mirror of
https://github.com/itiligent/Easy-Guacamole-Installer.git
synced 2025-12-13 18:02:32 +00:00
76 lines
5.3 KiB
Markdown
76 lines
5.3 KiB
Markdown
# Guacamole 1.5.1 Virtual Desktop/Jump Server appliance with MFA, Active Directory integration & Nginx SSL reverse proxy
|
|
|
|
## Automatic build, install & config script:
|
|
|
|
wget https://raw.githubusercontent.com/itiligent/Guacamole-Setup/main/1-setup.sh && chmod +x 1-setup.sh && ./1-setup.sh
|
|
|
|
## Prerequisites:
|
|
|
|
Recent flavours of Ubuntu / Debian / Raspian
|
|
Min 8GB RAM, 40GB HDD
|
|
Public or private DNS entries matching the default physical interface IP address. (needed for SSL)
|
|
Incoming access on tcp 22, 80 & 443
|
|
|
|
### Setup menu options are:
|
|
|
|
### 1. Install default Guacamole with either a local MySQL database or with a remote MySQL instance
|
|
sub-options:
|
|
a. Add MySQL mysql_secure_installation settings (to a local or remote MySQL instance)
|
|
b. Add Guacamole MFA and Auth extensions - DUO, TOTP, LDAP. (Simultaneous TOTP & DUO not possible)
|
|
|
|
|
|
### 2. Optionally add a reverse proxy front end to Guacamole of either:
|
|
a) None: Skip Nginx and keep the default Guacamole front end e.g. http://hostname:8080/guacamole
|
|
b) Install Nginx with NO SSL: e.g. http://hostname.local
|
|
c) Install Nginx with SELF SIGNED SSL certificates: e.g. https://hostname.local
|
|
- Newly created Windows & Linux browser certs $site.crt, $site.key & $site.pfx are saved to $DOWNLOAD_DIR/guac-setup
|
|
- Exact custom commands for the import of client certificates is generated on screen and is logged for later reference.
|
|
d) Install Nginx with LET'S ENCRYPT certificates: e.g. https://public.site.com
|
|
|
|
### 3. After installation, optional hardening scripts can be manually run for :
|
|
a. Adding a fail2ban lockdown policy for Guacamole
|
|
b. Encryption of internal traffic between the Gaucamole client and Guacd daemon with SSL
|
|
To do list: (Hardening scripts for Nginx & MFA for shell access)
|
|
|
|
## Install notes:
|
|
|
|
To create an unattended setup, run the link above first, then EXIT the 1-setup.sh script when prompted.
|
|
At this point only a download of all scripts has occurred and from there you may edit the "Silent setup options"
|
|
section at the start of 1-setup.sh as needed.
|
|
|
|
In 1-setup-sh, any variables with an actual setting i.e. Variable="value" will not prompt during interactive setup,
|
|
so with the right combination of saved ="variable" inputs it is fully possible to deploy Guacamole, Nginx and SSL with zero touch!
|
|
|
|
Note: If you have edited 1-setup.sh, you must setup script you saved LOCALLY with ./1-setup.sh (Important: DO NOT RUN AS SUDO, it will prompt for sudo as needed).
|
|
Be aware that if you start setup again from the above link this will re-download and overwrite any of your previous customisations.
|
|
|
|
There should be no need to customise any other scripts before installation. All optional (manually run) scripts are
|
|
dynamically updated with their specific and relevant variables during setup. Essentially, this means that all scripts are built
|
|
to work as a set specific to your particular install. Editing anything but 1-setup.sh (before a full install
|
|
is first completed once) is not recommended.
|
|
|
|
To keep any adaptations you do make to any of the scripts, simply comment out the relevant wget lines in the "Download github setup"
|
|
section at the top of script 1-setup.sh. This willl prevent any subsequent setup re-runs from overwriting your own edited versions.
|
|
|
|
This approach of pre-saving of options in the setup script itself has been taken as a more flexible route because there are far too
|
|
many potential inputs and combinations of command line arguments that would need to be passed to the setup script at the command line for
|
|
a full build, and this would require an impractically long string of setup arguments to type run correctly.
|
|
|
|
# Items downloaded with the setup command above are placed in the $DOWNLOAD_DIR/guac-setup directory...
|
|
1. 1-setup.sh - the parent install script itself
|
|
2. 2-install-guacamole.sh - Guacamole install script (inspired by https://github.com/MysticRyuujin/guac-install)
|
|
3. 3-install-nginx.sh - Installs Nginx and auto configures as a front end for Guacamole (optional)
|
|
4. 4a-install-ssl-self-signed-nginx.sh - Configures self signed ssl certs for Nginx (optional)
|
|
5. 4b-install-ssl-letsencrypt-nginx.sh - Installs and configures Let's Encrypt with Guacamole and Nginx (optional)
|
|
6. add-auth-duo.sh - Adds the Duo MFA extensions if not selected at install (optional)
|
|
7. add-auth-ldap.sh - Adds the LDAP Active Directory extension and guides the specific LDAP setup requirements (optional)
|
|
8. add-auth-totp.sh - Adds the TOTP MFA extension if not selected at install (optional)
|
|
9. add-ssl-guac-gaucd.sh - A hardening script to wrap an extra ssl layer between the guacd server and the Guacamole client (optional)
|
|
10. add-fail2ban.sh - Adds and configures fail2ban to secure Guacamole against brute force attacks
|
|
11. add-smtp-relay-o365.sh - Sets up TLS SMTP authenticated relay with O365 (BYO app password)
|
|
12. backup-guacamole.sh - A simple Guacamole backup script
|
|
13. branding.jar - An extension to customise the Guacomole login screen (optional)
|
|
see: https://github.com/Zer0CoolX/guacamole-customize-loginscreen-extension
|
|
|
|
Special acknowledgement to MysticRyuujin @ https://github.com/MysticRyuujin/guac-install and
|
|
Zer0CoolX @ https://github.com/Zer0CoolX/guacamole-customize-loginscreen-extension whos repos were a helpful source of ideas in assembling this project.
|