mirror of
https://github.com/itiligent/Easy-Guacamole-Installer.git
synced 2025-12-13 18:02:32 +00:00
Compare commits
21 commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
d3c0eeab20 | ||
|
|
5bc439bf11 | ||
|
|
b8ecc10f3d | ||
|
|
9499408573 | ||
|
|
5423eecfe0 | ||
|
|
f0bc38028e | ||
|
|
04151be101 | ||
|
|
909970fe9e | ||
|
|
50b2935457 | ||
|
|
3a357c0451 | ||
|
|
77826bd010 | ||
|
|
9915697260 | ||
|
|
8c8aed28f8 | ||
|
|
bc3b1530fb | ||
|
|
8059220396 | ||
|
|
1222d0d30d | ||
|
|
083109946f | ||
|
|
152e9d9d73 | ||
|
|
d42109fa1f | ||
|
|
16ca246428 | ||
|
|
6371c33552 |
6 changed files with 160 additions and 79 deletions
31
1-setup.sh
31
1-setup.sh
|
|
@ -83,11 +83,11 @@ mkdir -p $DB_BACKUP_DIR
|
|||
GITHUB="https://raw.githubusercontent.com/itiligent/Guacamole-Install/main"
|
||||
|
||||
# Version of Guacamole to install
|
||||
GUAC_VERSION="1.5.5"
|
||||
GUAC_VERSION="1.6.0"
|
||||
GUAC_SOURCE_LINK="http://apache.org/dyn/closer.cgi?action=download&filename=guacamole/${GUAC_VERSION}"
|
||||
|
||||
# MySQL Connector/J version to install
|
||||
MYSQLJCON="9.1.0"
|
||||
MYSQLJCON="9.3.0"
|
||||
MYSQLJCON_SOURCE_LINK="https://dev.mysql.com/get/Downloads/Connector-J/mysql-connector-j-${MYSQLJCON}.tar.gz"
|
||||
|
||||
# Provide a specific MySQL version e.g. 11.1.2 or leave blank "" to use distro default MySQL packages.
|
||||
|
|
@ -118,7 +118,7 @@ GUAC_USER="" # If blank "" default is guacamole_user
|
|||
MYSQL_ROOT_PWD="" # Manadatory entry here or at script prompt
|
||||
GUAC_PWD="" # Manadatory entry here or at script prompt
|
||||
GUACD_ACCOUNT="guacd" # Service account guacd will run under (and will be very heavily locked down)
|
||||
DB_TZ=$(cat /etc/timezone) # Blank "" defaults to UTC, for local timezone: $(cat /etc/timezone)
|
||||
DB_TZ=$(timedatectl show -p Timezone --value) # Blank "" defaults to UTC, for local timezone: $(cat /etc/timezone)
|
||||
INSTALL_TOTP="" # Add TOTP MFA extension (true/false), can't be installed simultaneously with DUO)
|
||||
INSTALL_DUO="" # Add DUO MFA extension (true/false, can't be installed simultaneously with TOTP)
|
||||
INSTALL_LDAP="" # Add Active Directory extension (true/false)
|
||||
|
|
@ -145,6 +145,7 @@ RDP_SHARE_HOST="" # Custom RDP host name shown in Windows Explorer
|
|||
RDP_SHARE_LABEL="RDP Share" # Custom RDP shared drive name in Windows Explorer (eg. "RDP_SHARE_LABEL on RDP_SHARE_HOST" eg. "your RDP share name on server01"
|
||||
RDP_PRINTER_LABEL="RDP Printer" # Custom RDP printer name shown in Windows
|
||||
CRON_DENY_FILE="/etc/cron.deny" # Distro's cron deny file
|
||||
FREERDP="freerdp2-dev" # Set default FreeRDP package
|
||||
|
||||
#######################################################################################################################
|
||||
# Download GitHub setup scripts. BEFORE RUNNING SETUP, COMMENT OUT DOWNLOAD LINES OF ANY SCRIPTS YOU HAVE EDITED ! ####
|
||||
|
|
@ -152,7 +153,7 @@ CRON_DENY_FILE="/etc/cron.deny" # Distro's cron deny file
|
|||
|
||||
# Script branding header
|
||||
echo
|
||||
echo -e "${GREYB}Guacamole ${GUAC_VERSION} Auto Installer."
