi
 # Fail2ban optional policy setup items ################################################################################
 #######################################################################################################################

-if [[ "${FAIL2BAN_GUAC}" = true ]]; then

+if [[ "${FAIL2BAN_GUAC}" = true ]]; then
    # Create the Guacamole jail.local policy template
-    cat >/tmp/fail2ban.conf <<EOF
+    cat >/tmp/fail2ban.temp2 <<EOF
+
 [guacamole]
 enabled = true
 port = http,https
 logpath = /var/log/$TOMCAT_VERSION/catalina.out
-bantime = 15m
+bantime = 10m
 findtime = 60m
 maxretry = 5
 EOF

-    # Apply the new Guacamole jail config keeping any pre-existing settings
-    sudo bash -c 'cat /tmp/fail2ban.conf /etc/fail2ban/jail.local | unique /tmp/fail2ban.update ; cat /tmp/fail2ban.update > /etc/fail2ban/jail.local'
+    # Apply the new Guacamole jail config
+	sudo bash -c 'cat /tmp/fail2ban.temp2 >> /etc/fail2ban/jail.local'

    # Backup the default Fail2ban Guacamole filter
    cp /etc/fail2ban/filter.d/guacamole.conf /etc/fail2ban/filter.d/guacamole.conf.bak
@ -234,20 +242,41 @@ EOF
    REGEX='failregex = ^.*WARN  o\.a\.g\.r\.auth\.AuthenticationService - Authentication attempt from <HOST> for user "[^"]*" failed\.$'
    #Insert the new regex
    sed -i -e "/Authentication attempt from/a ${REGEX}" /etc/fail2ban/filter.d/guacamole.conf
-
-    # Done
-    echo -e "${LGREEN}Guacamole security policy applied${GREY}\n- ${SED_NETADDR}are whitelisted from all IP bans.\n- To alter this whitelist, edit /etc/fail2ban/jail.local & sudo systemctl restart fail2ban \n \n This script may take a while to complete on first run..."
-
-    # Bounce the service to reload the new config
-    systemctl restart fail2ban
-    echo
 fi

-# Clean up
-rm -f /tmp/fail2ban.conf
-rm -f /tmp/ip_list.txt
-rm -f /tmp/netaddr.txt
-rm -f /tmp/fail2ban.update
+    # Clean up
+    rm -f /tmp/fail2ban.temp1
+	rm -f /tmp/fail2ban.temp2
+    rm -f /tmp/ip_list.txt
+    rm -f /tmp/netaddr.txt
+	apt-get -y remove john > /dev/null 2>&1
+	apt-get -y autoremove > /dev/null 2>&1
+
+# Display the updated config
+echo "Updated jail.local with Guacamole filter policy:"
+cat /etc/fail2ban/jail.local
+
+# make sure Tomcat catalina logs are configured
+if [[ ! -f "$TOMCAT_SERVICE_FILE" ]]; then
+    echo "Error: $TOMCAT_SERVICE_FILE not found, exiting..."
+    exit 1
+else
+    if grep -q "^$OUTPUT_LINE" "$TOMCAT_SERVICE_FILE" && grep -q "^$ERROR_LINE" "$TOMCAT_SERVICE_FILE"; then
+        echo "Required lines already exist in $TOMCAT_SERVICE_FILE. No changes made."
+    else
+        # Add lines if they don't already exist
+		sed -i "/^\[Service\]/a $OUTPUT_LINE\n$ERROR_LINE" "$TOMCAT_SERVICE_FILE"
+		systemctl daemon-reload
+		systemctl restart fail2ban
+		systemctl restart guacd
+		systemctl restart ${TOMCAT_VERSION}
+        echo "Lines were added successfully to $TOMCAT_SERVICE_FILE."
+    fi
+fi
+
+   # Done
+    echo
+	echo -e "${LGREEN}Guacamole security policy applied, but NOT YET ENABLED FOR LOCAL NETWORK(S) ${GREY}\n- Local network(s) ${SED_NETADDR}are currently whitelisted from all IP bans.\n- To alter this whitelist, edit /etc/fail2ban/jail.local then sudo systemctl restart fail2ban"

