Looge Ubuntu 16.04 LTS-is Guacamolei ​​abil HTML 5 RDP/SSH-liides

Sissejuhatus

1. samm – süsteemi ettevalmistamine

2. samm – Guacamole paigaldamine

3. samm – peenhäälestus ja puhastamine

4. samm (valik A) – töötab ainult HTTP-ga

5. samm (valik B) – Nginxi seadistamine

6. samm – testige kõike

Järeldus

Sissejuhatus

Selle õpetuse eesmärk on vabaneda avalikest SSH- ja avalikest RDP-ühendustest. Asetades selle kõik väga mugava HTML5 kliendi taha, saame oma pilvele juurdepääsuks lisada turvakihi.

Guacamole logib ka kõik kaugjuurdepääsud, nii et volitamata juurdepääs muutub palju paremini jälgitavaks.

Märkus. Let's encrypt (valik B) jaoks vajame domeeninime. Kui teil seda pole, võite selle sammu vahele jätta ja lihtsalt käivitada valiku A .

1. samm – süsteemi ettevalmistamine

Alustage VPS-i keerutamisest soovitud Vultri tsoonis. 1024 MBVPS on piisav, kuna Guacamole ei ole, et nõudlik.

Privaatse IP lubamine

Alustuseks lubage VPS-is privaatvõrk. See on siin hästi dokumenteeritud

Tulemüüri ettevalmistamine

Kõigepealt teeme pilti veidi kõvaks. Ja kontrollime, kas loodud pilt on ufwlubatud.

root@vultr:~# ufw status
Status: inactive

Vaikimisi on see keelatud, seega peame lisama mõned reeglid.

• Reegel 1: ssh: TCP-port 22
• Reegel 2: http: TCP port 8080 (Guacamole ajutine testimise reegel)

Alustame nende portide seadistamisega.

ufw allow 22/tcp
ufw allow 8080/tcp

Järgmisena lubage tulemüür.

ufw enable

Ärge muretsege, kui saate hoiatuse. Kui lisasite pordi 22, ei teki teil probleeme.

root@vultr:~# ufw enable
Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup

Kui see on lubatud, küsige tulemüüri olekut ja me näeme oma pordi konfiguratsiooni.

ufw status

---

Status: active

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere
8080/tcp                   ALLOW       Anywhere
22/tcp (v6)                ALLOW       Anywhere (v6)
8080/tcp (v6)              ALLOW       Anywhere (v6)

2. samm – Guacamole paigaldamine

Kõigi sõltuvuste installimine

Enne installimise alustamist peame repot värskendama ja täiendama. Selliste pakettidega nagu TomcatJava-põhine voog avastatud vigu ja nendega seotud veaparandusi. Tavaliselt on hea mõte seda kõigepealt teha, selle asemel, et tormata otse meie installiga.

apt-get update
apt-get -y upgrade 

Järgmine on kõik sõltuvused. Guacamole on neid üsna palju. (Täieliku loetelu sõltuvustest ja nende funktsioonidest leiate siit ). Jätkame nende kõigi installimisega.

apt-get -y install build-essential tomcat8 freerdp libcairo2-dev libjpeg-turbo8-dev libpng12-dev libossp-uuid-dev libavcodec-dev libavutil-dev libfreerdp-dev libpango1.0-dev libssh2-1-dev libtelnet-dev libvorbis-dev libwebp-dev mysql-server mysql-client mysql-common mysql-utilities libswscale-dev libvncserver-dev libpulse-dev libssl-dev

Kui installija küsib MySQL-i juurparooli, sisestage see ja võtke see kindlasti teadmiseks. Kasutame seda parooli hiljem Guacamole andmebaasi loomiseks.

Guacamole allalaadimine

Nüüd, kui meil on kõik sõltuvused olemas, saame jätkata Guacamole allalaadimisega. Guacamole ise on enamasti lähtevormis, mitte kahendvormingus. Kõigepealt liigume /tmpkausta, et vältida ketta teiste osade segamist. Seejärel laadige alla kogu lähtekood.

Allalaadimiseks on neli lähte-/binaarfaili:

• guacamole-0.9.13-incubating.war: see on veebirakendus. WARFail on kokkupakitud web pakett pakub ühtse veebisaidi majutatud Tomcat veebilehel
• guacamole-server-0.9.13-incubating.tar.gz: see fail pakub taustarakendust guacd. See loob vood RDP ja SSH kaudu.
• guacamole-auth-jdbc-0.9.13-incubating.tar.gz: Kasutame kohalikku MySQL-i andmebaasi, seega vajame sellega seotud JDBCpistikut.
• mysql-connector-java-5.1.43.tar.gz: Ilma andmebaasi draiverita ei tee JDBC pistik midagi. Selle faili pakub MySQL-i meeskond ise.