|
||||
echo -e "${GREYB}Guacamole ${GUAC_VERSION} Appliance Auto Installer"
|
||||
echo -e " ${LGREEN}Powered by Itiligent"
|
||||
echo
|
||||
echo
|
||||
|
|
@ -219,6 +220,10 @@ elif [[ ${ID,,} = "debian" ]] || [[ ${ID,,} = "raspbian" ]]; then
|
|||
LIBPNG="libpng-dev"
|
||||
fi
|
||||
|
||||
#######################################################################################################################
|
||||
# Ongoing fixes and workarounds as distros diverge/change #############################################################
|
||||
#######################################################################################################################
|
||||
|
||||
# Check for the more recent versions of Tomcat currently supported by the distro
|
||||
if [[ $(apt-cache show tomcat10 2>/dev/null | egrep "Version: 10" | wc -l) -gt 0 ]]; then
|
||||
TOMCAT_VERSION="tomcat10"
|
||||
|
|
@ -229,9 +234,10 @@ else
|
|||
TOMCAT_VERSION="tomcat9"
|
||||
fi
|
||||
|
||||
#######################################################################################################################
|
||||
# Ongoing fixes and workarounds as distros diverge/change #############################################################
|
||||
#######################################################################################################################
|
||||
# Decide the appropriate FreeRDP package (Debian 13.0 has issues with FreeRDP3)
|
||||
if [[ "${VERSION_CODENAME,,}" == "bookworm" || "${VERSION_CODENAME,,}" == "noble" ]]; then
|
||||
FREERDP="freerdp3-dev"
|
||||
fi
|
||||
|
||||
# Workaround for Debian incompatibilities with later Tomcat versions. (Adds the oldstable repo and downgrades the Tomcat version)
|
||||
if [[ ${ID,,} = "debian" && ${VERSION_CODENAME,,} = *"bookworm"* ]] || [[ ${ID,,} = "debian" && ${VERSION_CODENAME,,} = *"trixie"* ]]; then #(checks for upper and lower case)
|
||||
|
|
@ -311,7 +317,7 @@ fi
|
|||
|
||||
# Ensure SERVER_NAME is consistent with local host entries
|
||||
if [[ -z ${SERVER_NAME} ]]; then
|
||||
echo -e "${LYELLOW}Update Linux system HOSTNAME? [Enter to keep: ${HOSTNAME}]${LGREEN}"
|
||||
echo -e "${LYELLOW} Update Linux system HOSTNAME? [Enter to keep: ${HOSTNAME}]${LGREEN}"
|
||||
read -p " Enter Linux hostname : " SERVER_NAME
|
||||
# If hit enter making no SERVER_NAME change, assume the existing hostname as current
|
||||
if [[ "${SERVER_NAME}" = "" ]]; then
|
||||
|
|
@ -570,12 +576,12 @@ fi
|
|||
|
||||
# Prompt to redirect http://root:8080 to http://root:8080/guacamole if not installing reverse proxy
|
||||
if [[ -z ${GUAC_URL_REDIR} ]] && [[ "${INSTALL_NGINX}" = false ]]; then
|
||||
echo -e -n "FRONT END: Redirect Guacamole http://domain.root:8080 to /guacamole [y/n]? [default y]: "
|
||||
echo -e -n "FRONT END: Redirect http://domain.root:8080 to /guacamole (Warning: redirect may break DUO) [y/n]? [default n]: "
|
||||
read PROMPT
|
||||
if [[ ${PROMPT} =~ ^[Nn]$ ]]; then
|
||||
GUAC_URL_REDIR=false
|
||||
else
|
||||
if [[ ${PROMPT} =~ ^[Yy]$ ]]; then
|
||||
GUAC_URL_REDIR=true
|
||||
else
|
||||
GUAC_URL_REDIR=false
|
||||
fi
|
||||
fi
|
||||
|
||||
|
|
@ -735,6 +741,7 @@ export GUAC_VERSION=$GUAC_VERSION
|
|||
export GUAC_SOURCE_LINK=$GUAC_SOURCE_LINK
|
||||
export ID=$ID
|
||||
export VERSION_ID=$VERSION_ID
|
||||
export FREERDP=$FREERDP
|
||||
export VERSION_CODENAME=$VERSION_CODENAME
|
||||
export MYSQLJCON=$MYSQLJCON
|
||||
export MYSQLJCON_SOURCE_LINK=$MYSQLJCON_SOURCE_LINK
|
||||
|
|
|
|||
|
|
@ -98,9 +98,9 @@ spinner() {
|
|||
printf " "
|
||||
tput rc
|
||||
}
|
||||
apt-get -qq -y install ${MYSQLPKG} ${TOMCAT_VERSION} ${JPEGTURBO} ${LIBPNG} ufw pwgen expect \
|
||||
apt-get -qq -y install ${MYSQLPKG} ${TOMCAT_VERSION} ${JPEGTURBO} ${LIBPNG} ${FREERDP} ufw pwgen expect \
|
||||
build-essential libcairo2-dev libtool-bin uuid-dev libavcodec-dev libavformat-dev libavutil-dev \
|
||||
libswscale-dev freerdp2-dev libpango1.0-dev libssh2-1-dev libtelnet-dev libvncserver-dev libwebsockets-dev \
|
||||
libswscale-dev libpango1.0-dev libssh2-1-dev libtelnet-dev libvncserver-dev libwebsockets-dev \
|
||||
libpulse-dev libssl-dev libvorbis-dev libwebp-dev ghostscript &>>${INSTALL_LOG} &
|
||||
command_pid=$!
