Guacamole and web links: how to use RemoteApp

[Vieri <re...@yahoo.com.INVALID>]

Hi,

People on this list have mentioned creating Guacamole RDP RemoteApp connections using a browser such as Firefox in Kiosk mode to allow for "web links" within the Guacamole platform.

I'm having issues with my ||RemoteApp call, and I'm wondering if anyone has already dealt with this problem.

I'm calling firefox with -no-remote -private --kiosk URL (I can leave the first two out and I still get the same behavior).

The first time I call it with a given RDP user login, no problem.

Since I don't know how to close the browser in kiosk mode, I simply disconnect by pressing the X on the small window within Guacamole (obviously the RDP session and Firfox are still running).

Now, if I connect to another RemoteApp that calls either Firefox or another browser on the same host, it does not open the "new URL" of the second RemoteApp. Instead, I reconnect to the previous RemoteApp (I see Firefox in kiosk mode with the first URL).

I need to kill/close the Windows RDP session for that user in order for the second RemoteApp to work and open the right URL.

How do other people solve this?

BTW, I don't have admin access to the content of the URL the first RemoteApp opens, so I cannot add things like javascript:winodw.close() or the likes.
 
Regards,

Vieri Jerome


---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org

Re: Guacamole and web links: how to use RemoteApp

[Vieri <re...@yahoo.com.INVALID>]

Well, yes, the theory is nice, but I've come across a glitch.

I guess this is why people asked for HTTP/S tunneling in Guacamole. In my case, I was using Apache in reverse proxy mode with modsecurity to be on the safe side, and all I needed to do was include custom public web links within guacamole-client.
That worked fine until I was told by my organization that I could not do that. Everything has to go through just one platform, ie. Guacamole. So my only option is to try to use RemoteApps or drop support for it altogether.

In my earlier tests when I wrote to you the following RemoteApp call worked fine:

firefox.exe -profile "C:\Firefox\profile" -private-window https://myURL

I have userchrome.css in "C:\Firefox\profile\chrome", and it's content is:

@namespace url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"); /* only needed once */

#openLocation, #CustomizeToolbarWindow, #toolbar-context-menu,
#search-container, #personal-bookmarks, #menubar-items, #PanelUI-button {
 display:none!important;
}

#urlbar-container {
 visibility:hidden;
}

#tabbrowser-arrowscrollbox {pointer-events: none}

toolbarbutton#scrollbutton-up, toolbarbutton#scrollbutton-down {pointer-events:auto}

.tabbrowser-tab, #tabs-newtab-button, .tabs-newtab-button {pointer-events: auto}

.new-tab-popup, .new-tab-popup > * {pointer-events: auto}  /*container tabs - longpress*/


#menu_unsortedBookmarks { display: none !important; }

#menu_mobileBookmarks { display: none !important; }

#subscribeToPageMenuitem { display: none !important; }

#subscribeToPageMenupopup { display: none !important; }

#organizeBookmarksSeparator { display: none !important; }

#bookmarksToolbarSeparator { display: none !important; }

#bookmarksToolbarFolderMenu { display: none !important; }

#bookmarksToolbarFolderMenu+menuseparator { display: none !important; }


I enabled toolkit.legacyUserProfileCustomizations.stylesheets in about:config.
For the sake of completeness I also disabled browser.newtabpage.enabled. That leaves the user with a browser that cannot be used to manually navigate to other sites, but if the site needs to open new tabs or if the user needs to go back in the browser's history, he/she can (unlike in kiosk mode).

At some point though, after running the RemoteApp with at least 2 different users, the third started to behave oddly.

The same call (firefox.exe -profile "C:\Firefox\profile" -private-window https://myURL) would apply my userchrome.css but would not open https://myURL. Instead, it would open the default Firefox "newtabpage" if browser.newtabpage.enabled was set to true.

However, the following call would work fine (but without the custom userchrome.css):

firefox.exe -private-window https://myURL

So it made me think of some kind of permissions issue in "C:\Firefox\profile". Deleting everything in that dir and leaving just the chrome/ subdir fixed the problem.

So I can either find out why the common profile dir is getting screwed up (I wish Firefox had an application error log), or deploy the chrome/userchrome.css into each user's profile, as you suggested (not sure how to properly do that yet).

Maybe even a RemoteApp that runs a custom script which wipes out "C:\Firefox\profile" leaving only the chrome/ subdir before actually running firefox.exe with its arguments. Sounds very ugly, but it might work if the user running the process can actually delete the dir content.

Thanks,

Vieri

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org

Re: Guacamole and web links: how to use RemoteApp

[Nick Couchman <vn...@apache.org>]

On Mon, Jun 6, 2022 at 6:33 PM Vieri <re...@yahoo.com.invalid> wrote:

>  On Sunday, June 5, 2022, 03:02:35 PM GMT+2, Nick Couchman <
> vnick@apache.org> wrote:
>
> >
> > Yeah, I think the issue, here, is that Windows does not "know" the
> difference between URLs within the browser - it just knows that either
> Firefox is running, or it is not. I'm not sure
> > that Remote App can actually solve your issues, here.
>
> RemoteApps and Firefox in kiosk mode were mentioned several times on this
> list for this purpose.
>
>
Yes, I'm likely the one who has mentioned it, in response to queries about
Guacamole supporting HTTP(S) as a protocol. There are probably situations
and configurations that could work out, but there are certainly challenges
to work through and maybe even things that won't work. My mentions of it
have been, to my recollection, generic and theoretical, and certainly in
need of proving in the real world :-). I'll try to get some time to play
around with a more real-world configuration and see if I can get something
to work.


> Since kiosk mode does not work for me I tried using userchrome.css to
> disable most GUI components and launch Firefox as a private window. The
> user cannot do anything useful except close the browser by clicking on the
> window X button. It works a lot better than in kiosk mode. However, I'm
> using a common "profile dir" for all RemoteApp instances (multiple users).
> Despite launching in "private window" I0m still unsure this is "safe" to be
> used in a multi-user environment.
>
>
Cool, this sounds like a workable solution. As far as the shared profile
directory, if it were me, I would certainly launch each individual user
with a different/separate profile, but you can find a configuration that
works for you.

-NIck

Re: Guacamole and web links: how to use RemoteApp

[Vieri <re...@yahoo.com.INVALID>]

 On Sunday, June 5, 2022, 03:02:35 PM GMT+2, Nick Couchman <vn...@apache.org> wrote: 

>
> Yeah, I think the issue, here, is that Windows does not "know" the difference between URLs within the browser - it just knows that either Firefox is running, or it is not. I'm not sure 
> that Remote App can actually solve your issues, here.

RemoteApps and Firefox in kiosk mode were mentioned several times on this list for this purpose. 

Since kiosk mode does not work for me I tried using userchrome.css to disable most GUI components and launch Firefox as a private window. The user cannot do anything useful except close the browser by clicking on the window X button. It works a lot better than in kiosk mode. However, I'm using a common "profile dir" for all RemoteApp instances (multiple users). Despite launching in "private window" I0m still unsure this is "safe" to be used in a multi-user environment.

Thanks,

Vieri Jerome

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org

Re: Guacamole and web links: how to use RemoteApp

[Nick Couchman <vn...@apache.org>]

On Fri, Jun 3, 2022 at 4:26 AM Vieri <re...@yahoo.com.invalid> wrote:

> Hi,
>
> People on this list have mentioned creating Guacamole RDP RemoteApp
> connections using a browser such as Firefox in Kiosk mode to allow for "web
> links" within the Guacamole platform.
>
> I'm having issues with my ||RemoteApp call, and I'm wondering if anyone
> has already dealt with this problem.
>
> I'm calling firefox with -no-remote -private --kiosk URL (I can leave the
> first two out and I still get the same behavior).
>
> The first time I call it with a given RDP user login, no problem.
>
> Since I don't know how to close the browser in kiosk mode, I simply
> disconnect by pressing the X on the small window within Guacamole
> (obviously the RDP session and Firfox are still running).
>
> Now, if I connect to another RemoteApp that calls either Firefox or
> another browser on the same host, it does not open the "new URL" of the
> second RemoteApp. Instead, I reconnect to the previous RemoteApp (I see
> Firefox in kiosk mode with the first URL).
>
>
Yeah, I think the issue, here, is that Windows does not "know" the
difference between URLs within the browser - it just knows that either
Firefox is running, or it is not. I'm not sure that Remote App can actually
solve your issues, here.

-Nick