Märkus. Allalaadimised lahendati lähimasse serverisse .

cd /tmp
wget http://apache.belnet.be/incubator/guacamole/0.9.13-incubating/binary/guacamole-0.9.13-incubating.war
wget http://apache.cu.be/incubator/guacamole/0.9.13-incubating/source/guacamole-server-0.9.13-incubating.tar.gz
wget http://apache.cu.be/incubator/guacamole/0.9.13-incubating/binary/guacamole-auth-jdbc-0.9.13-incubating.tar.gz
wget https://dev.mysql.com/get/Downloads/Connector-J/mysql-connector-java-5.1.43.tar.gz

Kui oleme kõik need failid alla laadinud, ekstraktige tar.gz's.

tar -xzvf guacamole-server-0.9.13-incubating.tar.gz
tar -xzvf guacamole-auth-jdbc-0.9.13-incubating.tar.gz
tar -xzvf mysql-connector-java-5.1.43.tar.gz

Guacamole koostamine

Nüüd, kui oleme kogu lähtekoodi ekstraktinud, teeme mõned guacamolekaustad, mida hakkab kasutama guacamole rakendus ja selle sõltuvused.

mkdir -p /etc/guacamole/lib
mkdir -p /etc/guacamole/extensions

Kõik on meie uute Guacamole binaarfailide jaoks valmis. Nüüd saame alustada kompileerimis- ja installiprotsessi. Liikuge ekstraheeritud Guacamole serveri kausta.

cd /tmp/guacamole-server-0.9.13-incubating

Seadistage rakendus nii, et see loob init.dfaili, et seda hiljem teenusena kasutada.

./configure --with-init-dir=/etc/init.d

Kõigis teekides ja protokollides peaks käsk lõppema "jah"-ga. Kui ei, siis minge tagasi ja kontrollige käsku apt-get, et veenduda, et te pole ühestki paketist ilma jäänud.

------------------------------------------------
guacamole-server version 0.9.13-incubating
------------------------------------------------

   Library status:

     freerdp ............. yes
     pango ............... yes
     libavcodec .......... yes
     libavutil ........... yes
     libssh2 ............. yes
     libssl .............. yes
     libswscale .......... yes
     libtelnet ........... yes
     libVNCServer ........ yes
     libvorbis ........... yes
     libpulse ............ yes
     libwebp ............. yes

   Protocol support:

      RDP ....... yes
      SSH ....... yes
      Telnet .... yes
      VNC ....... yes

   Services / tools:

      guacd ...... yes
      guacenc .... yes

   Init scripts: /etc/init.d

Type "make" to compile guacamole-server.

Järgmisena kompileerige ja installige Gucamole server.

make && make install

Kui see kõik on tehtud, käivitage ldconfiglisatud teekide otsingutee uuesti ülesehitamiseks.

ldconfig

Käivitamise alustamiseks jätkake systemctlhäälestamiseks guacd(Guacamole Daemon).

systemctl enable guacd

Guacamole binaarfailid on nüüd installitud. Nüüd paneme veebirakenduse Tomcati jaoks valmis.

Alustage warfaili teisaldamisest guacamoleäsja loodud kausta. Kui see on tehtud, looge tomcati kataloogis loogiline link, mis osutab meie warfailile.

cd /tmp
mv guacamole-0.9.13-incubating.war /etc/guacamole/guacamole.war
ln -s /etc/guacamole/guacamole.war /var/lib/tomcat8/webapps/

Siis vajame mysql-pistikut ja JDBC-d. JDBC draiverit on vaja extensionskaustas, konnektorit libkaustas.

cp mysql-connector-java-5.1.43/mysql-connector-java-5.1.43-bin.jar /etc/guacamole/lib/
cp guacamole-auth-jdbc-0.9.13-incubating/mysql/guacamole-auth-jdbc-mysql-0.9.13-incubating.jar /etc/guacamole/extensions/

Guacamole ja Tomcati konfigureerimine

Once the connector and JDBC are in place, we need to edit the tocamt8 file. This file contains a lot of tomcat8 settings, and in our case we need to add the GUACAMOLE_HOME variable at the end of the file.

nano /etc/default/tomcat8

Append with the following.

GUACAMOLE_HOME=/etc/guacamole

Creating the database

Next up is creating the database. Guacamole stores its connection configuration in a database, not inside a file.

Login with the root password you used during the installation.

mysql -u root -p

The first step is to create a database called 'guacamole_db'.

create database guacamole_db;

Then run the create user command. This will create a user with a password mysupersecretpassword, this user will only be able to connect from localhost.

create user 'guacamole_user'@'localhost' identified by "mysupersecretpassword";

Grant CRUD operations to this user for the database guacamole_db.

GRANT SELECT,INSERT,UPDATE,DELETE ON guacamole_db.* TO 'guacamole_user'@'localhost';

Flush privileges and exit the shell.

flush privileges;
exit

Finish up by adding the Guacamole schema to our newly created database.

cat /tmp/guacamole-auth-jdbc-0.9.13-incubating/mysql/schema/*.sql | mysql -u root -p guacamole_db

Once this is done, we need to edit the guacamole.properties file. This file contains our recently created MySQL server configuration.

nano /etc/guacamole/guacamole.properties

Append the MySQL connection details and credentials.

mysql-hostname: localhost
mysql-port: 3306
mysql-database: guacamole_db
mysql-username: guacamole_user
mysql-password: mysupersecretpassword

Finish up by creating a symbolic link to the tomcat share folder, as this is where the WAR file will search these properties.

ln -s /etc/guacamole /usr/share/tomcat8/.guacamole

Testing the setup

End by restarting the tomcat8 server and start the guacd server daemon.

service tomcat8 restart
service guacd start

You can verify by using the status command.

service tomcat8 status
service guacd status

Now you can browse to your VPS on port 8080

http://<yourpublicip>:8080/guacamole/

Use the username guacadmin and the same password guacadmin. This will grant you access to an empty Guacamole server.

Click in the top right corner on your username guacadmin and select Settings. Once you are in the settings page go to the Users tab and select the user guacadmin.

Now change your password to something else or create a new admin user and delete the default guacadmin one.

Step 3 - Fine tuning and cleanup

These are the final steps: cleaning up after you are done.

Delete the downloaded source code and binaries from the /tmp folder.

rm -rf /tmp/guacamole-*
rm -rf /tmp/mysql-connector-java-*

Also, make the Guacamole web application the default one. In the tomcat ecosystem the application that gets the ROOT folder is the one that is started by default when you access the website.

Delete the old ROOT placeholder.

rm -rf /var/lib/tomcat8/webapps/ROOT

And make a symbolic link for the guacamole server to be the ROOT one.

ln -s /var/lib/tomcat8/webapps/guacamole /var/lib/tomcat8/webapps/ROOT

This requires a tomcat restart.

service tomcat8 restart

Step 4 (option A) - Running on HTTP only

• If you are not going to use Let's Encrypt certificates and not use a DNS, execute the actions in this step and afterwards go directly to Step 6. - Option A
• If you want to create a more secure site and you have a DNS ready, you can skip this and go straight to option B (Step 5).

Edit the tomcat8/server.xml file and change the connector port.

nano /etc/tomcat8/server.xml

Search for the Connector port.

<Connector port="8080" protocol="HTTP/1.1"
           connectionTimeout="20000"
           URIEncoding="UTF-8"
           redirectPort="8443" />

And replace 8080 with 80.

By default, tomcat doesn't allow the binding of ports below 1024. To enable this we need to tell tomcat8 to create authenticated binds.

Edit the default file of tomcat8 and uncomment the AUTHBIND line and use the option yes

nano /etc/default/tomcat8

---

AUTHBIND=yes

Once this is done, intall authbind.

apt-get install authbind

Configure it so that port 80 can be claimed by tomcat8.

touch /etc/authbind/byport/80
chmod 500 /etc/authbind/byport/80
chown tomcat8 /etc/authbind/byport/80

Allow port 80 through the firewall and delete the rule for 8080.

ufw allow 80/tcp
ufw delete allow 8080/tcp

Restart tomcat.

service tomcat8 restart

That's it, now Guacamole should be running on port 80.

Step 5 (option B) - Setting up Nginx

Installation and configuration of Nginx

Tomcat really isn't one of the best and most robust applications to use with certbot. Luckily Nginx is. We will just to proxy tomcat to Nginx. It uses the out-of-the-box functionality of certbot at the cost of sacrificing a little bit of RAM.

apt-get install nginx

Once installed, edit the default configuration.

nano /etc/nginx/sites-available/default

Delete all example configurations and add the following configuration.

server {      
  listen 0.0.0.0:80;

  proxy_request_buffering off;
  proxy_buffering off;

  location / {
     proxy_pass http://127.0.0.1:8080;
     proxy_redirect     off;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Host $server_name;
  }
}

This will create a proxy for the website running at 8080. Restart Nginx, and enable it at boot.

systemctl restart nginx
systemctl enable nginx

Check if everything is working.

systemctl status nginx

Disable the testing port 8080 and allow traffic on port 80.

ufw allow 80/tcp
ufw delete allow 8080/tcp

Installing Let's Encrypt

Before we can use certbot, we need to add the correct ppa to the system containing our certbot packages.

add-apt-repository ppa:certbot/certbot

Press "ENTER" to accept the configuration change.

