10 ms·

Apache Guacamole

503 points by WallyFunk 5y ago

iamkarlson 5y ago
I'm really looking forward to having all my working stuff in the cloud. however, it's so annoying sometimes that networking is not suitable yet to work from ANYWHERE. especially in public places where you can pull a laptop from the bag and start working, with remote it's mostly a challenge
- shepherdjerred 5y ago
  I've found that having a dedicated WiFi hotspot mostly solves this issue, as long as you're somewhere with decent cell service. I haven't tried it with desktop streaming, but VS Code remote development is a dream, even with little bandwidth.
  - brutal_chaos_ 5y ago
    My local library has WiFi Hotspots to checkout for free. They are T-Mobile hotspots and Fast.com reports: 35Mbps down (steady) 3Mbps up (decays quickly suggesting shown upload is "boost" / "burst" speeds or possibly throttled heavily in some other manner)
  - iamkarlson 5y ago
    it doesn't really work well. network coverage differ from place to place. also, whenever you sit in some shitty coworking, their wifi should give you hard time getting this working
- waynesonfire 5y ago
  Setup wireguard
- pjmlp 5y ago
  Ah the memories of going for a coffee break at the university, as $HOME failed to mount over NFS due to a bad terminator on the campus network.
charcircuit 5y ago
>We call it clientless because no plugins or client software are required. >all you need to access your desktops is a web browser. So which is it? Not having a client is nonsense.
Krisjohn 5y ago
We have a customer that was using ports directly exposed to the Internet to get to embedded VNC servers in some plant monitoring gear. I set them up a Guacamole VM from Bitnami or Turnkey on their environment and turned them loose on it. Since self-hosting and 100% control is exactly what they want, they loved it and we don't have to worry about hundreds of Internet-exposed VNC servers with the same single password.
semireg 5y ago
Is this something that would allow me to demo my electron app to visitors on my website? Or take it a step further and sell instances to users? If someone has consulting chops to help me with this I’d love to chat.
dmitrygr 5y ago
I use guacamole. It is awesome and super convenient. Nice insulation from various protocol bugs too. I don’t care what exploitable bugs RDP server in windows has if I access it only over guac.
- johncena33 5y ago
  Do you need a static ip address for it?
  - shepherdjerred 5y ago
    You could always use an IPv6 address, or setup something like Tailscale.
    - jeroenhd 5y ago
      As silly and astonishing as it is, I've heard from some (mostly American) ISPs that a static IPv6 subnet is either not available for consumers or costs extra. Yes, that's right, some ISPs rotate IPv6 subnets, negating many things IPv6 was invented for in the first place. Tailscale, Nebula or any of the automagical VPN solutions you can run yourself (like Innernet, https://github.com/tonarino/innernet https://github.com/tonarino/innernet) will probably negate the issue as long as you can reach some server with a static IP.
      - tinus_hn 5y ago
        Of course, because if you can use it to offer services, it’s a ‘pro’ connection!
      - piyh 5y ago
        Do other people use dynamic DNS services offered by domain registrars? I've use one for years and never have had an issue.
        jeroenhd 5y ago
fzumstein 5y ago
I found noVNC easier to use.
- rob_c 5y ago
  Best used in combination with guac imo. Good way of getting past industry firewalls too
ww520 5y ago
This is awesome. Sometimes I got lazy and don’t want to go to another room to access the computers. This allows for easy remote desktop usage.
rob_c 5y ago
Amazing project used it to host 40 accounts on a server recently to host remote tutorials at a workshop recently :)
- jll29 5y ago
  That's the kind of scenario that I also have in mind. What server and network did you use to serve 40 clients?
  - rob_c 5y ago
    Dual Xeon gold with 56 core. Ended up rolling a custom docker image and instance with vnc all 40 managed by guac... Took some sleepless nights
maximedupre 5y ago
That is kind of mind-blowing. The landing page and the video using Windows XP makes it look unappealing though I'd still use 10/10
- 5e92cb50239222b 5y ago
  It's not XP. Looks like 7 with the last decent theme that's ever came from them.
  - pjmlp 5y ago
    Nope, that is definitely XP, past Vista the Windows 2000 like theming was removed.
    - mopsi 5y ago
      It wasn't. Classic Theme was available on Windows 7 and Windows 8. https://www.google.com/search?q=windows+7+classic+theme https://www.google.com/search?q=windows+7+classic+theme
    - alphabet9000 5y ago
      the windows version in the demo video is windows 7 ultimate https://i.jollo.org/CaCZBXbc.png https://i.jollo.org/CaCZBXbc.png
- mopsi 5y ago
  > The landing page /-/ makes it look unappealing though Why, loads too fast?
- ldoughty 5y ago
  We use guacamole as a way to gatekeep access to servers which are explicitly made vulnerable for students to attack. We give students a Kali Linux box, and a server with dozens of vulnerabilities.. and we don't have to worry about those vulnerable targets being otherwise internet accessible. We've done over 200,000 VMs behind Guacamole over 4 years without incident, despite having machines with the username/password of "student", or being unpatched for 4 years (spinning up old Ubuntu 14 images)
