You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@guacamole.apache.org by Bhupender <bh...@diro.io.INVALID> on 2025/01/23 07:51:43 UTC
Technical Support Request - Smart Card Integration with Guacamole 1.5.4
Dear Support Team,
I hope this email finds you well. I am encountering issues with smart card
integration in our Guacamole deployment and would appreciate your
assistance.
*Environment Details:*
- *Guacamole Version:* 1.5.4
- *OS:* Ubuntu 22.04
- *Smart Card Reader:* ACS ACR39U ICC Reader
- *Card Type:* Siemens SLE 4432/42
- *FreeRDP Version:* 2.6.1
*Key Issue:*
Smart card authentication works with direct xfreerdp connections but *fails
when connecting through Guacamole*. The smart card reader is detected at
system level but not being redirected through the Guacamole connection.
*Working Configuration:*
bash
Copy
# Direct xfreerdp connection (WORKING):
xfreerdp /v:<RDP-SERVER>:<PORT> /u:<USERNAME> /smartcard
*Current Implementation:*
1. *Guacamole Properties:*
properties
Copy
rdp.security: nlardp.enable-smartcard: truerdp.smartcard-readers:
ACS ACR39U ICC Reader 00 00rdp.enable-drive:
truerdp.create-drive-path: truerdp.ignore-cert: true
*Steps Completed:*
1. ✅ Recompiled guacamole-server with smart card support:
bash
Copy
CFLAGS="-I/usr/include/PCSC -I/usr/include/freerdp2
-DFREERDP_SMARTCARD_EMULATE=1"LDFLAGS="-lpcsclite -lfreerdp2"
2. ✅ Installed all required dependencies
3. ✅ Configured proper system permissions
4. ✅ Verified smart card detection
5. ✅ Tested multiple connection configurations
*Current Status:*
- ✅ System properly detects smart card reader
- ✅ Direct xfreerdp connections work
- ❌ Guacamole fails to redirect smart card
- ❌ Basic RDP connectivity affected after changes
*Critical Questions:*
1. *Configuration:* Are there specific parameters we're missing?
2. *Debugging:* What are the recommended steps to identify the
redirection issue?
3. *Logging:* Is there additional logging we can enable for smart card
handling?
*Relevant Logs:*
Copy
Jan 22 12:49:17 guacd[xxxx]: Security mode: NLA
Jan 22 12:49:37 guacd[xxxx]: Connected to RDPDR 1.13 as client 0x0017
Jan 22 12:49:38 guacd[xxxx]: RDPDR user logged on
*Additional Information:*
- Smart card is detected by pcsc_scan
- All system services are running
- Proper permissions are set for guacd user
I can provide any additional technical details or logs if needed. Your
guidance on resolving this issue would be greatly appreciated.
Thank you for your time and assistance.
Best regards,
Bhupender
Re: Technical Support Request - Smart Card Integration with Guacamole 1.5.4
Posted by Sean Hulbert <sh...@securitycentric.net.INVALID>.
Hello,
Sounds like you are wanting CAC/PIV for identity access credential
management (iCAM).
This is easily done with NGINX this prompts for CAC (Smart card access)
once reader loads card in to session NGiNX will verify the cert and if
valid you may proceed.
Great thing is this is NGINX function and you can still use SSO/CAS or
LDAP with Guacamole.
Hope this helps!
PATH:/etc/nginx/sites-enabled/default
listen 443 ssl default_server;
server_name localhost;
server_tokens off;
ssl_dhparam /etc/nginx/ssl/dhparam.pem;
ssl_certificate /etc/nginx/ssl/YOURDOMAIN-bundle.crt ;
ssl_certificate_key
/etc/nginx/ssl/private/YOURDOMAIN_priv.key;
ssl_ciphers
'TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384';
ssl_protocols TLSv1.3 TLSv1.2;
ssl_ecdh_curve secp521r1:secp384r1:prime256v1;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
ssl_session_tickets off;
add_header Referrer-Policy "no-referrer";
add_header Strict-Transport-Security "max-age=15768000;
includeSubDomains" always;
add_header X-Frame-Options "";
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
proxy_hide_header Server;
proxy_hide_header X-Powered-By;
proxy_hide_header X-Frame-Options;
client_body_timeout 10;
client_header_timeout 10;
* #CAC client Certificate Settings
ssl_client_certificate /etc/nginx/ssl/dod/dodpki.pem;
ssl_verify_client on;
ssl_verify_depth 2;*
error_page 400 496 /400.html; #Custom 400 496 page
location = /400.html {
*Thank You*
Sean Hulbert
*Security Centric Inc.*
A Cybersecurity Virtualization Enablement Company
/StormCloud Gov, Protected CUI Environment!/
Industry's most secure CMMC/iTAR virtual desktops!