Update apt to gather the new packages.

apt-get update

Finally, install the Nginx module for assigning the certificates.

apt-get -y install python-certbot-nginx

Configure Nginx to use certificates

Configure the firewall to allow HTTPS.

ufw allow 443/tcp

Before we can request new certificates, we need a DNS name.

nano /etc/nginx/sites-available/default

Add the following server_name setting.

server_name rdp.example.com;

Change the configuration to reflect this new setting.

server {
  server_name rdp.example.com;

  listen 0.0.0.0:80;

  proxy_request_buffering off;
  proxy_buffering off;

  location / {
     proxy_pass http://127.0.0.1:8080;
     proxy_redirect     off;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Host $server_name;
  }
}

Check if all is working and restart Nginx.

nginx -t
service nginx restart

Now request a certificate with certbot.

certbot --nginx -d rdp.example.com

Esitage oma e-posti aadress ja nõustuge paigaldaja esitatud küsimustega. (Saate Nooma meili jagamiseks julgelt valida " ".) Certbot küsib automaatselt, mida ta peab tegema rakendusega HTTPS. Kasutame valikut 2: redirect to HTTPS.

Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
-------------------------------------------------------------------------------
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
-------------------------------------------------------------------------------
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2

Viimane asi, mida teeme, on DHparameetrite värskendamine . Need on 2017. aasta standardite jaoks vaikimisi pisut nõrgad.

Looge mõned uued.

openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048

Järgmisena lisage need Nginxi vaikesaidile.

nano /etc/nginx/sites-available/default

Lisage need serveri konfiguratsiooni.

server {
  server_name rdp.example.com;

  listen 0.0.0.0:80;
  ssl_dhparam /etc/ssl/certs/dhparam.pem;

  proxy_request_buffering off;
  proxy_buffering off;

  location / {
     proxy_pass http://127.0.0.1:8080;
     proxy_redirect     off;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Host $server_name;
  }
}

Kontrollige vigu.

nginx -t

Rakendage muudatused, taaskäivitades serveri.

service nginx restart

Puhastage vana 8080reegel

ufw delete allow 8080/tcp

Märkus: kui peaksite saama "502 Bad Gateway", peate taaskäivitama tomcat8 .

service tomcat8 restart

Sertifikaatide automaatne uuendamine

Let's Encrypt sertifikaadid nõuavad uuendamist. Selle jaoks saame luua cron-töökoha. Alustage crontab.

crontab -e

Lisage järgmine rida.

00 2 * * * /usr/bin/certbot renew --quiet

See kontrollib kell 2:00, kas mõni sertifikaat vajab uuendamist, ja uuendab neid, kui seda on vaja.

6. samm – testige kõike

Minge oma Guacamole serverisse (kas http://<ip>/või https://rdp.example.com)).

Selle testi jaoks vajate veel kahte eksemplari: ühte Linuxi VM-i ja teist Windows Server 2012 R2-d, mille privaatne IP on mõlemal lubatud.

Windowsi RDP-ühenduse lisamine

Klõpsake usernameparemas ülanurgas ikoonil " Settings" ja minge lehele " ". Seejärel minge jaotisse " Connections" ja valige " New Connection".

Täitke järgmised sätted (võite teised vaikeseaded jätta).

Name: Windows Server 2012 R2
Location: ROOT
Protocol: RDP
Maximum number of connections: 1
Maximum number of connections per user: 1
Parameters > Hostname: 10.99.0.12
Parameters > Port: 3389
Username: Administrator
Password: <password> (provided by Vultr)
Security mode: Any
Ignore server certificate: <checked>

Vajutage " save" ja minge tagasi avakuvale. Nüüd saate klõpsata ühendusel " Windows Server 2012 R2" ja see edastab RDP sellele masinale.

Linuxi SSH-ühenduse lisamine

Vajutage " Ctrl+Shift+Alt". See avab küljel oleva menüü. Siin saate katkestada ühenduse või täita muid Guacamole haldustoiminguid.

Klõpsake usernamemenüü ülaosas ja minge jaotisse " Settings". Seejärel minge Connectionsvahekaardile " " ja valige " New Connection".

Täitke järgmised sätted (võite teised vaikeseaded jätta).

Name: Linux
Location: ROOT
Protocol: SSH
Maximum number of connections: 5
Maximum number of connections per user: 2
Parameters > Hostname: 10.99.0.11
Parameters > Port: 22
Username: root
Password: <password> (provided by Vultr)

Vajutage " save" ja minge tagasi avakuvale. Nüüd saate klõpsata sellel äsja loodud ühendusel ja olla SSH kaudu ühenduses oma Linuxi serveriga.

Järeldus

Teil on nüüd veebi RDP/SSH HTML5 lüüs. Nüüd saate oma platvormi avalikule RDP- ja SSH-juurdepääsule tulemüüri seada ja oma keskkonnale juurde pääseda mis tahes kaasaegsest brauserist. Lisateavet selle kohta, mida Guacamole pakub, on suurepärane video, mis näitab kõiki platvormi võimalusi siin .