moontear 5y ago
Setting it up via Docker container is a lot easier than a custom setup. I really am not a fan of Guacamole. I love the idea and convenience of having everything running in the browser from the client side, but I much prefer a real RDP session (via VPN) than having it in the browser. Why? Keyboard shortcuts! I am soooo much slower because browsers (not guacs fault - but at the same time it is its fault since I would love a native client) can’t catch all keys (e.g. Windows key). ALT-TAB? Yeah you just tabbed away from Guac. Or the new fancy WIN-TAB, no way that gets passed on to Guac. Also the file sharing experience is worse. RDP? Just drag an drop or Ctrl-C, Ctrl-V. That doesn’t always work in Guac…
- reaperducer 5y ago
  Couldn't Guacamole hijack the keyboard shortcuts? One of the reasons I hate Wrike is that it hijacks Command-Shift-N (New private window) in Safari.
- stult 5y ago
  IIRC you can install the guac site as a PWA in your browser and sometimes the browser then allows more keyboard events to bubble up from the OS to the javascript layer where guac lives. Doesn't fix everything, but it can help.
- punnerud 5y ago
  The security is probably better if you enable HTTPS than RDP? When I use RDP it is always over SSH (port tunnel)
  - moontear 5y ago
    That’s why I said via VPN, but yes of course it’s more secure if you add another layer - I wouldn’t say more secure than SSH or VPN.
  - stult 5y ago
    Yes. And many corporate and government networks deny list all traffic on ports other than 80/443, so RDP just is not an option in many cases. VDI over HTTPS also means users don't need a separately installed RDP client and can just access the VDI via their browser.
bigmattystyles 5y ago
We put an intermediary to them behind sso. Only the intermediary can get to the machine and forward guacamole traffic. Solves the no password / everyone in the company having access to test machines. We have a little script that registers endpoint machines with the intermediary and who can access the machine / when. We even log and do time block. The intermediary does password rotation with vault.
rogereur 5y ago
Could this work as an alternative to Mighty?
a-dub 5y ago
how does performance compare with x2go/freenx?
mukundesh 5y ago
This is a life saver, have used it on different environments and it always worked...
marcodiego 5y ago
> once Guacamole is installed on a server, all you need to access your desktops is a web browser. These days, where basically nobody has a real ip, this is not entirely true. Using tor, you can easily expose a server to the outside world, the other point must support tor connections. Is there a way to freely expose anything to the outside world without needing special software on the client side?
- U8dcN7vx 5y ago
  A Cloudflare Argo Tunnel, perhaps the free one for short-term use.
- djrogers 5y ago
  If you want to do so securely, use tailscale or wireguard, or any of a number of p2p vpns.
- dmitrygr 5y ago
  DynDns exists
- tssva 5y ago
  > These days, where basically nobody has a real ip, this is not entirely true. This is a vast exaggeration. Although this is true for many and perhaps a majority, are there any publicly available stats regarding this, there are still a large number of ISPs which provide real ip addresses and allow incoming connections. My ISP serves several million customers across several US sates and provides real up addresses and allows incoming connections.
- xz18r 5y ago
  Awingu can do this. (https://www.awingu.com https://www.awingu.com)
- Ginden 5y ago
  Even if so, configuring forwarding-only VPS costs ~3$/month.
djrogers 5y ago
Guacamole and tailscale make my life so much easier when I’m away from home. Serving up guac from a machine with tailscale / wire guard means I can get to it without exposing it to the internet, or worrying about a home IP changing.
- hipjiveguy 5y ago
  So is the domain you end up going to a tailscale subdomain or something? And that allows you to hit your home computer that's running the Guacamole server?
smbv 5y ago
I deployed Guacamole myself (for SSH), but I found SSHWifty[0] a lot easier to use and deploy. [0] https://github.com/nirui/sshwifty https://github.com/nirui/sshwifty
NovemberWhiskey 5y ago
We adopted Guacamole for access to some of our Windows server production environments; the great thing about it is you can put your corporate SSO / authorization model into a web app to control access and not have to disclose credentials to service accounts to developers. You can also tap off a feed from the guacd that represents a complete screen recording and save it for audit trail purposes. The only issue we've had is that FreeRDP (that underlies it for connectivity to Window servers) is a bit fussier than the native RDP environment, or at least we've had challenges getting equivalent compatibility across old/odd Windows configurations.
- amaccuish 5y ago
  Out of interest, we have SAML and OpenID Connect. How do you manage passing the SSO to Windows after displaying the web portal. I couldn't see anything in the Guacomole pages, but Citrix manages this. Where you sign in to the web portal, click a desktop, and don't have to login. Do you get a kerberos ticket, do you have something running on the Windows host or how?
  - NovemberWhiskey 5y ago