 ############## Start Fail2ban NGINX security policy option ###############
 #if [[ "${FAIL2BAN_NGINX}" = true ]]; then
--- a/guac-optional-features/add-smtp-relay-o365.sh
+++ b/guac-optional-features/add-smtp-relay-o365.sh
@ -6,12 +6,10 @@
 # April 2023
 #######################################################################################################################

-# If run as standalone and not from the main installer script, check the below variables are correct.
-
 # Prerequisites:
 # An office 365 account with a mailbox (NON ADMIN!!)
 # An app password created for the above office 365 user at https://mysignins.microsoft.com/security-info
-# SMTP Auth enabled for that user under "manage mail apps in the Office365 admin centre
+# SMTP Auth enabled for that user under "manage mail apps" in the Office365 admin centre.

 # Prepare text output colours
 GREY='\033[0;37m'
@ -42,7 +40,7 @@ echo -e "${LYELLOW}SMTP relay for Office365 setup...${LGREEN}"
 # Install Posfix
 echo
 echo -e "${GREY}Installing Postfix with non-interactive defaults..."
-apt-get update -qq >/dev/null 2>&1
+apt-get update -qq
 DEBIAN_FRONTEND="noninteractive" apt-get install postfix mailutils -qq -y >/dev/null 2>&1
 if [[ $? -ne 0 ]]; then
    echo -e "${LRED}Postfix install failed. ${GREY}" 1>&2
--- a/guac-optional-features/add-tls-guac-daemon.sh
+++ b/guac-optional-features/add-tls-guac-daemon.sh
@ -65,11 +65,13 @@ DNS.1               = localhost
 IP.1                = 127.0.0.1
 EOF

-# Create the self signing request, certificate & key
+# Create the self signing request, certificate & key. 
+# If splitting guacd (backend) and guacamole (front end) across separate systems, run this command on guacd and then copy certs to the same location on guacamole server.
+# Also consider omitting the setting -config cert_attributes.txt or IP.1 = 0.0.0.0 for future ip address changes if splitting.
 openssl req -x509 -nodes -days $CERT_DAYS -newkey rsa:$RSA_KEY_LENGTH -keyout /etc/guacamole/ssl/guacd.key -out /etc/guacamole/ssl/guacd.crt -config cert_attributes.txt
 rm -f cert_attributes.txt

-# Point Guacamole config file to certificate and key
+# Point Guacamole config file to certificate and key. (If splitting, run this on guacd after changing bind_ host to 0.0.0.0 ).
 cp /etc/guacamole/guacd.conf /etc/guacamole/guacd.conf.bak
 cat <<EOF | sudo tee /etc/guacamole/guacd.conf
 [server]
@ -80,19 +82,19 @@ server_certificate = /etc/guacamole/ssl/guacd.crt
 server_key = /etc/guacamole/ssl/guacd.key
 EOF

-# Enable TLS backend
+# Enable TLS backend (Add this to guacamole server front end if splitting)
 cat <<EOF | sudo tee -a /etc/guacamole/guacamole.properties
 guacd-ssl: true
 EOF

-# Fix required permissions as guacd only runs as daemon
+# Fix required permissions as guacd only runs as daemon (Run on both systems if splitting)
 chown daemon:daemon /etc/guacamole/ssl
 chown daemon:daemon /etc/guacamole/ssl/guacd.key
 chown daemon:daemon /etc/guacamole/ssl/guacd.crt
 chmod 644 /etc/guacamole/ssl/guacd.crt
 chmod 644 /etc/guacamole/ssl/guacd.key

-# Add the new certificate into the Java Runtime certificate store and set JRE to trust it.
+# Add the new certificate into the Java Runtime certificate store and set JRE to trust it. (Run on guacamole server front end if splitting)
 cd /etc/guacamole/ssl
 keytool -importcert -alias guacd -noprompt -cacerts -storepass changeit -file guacd.crt

--- a/guac-management/upgrade-guac.sh
+++ b/guac-management/upgrade-guac.sh
@ -25,6 +25,7 @@ NC='\033[0m' #No Colour
 if ! [[ $(id -u) = 0 ]]; then
    echo
    echo -e "${LRED}Please run this script as sudo or root${NC}" 1>&2
+    echo
    exit 1
 fi

@ -49,10 +50,10 @@ mkdir -p $DOWNLOAD_DIR
 chown -R $SUDO_USER:root $DOWNLOAD_DIR

 # Version of Guacamole to upgrade to. See https://guacamole.apache.org/releases/ for latest version info.
-NEW_GUAC_VERSION="1.5.3"
+NEW_GUAC_VERSION="1.6.0"

 # MySQL Connector/J version. See https://dev.mysql.com/downloads/connector/j/ for latest version number.
-NEW_MYSQLJCON="8.1.0"
+NEW_MYSQLJCON="9.3.0"

 # Get the currently installed Tomcat version.
 TOMCAT_VERSION=$(ls /etc/ | grep tomcat)
@ -74,10 +75,33 @@ GUAC_USER=
 GUAC_PWD=
 GUAC_DB=
 MYSQL_ROOT_PWD=
+RDP_SHARE_HOST=
+RDP_SHARE_LABEL=
+RDP_PRINTER_LABEL=
+GUACD_ACCOUNT=
+
+# Standardise on a distro version identification lexicon
+source /etc/os-release
+ID=$ID
+VERSION_ID=$VERSION_ID
+VERSION_CODENAME=$VERSION_CODENAME
+
+# Workaround for issue #31
+if [[ "${ID,,}" = "debian" && "${VERSION_CODENAME,,}" = *"bullseye"* ]] || [[ "${ID,,}" = "ubuntu" && "${VERSION_CODENAME,,}" = *"focal"* ]]; then
+    IFS='.' read -ra guac_version_parts <<< "${GUAC_VERSION}"
+    major="${guac_version_parts[0]}"
+    minor="${guac_version_parts[1]}"
+    patch="${guac_version_parts[2]}"
+    # Assume this will be correctly fixed in 1.5.5 and is a 1.5.4 specific bug. Uncomment 2nd line if issue persists >=1.5.4 (See https://issues.apache.org/jira/browse/GUACAMOLE-1892))
+	if (( major == 1 && minor == 5 && patch == 4 )); then
+	#if (( major > 1 || (major == 1 && minor > 5) || ( major == 1 && minor == 5 && patch >= 4 ) )); then
+      export LDFLAGS="-lrt"
+    fi
+fi

 # Script branding header
 echo
-echo -e "${GREYB}Guacamole VDI & Jump Server Appliance UPGRADE."
+echo -e "${GREYB}Guacamole Appliance Auto Upgrade Script"
 echo -e "                             ${LGREEN}Powered by Itiligent"
 echo

@ -85,7 +109,9 @@ echo
 # Start upgrade actions  ##############################################################################################
 #######################################################################################################################

+sudo apt-get update -qq
 apt-get upgrade -qq -y
+apt-get -qq -y install build-essential

 # Stop tomcat and guacd
 systemctl stop ${TOMCAT_VERSION}
@ -145,6 +171,11 @@ else
 fi
 echo -e "${LGREEN}Downloaded guacamole-server-${NEW_GUAC_VERSION}.tar.gz${GREY}"

+# Add customised RDP share names and printer labels, remove Guacamole default labelling
+sed -i -e 's/IDX_CLIENT_NAME, "Guacamole RDP"/IDX_CLIENT_NAME, "'"${RDP_SHARE_HOST}"'"/' ${DOWNLOAD_DIR}/guacamole-server-${NEW_GUAC_VERSION}/src/protocols/rdp/settings.c
+sed -i -e 's/IDX_DRIVE_NAME, "Guacamole Filesystem"/IDX_DRIVE_NAME, "'"${RDP_SHARE_LABEL}"'"/' ${DOWNLOAD_DIR}/guacamole-server-${NEW_GUAC_VERSION}/src/protocols/rdp/settings.c
+sed -i -e 's/IDX_PRINTER_NAME, "Guacamole Printer"/IDX_PRINTER_NAME, "'"${RDP_PRINTER_LABEL}"'"/' ${DOWNLOAD_DIR}/guacamole-server-${NEW_GUAC_VERSION}/src/protocols/rdp/settings.c
+
 # Make and install guacd (Guacamole-Server)
 cd guacamole-server-${NEW_GUAC_VERSION}/
 echo
@ -200,8 +231,13 @@ if [[ "${INSTALL_MYSQL}" = true ]]; then
        FILEVERSION=$(echo ${FILE} | grep -oP 'upgrade-pre-\K[0-9\.]+(?=\.)')
        if [[ $(echo -e "${FILEVERSION}\n${OLD_GUAC_VERSION}" | sort -V | head -n1) == ${OLD_GUAC_VERSION} && ${FILEVERSION} != ${OLD_GUAC_VERSION} ]]; then
            echo "Patching ${GUAC_DB} with ${FILE}"
+
+    		if [[ ! -z "$MYSQL_ROOT_PWD" ]]; then
+                	mysql -u root -p${MYSQL_ROOT_PWD} -D ${GUAC_DB} -h ${MYSQL_HOST} -P ${MYSQL_PORT} <guacamole-auth-jdbc-${NEW_GUAC_VERSION}/mysql/schema/upgrade/${FILE} &>>${INSTALL_LOG}
+            	else
 			mysql -u root -D ${GUAC_DB} -h ${MYSQL_HOST} -P ${MYSQL_PORT} <guacamole-auth-jdbc-${NEW_GUAC_VERSION}/mysql/schema/upgrade/${FILE} &>>${INSTALL_LOG}
 	    	fi
+        fi
    done
    if [[ $? -ne 0 ]]; then
        echo -e "${LRED}SQL upgrade failed. See ${INSTALL_LOG}${GREY}" 1>&2
@ -312,16 +348,20 @@ for file in /etc/guacamole/extensions/guacamole-history-recording-storage*.jar;
    fi
 done

-# Fix for #196 see https://github.com/MysticRyuujin/guac-install/issues/196
-mkdir -p /usr/sbin/.config/freerdp
-chown daemon:daemon /usr/sbin/.config/freerdp
-
-# Fix for #197 see https://github.com/MysticRyuujin/guac-install/issues/197
-mkdir -p /var/guacamole
-chown daemon:daemon /var/guacamole
-
 # Bring guacd and Tomcat back up
 echo -e "${GREY}Starting guacd and Tomcat services..."
+
+# Reset freerdp profile permissions for storing certificates
+mkdir -p /home/"${GUACD_ACCOUNT}"/.config/freerdp
+chown ${GUACD_ACCOUNT}:${GUACD_ACCOUNT} /home/"${GUACD_ACCOUNT}"/.config/freerdp
+
+# Reset guacamole permissions
+mkdir -p /var/guacamole
+chown "${GUACD_ACCOUNT}":"${GUACD_ACCOUNT}" /var/guacamole
+
+# Reset the guacd systemd unit file's default service account 
+sudo sed -i "s/\bdaemon\b/${GUACD_ACCOUNT}/g" /etc/systemd/system/guacd.service
+systemctl daemon-reload
 systemctl enable guacd
 systemctl start guacd
 systemctl start ${TOMCAT_VERSION}
@ -335,8 +375,10 @@ fi

 # Cleanup
 echo -e "${GREY}Clean up install files...${GREY}"
+sudo apt -y remove build-essential
 rm -rf guacamole-*
 rm -rf mysql-connector-j-*
+sudo apt-get -y autoremove
 if [[ $? -ne 0 ]]; then
    echo -e "${LRED}Failed. See ${INSTALL_LOG}${GREY}" 1>&2
    exit 1