|
||||
spinner $command_pid
|
||||
|
|
@ -272,7 +272,7 @@ mkdir -p /etc/guacamole/extensions/
|
|||
adduser "${GUACD_ACCOUNT}" --disabled-password --disabled-login --gecos "" > /dev/null 2>&1
|
||||
gpasswd -d "${GUACD_ACCOUNT}" users > /dev/null 2>&1
|
||||
echo -e "\nMatch User ${GUACD_ACCOUNT}\n X11Forwarding no\n AllowTcpForwarding no\n PermitTTY no\n ForceCommand cvs server" | sudo tee -a /etc/ssh/sshd_config > /dev/null 2>&1
|
||||
systemctl restart sshd
|
||||
systemctl restart ssh
|
||||
touch "${CRON_DENY_FILE}"
|
||||
chmod 644 "${CRON_DENY_FILE}"
|
||||
chown root:root "${CRON_DENY_FILE}"
|
||||
|
|
|
|||
79
README.md
79
README.md
|
|
@ -1,7 +1,13 @@
|
|||
<div align="center">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
# 🥑 Easy Guacamole Installer
|
||||
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
<p align="center">
|
||||
|
|
@ -12,28 +18,30 @@
|
|||
|
||||
## Introduction
|
||||
|
||||
This project allows you to easily set up a Guacamole jump-host with optional TLS reverse proxy (self-signed or Let's Encrypt), Active Directory integration, multi-factor authentication, Quick Connect & History Recording Storage UI enhancements, a custom UI dark themed template, auto database backup, email alerts and internal hardening options including fail2ban for defence against brute force attacks. There are also options for enterprise deployments similar to [Amazon's Guacamole Bastion Cluster](http://netcubed-ami.s3-website-us-east-1.amazonaws.com/guaws/v2.3.1/cluster/).
|
||||
#### v1.6.0 is working. Issues and notes are tracked in https://github.com/itiligent/Easy-Guacamole-Installer/issues/78
|
||||
|
||||
This install script automatically sets up a Guacamole jump-host with optional for TLS reverse proxy (self-signed or Let's Encrypt), Active Directory integration, multi-factor authentication, Quick Connect & History Recording Storage UI enhancements. Other options also include a custom UI dark themed template, auto database backups, email alerts and internal hardening options including fail2ban for defence against brute force attacks. There is also facility for enterprise deployment similar to [Amazon's Guacamole Bastion Cluster](http://netcubed-ami.s3-website-us-east-1.amazonaws.com/guaws/v2.3.1/cluster/).
|
||||
|
||||
## Automatic Installation
|
||||
|
||||
🚀 To start building your Guacamole appliance, paste the below link into a terminal & follow the prompts (**do NOT run as root, the script will prompt for sudo as needed**):
|
||||
🚀 Move to you your home directory, paste the below link, then follow the prompts (**do NOT run as root, the script will prompt for sudo**):
|
||||
|
||||
```shell
|
||||
wget https://raw.githubusercontent.com/itiligent/Guacamole-Install/main/1-setup.sh && chmod +x 1-setup.sh && ./1-setup.sh
|
||||
```
|
||||
---
|
||||
|
||||
## Prerequisites
|
||||
|
||||
🔒 **A Compatible OS:**
|
||||
- **Debian: 12.x or 11.x**
|
||||
- **Ubuntu LTS variants: 24.04, 23.04, 22.04**
|
||||
- **Raspbian Buster or Bullseye**
|
||||
- **Official vendor cloud images equivalent to the above versions.**
|
||||
📋 **You will need:**
|
||||
- **Supported OS: Debian 12 or 13** | **Ubuntu LTS 22.x or 24.x** | **Raspbian**
|
||||
- **1 CPU core + 2GB RAM for every 25 users (plus minimum RAM & disk space for your selected OS).**
|
||||
- **Open TCP ports: 22, 80, and 443 (no other services using 80, 8080 & 443)**
|
||||
- **If selecting either of the TLS reverse proxy options, you must create a PRIVATE DNS record for the internal proxy site, and an additional PUBLIC DNS record if selecting the Let's Encrypt option.**
|
||||
- **For both TLS reverse proxy options you will need a PRIVATE DNS record for the internal proxy site, and an additional PUBLIC DNS record for the Let's Encrypt option.**
|
||||
- **Sudo & wget packages installed**
|
||||
- **The user running the 1-setup.sh script must have sudo permissions**
|
||||
- **The user running `1-setup.sh` must have sudo permissions.**
|
||||
|
||||
---
|
||||
|
||||
## Setup Script Menu
|
||||
|
||||
|
|
@ -48,17 +56,20 @@ wget https://raw.githubusercontent.com/itiligent/Guacamole-Install/main/1-setup.
