Learn how to – Install and Use Guacamole Remote Desktop on CentOS 8 / RHEL 8.
Apache Guacamole is a clientless remote desktop gateway that supports standard protocols like VNC, RDP, and SSH. Thanks to HTML5, once Guacamole is installed on a server, all you need to access your desktops is a web browser.
Guacamole is separated into two pieces: guacamole-server, which provides the guacd proxy and related libraries, and guacamole-client, which provides the client to be served by your servlet container. In most cases, the only source you will need to build is guacamole-server, and downloading the latest guacamole.war from the project website will be sufficient to provide the client.
Installation on Ubuntu: Install and Use Guacamole Remote Desktop on Ubuntu
Step 1: Server Preparation
Enable EPEL and PowerTools repository:
### CentOS 8 Stream ###
sudo dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
sudo dnf config-manager --set-enabled powertools
### EPEL 8 ###
sudo subscription-manager repos --enable codeready-builder-for-rhel-8-x86_64-rpms
sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
Install and update the system.
sudo dnf update -y
Apache Guacamole has many dependencies and we are going to deal with most of them in this step. You will notice that I used some packages from the Devel repository because getting them from the official repositories was a challenge. Disable it once the packages we need are all installed.
sudo dnf --enablerepo=devel install vim wget unzip make cmake wget gcc zlib-devel compat-openssl10 cairo-devel libuv-devel libjpeg-turbo-devel libjpeg-devel libpng-devel libtool uuid-devel freerdp-devel pango-devel libvncserver-devel pulseaudio-libs-devel openssl-devel libvorbis-devel libwebp-devel libssh2-devel libtheora opus lame-libs libwebsockets-devel libtelnet-devel
Agree to install the dependencies:
...
Transaction Summary
======================================================================================================================================================================================================
Install 153 Packages
Total download size: 48 M
Installed size: 153 M
Is this ok [y/N]: y
Step 2: Install Apache Tomcat
Once the prerequisites are sorted, run the command below to install Apache Tomcat Java servelet container that serves Guacamole java client and all the required dependencies. Since it is in Java, let us first get Java installed.
Install OpenJDK 11
Run the command below to fetch java-11-openjdk.
sudo yum install java-11-openjdk-devel
Create a file and set Java environment variables.
$ sudo vim /etc/profile.d/java11.sh
export JAVA_HOME=$(dirname $(dirname $(readlink -f $(which javac))))
export PATH=$PATH:$JAVA_HOME/bin
export CLASSPATH=.:$JAVA_HOME/jre/lib:$JAVA_HOME/lib:$JAVA_HOME/lib/tools.jar
Source the file to start using it without logging out.
source /etc/profile.d/java11.sh
Install Apache Tomcat on CentOS 8 / RHEL 8
Add Tomcat user.
sudo useradd -m -U -d /opt/tomcat -s /bin/false tomcat
Fetch Apache Tomcat
You can get Apache Tomcat binary distribution from the official Tomcat downloads page. When this guide was being written, the latest stable version was 9.0.62.
Note: We noticed an issue with Tomcat 10, it doesn’t load servlets. Get more information from Stackoverflow. Let us know when this is resolved good people.
cd ~/
VER="9.0.75"
wget https://downloads.apache.org/tomcat/tomcat-9/v${VER}/bin/apache-tomcat-${VER}.tar.gz -P ~
The download will complete and you will proceed to extract the tar file to the /opt/tomcat directory like so:
sudo mkdir /opt/tomcat
sudo tar -xzf apache-tomcat-*.tar.gz -C /opt/tomcat/
sudo mv /opt/tomcat/apache-tomcat-*/ /opt/tomcat/tomcatapp
Since tomcat user is the one who will be running Apache Tomcat, we will have to grant it the requisite rights to the /opt/tomcat directory. Run the command below to make this happen
sudo chown -R tomcat: /opt/tomcat
Then make all of the shell scripts in /opt/tomcat/tomcatapp/bin directory executable
sudo find /opt/tomcat/tomcatapp/bin/ -type f -iname "*.sh" -exec chmod +x {} ;
Next, we are ready to add Tomcat’s Systemd service so that we can have an easy time starting and stopping it like other services in your server. To do that, we will have to create a new file then populate it with the right configuration as follows
$ sudo vim /etc/systemd/system/tomcat.service
[Unit]
Description=Tomcat 9 servlet container
After=network.target
[Service]
Type=forking
User=tomcat
Group=tomcat
Environment="JAVA_HOME=/usr/lib/jvm/jre-openjdk/"
Environment="JAVA_OPTS=-Djava.security.egd=file:///dev/urandom -Djava.awt.headless=true"
Environment="CATALINA_BASE=/opt/tomcat/tomcatapp"
Environment="CATALINA_HOME=/opt/tomcat/tomcatapp"
Environment="CATALINA_PID=/opt/tomcat/tomcatapp/temp/tomcat.pid"
Environment="CATALINA_OPTS=-Xms512M -Xmx1024M -server -XX:+UseParallelGC"
ExecStart=/opt/tomcat/tomcatapp/bin/startup.sh
ExecStop=/opt/tomcat/tomcatapp/bin/shutdown.sh
[Install]
WantedBy=multi-user.target
Our new systemd file is clean. Save it then reload the daemon so that SystemD daemon will read it.
sudo systemctl daemon-reload
Then start the service
sudo systemctl enable --now tomcat
And tomcat should be running happily
$ systemctl status tomcat
● tomcat.service - Tomcat 9 servlet container
Loaded: loaded (/etc/systemd/system/tomcat.service; enabled; vendor preset: disabled)
Active: active (running) since Fri 2023-01-27 10:16:55 UTC; 4min 42s ago
Process: 69867 ExecStart=/opt/tomcat/tomcatapp/bin/startup.sh (code=exited, status=0/SUCCESS)
Main PID: 69877 (java)
Tasks: 29 (limit: 23036)
Memory: 173.8M
CGroup: /system.slice/tomcat.service
└─69877 /usr/lib/jvm/jre-openjdk//bin/java -Djava.util.logging.config.file=/opt/tomcat/tomcatapp/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager>
Jan 27 10:16:55 rocky8.mylab.io systemd[1]: Starting Tomcat 9 servlet container...
Jan 27 10:16:55 rocky8.mylab.io startup.sh[69867]: Existing PID file found during start.
Jan 27 10:16:55 rocky8.mylab.io startup.sh[69867]: Removing/clearing stale PID file.
Jan 27 10:16:55 rocky8.mylab.io startup.sh[69867]: Tomcat started.
Step 3: Build the Guacamole Server From Source
guacamole-server contains all the native, server-side components required by Guacamole to connect to remote desktops. It provides a common C library, libguac, which all other native components depend on, as well as separate libraries for each supported protocol, and a proxy daemon, guacd, the heart of Guacamole.
Download the latest stable version of guacamole-server
cd ~/
VER=1.5.2
wget https://archive.apache.org/dist/guacamole/$VER/source/guacamole-server-$VER.tar.gz
Extract the downloaded archive.
tar -xvf guacamole-server-$VER.tar.gz
Change into the extracted directory.
cd guacamole-server-*/
Configure the build environment. Running configure will determine which libraries are available on your system and will select the appropriate components for building depending on what you actually have installed.
./configure --with-init-dir=/etc/init.d
Then compile guacamole-server. Quite a bit of output will scroll up the screen as all the components are compiled
make
Once everything finishes, all you have left to do is type “sudo make install” to install the components that were built, and then “ldconfig” to update your system’s cache of installed libraries.
sudo make install
Update the system’s cache of installed libraries.
sudo ldconfig
Refresh systemd for it to find the guacd (Guacamole proxy daemon) service installed in /etc/init.d/ directory.
sudo systemctl daemon-reload
Once reloaded, start the guacd service.
sudo systemctl start guacd
sudo systemctl enable guacd
And to have that smile on your face, check its status.
