Setting Up Apache Guacamole LDAP Authentication in Docker 🌱

What is Apache Guacamole?

Apache Guacamole is a clientless remote desktop gateway. It supports standard protocols like VNC, RDP, and SSH. We call it clientless because no plugins or client software are required. Thanks to HTML5, once Guacamole is installed on a server, all you need to access your desktops is a web browser. - https://guacamole.apache.org/

Installing Docker

  1. Log into the Linux based device
  2. Run the following commands in the terminal
    # install prerequisites
    sudo apt install apt-transport-https ca-certificates curl software-properties-common gnupg-agent -y
    # add docker gpg key
    curl -fsSL https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release)/gpg | sudo apt-key add -
    # add docker software repository
    sudo add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release) $(lsb_release -cs) stable"
    # install docker
    sudo apt install docker-ce docker-compose containerd.io -y
    # enable and start docker service
    sudo systemctl enable docker && sudo systemctl start docker
    # add the current user to the docker group
    sudo usermod -aG docker $USER
    # reauthenticate for the new group membership to take effect
    su - $USER

Configuring Apache Guacamole

  1. Continue with the following commands in a terminal window
    # create working directories
    mkdir ~/docker/mariadb -p
    # set owner of docker directory
    sudo chown $USER ~/docker -R
    # download the guacamole container
    docker pull guacamole/guacamole
    # run the mariadb docker container
    docker run -d --name mariadb -e MYSQL_ROOT_PASSWORD=r00tp@ss -v ~/docker/mariadb:/var/lib/mysql -p 3306:3306 --restart=unless-stopped mariadb:latest
    # create database init script
    docker run --rm guacamole/guacamole /opt/guacamole/bin/initdb.sh --mysql > ~/docker/mariadb/guacamole_db.sql
    # connect to mariadb container shell
    docker exec -ti mariadb /bin/bash
    # connect to mariadb as root user
    mysql -uroot -pr00tp@ss
    # create the database
    create database guacamole;
    # create and configure the database user
    GRANT ALL ON guacamole.* TO 'guacamole_rw'@'%' IDENTIFIED BY 'Guac@m0le!';
    # flush mariadb privileges
    flush privileges;
    # exit mariadb cli
    quit
    # import the guacamole schema
    cat /var/lib/mysql/guacamole_db.sql | mysql -uroot -pr00tp@ss -Dguacamole
    # exit the maridb container shell
    exit
    # run the guacd container
    docker run -d --name guacd --network host guacamole/guacd
    # run the guacamole container
    # update the LDAP environmental variables as needed
    docker run -d --name guacamole --network host -e GUACD_HOSTNAME=127.0.0.1 -e MYSQL_HOSTNAME=127.0.0.1 -e MYSQL_DATABASE=guacamole -e MYSQL_USER=guacamole_rw -e MYSQL_PASSWORD=Guac@m0le! -e LDAP_HOSTNAME="10.10.27.1" -e LDAP_PORT=389 -e LDAP_ENCRYPTION_METHOD="none" -e LDAP_USER_BASE_DN="DC=i12bretro,DC=local" -e LDAP_USERNAME_ATTRIBUTE="sAMAccountName" -e LDAP_SEARCH_BIND_DN="CN=Readonly SVC,CN=Users,DC=i12bretro,DC=local" -e LDAP_SEARCH_BIND_PASSWORD="Read0nly!" --restart=unless-stopped guacamole/guacamole
  2. Open a web browser and navigate to http://DNS-or-IP:8080/guacamole/
  3. Log in with guacadmin/guacadmin
  4. Go to Settings > Users
  5. Create a new admin user and grant all permissions
  6. Log out and log in as the new admin user
  7. Go to Settings > Users > Delete the guacadmin user
  8. Go to Settings > Users
  9. Create a new user with the LDAP user name, leave the password field blank and grant the necessary permissions
  10. Log out and log in as the LDAP user using the LDAP password
  11. Enjoy browser based SSH, VNC, RDP and more

Documentation: https://guacamole.apache.org/doc/gug/guacamole-docker.html#ldap-authentication