*/FedRAMP MIL4 in process/*
System Award Management
*CAGE: 8AUV4*
*SAM ID: UMJLJ8A7BMT3*
AFCEA San Francisco Chapter President
If you have heard of a hacker by name, he/she has failed, fear the
hacker you haven’t heard of!
CONFIDENTIALITY NOTICE: This communication with its contents may contain
confidential and/or legally privileged information. It is solely for the
use of the intended recipient(s). Unauthorized interception, review, use
or disclosure is prohibited and may violate applicable laws including
the Electronic Communications Privacy Act. If you are not the intended
recipient, please contact the sender and destroy all copies of the
communication. Content within this email communication is not legally
binding as a contract and no promises are guaranteed unless in a formal
contract outside this email communication.
igitur qui desiderat pacem, praeparet bellum!!!
Epitoma Rei Militaris
On 1/22/2025 11:51 PM, Bhupender wrote:
>
> Dear Support Team,
>
> I hope this email finds you well. I am encountering issues with smart
> card integration in our Guacamole deployment and would appreciate your
> assistance.
>
> *Environment Details:*
>
> * *Guacamole Version:* 1.5.4
> * *OS:* Ubuntu 22.04
> * *Smart Card Reader:* ACS ACR39U ICC Reader
> * *Card Type:* Siemens SLE 4432/42
> * *FreeRDP Version:* 2.6.1
>
> *Key Issue:*
>
> Smart card authentication works with direct xfreerdp connections
> but *fails when connecting through Guacamole*. The smart card
> reader is detected at system level but not being redirected
> through the Guacamole connection.
>
> *Working Configuration:*
>
> bash
> Copy
> |# Direct xfreerdp connection (WORKING): xfreerdp
> /v:<RDP-SERVER>:<PORT> /u:<USERNAME> /smartcard|
>
> *Current Implementation:*
>
> 1. *Guacamole Properties:*
> properties
> Copy
> |rdp.security: nla rdp.enable-smartcard: true
> rdp.smartcard-readers: ACS ACR39U ICC Reader 00 00
> rdp.enable-drive: true rdp.create-drive-path: true
> rdp.ignore-cert: true|
>
> *Steps Completed:*
>
> 1. ✅ Recompiled guacamole-server with smart card support:
> bash
> Copy
> |CFLAGS="-I/usr/include/PCSC -I/usr/include/freerdp2
> -DFREERDP_SMARTCARD_EMULATE=1" LDFLAGS="-lpcsclite -lfreerdp2"|
> 2. ✅ Installed all required dependencies
> 3. ✅ Configured proper system permissions
> 4. ✅ Verified smart card detection
> 5. ✅ Tested multiple connection configurations
>
> *Current Status:*
>
> * ✅ System properly detects smart card reader
> * ✅ Direct xfreerdp connections work
> * ❌ Guacamole fails to redirect smart card
> * ❌ Basic RDP connectivity affected after changes
>
> *Critical Questions:*
>
> 1. *Configuration:* Are there specific parameters we're missing?
> 2. *Debugging:* What are the recommended steps to identify the
> redirection issue?
> 3. *Logging:* Is there additional logging we can enable for smart
> card handling?
>
> *Relevant Logs:*
>
> Copy
> |Jan 22 12:49:17 guacd[xxxx]: Security mode: NLA Jan 22 12:49:37
> guacd[xxxx]: Connected to RDPDR 1.13 as client 0x0017 Jan 22 12:49:38
> guacd[xxxx]: RDPDR user logged on|
>
> *Additional Information:*
>
> * Smart card is detected by |pcsc_scan|
> * All system services are running
> * Proper permissions are set for guacd user
>
> I can provide any additional technical details or logs if needed. Your
> guidance on resolving this issue would be greatly appreciated.
>
> Thank you for your time and assistance.
>
> Best regards,
> Bhupender
>
Re: Technical Support Request - Smart Card Integration with Guacamole 1.5.4
Posted by Nick Couchman <vn...@apache.org>.
On Fri, Jan 24, 2025 at 3:43 AM Bhupender <bh...@diro.io.invalid> wrote:
> Thank you Mike for clarifying about Guacamole's smart card support
> limitations. Based on your response, I understand:
>
> 1. Guacamole doesn't currently support direct smart card redirection
> 2. The properties I tried in guacamole.properties are invalid
> 3. Smart card SSO will be available in version 1.6.0 (GUACAMOLE-839)
>
>
Correct.
> I'll explore using the ${GUAC_USERNAME} token as a workaround for now.
>
> Questions:
> 1. For version 1.6.0 SSO, will it support specific smart card
> types/standards?
>
Guacamole does not limit or support any particular type of Smart Card -
Smart Cards are just ways of securely storing and accessing SSL
certificates, and the SSO SSL support in Guacamole 1.6.0 will support any
Smart Card that your browser is able to see, along with any other SSL
certificates that support client authentication (for example, Active
Directory-issued certificates).
> 2. What's the expected timeline for 1.6.0 release?
>
>
We don't have a firm timeline - a couple of lingering items are getting
cleaned up, now, before it heads to the RC stage.
-Nick
Re: Technical Support Request - Smart Card Integration with Guacamole 1.5.4
Posted by Michael Jumper <mj...@apache.org>.
On 1/24/25 12:42 AM, Bhupender wrote:
> Thank you Mike for clarifying about Guacamole's smart card support
> limitations. Based on your response, I understand:
>
> 1. Guacamole doesn't currently support direct smart card redirection
> 2. The properties I tried in guacamole.properties are invalid
> 3. Smart card SSO will be available in version 1.6.0 (GUACAMOLE-839)
>
> I'll explore using the ${GUAC_USERNAME} token as a workaround for now.
>
> Questions:
> 1. For version 1.6.0 SSO, will it support specific smart card types/
> standards?
That would actually be up to the user's OS and browser. Only the local
OS and browser will be interfacing directly with the smart card.
For smart card SSO within Guacamole, you deploy a reverse proxy like
Nginx to provide SSL/TLS client authentication. Guacamole consumes the
assertion of the user's identity via an HTTP header added by that
reverse proxy.
> 2. What's the expected timeline for 1.6.0 release?
>
It looks like 1.6.0 should be ready in a week or two, but take that with
a grain of salt. We're moving forward carefully given the scope of the
changes to guacd intended to improve performance.
If no other issues pop up during testing, a week or two should be accurate.
- Mike
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org
Re: Technical Support Request - Smart Card Integration with Guacamole 1.5.4
Posted by Bhupender <bh...@diro.io.INVALID>.
Thank you Mike for clarifying about Guacamole's smart card support
limitations. Based on your response, I understand:
1. Guacamole doesn't currently support direct smart card redirection
2. The properties I tried in guacamole.properties are invalid
3. Smart card SSO will be available in version 1.6.0 (GUACAMOLE-839)
I'll explore using the ${GUAC_USERNAME} token as a workaround for now.
Questions:
1. For version 1.6.0 SSO, will it support specific smart card
types/standards?
2. What's the expected timeline for 1.6.0 release?
Best regards,
Bhupender
On Thu, Jan 23, 2025 at 1:52 PM Michael Jumper <mj...@apache.org> wrote:
> On 1/22/25 11:51 PM, Bhupender wrote:
> > Dear Support Team,
> >
> > I hope this email finds you well. I am encountering issues with smart
> > card integration in our Guacamole deployment and would appreciate your
> > assistance.
> >
> > ...
> >
> > *Current Implementation:*
> >
> > 1. *Guacamole Properties:*
> >
> > properties
> > Copy
> > |rdp.security: nla rdp.enable-smartcard: true rdp.smartcard-readers:
> > ACS ACR39U ICC Reader 00 00 rdp.enable-drive: true rdp.create-drive-
> > path: true rdp.ignore-cert: true|
> >
> > ...
> >
>
> You're in the right place to seek assistance, but please note that this
> is a community of your fellow users and volunteer developers, not a
> support team.
>
> Guacamole does not have smart cart redirection support and none of the
> properties you show for your guacamole.properties are valid properties.
>
> While the FreeRDP library and native "xfreerdp" client do have support
> for smart cards, leveraging that support through JavaScript and the
> browser is whole different problem. Low-level smart card operations are
> not currently exposed by browsers through any standard API, and such an
> API would be a prerequisite for implementing this.
>
> Authenticating to Guacamole itself using smart cards _is_ possible in
> the sense of single sign-on. That's part of the upcoming 1.6.0 release:
>
> https://issues.apache.org/jira/browse/GUACAMOLE-839
>
> This much is possible because it's purely between the browser and
> webapp, and thus can build on the browser's support for SSL/TLS client
> authentication. You can't pass that on to RDP, though, except to perhaps
> pass the username from the card with the "${GUAC_USERNAME}" token:
>
>
> https://guacamole.apache.org/doc/gug/configuring-guacamole.html#parameter-tokens
>
> - Mike
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
> For additional commands, e-mail: user-help@guacamole.apache.org
>
>
Re: Technical Support Request - Smart Card Integration with Guacamole 1.5.4
Posted by Michael Jumper <mj...@apache.org>.
On 1/22/25 11:51 PM, Bhupender wrote:
> Dear Support Team,
>
> I hope this email finds you well. I am encountering issues with smart
> card integration in our Guacamole deployment and would appreciate your
> assistance.
>
> ...
>
> *Current Implementation:*
>
> 1. *Guacamole Properties:*
>
> properties
> Copy
> |rdp.security: nla rdp.enable-smartcard: true rdp.smartcard-readers:
> ACS ACR39U ICC Reader 00 00 rdp.enable-drive: true rdp.create-drive-
> path: true rdp.ignore-cert: true|
>
> ...
>
You're in the right place to seek assistance, but please note that this
is a community of your fellow users and volunteer developers, not a
support team.
Guacamole does not have smart cart redirection support and none of the
properties you show for your guacamole.properties are valid properties.
While the FreeRDP library and native "xfreerdp" client do have support
for smart cards, leveraging that support through JavaScript and the
browser is whole different problem. Low-level smart card operations are
not currently exposed by browsers through any standard API, and such an
API would be a prerequisite for implementing this.
Authenticating to Guacamole itself using smart cards _is_ possible in
the sense of single sign-on. That's part of the upcoming 1.6.0 release:
https://issues.apache.org/jira/browse/GUACAMOLE-839
This much is possible because it's purely between the browser and
webapp, and thus can build on the browser's support for SSL/TLS client
authentication. You can't pass that on to RDP, though, except to perhaps
pass the username from the card with the "${GUAC_USERNAME}" token:
https://guacamole.apache.org/doc/gug/configuring-guacamole.html#parameter-tokens
- Mike
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org
Re: Technical Support Request - Smart Card Integration with Guacamole 1.5.4
Posted by Nick Couchman <vn...@apache.org>.
On Fri, Jan 24, 2025 at 3:47 AM Bhupender <bh...@diro.io.invalid> wrote:
> Thank you Sean for sharing the NGINX-based smart card authentication
> solution.
>
> I'm interested in implementing this NGINX configuration with Guacamole. A
> few questions:
>
> 1. Does this configuration require specific smart card middleware or
> drivers on the NGINX server?
> 2. Will the smart card certificates need to be periodically updated in the
> NGINX configuration?
> 3. Is there a recommended way to test the configuration before production
> deployment?
>
> Best regards,
> Bhupender
>
>
One other note I'll add on Sean's suggestion for using Nginx to validate
the Smart Cards - if you use this in combination with the
guacamole-auth-header authentication module, you can have Nginx pass
through the name of the user who has been authenticated and allow Guacamole
to "trust" this authentication and log the user in directly. This requires
slightly more scrutiny from a security perspective, as you must make
absolute certain that nothing can spoof the header used for Nginx to pass
the username to Guacamole (by default REMOTE_USER), but it can be done. See:
https://guacamole.apache.org/doc/gug/header-auth.html
-Nick
>
Re: Technical Support Request - Smart Card Integration with Guacamole 1.5.4
Posted by Bhupender <bh...@diro.io.INVALID>.
Thank you Sean for sharing the NGINX-based smart card authentication
solution.
I'm interested in implementing this NGINX configuration with Guacamole. A
few questions:
1. Does this configuration require specific smart card middleware or
drivers on the NGINX server?
2. Will the smart card certificates need to be periodically updated in the
NGINX configuration?
3. Is there a recommended way to test the configuration before production
deployment?
Best regards,
Bhupender
On Thu, Jan 23, 2025 at 1:21 PM Bhupender <bh...@diro.io> wrote:
> Dear Support Team,
>
> I hope this email finds you well. I am encountering issues with smart card
> integration in our Guacamole deployment and would appreciate your
> assistance.
>
> *Environment Details:*
>
> - *Guacamole Version:* 1.5.4
> - *OS:* Ubuntu 22.04
> - *Smart Card Reader:* ACS ACR39U ICC Reader
> - *Card Type:* Siemens SLE 4432/42
> - *FreeRDP Version:* 2.6.1
>
> *Key Issue:*
>
> Smart card authentication works with direct xfreerdp connections but *fails
> when connecting through Guacamole*. The smart card reader is detected at
> system level but not being redirected through the Guacamole connection.
>
> *Working Configuration:*
>
> bash
> Copy
> # Direct xfreerdp connection (WORKING):
> xfreerdp /v:<RDP-SERVER>:<PORT> /u:<USERNAME> /smartcard
>
> *Current Implementation:*
>
> 1. *Guacamole Properties:*
>
> properties
> Copy
> rdp.security: nlardp.enable-smartcard: truerdp.smartcard-readers: ACS ACR39U ICC Reader 00 00rdp.enable-drive: truerdp.create-drive-path: truerdp.ignore-cert: true
>
>
> *Steps Completed:*
>
> 1. ✅ Recompiled guacamole-server with smart card support:
>
> bash
> Copy
> CFLAGS="-I/usr/include/PCSC -I/usr/include/freerdp2 -DFREERDP_SMARTCARD_EMULATE=1"LDFLAGS="-lpcsclite -lfreerdp2"
>
> 2. ✅ Installed all required dependencies
> 3. ✅ Configured proper system permissions
> 4. ✅ Verified smart card detection
> 5. ✅ Tested multiple connection configurations
>
> *Current Status:*
>
> - ✅ System properly detects smart card reader
> - ✅ Direct xfreerdp connections work
> - ❌ Guacamole fails to redirect smart card
> - ❌ Basic RDP connectivity affected after changes
>
> *Critical Questions:*
>
> 1. *Configuration:* Are there specific parameters we're missing?
> 2. *Debugging:* What are the recommended steps to identify the
> redirection issue?
> 3. *Logging:* Is there additional logging we can enable for smart card
> handling?
>
> *Relevant Logs:*
>
> Copy
> Jan 22 12:49:17 guacd[xxxx]: Security mode: NLA
> Jan 22 12:49:37 guacd[xxxx]: Connected to RDPDR 1.13 as client 0x0017
> Jan 22 12:49:38 guacd[xxxx]: RDPDR user logged on
>
> *Additional Information:*
>
> - Smart card is detected by pcsc_scan
> - All system services are running
> - Proper permissions are set for guacd user
>
> I can provide any additional technical details or logs if needed. Your
> guidance on resolving this issue would be greatly appreciated.
>
> Thank you for your time and assistance.
>
> Best regards,
> Bhupender
>