Quản lý truy cập với Guacamole jump host trên nền web

Guacamole Jump Host

System, Linux  · 

1. Giới thiệu

Thông thường trong các hệ thống doanh nghiệp, chúng ta triển khai 1 vài server chạy Windows server hoặc Linux server làm jump host, từ đó SSH hoặc RDP tới các server đằng sau, nhằm quản lý truy cập vào hệ thống để đảm bảo security. Với cách triển khai như vậy, chúng ta khó hoặc không thể ghi nhận các thao tác của user đối với hệ thống từ jump host, đặc biệt trên môi trường đồ họa như Windows Desktop hoặc Ubuntu Desktop không thể ghi nhận thao tác click chuột của user.

Trong bài viết này, mình chia sẻ về cách triển khai Apache Guacamole làm jump host với các ưu điểm :

Mô hình triển khai

HA design

2. Triển khai Apache Guacamole jump host

2.1. Chuẩn bị

hostnamectl set-hostname jump101

apt update

apt install -y gcc nano vim curl wget g++ libcairo2-dev libjpeg-turbo8-dev libpng-dev libtool-bin libossp-uuid-dev

apt install -y libavcodec-dev libavformat-dev libavutil-dev libswscale-dev build-essential libpango1.0-dev libssh2-1-dev libvncserver-dev libtelnet-dev libpulse-dev libvorbis-dev libwebp-dev

# Install FreeRDP2
add-apt-repository ppa:remmina-ppa-team/remmina-next-daily -y
apt update
apt install freerdp2-dev freerdp2-x11 -y

apt install default-jdk -y

java --version

root@jump101:/root/# java --version
openjdk 11.0.26 2025-01-21
OpenJDK Runtime Environment (build 11.0.26+4-post-Ubuntu-1ubuntu122.04)
OpenJDK 64-Bit Server VM (build 11.0.26+4-post-Ubuntu-1ubuntu122.04, mixed mode, sharing)
root@jump101:/root/#

apt install tomcat9 tomcat9-admin tomcat9-common tomcat9-user -y 

systemctl enable --now tomcat9
systemctl status tomcat9

2.2. Cài đặt MariaDB

apt -y install mariadb-server

tee /etc/mysql/my.cnf <<EOF
[server]
[mysqld]
pid-file                = /run/mysqld/mysqld.pid
basedir                 = /usr
bind-address            = 0.0.0.0
port = 3306
# default max_connections value 151 is not enough on Openstack Env
max_connections = 500
expire_logs_days        = 10
character-set-server  = utf8mb4
collation-server      = utf8mb4_general_ci
[embedded]
[mariadb]
[mariadb-10.6]
[client-server]
socket = /run/mysqld/mysqld.sock
EOF

mysql_secure_installation

Change the root password? [Y/n] 
New password: 123456


systemctl restart mariadb
systemctl enable mariadb
journalctl -xeu mariadb.service

root@jump101:/root/# mysql -u root -p123456 -e "SELECT host, user FROM mysql.user  ;"
+-----------+-------------+
| Host      | User        |
+-----------+-------------+
| localhost | mariadb.sys |
| localhost | mysql       |
| localhost | root        |
+-----------+-------------+
root@jump101:/root/#


root@jump101:/root/# netstat -nlpt | grep mariadb
tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN      12129/mariadbd
root@jump101:/root/#

2.3. Build the Guacamole Server from source

# download Guacamole Server
cd ~/
VER=1.5.4
wget https://archive.apache.org/dist/guacamole/$VER/source/guacamole-server-$VER.tar.gz
tar xzf ~/guacamole-server-*.tar.gz

# build Guacamole Server
cd ~/guacamole-server-*/
./configure  --with-init-dir=/etc/init.d


make 
make install

ldconfig
mkdir  -p /etc/guacamole/{extensions,lib}
tree  /etc/guacamole/


tee /etc/guacamole/guacd.conf <<EOF
[daemon]
pid_file = /var/run/guacd.pid
#log_level = debug

[server]
#bind_host = localhost
bind_host = 127.0.0.1
bind_port = 4822

#[ssl]
#server_certificate = /etc/ssl/certs/guacd.crt
#server_key = /etc/ssl/private/guacd.key
EOF

2.4. Cấu hình Guacamole Database Authentication

# MySQL Connector/J (Java Connector)
cd ~/
CON_VER=8.3.0
wget https://dev.mysql.com/get/Downloads/Connector-J/mysql-connector-j-$CON_VER.tar.gz
tar -xf mysql-connector-j-$CON_VER.tar.gz
cp mysql-connector-j-$CON_VER/mysql-connector-j-$CON_VER.jar /etc/guacamole/lib/

# JDBC auth plugin for Guacamole
cd ~/
VER=1.5.4
wget https://downloads.apache.org/guacamole/$VER/binary/guacamole-auth-jdbc-$VER.tar.gz
tar -xf guacamole-auth-jdbc-$VER.tar.gz
mv guacamole-auth-jdbc-$VER/mysql/guacamole-auth-jdbc-mysql-$VER.jar /etc/guacamole/extensions/


mysql -u root -p123456

CREATE DATABASE guacamole_db;
CREATE USER 'guacamole_user'@'localhost' IDENTIFIED BY 'Passw0rd!';
GRANT SELECT,INSERT,UPDATE,DELETE ON guacamole_db.* TO 'guacamole_user'@'localhost';
FLUSH PRIVILEGES;
QUIT

cd guacamole-auth-jdbc-*/mysql/schema
cat *.sql | mysql -u root -pPassw0rd! guacamole_db

2.5. Cài đặt recording storage extension

cd ~
VER=1.5.4
wget https://downloads.apache.org/guacamole/$VER/binary/guacamole-history-recording-storage-$VER.tar.gz
tar -xf guacamole-history-recording-storage-$VER.tar.gz

mv guacamole-history-recording-storage-1.5.4/guacamole-history-recording-storage-1.5.4.jar /etc/guacamole/extensions/


mkdir -p /var/lib/guacamole/recordings
chown tomcat:tomcat /var/lib/guacamole/recordings
chmod 2750 /var/lib/guacamole/recordings

2.6. Cài đặt Guacamole Web Application

# Install Guacamole Client
cd ~
VER=1.5.4
wget https://archive.apache.org/dist/guacamole/$VER/binary/guacamole-$VER.war
mv guacamole-$VER.war /var/lib/tomcat9/webapps/guacamole.war

# config Guacamole client connect to the Guacamole server (guacd)
echo "GUACAMOLE_HOME=/etc/guacamole" | tee -a /etc/default/tomcat
echo "export GUACAMOLE_HOME=/etc/guacamole" | tee -a /etc/profile

tee /etc/guacamole/guacamole.properties <<EOF
guacd-hostname: localhost
guacd-port:     4822

### MySQL properties
mysql-hostname: 127.0.0.1
mysql-port: 3306
mysql-database: guacamole_db
mysql-username: guacamole_user
mysql-password: Passw0rd!

EOF


systemctl restart tomcat9 guacd

2.7. SSH Linux Server , RDP Windows Server qua Web

admin default : guacadmin\guacadmin

Recording path:	${HISTORY_PATH}/${HISTORY_UUID}/
Recording name:	session-${GUAC_USERNAME}-${GUAC_DATE}-${GUAC_TIME}

2.8. Xem lại record lịch sử truy cập của user

# convert to .m4v
guacenc -s 1280x720 -r 20000000 -f /var/lib/guacamole/recordings/1efef3b7-049e-390c-be74-effe86e1ab83/session-anhlx-20250501-031132

### 3. Lời kết