|
|||
- New server & client browser certificates are saved to `$HOME/guac-setup/tls-certs/[date-time]/`.
|
||||
- Optionally follow on-screen instructions for client certificate import to avoid https browser warnings.
|
||||
|
||||
## Custom Installation Instructions
|
||||
---
|
||||
|
||||
⚙️ **To customize the many available script options:**
|
||||
## Customising The Build
|
||||
|
||||
⚙️ **To customise the many available script options:**
|
||||
|
||||
- Exit `1-setup.sh` at the first prompt.
|
||||
- All configurable script options are noted at the start of `1-setup.sh` under **Silent setup options**. Re-run the edited setup script after making your changes. (Re-run script locally, do not re-run the automatic install web link).
|
||||
- Certain combinations of the **Silent setup options** will allow for a fully unattended install supporting mass deployment or highly customized docker builds.
|
||||
- All configurable script options are shown under **Silent setup options** at the start of `1-setup.sh`.
|
||||
- Certain combinations of the **Silent setup options** will allow for a fully unattended install supporting mass deployment or highly customised docker builds.
|
||||
- Re-run your edited script locally after making changes (do not re-run the automatic install web link - see below).
|
||||
|
||||
**Other custom install notes:**
|
||||
- **Caution:** Re-running the auto-installer re-downloads the suite of scripts and this will overwrite all your script edits. You must therefore run 1-setup.sh LOCALLY after editing. If any other scripts are edited, their corresponding download links in the 1-setup.sh script must also be commented out.
|
||||
- Upgrade scripts are **automatically customised with your specifc installation settings** for consistent future updates. (Re-downloading from the auto install link after install will overwrite all custom settings as above.)
|
||||
- **Caution:** Re-running the auto-installer link re-downloads the suite of scripts which will overwrite any custom script edits. You must run 1-setup.sh LOCALLY after editing. If any child scripts are edited, their corresponding download links in 1-setup.sh script must also be commented out.
|
||||
- Upgrade scripts are **automatically customised with your specifc installation settings** for consistent future updates.
|
||||
- Nginx reverse proxy is configured to default to at least TLS 1.2. For ancient systems, see commented sections of the `/etc/nginx/nginx.conf` file after install.
|
||||
- A daily MySQL backup job is automatically configured under the script owner's crontab.
|
||||
- The Quick Connect option brings some extra security implications, be aware of potential risks in your environment.
|
||||
|
|
@ -70,35 +81,49 @@ wget https://raw.githubusercontent.com/itiligent/Guacamole-Install/main/1-setup.
|
|||
- `add-auth-ldap.sh`: Template script for simplified Active Directory integration.
|
||||
- `add-smtp-relay-o365.sh`: Template script for email alert integration with MSO65 (BYO app password).
|
||||
|
||||
## Customise & Brand Your Guacamole Theme
|
||||
---
|
||||
|
||||
## Branding The Guacamole UI Theme
|
||||
|
||||
🎨 **Follow the theme and branding instructions** [here](https://github.com/itiligent/Guacamole-Install/tree/main/guac-custom-theme-builder). To revert to the default theme, simply delete the branding.jar file from `/etc/guacamole/extensions`, clear your browser cache and restart.
|
||||
|
||||
## Managing Self-Signed TLS Certs with Nginx (the easy way!)
|
||||
---
|
||||
|
||||
## Managing Self-Signed TLS Certs With Nginx
|
||||
|
||||
**To renew self-signed certificates or change the reverse proxy local DNS name/IP address:**
|
||||
- Re-run `4a-install-tls-self-signed-nginx.sh` to create a new certificate for Nginx (accompanying browser client certificates will also be updated). Always clear your browser cache after changing certificates.
