Apache Guacamole behind nginx reverse proxy strange headers reddit / selfhosted ---------------------------------------------------------------------- wayne1191 · 2023-11-20 11:19 Hello, I installed Apache Guacamole using this script: https://github.com/MysticRyuujin/guac-install I am using nginx as a reverse proxy to forward to the guacamole host... Nginx conf (redirect to 443 is set in default conf): server { listen 443 ssl; server_name vm.domain.com; ssl_certificate /etc/letsencrypt/live/domain.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/domain.com/privkey.pem; location / { proxy_pass http://IP-ADDRESS:8080/guacamole; proxy_buffering off; proxy_http_version 1.1; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; access_log off; } } If I open “vm.domain.com” it shows me the nginx welcome page. If I open “vm.domain.com/guacamole” it shows me the guacamole page, but strange field-names (never seen this before...). When I open it by using the local IP, everything is fine. So how do I change the tomcat9 default path, that I don't have to use "vm.domain.com/guacamole" just "vm.domain.com" (also with local ip)? And how do I get it shown right? ---------------------------------------------------------------------- tusti070 · 2023-11-20 11:48 It's because, something is bad coded in index.html of guacamole. i18n traduction must try to load resources with absolute path without a / in front of. You can turn on dev window in your browser and look at the resources, some one should fail at loading (404). ---------------------------------------------------------------------- wayne1191 · 2023-11-20 13:15 It failed to load webpack:// -> guacamole.c99….js (unknown url scheme) There are also errors with fonts, angular.min.js and jquery.min.js Says something about Content Policy Security. Can you help me further? Sorry I’m not an expert and haven’t got issues like that so far… ---------------------------------------------------------------------- CoderAU · 2023-11-20 17:18 You'll need to enable CORS on the proxy I believe, by adding Access- Control-Allow-Origin: * to the header, or look up more info on how to do this, I'm not too well versed with Nginx but that's the issue coming from a web dev perspective. ---------------------------------------------------------------------- wayne1191 · 2023-11-20 18:10 Thank you so much location/“-config: add_header 'Access-Control—Allow-Origin' 'https://vm.hoffelner.me'; Are there any security risks by enabling CORS? ---------------------------------------------------------------------- latkde · 2023-11-20 18:13 > So how do I change the tomcat9 default path, that I don't have to use "vm.domain.com/guacamole" just "vm.domain.com" Unfortunately, you don't. Not even the Guacamole Docker container does this. I would configure Nginx to redirect from `/` to `/guacamole/`. You could also try reconfiguring Tomcat. Perhaps renaming the `guacamole.war` to `ROOT.war` is enough, but I vaguely remember that Tomcat is more tricky than that. Looks like the Guacamole web frontend doesn't know it is being proxied, and generates some links to translation resources using an absolute path. Also, a security note: absolutely do not run `guacd` (the guacamole- server component) as unconfined root or on a publicly accessible port. Guacd has no authentication, and could thus be used as an open proxy by attackers (also to look into your network). Guacd is also written in C, and not in an overly security-conscious manner. It is likely that the code contains quite some vulnerabilities. The easiest way to harden guacd is to run it in a Docker container and to "bind" it to localhost (not 0.0.0.0). So instead of `docker run --rm -p 4822:4822 my-guacd-image` you might specify the port as `-p 127.0.0.1:4822:4822`, which only allows incoming connections from within the server. (But you might not want a separate network namespace at all, especially since this affects the destination IP address for your VNC connections. Then, use `--net=host` for Docker and set `localhost` in the guacd config file). Instead of running in a container, it may be acceptable to use Systemd options for hardening, in particular running as a separate user. Use `systemd-analyze security` to get suggestions about Systemd features that might be beneficial. ---------------------------------------------------------------------- wayne1191 · 2023-11-20 18:14 Thank you so much <3 Added the following line to the „server location/“-config: add_header 'Access-Control-Allow-Origin' 'https://my.domain.com'; Are there any security risks with CORS? And should I enable TFA for guacamole? ---------------------------------------------------------------------- wayne1191 · 2023-11-20 19:17 Thanks for your help, I got it to work. I installed it natively. I changed the server.xml of the tomcat/guacamole host so I don’t need /guacamole and enabled CORS on the nginx reverse proxy (it blocked some .js-files) Why should I not run guacd as root? Guacamole is running on a separate host and I only enabled http/https to connect to my DMZ. I am running the hosts on a Proxmox server and set firewall-rules to the LXCs/VMs ---------------------------------------------------------------------- akircher · 2023-11-20 23:32 I had a bit of hassle with Guacamole too. I eventually got it working like this: ``` location / { proxy_pass http://guacamole:8080/guacamole/; proxy_buffering off; proxy_http_version 1.1; proxy_cookie_path /guacamole/ /; proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Server $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Host $host; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; } ``` Happy to send you my `docker-compose.yml` if you want a copy. ---------------------------------------------------------------------- maximus459 · 2023-11-21 14:30 Just want to know, does the copy paste and session recording work for you? I've tried a couple of docker images, and dinner features are buggy.. - while you have to use the hosted mode the history function to show the actual use details - ...the recording and copy/paste never seems to work, the option is there but the function first work ---------------------------------------------------------------------- wayne1191 · 2023-11-21 14:35 Copy/Paste works fine, recording not tested yet ---------------------------------------------------------------------- latkde · 2023-11-21 15:05 ok, if you're running guacd in its own LXC container and prevent access to guacd except from within your network that should be reasonably safe. LXC and Docker use the same underlying Linux security features.