$ systemctl status guacd
● guacd.service - LSB: Guacamole proxy daemon
Loaded: loaded (/etc/rc.d/init.d/guacd; generated)
Active: active (running) since Fri 2023-01-27 10:08:17 UTC; 52s ago
Docs: man:systemd-sysv-generator(8)
Tasks: 1 (limit: 23036)
Memory: 10.1M
CGroup: /system.slice/guacd.service
└─69527 /usr/local/sbin/guacd -p /var/run/guacd.pid
Jan 27 10:08:17 rocky8.mylab.io systemd[1]: Starting LSB: Guacamole proxy daemon...
Jan 27 10:08:17 rocky8.mylab.io guacd[69525]: Guacamole proxy daemon (guacd) version 1.5.2 started
Jan 27 10:08:17 rocky8.mylab.io guacd[69524]: Starting guacd:
Jan 27 10:08:17 rocky8.mylab.io guacd[69525]: Starting guacd:
Jan 27 10:08:17 rocky8.mylab.io guacd[69525]: uacd[69525]: INFO: Guacamole proxy daemon (guacd) versio
Jan 27 10:08:17 rocky8.mylab.io systemd[1]: Started LSB: Guacamole proxy daemon.
Jan 27 10:08:17 rocky8.mylab.io guacd[69527]: Listening on host ::1, port 4822
Jan 27 10:08:17 rocky8.mylab.io guacd[69524]: uacd[695
Step 4: Install the Guacamole Web Application
There are two critical files involved in the deployment of Guacamole: guacamole.war, which is the file containing the web application, and guacamole.properties, the main configuration file for Guacamole. The recommend way to set up Guacamole involves placing these files in standard locations, and then creating symbolic links to them so that Tomcat can find them
guacamole-client contains all Java and Maven components of Guacamole (guacamole, guacamole-common, guacamole-ext, and guacamole-common-js). These components ultimately make up the web application that will serve the HTML5 Guacamole client to users that connect to your server. This web application will connect to guacd, part of guacamole-server, on behalf of connected users in order to serve them any remote desktop they are authorized to access.
Install Guacamole Client
The Guacamole client is available as a binary. To install it, just pull it from the Guacamole binaries downloads page as shown below, copy it to /etc/guacamole/ directory and rename it at the same time.
cd ~
VER=1.5.2
sudo mkdir /etc/guacamole
wget https://archive.apache.org/dist/guacamole/$VER/binary/guacamole-$VER.war
sudo mv guacamole-$VER.war /etc/guacamole/guacamole.war
To install the Guacamole client binary, create a symbolic link of the guacamole client to Tomcat webapps directory as shown below;
sudo ln -s /etc/guacamole/guacamole.war /opt/tomcat/tomcatapp/webapps
Step 5: Configure Guacamole Server
After the installation of the Guacamole server daemon, you need define how to Guacamole client will connect to the Guacamole server (guacd) under the /etc/guacamole/guacamole.properties configuration file. Within this configuration, you need to simply define Guacamole server hostname, port, user mapping configuration file, authentication provider.
GUACAMOLE_HOME is the name given to Guacamole’s configuration directory, which is located at /etc/guacamole by default. All configuration files, extensions, etc. reside within this directory.
Create GUACAMOLE_HOME environment variable
echo "GUACAMOLE_HOME=/etc/guacamole" | sudo tee -a /etc/default/tomcat
Create /etc/guacamole/guacamole.properties config file and populate is as shown below:
$ sudo vim /etc/guacamole/guacamole.properties
guacd-hostname: localhost
guacd-port: 4822
user-mapping: /etc/guacamole/user-mapping.xml
auth-provider: net.sourceforge.guacamole.net.basic.BasicFileAuthenticationProvider
After the configuration is as pretty as above, save it and link the Guacamole configurations directory to Tomcat servlet directory as illustrated below.
sudo ln -s /etc/guacamole /opt/tomcat/tomcatapp/.guacamole
sudo chown -R tomcat: /opt/tomcat
Step 6: Setup Guacamole Authentication Method
Guacamole’s default authentication method reads all users and connections from a single file called user-mapping.xml. In this file, you need to define the users allowed to access Guacamole web UI, the servers to connect to and the method of connection.
Generate the MD5 hash of passwords for a user you are going to use to log into Guacamole web user interface. Replace you password accordingly.
$ echo -n StrongPassword | openssl md5
(stdin)= 0f6e4a1df0cf5ee97c2066953bed21b2
Once your password is ready, create the user-mapping file with sample contents illustrated below. You can place any hostname, usernames and hosts as per your environment.
$ sudo vim /etc/guacamole/user-mapping.xml
<user-mapping>
<!-- Per-user authentication and config information -->
<!-- A user using md5 to hash the password
guacadmin user and its md5 hashed password below is used to
login to Guacamole Web UI-->
<authorize
username="admin"
password="0f6e4a1df0cf5ee97c2066953bed21b2"
encoding="md5">
<!-- First authorized Remote connection -->
<connection name="RHEL 7 Maipo">
<protocol>ssh</protocol>
<param name="hostname">10.10.10.10</param>
<param name="port">22</param>
</connection>
<!-- Second authorized remote connection -->
<connection name="Windows Server 2019">
<protocol>rdp</protocol>
<param name="hostname">10.10.10.5</param>
<param name="port">3389</param>
<param name="username">tech</param>
<param name="ignore-cert">true</param>
</connection>
</authorize>
</user-mapping>
Reference: Guacamole configurations documentation
Create guacd.conf
file with the following contents.
$ sudo vim /etc/guacamole/guacd.conf
[daemon]
pid_file = /var/run/guacd.pid
#log_level = debug
[server]
#bind_host = localhost
bind_host = 127.0.0.1
bind_port = 4822
#[ssl]
#server_certificate = /etc/ssl/certs/guacd.crt
#server_key = /etc/ssl/private/guacd.key
Good stuff. Once everything is done, restart both Tomcat and guacd to realize the changes made.
sudo systemctl restart tomcat guacd
In case you have a firewall running and you haven’t allowd the ports yet, then this is the chance to do so as quickly as below:
sudo firewall-cmd --permanent --add-port={4822,8080}/tcp
sudo firewall-cmd --reload
Step 7: Getting Guacamole Web Interface
Thus far, we have setup everything well and we should therefore be ready to access the application we have been toiling to bring up. To access Guacamole’s web interface, simply point your browser to http://ip-or-domain-name:8080/guacamole and you should be greeted with a login screen as shown below:
As you can see, the connections we had made in the configuration file are already loaded when you login.
Simply click on the one you would wish to connect to and you will be prompted with a username and password whether via SSH or RDP.
Enter your server password
And we should be allowed in
Closing Remarks
Because the Guacamole client is an HTML5 web application, use of your computers is not tied to any one device or location. As long as you have access to a web browser, you have access to your machines. With both Guacamole and a desktop operating system hosted in the cloud, you can combine the convenience of Guacamole with the resilience and flexibility of cloud computing. Check it out and leverage on its flexibility and convenience especially during this season where most of us are working from home.
References:
As we appreciate your continued support, keep the fun as you grab other ideas from the exquisite guides shared below.
- Easy way to Create SSH tunnels on Linux CLI
- Install and Configure OpenSSH Server on Windows Server
- How To Set Up Two factor (2FA) Authentication for SSH on CentOS / RHEL 7/8
Leave a Reply
You must be logged in to post a comment.