|
||||
- Re-run `4a-install-tls-self-signed-nginx.sh` to create a new Nginx certificate (new browser client certificates will also be created for re-import). Always clear your browser cache after changing certificates.
|
||||
|
||||
---
|
||||
|
||||
## Active Directory Integration
|
||||
|
||||
🔑 See [here](https://github.com/itiligent/Guacamole-Install/blob/main/ACTIVE-DIRECTORY-HOW-TO.md).
|
||||
|
||||
## For SS0 Extensions (Radius, Base, CAS, OpenID, SAML, Dist)
|
||||
---
|
||||
|
||||
## SS0 Extensions (Radius, Base, CAS, OpenID, SAML, Dist)
|
||||
🔑 See [here](https://github.com/itiligent/Guacamole-Installer/blob/main/SSO-EXTENSIONS-HOW-TO.md)
|
||||
|
||||
---
|
||||
|
||||
## Upgrading Guacamole
|
||||
|
||||
🌐 To upgrade Guacamole, edit `upgrade-guacamole.sh` to reflect the latest versions of Guacamole & MySQL connector/J before running. This script will automatically update TOTP, DUO, LDAP, Quick Connect, and History Recorded Storage extensions if present.
|
||||
|
||||
---
|
||||
|
||||
## High Availability Deployment
|
||||
|
||||
- 👔 **For a separate DATABASE layer:** Use the `install-mysql-backend-only.sh` [here](https://github.com/itiligent/Guacamole-Install/tree/main/guac-enterprise-build) to install a standalone instance of the Guacamole MySQL database.
|
||||
- 👔 **For a separate APPLICATION layer:** Run `1-setup.sh` and point new installations to your separate database instance. Just say **no** to the "Install MySQL locally" option and any other local reverse proxy install options.
|
||||
- 👔 **For a separate FRONT END layer:** Use the included Nginx installer scripts to build out a separate Nginx front end layer, and then apply your preferred TLS load balancing technique. Alternatively, AWS/Azure/GCP load balancers or [HA Proxy](https://www.haproxy.org/) may provide superior session persistence & affinity compared to [Open Source Nginx](https://www.nginx.com/products/nginx/compare-models/).
|
||||
|
||||
### Installer Script Download Manifest
|
||||
---
|
||||
|
||||
📦 **The autorun link downloads these repo files into `$HOME/guac-setup`:**
|
||||
### Script Download Manifest
|
||||
|
||||
📦 **The autorun link downloads these files into `$HOME/guac-setup`:**
|
||||
|
||||
- `1-setup.sh`: The parent setup script.
|
||||
- `2-install-guacamole.sh`: Guacamole source build & installer script.
|
||||
|
|
@ -118,4 +143,14 @@ wget https://raw.githubusercontent.com/itiligent/Guacamole-Install/main/1-setup.
|
|||
- `branding.jar`: Base template for customizing Guacamole's UI theme.
|
||||
|
||||
😄🥑
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -15,8 +15,17 @@ sudo systemctl restart guacd && sudo systemctl restart ${TOMCAT}
|
|||
|
||||
## Theme customisation hints: ##
|
||||
- Do not change any of the theme's directory structure or file names. File contents can be carefully edited according to the following constraints:
|
||||
- `MANIFEST.MF`: All values in here can be updated. Be aware that the "Name:" value MUST use same value in front of the the .jar creation command shown above in the 1st line e.g. `Name: branding` expects branding.jar
|
||||
- `guac-manifest.json`: The "name:" value in here can be changed to anything. The "namespace:" value given in this file MUST match the namespace image path line found in `custom-theme.css`, eg.`background-image: url('app/ext/custom-namespace/images/logo.png');`
|
||||
- `META-INF/MANIFEST.MF`: All values in here can be updated, **BUT** be aware that `Name: branding` is linked to the commands above e.g. `Name: branding` expects `branding.jar` as the .jar filename
|
||||
- `guac-manifest.json`: The "name:" value in here can be changed to anything **BUT** the `"namespace" : "custom-namespace"` value MUST match the namespace image path line found in `custom-theme.css`, eg:
|
||||
```
|
||||
.login-ui .login-dialog .logo {
|
||||
background-image: url('app/ext/custom-namespace/images/logo.png');
|
||||
width: 7em;
|
||||
height: 7em;
|
||||
-webkit-background-size: 7em auto;
|
||||
|
||||
}
|
||||
```
|
||||
- It is preferable to give css a range of logo sizes as shown in the template. The "smallIcon" value in `guac-manifest.json` is used for browser tab favicons. As such this file can be kept to < 80x80 pixels. The example used is 64x64 pixels.
|
||||
- Within `custom-theme.css`, you may need to experiment with the the height and width values under `.login-ui .login-dialog .logo` to scale your particular logo neatly within the dialog box. Another option is to make the login dialog box larger. Under `.login-ui .login-dialog`, experiment with adding a `max-width: 4in;` or similar. There's a ton of css options available and this template is just starting point, Google is your friend!
|
||||
- An easy way to debug and preview potential style changes is to tweak various values by setting your browser to developer mode.
