Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

GUACAMOLE-1746: Docker Allow usage of custom keystore and custom certificat #805

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

GUACAMOLE-1746: Docker Allow usage of custom keystore and custom certificat #805

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
647eedd
GUACAMOLE-1746: Docker Allow usage of custom keystore and custom cert…
ronansalmon Mar 3, 2023
153722e
GUACAMOLE-1746: moved guacd documentation to guacamole-server repository
ronansalmon Mar 23, 2023
fe6828a
rename environment variables GUACD_SSL_KEYSTORE_FILE and GUACD_SSL_KE…
ronansalmon Oct 30, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions guacamole-docker/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -228,6 +228,31 @@ The process for doing this via the `sqlcmd` utilities included
with SQLServer is documented in
[the Guacamole manual](http://guacamole.apache.org/doc/gug/jdbc-auth.html#jdbc-auth-sqlserver).

Enabling ssl
================
This explains how to enable ssl between guacamole and guacd using a self signed certificate.

You need to create the new certificate on the guacd host, see https://github.com/apache/guacamole-server/blob/master/README
or https://github.com/apache/guacamole-server/blob/master/src/guacd-docker/README.md depending
on the version you will use (standalone vs docker).
Comment on lines +235 to +237
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suspect we should document this somewhere in the Guacamole User Guide (Manual), and link to that instead of linking directly to the Github repository.


Copy the SSL certificate server.p12 to /path/guacamole/certs

```shell
docker run --name some-guacamole \
-e GUACOMOLE_SSL_KEYSTORE_FILE=/home/guacamole/certs/server.p12 \
-e GUACOMOLE_SSL_KEYSTORE_PASS=changeme \
-e GUACD_SSL=true \
-e GUACD_PORT=4822 \
-e GUACD_HOSTNAME=hostname \
-v /path/guacamole/certs:/home/guacamole/certs \
...
-d -p 8080:8080 guacamole/guacamole
```

From the guacamole web interface, add a new connection and enable SSL/TLS whenever using a guacd proxy.


Reporting issues
================

Expand Down
12 changes: 12 additions & 0 deletions guacamole-docker/bin/start.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1041,6 +1041,9 @@ fi
# Use default guacd port if none specified
GUACD_PORT="${GUACD_PORT-4822}"

# guacd ssl is disabled by default
GUACD_SSL="${GUACD_SSL-false}"

# Verify required guacd connection information is present
if [ -z "$GUACD_HOSTNAME" -o -z "$GUACD_PORT" ]; then
cat <<END
Expand Down Expand Up @@ -1068,6 +1071,15 @@ fi
# Update config file
set_property "guacd-hostname" "$GUACD_HOSTNAME"
set_property "guacd-port" "$GUACD_PORT"
set_property "guacd-ssl" "$GUACD_SSL"

# guacd ssl keystore
if [ -n "$JAVA_KEYSTORE_FILE" ]; then
export JAVA_OPTS="${JAVA_OPTS} -Djavax.net.ssl.trustStore=${JAVA_KEYSTORE_FILE}"
fi
if [ -n "$JAVA_KEYSTORE_PASS" ]; then
export JAVA_OPTS="${JAVA_OPTS} -Djavax.net.ssl.trustStorePassword=${JAVA_KEYSTORE_PASS}"
fi

# A comma-separated list of the identifiers of authentication providers that
# should be allowed to fail internally without aborting the authentication process
Expand Down