9 ms·

Apache Guacamole – Clientless remote desktop gateway

129 points by gsempe 7y ago

mkj 7y ago
This works pretty well, the only downside is ctrl-w can't be captured so I keep closing the browser tab!
- haydn3 7y ago
  Use an on-screen keyboard on the Remote side
  - azinman2 7y ago
    That’s not a useful way to remotely work.
    - gsich 7y ago
      Then you need to use RDP. Not in a browser.
- mleonard 7y ago
  Interestingly Ctrl W can actually be captured in Chrome now (on desktop) if the application is fullscreen and they make use of the keyboard lock API. I'm away from my desktop at the moment - can you try it on Chrome? (if you were using another browser). If it doesn't work we should file an issue and suggest they look into the keyboard lock API!
- santa_boy 7y ago
  I had the same problem and just used a node-webkit shell to override the shortcut. It works amazingly well. I use it to work on my EC2 spot instance and works very well even behind a strict corporate proxy. If you need the shell, please ping me on my email.
- rubendv 7y ago
  In our product (https://www.awingu.com/ https://www.awingu.com/), an HTML5 RDP gateway, this actually works properly across browsers.
francescovv 7y ago
Is there anybody around here who tried both Guacamole and https://github.com/novnc/noVNC https://github.com/novnc/noVNC - and can describe pros/cons?
- riffic 7y ago
  The console for digitalocean droplets (kvm virtual servers) is presented with noVNC.
- sansnomme 7y ago
  Guacamole is a VNC wrapper and proxy in a box. It's like comparing Visual Studio to GCC. Apples to oranges.
  - SlavikCA 7y ago
    NoVNC is a wrapper, too. It requires VNC server and present that VNC server as HTML5 app.
    - sansnomme 7y ago
      No you are incorrect. noVNC is still ultimately a client, a simple baked-in static web server does not a PaaS make. Guacamole is a turnkey server that works out of the box where you get a full blown GUI and control panel and everything. Guacamole has the added overhead of the proxy but it's a lot more convenient. Unless you are doing high performance applications like cloud gaming with the server halfway across the globe, Guacamole is more than sufficient if you don't want to fiddle with too many knobs.
      - SlavikCA 7y ago
        I still don't see your point. Yes, Guacamole may be "turnkey server", but noVNC is server, too. noVnc supports only VNC. Guacamole supports VNC, RDP, SSH. noVNC can be run on Windows and Linux. I think Guacamole server has be run on Linux. Not sure about that. That's not apples to oranges.
gunta 7y ago
There is OpenSTF which is similar but for physically remote controlling Smartphones. No need to install any client. Can be controlled from any browser, even from another smartphone. https://openstf.io https://openstf.io
asadlionpk 7y ago
Love this project. I maintain a service around Guacamole[1] with slightly modified protocol and client built in nodejs instead of the included Java one. [1] https://www.allmydesktops.com/ https://www.allmydesktops.com/
- marktangotango 7y ago
  Nice, are you getting any traction with this? The land page says "No Installation Required" but the users desktop does require either VNC or RDP enabled correct? And from the "user inside the firewall" perspective, ports have to be opened for RDP/VNC?
  - asadlionpk 7y ago
    Last I checked, I had 150+ unique weekly active with successful sessions. Most use it to connect to their ec2-like machines and not for teamviewer-like usecase. My main problem is that user’s login creds have to go through our server unencrypted as we essentially provide a translation proxy for VNC/RDP to websockets.
    - marktangotango 7y ago
      So 150 paying customers? Nice work, how have you acquired users?
cerberusss 7y ago
My problem isn't really the protocol or the client. It's that the device is behind a NAT, a corporate firewall or otherwise not reachable at a public IP address. I assume this project doesn't help with that? For now I'm just sticking to products like TeamViewer.
- wtallis 7y ago
  The Guacamole server needs to be reachable from the internet, but the desktops you're connecting to only need to be reachable from the Guacamole server. That helps with some but not all of the situations where desktops aren't reachable with a public IP.
- omnifischer 7y ago
  you could install a opensource SDN like zerotier. The you can connect even if the device is behind NAT/firewall whatever!
  - cerberusss 7y ago
    Good tip, thanks!
- Timothycquinn 7y ago
  RDP uses a single port so opening a port on the public IP NAT for RDP is trivial, however it's always best to hide RDP behind a VPN. This security rule applies to pretty much any remote access protocol, which you should avoid having listening on the open Internet.
  - hunter2_ 7y ago
    I'm all for defense in depth generally, but if a use case demands the convenience of not having this extra step, can't various application protocols be made as tough as a VPN to crack? At that point the VPN just adds obscurity. Wrapping insecure legacy protocols, like SMB for example, with a VPN is absolutely required.
badrabbit 7y ago
I've used this a ton with cuckoo sandbox. If you haven't already set up your own cuckoo and use it to visir untrusted links and open untrusted files. It is fun! I like how guacamole allows you to interact with the session. I know a few (most?) Paid alternatives that won't let you interact.
- Iwillgetby 7y ago
  I never have been able to find a cuckoo install guide that feels straightforward. Any tips or links you can share that helped you?
  - PenguinCoder 7y ago
    Same. I have an installation setup, with KVM, but even after following instructions and setupz cuckoo never reverts the snapshot it used. So after the first use , it reused the potentially malicious snapshot for the next run. If I can't figure out how to fix that , I can't use it.
  - badrabbit 7y ago
    I just used the one in their docs. You don't need any other guide. If you have trouble with the vm,try something simple like virtualbox
jodrellblank 7y ago
Slightly off topic, but it's often bugged me that remote desktop protocols push for things like video and audio redirection as if everyone was on gigabit networking, but I haven't seen much in the way of pushing down down down on bandwidth. Dameware Mini Remote Control from years ago used to have options to set grayscale and dithering and horizontal scanline interleaving(?) and slow refresh frequency and things, but I imagine going beyond that - a line sketch of the visible window borders and their titles, then let me draw a region to update with the mouse, scrape the text out and send that to me. There's ways to build TUIs inside CLIs, but what about squishing a GUI down towards a CLI-style-basics?
gravypod 7y ago
Has anyone set something like this up with sound + multiple viewers? I've been looking for someone to help me watch TV with friends who are remote. I used to use rabb.it but I think that died.
- xemdetia 7y ago
  Have you looked into VLC or OBS for doing this? The big issue that isn't really solved is that most desktop protocols take advantage that the image has a majority of the screen static and only small areas of the screens need updates. Video is the exact opposite problem: nearly every pixel changes across frames and so to have it be reasonably well sync'd especially with sound you need a different kind of protocol. https://www.videolan.org/vlc/streaming.html https://www.videolan.org/vlc/streaming.html
  - gravypod 7y ago
    Rabb.it was really cool because it was a shared web browser that was ephemeral and neutral. Both people could control it, there was very low latency, and you could keep doing sensitive stuff while rabbit was also open. I haven't been able to find a way to do that with RTMP streaming systems.
- heroprotagonist 7y ago
  Zoom works fine. Check the boxes for 'Send desktop sound' and 'Optimize for fullscreen video' and you're set.
WalterSobchak 7y ago
Previous discussions: * 2 yrs ago - https://news.ycombinator.com/item?id=15389727 https://news.ycombinator.com/item?id=15389727 * 2 yrs ago - https://news.ycombinator.com/item?id=15778902 https://news.ycombinator.com/item?id=15778902 * 4 yrs ago - https://news.ycombinator.com/item?id=11744430 https://news.ycombinator.com/item?id=11744430 * 5 yrs ago - https://news.ycombinator.com/item?id=8166388 https://news.ycombinator.com/item?id=8166388

129 points by gsempe 7y ago

mkj 7y ago

This works pretty well, the only downside is ctrl-w can't be captured so I keep closing the browser tab!

haydn3 7y ago
Use an on-screen keyboard on the Remote side
- azinman2 7y ago
  That’s not a useful way to remotely work.
  - gsich 7y ago
    Then you need to use RDP. Not in a browser.
mleonard 7y ago
Interestingly Ctrl W can actually be captured in Chrome now (on desktop) if the application is fullscreen and they make use of the keyboard lock API. I'm away from my desktop at the moment - can you try it on Chrome? (if you were using another browser). If it doesn't work we should file an issue and suggest they look into the keyboard lock API!
santa_boy 7y ago
I had the same problem and just used a node-webkit shell to override the shortcut. It works amazingly well. I use it to work on my EC2 spot instance and works very well even behind a strict corporate proxy. If you need the shell, please ping me on my email.
rubendv 7y ago
In our product (https://www.awingu.com/ https://www.awingu.com/), an HTML5 RDP gateway, this actually works properly across browsers.

francescovv 7y ago

Is there anybody around here who tried both Guacamole and https://github.com/novnc/noVNC https://github.com/novnc/noVNC - and can describe pros/cons?

riffic 7y ago
The console for digitalocean droplets (kvm virtual servers) is presented with noVNC.
sansnomme 7y ago
Guacamole is a VNC wrapper and proxy in a box. It's like comparing Visual Studio to GCC. Apples to oranges.
- SlavikCA 7y ago
  NoVNC is a wrapper, too. It requires VNC server and present that VNC server as HTML5 app.
  - sansnomme 7y ago
    No you are incorrect. noVNC is still ultimately a client, a simple baked-in static web server does not a PaaS make. Guacamole is a turnkey server that works out of the box where you get a full blown GUI and control panel and everything. Guacamole has the added overhead of the proxy but it's a lot more convenient. Unless you are doing high performance applications like cloud gaming with the server halfway across the globe, Guacamole is more than sufficient if you don't want to fiddle with too many knobs.
    - SlavikCA 7y ago
      I still don't see your point. Yes, Guacamole may be "turnkey server", but noVNC is server, too. noVnc supports only VNC. Guacamole supports VNC, RDP, SSH. noVNC can be run on Windows and Linux. I think Guacamole server has be run on Linux. Not sure about that. That's not apples to oranges.

gunta 7y ago

There is OpenSTF which is similar but for physically remote controlling Smartphones. No need to install any client. Can be controlled from any browser, even from another smartphone. https://openstf.io https://openstf.io

asadlionpk 7y ago

Love this project. I maintain a service around Guacamole[1] with slightly modified protocol and client built in nodejs instead of the included Java one. [1] https://www.allmydesktops.com/ https://www.allmydesktops.com/

marktangotango 7y ago
Nice, are you getting any traction with this? The land page says "No Installation Required" but the users desktop does require either VNC or RDP enabled correct? And from the "user inside the firewall" perspective, ports have to be opened for RDP/VNC?
- asadlionpk 7y ago
  Last I checked, I had 150+ unique weekly active with successful sessions. Most use it to connect to their ec2-like machines and not for teamviewer-like usecase. My main problem is that user’s login creds have to go through our server unencrypted as we essentially provide a translation proxy for VNC/RDP to websockets.
  - marktangotango 7y ago
    So 150 paying customers? Nice work, how have you acquired users?

cerberusss 7y ago

My problem isn't really the protocol or the client. It's that the device is behind a NAT, a corporate firewall or otherwise not reachable at a public IP address. I assume this project doesn't help with that? For now I'm just sticking to products like TeamViewer.

wtallis 7y ago
The Guacamole server needs to be reachable from the internet, but the desktops you're connecting to only need to be reachable from the Guacamole server. That helps with some but not all of the situations where desktops aren't reachable with a public IP.
omnifischer 7y ago
you could install a opensource SDN like zerotier. The you can connect even if the device is behind NAT/firewall whatever!
- cerberusss 7y ago
  Good tip, thanks!
Timothycquinn 7y ago
RDP uses a single port so opening a port on the public IP NAT for RDP is trivial, however it's always best to hide RDP behind a VPN. This security rule applies to pretty much any remote access protocol, which you should avoid having listening on the open Internet.
- hunter2_ 7y ago
  I'm all for defense in depth generally, but if a use case demands the convenience of not having this extra step, can't various application protocols be made as tough as a VPN to crack? At that point the VPN just adds obscurity. Wrapping insecure legacy protocols, like SMB for example, with a VPN is absolutely required.

badrabbit 7y ago

I've used this a ton with cuckoo sandbox. If you haven't already set up your own cuckoo and use it to visir untrusted links and open untrusted files. It is fun! I like how guacamole allows you to interact with the session. I know a few (most?) Paid alternatives that won't let you interact.

Iwillgetby 7y ago
I never have been able to find a cuckoo install guide that feels straightforward. Any tips or links you can share that helped you?
- PenguinCoder 7y ago
  Same. I have an installation setup, with KVM, but even after following instructions and setupz cuckoo never reverts the snapshot it used. So after the first use , it reused the potentially malicious snapshot for the next run. If I can't figure out how to fix that , I can't use it.
- badrabbit 7y ago
  I just used the one in their docs. You don't need any other guide. If you have trouble with the vm,try something simple like virtualbox

jodrellblank 7y ago

Slightly off topic, but it's often bugged me that remote desktop protocols push for things like video and audio redirection as if everyone was on gigabit networking, but I haven't seen much in the way of pushing down down down on bandwidth. Dameware Mini Remote Control from years ago used to have options to set grayscale and dithering and horizontal scanline interleaving(?) and slow refresh frequency and things, but I imagine going beyond that - a line sketch of the visible window borders and their titles, then let me draw a region to update with the mouse, scrape the text out and send that to me. There's ways to build TUIs inside CLIs, but what about squishing a GUI down towards a CLI-style-basics?

gravypod 7y ago

Has anyone set something like this up with sound + multiple viewers? I've been looking for someone to help me watch TV with friends who are remote. I used to use rabb.it but I think that died.

xemdetia 7y ago
Have you looked into VLC or OBS for doing this? The big issue that isn't really solved is that most desktop protocols take advantage that the image has a majority of the screen static and only small areas of the screens need updates. Video is the exact opposite problem: nearly every pixel changes across frames and so to have it be reasonably well sync'd especially with sound you need a different kind of protocol. https://www.videolan.org/vlc/streaming.html https://www.videolan.org/vlc/streaming.html
- gravypod 7y ago
  Rabb.it was really cool because it was a shared web browser that was ephemeral and neutral. Both people could control it, there was very low latency, and you could keep doing sensitive stuff while rabbit was also open. I haven't been able to find a way to do that with RTMP streaming systems.
heroprotagonist 7y ago
Zoom works fine. Check the boxes for 'Send desktop sound' and 'Optimize for fullscreen video' and you're set.

WalterSobchak 7y ago

Previous discussions: * 2 yrs ago - https://news.ycombinator.com/item?id=15389727 https://news.ycombinator.com/item?id=15389727 * 2 yrs ago - https://news.ycombinator.com/item?id=15778902 https://news.ycombinator.com/item?id=15778902 * 4 yrs ago - https://news.ycombinator.com/item?id=11744430 https://news.ycombinator.com/item?id=11744430 * 5 yrs ago - https://news.ycombinator.com/item?id=8166388 https://news.ycombinator.com/item?id=8166388