    The users don't log in with their own identities - we don't have developer accounts on production hosts. They log into service accounts: credentials are retrieved from a vault once the user has been authorized, after which the web application dynamically configures the RDP host/account/credential.
  - denysvitali 5y ago
    From his comment it seems like they use a service account and thus hardcoded username + password on the Guacamole side rather than doing what Citrix does
- 2Gkashmiri 5y ago
  i have a question. i could "never" understand guacamole. i mean i currently use zerotier for clients/server and rdpwrap to get a bulletproof setup. is there some sort of foss "server" implementation of rdp so as to avoid using rdpwrap? i know vnc but i need multiple users connected at the same time...
CyberShadow 5y ago
The video on the main page is amazing. Rare that a product demo video is both entertaining and informative with a high information density!
cowmix 5y ago
I personally use Chrome Remote Desktop for type of access. If you don't mind trusting Google for tunneling, it works great.
- arthurcolle 5y ago
  yeah, Chrome Remote Desktop is a wonderful piece of engineering. Pretty much just works and was trivial to install. Needed it to remote into a physical machine that sometimes would have no internet, so I'd use an old MacBook Pro running Chrome Remote Desktop to "kick off" the VM before figuring out a better way to accomplish this entire process altogether. I am fairly surprised that they haven't made it a paid feature of G Workspaces or whatever its called now lol
  - opless 5y ago
    I've been using it for years, and it just works. Though every so often you need to reinstall the remote access software
sudosysgen 5y ago
We've been using Guacamole for around 5 years now. It is an absolute godsend, and it makes remote work so much easier. Highly recommend!
TheDudeMan 5y ago
That was a heck of a demo. I wonder how many takes that took.
Rexxar 5y ago
Has someone already use guacamole to make a publicly available desktop software demo ?
didibus 5y ago
How fast and responsive is it? My current favorite is ThinLinc by Cendio as I've found it the most reliable and performant.
Art9681 5y ago
Tried Guacamole and it was ok. For this type of stuff a simple WireGuard VPN is much better. However, if you must serve apps remotely via browser, I find KASM WorkSpaces a superior solution.
chjohnst 5y ago
Used the guac to host 100+ sessions for researchers and devs at my previous company. Performed well and using docker made it a breeze to deploy in the cloud and it also tied into my IPA infrastructure nicely for central authentication. I did not play with the screen recording feature though.
fhd2 5y ago
Love it! That said: "We call it clientless because no plugins or client software are required. Thanks to HTML5, once Guacamole is installed on a server, all you need to access your desktops is a web browser." So... the web browser is the client software. Why not just come out and say that instead of first calling it fairly misleadingly "clientless"?
- tjoff 5y ago
  They do, immediately. I was confused for a second but since the next sentence clarified it I can't see the issue.
  - robotresearcher 5y ago
    "You don't need a hammer to bang our nail. Simply use a hammer." vs. "You don't need a special hammer to bang our nail. Simply use your existing hammer."
    - tjoff 5y ago
      More like "You don't need any tools for this, just use your thumb." The idea being that every computer you own and happen to come across has a browser already. You will not need to install a client so it doesn't matter that you don't have rights to do so or don't want to pollute someone else's computer. It is pretty straight forward.
  - deleted 5y ago
    [deleted]
- sbysb 5y ago
  I actually disagree tbh - web browsers are so ubiquitous at this point that I would consider them a core part of the desktop at this point. If I can use just the "core tools" of my OS to access something I would consider that clientless for all intents and purposes
  - kube-system 5y ago
jstrieb 5y ago
I have used Apache Guacamole to access running GitHub Actions workflows as remote desktops. It worked super well for testing GUI apps on other operating systems that I didn't want to deal with setting up. It's also nice if you want to run a GUI application in someone else's sandbox. https://github.com/jstrieb/ctf-collab/blob/9300c57364f71fe29d260a387fe5606966b09de5/.github/workflows/run-server-graphical.yml#L126 https://github.com/jstrieb/ctf-collab/blob/9300c57364f71fe29...
- ldoughty 5y ago
  It's also really good if you're standing up old VMs (e.g. testing older OSs/setups from images). I think Microsoft, for a time, offered VMs for such testing... Or maybe it was a third party... Guacamole world be a very good gatekeeper in this situation so the end users don't need virtualization themselves. If the network is otherwise set up correctly, you can reasonably safely run windows XP behind Guacamole. Of course, I don't recommend that, but it prices that you can write software and then see how any of OS or setup runs your code/website/software... Without worrying that your VM might be compromised in 60 seconds. As an aide, the siding of virtualization is also helpful for schools... A Chromebook can access guacamole to get to a VM... But a Chromebook can't run a VM itself.
edoceo 5y ago
Oh, I remember this thing, built some shit-hack auth for it like eight years ago. It's an awesome project and super easy to extend.
guerby 5y ago
