clone a connection

[Vieri <re...@yahoo.com.INVALID>]

Hi,

I set up Guacamole to authenticate with SAML SSO (local Postgresql DB). I added some provisioned users the right to create connections.
They can create just fine a new connection. However, cloning one and then pressing the Save button leads to a permission denied popup message (sometimes the pink message box doesn't contain any text -- just "error").

Is there something special about "cloning" a connection configuration and saving it (after changing the name and target host of course).

Regards,

Vieri

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org

Re: clone a connection

[Nick Couchman <vn...@apache.org>]

On Tue, Feb 7, 2023 at 3:59 AM Vieri <re...@yahoo.com.invalid> wrote:
>
> OK, I just got bitten by my own system.
>
> Guacamole is behind a reverse-proxy with ModSecurity.
> Sending variables as ${} is considered a potential attack, so I get this in the WAF:
>
> [id "932130"] [msg "Remote Command Execution: Unix Shell Expression Found"] [data "Matched Data: ${guac_username}_${guac_date}_${guac_time} found within ARGS:parameters.recording-name: test_rdp_${guac_username}_${guac_date}_${guac_time}"]
>
> Sorry for the misleading messages in this ML!
>
> I guess I can deactivate this Rule by ID for my Guacamole virtual domain.
> However, would it be possible for the Guacamole Client to somehow encrypt or base64-encode the HTTP requests so it doesn't trigger this ModSecurity rule?
>

Yes, it would be possible to do such a thing, but it seems like a
fairly extreme way to resolve the issue. I would imagine that the WAF
has ways to create exceptions for the rules, rather than de-activating
them entirely, and that seems a more reasonable approach than either
de-activating the rule entirely or modifying the source code.

-Nick

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org

Re: clone a connection

[Vieri <re...@yahoo.com.INVALID>]

OK, I just got bitten by my own system.

Guacamole is behind a reverse-proxy with ModSecurity.
Sending variables as ${} is considered a potential attack, so I get this in the WAF:

[id "932130"] [msg "Remote Command Execution: Unix Shell Expression Found"] [data "Matched Data: ${guac_username}_${guac_date}_${guac_time} found within ARGS:parameters.recording-name: test_rdp_${guac_username}_${guac_date}_${guac_time}"]

Sorry for the misleading messages in this ML!

I guess I can deactivate this Rule by ID for my Guacamole virtual domain.
However, would it be possible for the Guacamole Client to somehow encrypt or base64-encode the HTTP requests so it doesn't trigger this ModSecurity rule?

Thanks

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org

Re: clone a connection

[Vieri <re...@yahoo.com.INVALID>]

On Tuesday, February 7, 2023 at 09:36:47 AM GMT+1, Vieri <re...@yahoo.com.invalid> wrote: 
>
> I haven't checked yet if the recorded file name actually contains the expanded values.


I just cjhecked and can confirm that ${GUAC_USERNAME}, ${GUAC_DATE} and ${GUAC_TIME} are properly expanded (ie. I can see file names in my server'ss recording dir with the expected values).
That happens when I SQL-insert the variable names in the DB.
One cannot add the variable names in the "connection details" web UI form.
 

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org

Re: clone a connection

[Vieri <re...@yahoo.com.INVALID>]

The problem seems to be with special characters such as curly braces.
I can reproduce the issue (blank error message) with both "cloning" and "creating" a connection -- it doesn't really matter (red herring).
To reproduce it yourself, simply add ${GUAC_DATE} and/or ${GUAC_USERNAME} or anything between {} in any field (but it would make sense to put it in "Recording Name").

The following SQL command works:

"INSERT INTO guacamole_connection_parameter VALUES ($((conn_id)), 'typescript-name', 'VoIP_MGM_SSH_${GUAC_USERNAME}_${GUAC_DATE}_${GUAC_TIME}');"

and if I do that to the backend then connecting to the guacamole UI shows me the ${} variables as expected -- no errors.

I haven't checked yet if the recorded file name actually contains the expanded values.

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org

Re: clone a connection

[Michael Jumper <mj...@apache.org>]

On Mon, Feb 6, 2023, 8:11 AM Vieri <re...@yahoo.com.invalid> wrote:

> Hi,
>
> I set up Guacamole to authenticate with SAML SSO (local Postgresql DB). I
> added some provisioned users the right to create connections.
> They can create just fine a new connection. However, cloning one and then
> pressing the Save button leads to a permission denied popup message
> (sometimes the pink message box doesn't contain any text -- just "error").
>
> Is there something special about "cloning" a connection configuration and
> saving it (after changing the name and target host of course).
>

No, cloning is just creating a connection. The only difference is that the
fields are pre-populated with data from the connection being cloned by the
UI. It's no different than if you created a new connection and filled in
those same values manually.

If the connection was moved to a connection group that the user doesn't
have permission to update, that could cause a permission denied error. You
can't add connections to a connection group that you lack permission to
modify.

- Mike