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
# Add fail2ban restrictions to Guacamole
|
||||
# For Ubuntu / Debian / Raspbian
|
||||
# David Harrop
|
||||
# April 2023
|
||||
# December 2024
|
||||
#######################################################################################################################
|
||||
|
||||
# Prepare text output colours
|
||||
|
|
@ -21,6 +21,7 @@ clear
|
|||
if ! [[ $(id -u) = 0 ]]; then
|
||||
echo
|
||||
echo -e "${LGREEN}Please run this script as sudo or root${NC}" 1>&2
|
||||
echo
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
|
@ -30,12 +31,16 @@ FAIL2BAN_GUAC=""
|
|||
FAIL2BAN_NGINX=""
|
||||
FAIL2BAN_SSH=""
|
||||
TOMCAT_VERSION=$(ls /etc/ | grep tomcat)
|
||||
TOMCAT_SERVICE_FILE="/usr/lib/systemd/system/$TOMCAT_VERSION.service"
|
||||
# Tomcat service file logging lines that must exist
|
||||
OUTPUT_LINE="StandardOutput=append:/var/log/$TOMCAT_VERSION/catalina.out"
|
||||
ERROR_LINE="StandardError=append:/var/log/$TOMCAT_VERSION/catalina.out"
|
||||
|
||||
#Clean up from any previous runs
|
||||
rm -f /tmp/fail2ban.conf
|
||||
rm -f /tmp/fail2ban.temp1
|
||||
rm -f /tmp/fail2ban.temp2
|
||||
rm -f /tmp/ip_list.txt
|
||||
rm -f /tmp/netaddr.txt
|
||||
rm -f /tmp/fail2ban.update
|
||||
|
||||
#######################################################################################################################
|
||||
# Start setup prompts #################################################################################################
|
||||
|
|
@ -92,13 +97,14 @@ fi
|
|||
|
||||
# Install base fail2ban base application, and whitelist the local subnet as the starting baseline (no policy defined yet)
|
||||
if [[ "${FAIL2BAN_BASE}" = true ]]; then
|
||||
|
||||
echo
|
||||
#Update and install fail2ban (and john for management of config file updates, and not overwrite any existing settings)
|
||||
apt-get update -qq
|
||||
apt-get install fail2ban john -qq -y
|
||||
|
||||
# Create the basic jail.local template and local subnet whitelist
|
||||
cat >/tmp/fail2ban.conf <<EOF
|
||||
# Create the basic jail.local template local subnet whitelist
|
||||
echo
|
||||
cat >/tmp/fail2ban.temp1 <<EOF
|
||||
[DEFAULT]
|
||||
destemail = yourname@example.com
|
||||
sender = yourname@example.com
|
||||
|
|
@ -106,7 +112,7 @@ action = %(action_mwl)s
|
|||
ignoreip =
|
||||
|
||||
[sshd]
|
||||
backend=systemd
|
||||
backend = systemd
|
||||
enabled = true
|
||||
EOF
|
||||
|
||||
|
|
@ -181,26 +187,23 @@ if [[ "${FAIL2BAN_BASE}" = true ]]; then
|
|||
# Finally assemble the entire syntax of the ignoreip whitelist for insertion into the base fail2ban config
|
||||
SED_IGNORE=$(echo "ignoreip = ")
|
||||
SED_NETADDR=$(cat /tmp/netaddr.txt)
|
||||
sed -i "s|ignoreip \=|${SED_IGNORE}${SED_NETADDR}|g" /tmp/fail2ban.conf
|
||||
sed -i "s|ignoreip \=|${SED_IGNORE}${SED_NETADDR}|g" /tmp/fail2ban.temp1
|
||||
|
||||
# Move the new base fail2ban config to the jail.local file
|
||||
touch /etc/fail2ban/jail.local
|
||||
|
||||
# Apply the base config, keeping any pre-existing settings
|
||||
sudo bash -c 'cat /tmp/fail2ban.conf /etc/fail2ban/jail.local | unique /tmp/fail2ban.update ; cat /tmp/fail2ban.update > /etc/fail2ban/jail.local'
|
||||
|
||||
# Clean up
|
||||
rm -f /tmp/fail2ban.conf
|
||||
rm -f /tmp/ip_list.txt
|
||||
rm -f /tmp/netaddr.txt
|
||||
rm -f /tmp/fail2ban.update
|
||||
sudo bash -c 'cat /tmp/fail2ban.temp1 > /etc/fail2ban/jail.local'
|
||||
|
||||
# bounce the service to reload the new config
|
||||
systemctl restart fail2ban
|
||||
|
||||
# Display the new config
|
||||
echo "New base /etc/fail2ban/jail.local config:"
|
||||
cat /etc/fail2ban/jail.local
|
||||
|
||||
# Done
|
||||
echo
|
||||
echo -e "${LGREEN}Fail2ban installed...${GREY}"
|
||||
echo -e "${LGREEN}Fail2ban base installed...${GREY}"
|
||||
echo
|
||||
|
||||
else
|
||||
|
|
@ -212,21 +215,22 @@ fi
|
|||
# Fail2ban optional policy setup items ################################################################################
|
||||
#######################################################################################################################
|
||||
|
||||
if [[ "${FAIL2BAN_GUAC}" = true ]]; then
|
||||
|
||||
if [[ "${FAIL2BAN_GUAC}" = true ]]; then
|
||||
# Create the Guacamole jail.local policy template
|
||||
cat >/tmp/fail2ban.conf <<EOF
|
||||
cat >/tmp/fail2ban.temp2 <<EOF
|
||||
|
||||
[guacamole]
|
||||
enabled = true
|
||||
port = http,https
|
||||
logpath = /var/log/$TOMCAT_VERSION/catalina.out
|
||||
bantime = 15m
|
||||
findtime = 60m
|
||||
logpath = /var/log/$TOMCAT_VERSION/catalina.out
|
||||
bantime = 10m
|
||||
findtime = 60m
|
||||
maxretry = 5
|
||||
EOF
|
||||
|
||||
# Apply the new Guacamole jail config keeping any pre-existing settings
|
||||
sudo bash -c 'cat /tmp/fail2ban.conf /etc/fail2ban/jail.local | unique /tmp/fail2ban.update ; cat /tmp/fail2ban.update > /etc/fail2ban/jail.local'
|
||||
# Apply the new Guacamole jail config
|
||||
sudo bash -c 'cat /tmp/fail2ban.temp2 >> /etc/fail2ban/jail.local'
|
||||
|
||||
# Backup the default Fail2ban Guacamole filter
|
||||
cp /etc/fail2ban/filter.d/guacamole.conf /etc/fail2ban/filter.d/guacamole.conf.bak
|
||||
|
|
@ -238,20 +242,41 @@ EOF
|
|||
REGEX='failregex = ^.*WARN o\.a\.g\.r\.auth\.AuthenticationService - Authentication attempt from <HOST> for user "[^"]*" failed\.$'
|
||||
#Insert the new regex
|
||||
sed -i -e "/Authentication attempt from/a ${REGEX}" /etc/fail2ban/filter.d/guacamole.conf
|
||||
|
||||
# Done
|
||||
echo -e "${LGREEN}Guacamole security policy applied${GREY}\n- ${SED_NETADDR}are whitelisted from all IP bans.\n- To alter this whitelist, edit /etc/fail2ban/jail.local & sudo systemctl restart fail2ban \n \n This script may take a while to complete on first run..."
|
||||
|
||||
# Bounce the service to reload the new config
|
||||
systemctl restart fail2ban
|
||||
echo
|
||||
fi
|
||||
|
||||
# Clean up
|
||||
rm -f /tmp/fail2ban.conf
|
||||
rm -f /tmp/ip_list.txt
|
||||
rm -f /tmp/netaddr.txt
|
||||
rm -f /tmp/fail2ban.update
|
||||
# Clean up
|
||||
rm -f /tmp/fail2ban.temp1
|
||||
rm -f /tmp/fail2ban.temp2
|
||||
rm -f /tmp/ip_list.txt
|
||||
rm -f /tmp/netaddr.txt
|
||||
apt-get -y remove john > /dev/null 2>&1
|
||||
apt-get -y autoremove > /dev/null 2>&1
|
||||
|
||||
# Display the updated config
|
||||
echo "Updated jail.local with Guacamole filter policy:"
|
||||
cat /etc/fail2ban/jail.local
|
||||
|
||||
# make sure Tomcat catalina logs are configured
|
||||
if [[ ! -f "$TOMCAT_SERVICE_FILE" ]]; then
|
||||
echo "Error: $TOMCAT_SERVICE_FILE not found, exiting..."
|
||||
exit 1
|
||||
else
|
||||
if grep -q "^$OUTPUT_LINE" "$TOMCAT_SERVICE_FILE" && grep -q "^$ERROR_LINE" "$TOMCAT_SERVICE_FILE"; then
|
||||
echo "Required lines already exist in $TOMCAT_SERVICE_FILE. No changes made."
|
||||
else
|
||||
# Add lines if they don't already exist
|
||||
sed -i "/^\[Service\]/a $OUTPUT_LINE\n$ERROR_LINE" "$TOMCAT_SERVICE_FILE"
|
||||
systemctl daemon-reload
|
||||
systemctl restart fail2ban
|
||||
systemctl restart guacd
|
||||
systemctl restart ${TOMCAT_VERSION}
|
||||
echo "Lines were added successfully to $TOMCAT_SERVICE_FILE."
|
||||
fi
|
||||
fi
|
||||
|
||||
# Done
|
||||
echo
|
||||
echo -e "${LGREEN}Guacamole security policy applied, but NOT YET ENABLED FOR LOCAL NETWORK(S) ${GREY}\n- Local network(s) ${SED_NETADDR}are currently whitelisted from all IP bans.\n- To alter this whitelist, edit /etc/fail2ban/jail.local then sudo systemctl restart fail2ban"
|
||||
|
||||
############## Start Fail2ban NGINX security policy option ###############
|
||||
#if [[ "${FAIL2BAN_NGINX}" = true ]]; then
|
||||
|
|
|
|||
|
|
@ -50,10 +50,10 @@ mkdir -p $DOWNLOAD_DIR
|
|||
chown -R $SUDO_USER:root $DOWNLOAD_DIR
|
||||
|
||||
# Version of Guacamole to upgrade to. See https://guacamole.apache.org/releases/ for latest version info.
|
||||
NEW_GUAC_VERSION="1.5.5"
|
||||
NEW_GUAC_VERSION="1.6.0"
|
||||
|
||||
# MySQL Connector/J version. See https://dev.mysql.com/downloads/connector/j/ for latest version number.
|
||||
NEW_MYSQLJCON="9.1.0"
|
||||
NEW_MYSQLJCON="9.3.0"
|
||||
|
||||
# Get the currently installed Tomcat version.
|
||||
TOMCAT_VERSION=$(ls /etc/ | grep tomcat)
|
||||
|
|
@ -101,7 +101,7 @@ fi
|
|||
|
||||
# Script branding header
|
||||
echo
|
||||
echo -e "${GREYB}Guacamole Appliance Auto Upgrade Script."
|
||||
echo -e "${GREYB}Guacamole Appliance Auto Upgrade Script"
|
||||
echo -e " ${LGREEN}Powered by Itiligent"
|
||||
echo
|
||||
|
||||
|
|
@ -231,7 +231,12 @@ if [[ "${INSTALL_MYSQL}" = true ]]; then
|
|||
FILEVERSION=$(echo ${FILE} | grep -oP 'upgrade-pre-\K[0-9\.]+(?=\.)')
|
||||
if [[ $(echo -e "${FILEVERSION}\n${OLD_GUAC_VERSION}" | sort -V | head -n1) == ${OLD_GUAC_VERSION} && ${FILEVERSION} != ${OLD_GUAC_VERSION} ]]; then
|
||||
echo "Patching ${GUAC_DB} with ${FILE}"
|
||||
mysql -u root -D ${GUAC_DB} -h ${MYSQL_HOST} -P ${MYSQL_PORT} <guacamole-auth-jdbc-${NEW_GUAC_VERSION}/mysql/schema/upgrade/${FILE} &>>${INSTALL_LOG}
|
||||
|
||||
if [[ ! -z "$MYSQL_ROOT_PWD" ]]; then
|
||||
mysql -u root -p${MYSQL_ROOT_PWD} -D ${GUAC_DB} -h ${MYSQL_HOST} -P ${MYSQL_PORT} <guacamole-auth-jdbc-${NEW_GUAC_VERSION}/mysql/schema/upgrade/${FILE} &>>${INSTALL_LOG}
|
||||
else
|
||||
mysql -u root -D ${GUAC_DB} -h ${MYSQL_HOST} -P ${MYSQL_PORT} <guacamole-auth-jdbc-${NEW_GUAC_VERSION}/mysql/schema/upgrade/${FILE} &>>${INSTALL_LOG}
|
||||
fi
|
||||
fi
|
||||
done
|
||||
if [[ $? -ne 0 ]]; then
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue