Question

成功设置 dockerized guacamole 0.9.8

使用下面的脚本并使用user登录：guacadmin密码：guacadmin 我能够设置用户和rdp连接。 Guacamole的UI是可用的直接通过docker安装脚本中配置的映射端口（在我的例子中为8380），也可以通过guacamoles手册配置的反向apache代理：

<Location /guac/ >
    Order allow,deny
    Allow from all
    ProxyPass http://localhost:8380/guacamole/ flushpackets=on
    ProxyPassReverse http://localhost:8380/guacamole/
  </Location>

我尝试按照手册进行rdp连接 http://guac-dev.org/doc/gug/configuring-guacamole.html#rdp

但是当使用反向代理时最终得到：

其他用户也发生了这样的事情：

https://sourceforge.net/p/guacamole/discussion/1110834/thread/73abbe35/

如何调试此情况以找到正确的设置？

作为管理员，似乎有些可疑guacadmin我明白了尝试在以下对话框中启用和保存连接权限时：

我可以访问用于权限的mysql数据库，例如与

mysql> show tables;
+---------------------------------------+
| Tables_in_guacamole_db                |
+---------------------------------------+
| guacamole_connection                  |
| guacamole_connection_group            |
| guacamole_connection_group_permission |
| guacamole_connection_history          |
| guacamole_connection_parameter        |
| guacamole_connection_permission       |
| guacamole_system_permission           |
| guacamole_user                        |
| guacamole_user_permission             |
+---------------------------------------+

这是我使用的鳄梨酱的Dockerizing脚本

#!/bin/bash
# 
#   WF 2015-10-26
#
# Guacamole (semi) automatic setup of guacamole Remote Desktop server for docker
# see
#  http://guac-dev.org/doc/gug/guacamole-docker.html
#  http://kalzi.github.io/2015/guacamole-with-docker-containers/
#
# Since: 2015-10-26
#

# config variables

# images
GUAC=glyptodon/guacamole 
GUACD=glyptodon/guacd
MYSQL=mysql

# DB settings
DB=guacamole_db
DB_USER=guacamole_user

# prefix to be used for container names
prefix="lab"

#ansi colors
#http://www.csc.uvic.ca/~sae/seng265/fall04/tips/s265s047-tips/bash-using-colors.html
blue='\033[0;34m'
red='\033[0;31m'
green='\033[0;32m' # '\e[1;32m' is too bright for white bg.
endColor='\033[0m'

#
# a colored message 
#   params:
#     1: l_color - the color of the message
#     2: l_msg - the message to display
#
color_msg() {
  local l_color="$1"
  local l_msg="$2"
  echo -e "${l_color}$l_msg${endColor}"
}

#
# error
#
#   show an error message and exit
#
#   params:
#     1: l_msg - the message to display
error() {
local l_msg="$1"
# use ansi red for error
color_msg $red "Error: $l_msg" 1>&2
exit 1
}

#
# show usage
#
usage() {
echo "usage: guac-setup"
# -h|--help|usage|show this usage
echo "  -h|--help: show this usage"
# -m|--mysql|run mysql in linked container
echo "  -m|--mysql:run mysql in linked container"
# -r|--run|run|run guacamole
echo "  -p|--pull: pull guacamole"
echo "  -pf|--prefix: set the containername prefix"
echo "  -r|--run: run guacamole"
color_msg $blue "Example:"
echo "   sudo ./guac-setup -p -pf test -r"
exit 1
}

#
# generate a random password
#
random_password() {
date +%N | sha256sum | base64 | head -c 16 ; echo
} 

#
# run mysql in container
#
mysql_from_container() {
  local l_option="$1"
  local l_db="$2"
  local l_dbparam=""
  if [ "$l_db" != "" ]
  then
    l_dbparam=" $l_db"
  fi
  local l_cmd='exec mysql -h"$MYSQL_PORT_3306_TCP_ADDR" -P"$MYSQL_PORT_3306_TCP_PORT" -uroot -p"$MYSQL_ENV_MYSQL_ROOT_PASSWORD"'"$l_dbparam"
  #echo "$l_cmd"
  docker run $l_option --link $prefix-mysql:mysql --rm mysql sh -c "$l_cmd" 
} 

#
# initialize the database
#
init_db() {
local l_tmp=/tmp/initdb.sql
#docker run -it $GUAC /bin/bash 
color_msg $blue creating database

cat << EOF | mysql_from_container -i
DROP DATABASE IF EXISTS $DB;
CREATE DATABASE IF NOT EXISTS $DB;
DROP USER '${DB_USER}';
CREATE USER '${DB_USER}' IDENTIFIED BY '${DB_PASSWD}';
GRANT SELECT,INSERT,UPDATE,DELETE ON guacamole_db.* TO 'guacamole_user';
FLUSH PRIVILEGES;
EOF
  color_msg $blue "getting initdb.sh" 
  docker run --rm $GUAC /opt/guacamole/bin/initdb.sh --mysql > $l_tmp 
  color_msg $blue "initializing database"
  # pipe the result thru mysql
  cat $l_tmp | mysql_from_container -i "$DB"
  color_msg $blue "keeping password for db $DB at /var/lib/mysql/guac_passwd"
  #echo $DB_PASSWD
  echo $DB_PASSWD | docker exec -i $prefix-mysql /usr/bin/tee /var/lib/mysql/guac_passwd > /dev/null
}

#  
# run guacamole
# 
run () {
  local l_prefix="$1"
  MYSQL_ROOT_PASSWORD=`random_password`
  color_msg $blue "starting $l_prefix-guacd"
  docker run --name $l_prefix-guacd -d $GUACD
  color_msg $blue "starting $l_prefix-mysql"
  docker run --name $l_prefix-mysql -e MYSQL_ROOT_PASSWORD=$MYSQL_ROOT_PASSWORD -d mysql:latest
  docker ps -a --filter "name=$l_prefix*"
}

# 
# pull images
# 
pull() {
  for image in $GUACD $GUAC $MYSQL 
  do
    docker images | cut -c1-22 | grep $image
    if [ $? -ne 0 ]
    then
      docker pull $image
    else
      color_msg $green "$image already pulled"
    fi
  done
}

#
# start it
#
startit() {
  DB_PASSWD=`docker exec -i $prefix-mysql /bin/cat /var/lib/mysql/guac_passwd`
  # now run the whole show
  docker run --name $prefix-guacamole --link $prefix-guacd:guacd \
     --link $prefix-mysql:mysql      \
     -e MYSQL_DATABASE=$DB  \
     -e MYSQL_USER=$DB_USER    \
     -e MYSQL_PASSWORD=$DB_PASSWD \
     -d -p 8380:8080 $GUAC 
}

# start of script

# check arguments
if [ $# -eq 0 ]
then
  usage
fi
while test $# -gt 0
do
  case $1 in
    # -h|--help|usage|show this usage
    -h|--help) 
      usage;;

    # -p|--pull|pull|pull guacamole
    -p|--pull) 
       pull;;

    # -pf|--prefix|set containername prefix
    -pf|--prefix) 
       shift
       prefix=$1
       ;;

    # -r|--run|run|run guacamole
    -r|--run) 
       run $prefix;;

    # -m|--mysql|run mysql connection to container
    -m|--mysql) 
       mysql_from_container -it
       ;;

    -ms|--mysql_shell) 
      docker exec -it $prefix-mysql /bin/bash
      ;;

    -i|--initdb)
       DB_PASSWD=`random_password`
       init_db
       ;;

    --setup) 
       pull
       run $prefix
       ;;

    --start) 
       startit
       ;;
  esac
  shift
done

Answer 1

如何调试此情况以找到正确的设置？

如果是这样的身份验证错误，您应该做的第一件事是检查Tomcat日志是否有错误。如果发生导致Guacamole返回＆＃34; Permission denied＆＃34;的错误，则应记录该错误，并将在时间上与产生错误的操作相关联。

如果没有任何相关内容跳出来，您也可以尝试enabling debug-level logging。这涉及在GUACAMOLE_HOME中创建包含以下内容的logback.xml文件：

<configuration>

    <!-- Appender for debugging -->
    <appender name="GUAC-DEBUG" class="ch.qos.logback.core.ConsoleAppender">
        <encoder>
            <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
        </encoder>
    </appender>

    <!-- Log at DEBUG level -->
    <root level="debug">
        <appender-ref ref="GUAC-DEBUG"/>
    </root>

</configuration>

如果您使用官方Docker镜像执行此操作，GUACAMOLE_HOME将为/root/.guacamole，您将需要重新启动容器以强制Tomcat重新启动并重新加载Guacamole配置。

如果您在Nginx或Apache之类的代理服务器后面使用Guacamole，我还建议您首先尝试直接连接到Guacamole。不正确的代理配置可能会阻止WebSocket工作，然后阻止回退HTTP隧道工作。从Guacamole的角度来看，您可能会出现这样的错误配置，即您尝试访问资源而未登录，导致权限错误。

Answer 2

http://guac-dev.org/doc/gug/proxying-guacamole.html#websocket-and-apache

具有必要的配置（此处显示适用于正在使用的8380端口和/ guac路径）

<Location /guac/websocket-tunnel>
    Order allow,deny
    Allow from all
    ProxyPass ws://localhost:8380/guacamole/websocket-tunnel
    ProxyPassReverse ws://localhost:8380/guacamole/websocket-tunnel
</Location>

要激活我使用的配置：

a2enmod proxy_wstunnel
Considering dependency proxy for proxy_wstunnel:
Module proxy already enabled
Enabling module proxy_wstunnel.
To activate the new configuration, you need to run:
  service apache2 restart
service apache2 restart
 * Restarting web server apache2

现在，连接可以通过端口8380直接连接，也可以通过反向代理配置将其映射到主服务器上的/ guac。

guacamole您无权访问此连接＆＃34;

2 个答案: