In FAR Over My Head... RDP on Server 2012 with Guacamole?

[JRA]

Hi all - aside from the regular that's killing me, this is another awful one.

 

Long and short is I've got no staff and no time. It's killed me on my W10 deployment and I need to overhaul the old 2008R2 RDP servers with Guacamole frontend to 2012 RDP.

 

No problem, I thought, I can just in-place upgrade them to 2012 and keep the wolf from the door.

 

How wrong I was...

 

So, this is different. Very different. I'm tempted to just strip out Guacamole altogether unless I can figure this out. This might not be news to anyone else but it's changed massively since the last time I looked at anything to do with this!

 

So, old RDP server Guacamole presented you with the choice of server. You logged in, got to a desktop. I would very much like to have that back again!

 

How on earth do I go about doing that? If not, would YOU in my shows just strip out Guacamole, put a link (one for a staff server one for a student server) on the website and go virtual machine based rather than session based?

 

Very grateful for any help at all. Thanks for reading.

[dhicks]

So, old RDP server Guacamole presented you with the choice of server. You logged in, got to a desktop. I would very much like to have that back again!

 

I'm part-way through writing an OAuth-authorised gateway service for Guacamole, allowing users to log in to a remote desktop using their existing GSuite / O365 / etc credentials. I have a working Guacamole setup, which might be at least partially suitable or what you're doing.

 

I found getting Guacamole working on Debian 10 to be difficult, and have stuck with Debian 9 for the moment. On a freshly installed Debian 9 VM, I installed:

 

# Cairo (library used by Guacamole for rendering graphics).
apt-get install -y libcairo2-dev

# libjpeg62-turbo-dev (library used by Guacamole for handling JPEG image data).
apt-get install -y libjpeg62-turbo-dev

# libpng-dev (library used by Guacamole for handling PNG image data).
apt-get install -y libpng-dev

# libossp-uuid-dev (library used by Guacamole for handling PNG image data).
apt-get install -y libossp-uuid-dev

# FFmpeg (library used by Guacamole for handling video encoding).
apt-get install -y libavcodec-dev
apt-get install -y libavutil-dev
apt-get install -y libswscale-dev

# FreeRDP (library used by Guacamole to handle RDP connections).
# Note that, hopefully, in a future version of Gaucamole, this dependancy is going to
# change from libfreerdp-dev to freerdp2-dev. For the moment, we are sticking with
# Debian 9 ("Stretch").
apt-get install -y libfreerdp-dev

# Pango (library used by Guacamole to support SSH and Telnet connections).
apt-get install -y libpango1.0-dev

# libssh2 (library used by Guacamole to support SSH connections).
apt-get install -y libssh2-1-dev

# libtelnet (library used by Guacamole to support Telnet connections).
apt-get install -y libtelnet-dev

# libvncserver (library used by Guacamole to support VNC connections).
apt-get install -y libvncserver-dev

# Pulse Audio (library used by Guacamole to support audio over VNC).
apt-get install -y libpulse-dev

# libssl (library used by Guacamole to support SSL) is installed.
apt-get install -y libssl-dev

# Ogg Vorbis (library used by Guacamole to support Ogg Vorbis audio).
apt-get install -y libvorbis-dev

# libwebp (library used by Guacamole to support WebP image data).
apt-get install -y libwebp-dev

# Tomcat servlet container (used for serving Guacamole client contents to users connecting to the Guacamole server via web).
apt-get install -y tomcat8 tomcat8-admin tomcat8-common tomcat8-user

 

How are you handling SSL? I installed Nginx to act as a reverse proxy, along with support for Let's Encrypt:

 

# Nginx web/proxy server (used to proxy the Tomcat server and provide SSL)...
apt-get install -y nginx
# ...with support for Let's Encrypt.
apt-get install -y python3-acme python3-certbot-nginx python3-mock python3-openssl python3-pkg-resources python3-pyparsing python3-zope.interface

[JRA]

Thanks for that. Okay, I'm in over my head with Guacamole then and that'll need to go. I'll do a fairly vanilla link on the website, SSL cert on the RD server sort-of-thing and go down to the one server for everyone.

 

I also discovered the registry key change to allow a remote desktop in the list of apps too, so hopefully I'm not MILES away.

 

Thanks so much though. With no staff last 6 months AND Sophos being dreadful AND W10 still far off I really thought I'd have a bit of luck...

[Norphy]

Are you stuck on Windows 2012? With 2016, there is a first party HTML5 interface available for RDP sessions that works very well. It’s very easy to set up; put in an RDS gateway, run a couple of PowerShell commands and that’s it.

[free780]

Or buy Ericom Access Now for RDCB. It won't SSO to Office 365 but you can put it behind the app proxy. The MS html client doesn't support limiting RDP connections to domain joined devices. So you have to put it behind the app proxy to force 2FA. I wouldn't rely on just password authentication.

[localzuk]

We've moved to the HTML client built in to 2016 here too. Even if you don't use 2016 for the RDSH server itself, you can install it on a RD gateway/web access server set up with 2012 as the RDSH.

[JRA]

Thank you everyone for leaping into this and bailing me out. It was very much appreciated and I felt all desperate!

 

In the end I did manage to get it working, and working the way I wanted too! Still have my guacamole and we're "getting on" together.

 

Thanks everybody enormously.

[Alis_Klar]

How does the Security of Guacamole and Ericom compare to 1st party Windows RDS gateway in terms of vulnerabilites. Are there any consultantcies that will implement and support Guacamole?

 

Thinking for COVID-19 we currently use foldr but would like remote desktop for Apps such as ActivInspire and BYOD where the data never leaves the network.

[aguacate]

Ericom has a 60 day trial license running now, it was £60 per seat when I last enquired for a perpetual license, I like Guacamole but it has a steep learning curve but it does work with google authenticator for 2FA, RDP is heavily targeted by malware across the internet so it really needs a RDS Gateway in front of it which delays implementation Edited March 20, 2020 by aguacate

[mavhc]

https://www.cvedetails.com/vulnerability-list/vendor_id-45/product_id-43051/Apache-Guacamole.html

 

https://www.cvedetails.com/product/27820/Ericom-Accessnow-Server.html?vendor_id=13381

 

https://msrc-blog.microsoft.com/2019/08/13/patch-new-wormable-vulnerabilities-in-remote-desktop-services-cve-2019-1181-1182/

[dhicks]

Are there any consultantcies that will implement and support Guacamole?

 

This was what I was getting geared up to do - provide and support Guacamole with an OAuth-capable gateway to make it nice and easy for teachers / pupils to use. It'll be a little while until I have time to work on this again as I'm busy with school stuff at the moment, but it's something I plan to get back to sorting out as I can only see demand increasing in the future.

[mavhc]

https://guacamole.apache.org/support/#commercial-support

[gh5000]

Got mine running. Feel like I'm an expert after all that. Problem is I don't use Linux often enough and forget most of it all.

 

Mysql, TOTP and LDAP setup

 

Couple of things I came across. You can't use NLA on Guac without entering the computer creds in Guac. The LDAP part comes in handy there as you can pass ${GUAC_USERNAME} and ${GUAC_PASSWORD} through to the computer.

 

There is another issue with W10 1903 and above clients. Have to set them to use the basic Wddm driver in the registry for RDP to work over Guac