meshcentral is another nice free software for remote desktop and more: https://github.com/Ylianst/MeshCentral https://github.com/Ylianst/MeshCentral https://twitter.com/MeshCentral https://twitter.com/MeshCentral https://www.youtube.com/channel/UCJWz607A8EVlkilzcrb-GKg https://www.youtube.com/channel/UCJWz607A8EVlkilzcrb-GKg Disclaimer: we installed meshcentral for enabling student access to regular physical desktops machine during COVID19
buybackoff 5y ago
Using it mainly because of the paranoia of just exposing RDP to the internet. Http(s) is very convenient to add more layers of security, in my case via NGINX (both as LXC containers in Proxmox). I'm using a wildcard domain *.myhome.tld pointed to my static IP. Guacamole is hosted at try_guess_me.myhome.tld, with NGINX basic auth same for all subdomains (further protected by fail2ban). So in total 3 tokens are required (subdomain and basic auth username and password) just to get to the Guacamole login page, where additional username/password + 2FA are required. I used to expose RDP directly for years, but after a chat with a colleague before vacations and a purchase of a NUC for a homelab server decided to strengthen the security slightly. RDP is still much better user experience, so once when I needed a longer session I used Guacamole to access my router admin interface and temporarily expose RDP directly via a random port and a very strong password. I'm still not convinced that the latter combination is not enough, but it's better to be safe than sorry.
- xen2xen1 5y ago
  There is an IP ban / fail2ban app for windows and RDP, nice extra layer.
- ncrmro 5y ago
  For a lot of my stuff, the devices domain is only resolvable on my Wireguard’s dns and access allowed only from Wireguard’s subtnet.
  - buybackoff 5y ago
    I wanted to avoid VPN both for my main working/dev machine and clients. What if VPN does not go up after hard reboot due to some weird loading order while I'm not logged in (e.g. electricity failure)? Both that machine and Guacamole/NGINX host are configured to autostart after powering off. This is the first thing I tested. For clients, I do not want to have VPN on each of them. And what if I need to use a random machine? Multi-layer opaque https endpoint seems safe enough.
    - ncrmro 5y ago
pkukkapalli 5y ago
I bought a PopOS Gazelle with an Nvidia GPU so I could play around with ML stuff. But, looking back on it, it might have been more efficient to just get a GPU instance on AWS or Google Cloud, and just using a remote desktop like this. Anybody tried that configuration? If so, how has your experience been?
dang 5y ago
Past related threads: Apache Guacamole 1.1.0 - https://news.ycombinator.com/item?id=22190251 https://news.ycombinator.com/item?id=22190251 - Jan 2020 (50 comments) Apache Guacamole – Clientless remote desktop gateway - https://news.ycombinator.com/item?id=21660925 https://news.ycombinator.com/item?id=21660925 - Nov 2019 (40 comments) Apache Guacamole – A clientless remote desktop gateway - https://news.ycombinator.com/item?id=15778902 https://news.ycombinator.com/item?id=15778902 - Nov 2017 (41 comments) Guacamole – A clientless remote desktop gateway - https://news.ycombinator.com/item?id=15389727 https://news.ycombinator.com/item?id=15389727 - Oct 2017 (216 comments) Apache Guacamole - https://news.ycombinator.com/item?id=11744430 https://news.ycombinator.com/item?id=11744430 - May 2016 (57 comments) Also: Fixing critical vulnerabilities in Apache's remote desktop - https://news.ycombinator.com/item?id=23715212 https://news.ycombinator.com/item?id=23715212 - July 2020 (8 comments)
rcarmo 5y ago
The nice thing about Guacamole is that you can wrap just about anything on it and get at it from most browsers (although it can be a pain to use from an iOS client). Only the other day I wrapped an old version of a mind mapping desktop app so I could open my old files on it without installing it: https://github.com/rcarmo/docker-xmind https://github.com/rcarmo/docker-xmind
skanga 5y ago
The ridiculous installation procedure should be improved for non-docker users.
_8j50 5y ago
This is not easy to deploy, even with docker. Had to setup tomcat. Great project, but hoping for more features and integration as well as simpler setup and config.
smitty1e 5y ago
Does anyone have a reference to an example configuration for setting up a cloud instance that pipes Guacamole over SSH?
zaptheimpaler 5y ago
A popular docker image for calibre uses Guacamole: https://github.com/linuxserver/docker-calibre https://github.com/linuxserver/docker-calibre It’s not as smooth as a web application but it works well. Might be useful as a reference if you want to setup your own instance too.
stonecharioteer 5y ago
I'd almost used guacamole at my previous company, GKN Driveline. My boss wanted to setup soemthing to let people xvnc into servers effortlessly. We were dealing with mechanical engineers who weren't great with Linux tools. I never stayed long enough to implement it and my replacement had his hands full with other projects, but I really was excited about Guacamole and want to try it out some day. It seems like a great project, and might not get the same appreciation in tech spaces as it would in non-software companies which deal with something like Beowulf clusters or their like.
protoman3000 5y ago
That’s really great. Do I understand correctly that it doesn’t understand SPICE?
mikestaub 5y ago
Can I run MacOS on a super powerful cloud instance with this?

503 points by WallyFunk 5y ago

I'm really looking forward to having all my working stuff in the cloud. however, it's so annoying sometimes that networking is not suitable yet to work from ANYWHERE. especially in public places where you can pull a laptop from the bag and start working, with remote it's mostly a challenge

shepherdjerred 5y ago
I've found that having a dedicated WiFi hotspot mostly solves this issue, as long as you're somewhere with decent cell service. I haven't tried it with desktop streaming, but VS Code remote development is a dream, even with little bandwidth.
- brutal_chaos_ 5y ago
  My local library has WiFi Hotspots to checkout for free. They are T-Mobile hotspots and Fast.com reports: 35Mbps down (steady) 3Mbps up (decays quickly suggesting shown upload is "boost" / "burst" speeds or possibly throttled heavily in some other manner)
- iamkarlson 5y ago
  it doesn't really work well. network coverage differ from place to place. also, whenever you sit in some shitty coworking, their wifi should give you hard time getting this working
waynesonfire 5y ago
Setup wireguard
pjmlp 5y ago
Ah the memories of going for a coffee break at the university, as $HOME failed to mount over NFS due to a bad terminator on the campus network.

charcircuit 5y ago

>We call it clientless because no plugins or client software are required. >all you need to access your desktops is a web browser. So which is it? Not having a client is nonsense.

Krisjohn 5y ago

We have a customer that was using ports directly exposed to the Internet to get to embedded VNC servers in some plant monitoring gear. I set them up a Guacamole VM from Bitnami or Turnkey on their environment and turned them loose on it. Since self-hosting and 100% control is exactly what they want, they loved it and we don't have to worry about hundreds of Internet-exposed VNC servers with the same single password.

semireg 5y ago

Is this something that would allow me to demo my electron app to visitors on my website? Or take it a step further and sell instances to users? If someone has consulting chops to help me with this I’d love to chat.

dmitrygr 5y ago

I use guacamole. It is awesome and super convenient. Nice insulation from various protocol bugs too. I don’t care what exploitable bugs RDP server in windows has if I access it only over guac.

johncena33 5y ago
Do you need a static ip address for it?
- shepherdjerred 5y ago
  You could always use an IPv6 address, or setup something like Tailscale.
  - jeroenhd 5y ago
    As silly and astonishing as it is, I've heard from some (mostly American) ISPs that a static IPv6 subnet is either not available for consumers or costs extra. Yes, that's right, some ISPs rotate IPv6 subnets, negating many things IPv6 was invented for in the first place. Tailscale, Nebula or any of the automagical VPN solutions you can run yourself (like Innernet, https://github.com/tonarino/innernet https://github.com/tonarino/innernet) will probably negate the issue as long as you can reach some server with a static IP.
    - tinus_hn 5y ago
      Of course, because if you can use it to offer services, it’s a ‘pro’ connection!
    - piyh 5y ago
      Do other people use dynamic DNS services offered by domain registrars? I've use one for years and never have had an issue.
      - jeroenhd 5y ago

fzumstein 5y ago

I found noVNC easier to use.

rob_c 5y ago
Best used in combination with guac imo. Good way of getting past industry firewalls too

ww520 5y ago

This is awesome. Sometimes I got lazy and don’t want to go to another room to access the computers. This allows for easy remote desktop usage.

rob_c 5y ago

Amazing project used it to host 40 accounts on a server recently to host remote tutorials at a workshop recently :)

jll29 5y ago
That's the kind of scenario that I also have in mind. What server and network did you use to serve 40 clients?
- rob_c 5y ago
  Dual Xeon gold with 56 core. Ended up rolling a custom docker image and instance with vnc all 40 managed by guac... Took some sleepless nights

maximedupre 5y ago

That is kind of mind-blowing. The landing page and the video using Windows XP makes it look unappealing though I'd still use 10/10

5e92cb50239222b 5y ago
It's not XP. Looks like 7 with the last decent theme that's ever came from them.
- pjmlp 5y ago
  Nope, that is definitely XP, past Vista the Windows 2000 like theming was removed.
  - mopsi 5y ago
    It wasn't. Classic Theme was available on Windows 7 and Windows 8. https://www.google.com/search?q=windows+7+classic+theme https://www.google.com/search?q=windows+7+classic+theme
  - alphabet9000 5y ago
    the windows version in the demo video is windows 7 ultimate https://i.jollo.org/CaCZBXbc.png https://i.jollo.org/CaCZBXbc.png
mopsi 5y ago
> The landing page /-/ makes it look unappealing though Why, loads too fast?
ldoughty 5y ago
We use guacamole as a way to gatekeep access to servers which are explicitly made vulnerable for students to attack. We give students a Kali Linux box, and a server with dozens of vulnerabilities.. and we don't have to worry about those vulnerable targets being otherwise internet accessible. We've done over 200,000 VMs behind Guacamole over 4 years without incident, despite having machines with the username/password of "student", or being unpatched for 4 years (spinning up old Ubuntu 14 images)

moontear 5y ago

Setting it up via Docker container is a lot easier than a custom setup. I really am not a fan of Guacamole. I love the idea and convenience of having everything running in the browser from the client side, but I much prefer a real RDP session (via VPN) than having it in the browser. Why? Keyboard shortcuts! I am soooo much slower because browsers (not guacs fault - but at the same time it is its fault since I would love a native client) can’t catch all keys (e.g. Windows key). ALT-TAB? Yeah you just tabbed away from Guac. Or the new fancy WIN-TAB, no way that gets passed on to Guac. Also the file sharing experience is worse. RDP? Just drag an drop or Ctrl-C, Ctrl-V. That doesn’t always work in Guac…

reaperducer 5y ago
Couldn't Guacamole hijack the keyboard shortcuts? One of the reasons I hate Wrike is that it hijacks Command-Shift-N (New private window) in Safari.
stult 5y ago
IIRC you can install the guac site as a PWA in your browser and sometimes the browser then allows more keyboard events to bubble up from the OS to the javascript layer where guac lives. Doesn't fix everything, but it can help.
punnerud 5y ago
The security is probably better if you enable HTTPS than RDP? When I use RDP it is always over SSH (port tunnel)
- moontear 5y ago
  That’s why I said via VPN, but yes of course it’s more secure if you add another layer - I wouldn’t say more secure than SSH or VPN.
- stult 5y ago
  Yes. And many corporate and government networks deny list all traffic on ports other than 80/443, so RDP just is not an option in many cases. VDI over HTTPS also means users don't need a separately installed RDP client and can just access the VDI via their browser.

bigmattystyles 5y ago

We put an intermediary to them behind sso. Only the intermediary can get to the machine and forward guacamole traffic. Solves the no password / everyone in the company having access to test machines. We have a little script that registers endpoint machines with the intermediary and who can access the machine / when. We even log and do time block. The intermediary does password rotation with vault.

rogereur 5y ago

Could this work as an alternative to Mighty?

a-dub 5y ago

how does performance compare with x2go/freenx?

mukundesh 5y ago

This is a life saver, have used it on different environments and it always worked...

marcodiego 5y ago

> once Guacamole is installed on a server, all you need to access your desktops is a web browser. These days, where basically nobody has a real ip, this is not entirely true. Using tor, you can easily expose a server to the outside world, the other point must support tor connections. Is there a way to freely expose anything to the outside world without needing special software on the client side?

U8dcN7vx 5y ago
A Cloudflare Argo Tunnel, perhaps the free one for short-term use.
djrogers 5y ago
If you want to do so securely, use tailscale or wireguard, or any of a number of p2p vpns.
dmitrygr 5y ago
DynDns exists
tssva 5y ago
> These days, where basically nobody has a real ip, this is not entirely true. This is a vast exaggeration. Although this is true for many and perhaps a majority, are there any publicly available stats regarding this, there are still a large number of ISPs which provide real ip addresses and allow incoming connections. My ISP serves several million customers across several US sates and provides real up addresses and allows incoming connections.
xz18r 5y ago
Awingu can do this. (https://www.awingu.com https://www.awingu.com)
Ginden 5y ago
Even if so, configuring forwarding-only VPS costs ~3$/month.

djrogers 5y ago

Guacamole and tailscale make my life so much easier when I’m away from home. Serving up guac from a machine with tailscale / wire guard means I can get to it without exposing it to the internet, or worrying about a home IP changing.

hipjiveguy 5y ago
So is the domain you end up going to a tailscale subdomain or something? And that allows you to hit your home computer that's running the Guacamole server?

smbv 5y ago

I deployed Guacamole myself (for SSH), but I found SSHWifty[0] a lot easier to use and deploy. [0] https://github.com/nirui/sshwifty https://github.com/nirui/sshwifty

NovemberWhiskey 5y ago

We adopted Guacamole for access to some of our Windows server production environments; the great thing about it is you can put your corporate SSO / authorization model into a web app to control access and not have to disclose credentials to service accounts to developers. You can also tap off a feed from the guacd that represents a complete screen recording and save it for audit trail purposes. The only issue we've had is that FreeRDP (that underlies it for connectivity to Window servers) is a bit fussier than the native RDP environment, or at least we've had challenges getting equivalent compatibility across old/odd Windows configurations.

amaccuish 5y ago
Out of interest, we have SAML and OpenID Connect. How do you manage passing the SSO to Windows after displaying the web portal. I couldn't see anything in the Guacomole pages, but Citrix manages this. Where you sign in to the web portal, click a desktop, and don't have to login. Do you get a kerberos ticket, do you have something running on the Windows host or how?
- NovemberWhiskey 5y ago
  The users don't log in with their own identities - we don't have developer accounts on production hosts. They log into service accounts: credentials are retrieved from a vault once the user has been authorized, after which the web application dynamically configures the RDP host/account/credential.
- denysvitali 5y ago
  From his comment it seems like they use a service account and thus hardcoded username + password on the Guacamole side rather than doing what Citrix does
2Gkashmiri 5y ago
i have a question. i could "never" understand guacamole. i mean i currently use zerotier for clients/server and rdpwrap to get a bulletproof setup. is there some sort of foss "server" implementation of rdp so as to avoid using rdpwrap? i know vnc but i need multiple users connected at the same time...

CyberShadow 5y ago

The video on the main page is amazing. Rare that a product demo video is both entertaining and informative with a high information density!

cowmix 5y ago

I personally use Chrome Remote Desktop for type of access. If you don't mind trusting Google for tunneling, it works great.

arthurcolle 5y ago
yeah, Chrome Remote Desktop is a wonderful piece of engineering. Pretty much just works and was trivial to install. Needed it to remote into a physical machine that sometimes would have no internet, so I'd use an old MacBook Pro running Chrome Remote Desktop to "kick off" the VM before figuring out a better way to accomplish this entire process altogether. I am fairly surprised that they haven't made it a paid feature of G Workspaces or whatever its called now lol
- opless 5y ago
  I've been using it for years, and it just works. Though every so often you need to reinstall the remote access software

sudosysgen 5y ago

We've been using Guacamole for around 5 years now. It is an absolute godsend, and it makes remote work so much easier. Highly recommend!

TheDudeMan 5y ago

That was a heck of a demo. I wonder how many takes that took.

Rexxar 5y ago

Has someone already use guacamole to make a publicly available desktop software demo ?

didibus 5y ago

How fast and responsive is it? My current favorite is ThinLinc by Cendio as I've found it the most reliable and performant.

Art9681 5y ago

Tried Guacamole and it was ok. For this type of stuff a simple WireGuard VPN is much better. However, if you must serve apps remotely via browser, I find KASM WorkSpaces a superior solution.

chjohnst 5y ago

Used the guac to host 100+ sessions for researchers and devs at my previous company. Performed well and using docker made it a breeze to deploy in the cloud and it also tied into my IPA infrastructure nicely for central authentication. I did not play with the screen recording feature though.

fhd2 5y ago

Love it! That said: "We call it clientless because no plugins or client software are required. Thanks to HTML5, once Guacamole is installed on a server, all you need to access your desktops is a web browser." So... the web browser is the client software. Why not just come out and say that instead of first calling it fairly misleadingly "clientless"?

tjoff 5y ago
They do, immediately. I was confused for a second but since the next sentence clarified it I can't see the issue.
- robotresearcher 5y ago
  "You don't need a hammer to bang our nail. Simply use a hammer." vs. "You don't need a special hammer to bang our nail. Simply use your existing hammer."
  - tjoff 5y ago
    More like "You don't need any tools for this, just use your thumb." The idea being that every computer you own and happen to come across has a browser already. You will not need to install a client so it doesn't matter that you don't have rights to do so or don't want to pollute someone else's computer. It is pretty straight forward.
- deleted 5y ago
  [deleted]
sbysb 5y ago
I actually disagree tbh - web browsers are so ubiquitous at this point that I would consider them a core part of the desktop at this point. If I can use just the "core tools" of my OS to access something I would consider that clientless for all intents and purposes
- kube-system 5y ago

jstrieb 5y ago

I have used Apache Guacamole to access running GitHub Actions workflows as remote desktops. It worked super well for testing GUI apps on other operating systems that I didn't want to deal with setting up. It's also nice if you want to run a GUI application in someone else's sandbox. https://github.com/jstrieb/ctf-collab/blob/9300c57364f71fe29d260a387fe5606966b09de5/.github/workflows/run-server-graphical.yml#L126 https://github.com/jstrieb/ctf-collab/blob/9300c57364f71fe29...

ldoughty 5y ago
It's also really good if you're standing up old VMs (e.g. testing older OSs/setups from images). I think Microsoft, for a time, offered VMs for such testing... Or maybe it was a third party... Guacamole world be a very good gatekeeper in this situation so the end users don't need virtualization themselves. If the network is otherwise set up correctly, you can reasonably safely run windows XP behind Guacamole. Of course, I don't recommend that, but it prices that you can write software and then see how any of OS or setup runs your code/website/software... Without worrying that your VM might be compromised in 60 seconds. As an aide, the siding of virtualization is also helpful for schools... A Chromebook can access guacamole to get to a VM... But a Chromebook can't run a VM itself.

edoceo 5y ago

Oh, I remember this thing, built some shit-hack auth for it like eight years ago. It's an awesome project and super easy to extend.

guerby 5y ago

meshcentral is another nice free software for remote desktop and more: https://github.com/Ylianst/MeshCentral https://github.com/Ylianst/MeshCentral https://twitter.com/MeshCentral https://twitter.com/MeshCentral https://www.youtube.com/channel/UCJWz607A8EVlkilzcrb-GKg https://www.youtube.com/channel/UCJWz607A8EVlkilzcrb-GKg Disclaimer: we installed meshcentral for enabling student access to regular physical desktops machine during COVID19

buybackoff 5y ago

Using it mainly because of the paranoia of just exposing RDP to the internet. Http(s) is very convenient to add more layers of security, in my case via NGINX (both as LXC containers in Proxmox). I'm using a wildcard domain *.myhome.tld pointed to my static IP. Guacamole is hosted at try_guess_me.myhome.tld, with NGINX basic auth same for all subdomains (further protected by fail2ban). So in total 3 tokens are required (subdomain and basic auth username and password) just to get to the Guacamole login page, where additional username/password + 2FA are required. I used to expose RDP directly for years, but after a chat with a colleague before vacations and a purchase of a NUC for a homelab server decided to strengthen the security slightly. RDP is still much better user experience, so once when I needed a longer session I used Guacamole to access my router admin interface and temporarily expose RDP directly via a random port and a very strong password. I'm still not convinced that the latter combination is not enough, but it's better to be safe than sorry.

xen2xen1 5y ago
There is an IP ban / fail2ban app for windows and RDP, nice extra layer.
ncrmro 5y ago
For a lot of my stuff, the devices domain is only resolvable on my Wireguard’s dns and access allowed only from Wireguard’s subtnet.
- buybackoff 5y ago
  I wanted to avoid VPN both for my main working/dev machine and clients. What if VPN does not go up after hard reboot due to some weird loading order while I'm not logged in (e.g. electricity failure)? Both that machine and Guacamole/NGINX host are configured to autostart after powering off. This is the first thing I tested. For clients, I do not want to have VPN on each of them. And what if I need to use a random machine? Multi-layer opaque https endpoint seems safe enough.
  - ncrmro 5y ago

pkukkapalli 5y ago

I bought a PopOS Gazelle with an Nvidia GPU so I could play around with ML stuff. But, looking back on it, it might have been more efficient to just get a GPU instance on AWS or Google Cloud, and just using a remote desktop like this. Anybody tried that configuration? If so, how has your experience been?

dang 5y ago

Past related threads: Apache Guacamole 1.1.0 - https://news.ycombinator.com/item?id=22190251 https://news.ycombinator.com/item?id=22190251 - Jan 2020 (50 comments) Apache Guacamole – Clientless remote desktop gateway - https://news.ycombinator.com/item?id=21660925 https://news.ycombinator.com/item?id=21660925 - Nov 2019 (40 comments) Apache Guacamole – A clientless remote desktop gateway - https://news.ycombinator.com/item?id=15778902 https://news.ycombinator.com/item?id=15778902 - Nov 2017 (41 comments) Guacamole – A clientless remote desktop gateway - https://news.ycombinator.com/item?id=15389727 https://news.ycombinator.com/item?id=15389727 - Oct 2017 (216 comments) Apache Guacamole - https://news.ycombinator.com/item?id=11744430 https://news.ycombinator.com/item?id=11744430 - May 2016 (57 comments) Also: Fixing critical vulnerabilities in Apache's remote desktop - https://news.ycombinator.com/item?id=23715212 https://news.ycombinator.com/item?id=23715212 - July 2020 (8 comments)

rcarmo 5y ago

The nice thing about Guacamole is that you can wrap just about anything on it and get at it from most browsers (although it can be a pain to use from an iOS client). Only the other day I wrapped an old version of a mind mapping desktop app so I could open my old files on it without installing it: https://github.com/rcarmo/docker-xmind https://github.com/rcarmo/docker-xmind

skanga 5y ago

The ridiculous installation procedure should be improved for non-docker users.

_8j50 5y ago

This is not easy to deploy, even with docker. Had to setup tomcat. Great project, but hoping for more features and integration as well as simpler setup and config.

smitty1e 5y ago

Does anyone have a reference to an example configuration for setting up a cloud instance that pipes Guacamole over SSH?

zaptheimpaler 5y ago

A popular docker image for calibre uses Guacamole: https://github.com/linuxserver/docker-calibre https://github.com/linuxserver/docker-calibre It’s not as smooth as a web application but it works well. Might be useful as a reference if you want to setup your own instance too.

stonecharioteer 5y ago

I'd almost used guacamole at my previous company, GKN Driveline. My boss wanted to setup soemthing to let people xvnc into servers effortlessly. We were dealing with mechanical engineers who weren't great with Linux tools. I never stayed long enough to implement it and my replacement had his hands full with other projects, but I really was excited about Guacamole and want to try it out some day. It seems like a great project, and might not get the same appreciation in tech spaces as it would in non-software companies which deal with something like Beowulf clusters or their like.

protoman3000 5y ago

That’s really great. Do I understand correctly that it doesn’t understand SPICE?

mikestaub 5y ago

Can I run MacOS on a super powerful cloud instance with this?