You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@guacamole.apache.org by Jamie Love <jl...@nsquared.nz> on 2025/08/25 03:46:45 UTC
SSH Proxy using guacd
Hi there,
I'm fairly sure the answer is to extend the existing SSH backend to guacd, however I was wondering if it was possible to set up guacd to ssh to a remote server via a proxy host. The equivalent of this setup in a ~/.ssh/config file:
Host server-a
HostName 192.168.10.19
User usera
Host server-b
HostName 10.3.80.40
ProxyJump server-a
User usera
Thanks
Re: SSH Proxy using guacd
Posted by Jamie Love <jl...@nsquared.nz>.
Thanks all for the great ideas. I'll look into Chrome via SupraRBI-VNC since using Chrome/chromium isn't a deal breaker.
On Wed, 27 Aug 2025, at 7:06 AM, Nick Couchman wrote:
> On Tue, Aug 26, 2025 at 8:49 AM viktor_krumm <vi...@proton.me.invalid> wrote:
>> I looked at that possibility a bit of time back. I chose to build an Event Listener (https://guacamole.apache.org/doc/gug/event-listeners.html) to forward the event to another custom service that would fork and handle the docker containers.
>>
>>
>> Sent with Proton Mail <https://proton.me/mail/home> secure email.
>>
>> On Monday, August 25th, 2025 at 6:30 PM, Jamie Love <jl...@nsquared.nz> wrote:
>>> Thanks Nick, great to see the feature is in the works.
>>> I appreciate the complexity and effort required to get these sorts of features working.
>>>
>>> One final question which I haven't been able to find an answer for. I have been wanting to run a docker-based Firefox (e.g. https://hub.docker.com/r/linuxserver/firefox) behind guacamole for per-user on-demand browser usage. There doesn't seem to be any obvious mechanism to do this, except possibly hooking into the database and monitoring for login events. Would that be the way?
>>>
> There are definitely a handful of ways to accomplish this. As Viktor mentioned, you can code an event listener and trigger actions when certain events happen within Guacamole. In the past the types of events were quite limited (there were four: login success, login failure, tunnel connect, tunnel disconnect), but with the 1.6.0 release this has been expanded to include quite a few more:
>
> https://github.com/apache/guacamole-client/tree/1.6.0/guacamole-ext/src/main/java/org/apache/guacamole/net/event
>
> Another option is to write an Authentication Provider that takes action when a user logs in - similar to the event listener, but gives you the possibility of putting something into the authentication workflow, rather than just listening for and reacting to events.
>
> Of course, both of those options rely on your ability to write some Java code - developing an extension of some form or another - but there are a couple of ways to accomplish this outside of Guacamole itself. Back in a previously life I actually used Guacaomole to front some VDI images on which I hosted some shared applications, and, while I used Guacamole for the front-end, I used HAProxy as a load balancer and then used some scripts to query the HAProxy status and react when the number of connections changed on one of the pools of systems that I was presenting to users. It was a poor man's replacement for VMware Horizon (View) or Citrix XenDesktop, but it worked - I could at least control power on the VMs and start and stop them on-demand. You can do similar things these days with other on-premise load balancers and many of the cloud options - for example, I know AWS's load balancer can scale EC2, ECS, or EKS instances for you based on demand. And platforms like Kubernetes have built-in options for load balancing, so you can probably accomplish similar things on containers on your choice of K8s cluster.
>
> -Nick
Jamie Love
N-Squared Software
mobilePhone
+64 (21) 063 5462 <tel:+64 (27) 492 7866>
emailAddress
jlove@nsquared.nz
website
nsquared.nz
Re: SSH Proxy using guacd
Posted by Nick Couchman <vn...@apache.org>.
On Tue, Aug 26, 2025 at 8:49 AM viktor_krumm <vi...@proton.me.invalid>
wrote:
> I looked at that possibility a bit of time back. I chose to build an
> Event Listener (https://guacamole.apache.org/doc/gug/event-listeners.html)
> to forward the event to another custom service that would fork and handle
> the docker containers.
>
> Sent with Proton Mail <https://proton.me/mail/home> secure email.
>
> On Monday, August 25th, 2025 at 6:30 PM, Jamie Love <jl...@nsquared.nz>
> wrote:
>
> Thanks Nick, great to see the feature is in the works.
> I appreciate the complexity and effort required to get these sorts of
> features working.
>
> One final question which I haven't been able to find an answer for. I
> have been wanting to run a docker-based Firefox (e.g.
> https://hub.docker.com/r/linuxserver/firefox) behind guacamole for
> per-user on-demand browser usage. There doesn't seem to be any obvious
> mechanism to do this, except possibly hooking into the database and
> monitoring for login events. Would that be the way?
>
> There are definitely a handful of ways to accomplish this. As Viktor
mentioned, you can code an event listener and trigger actions when certain
events happen within Guacamole. In the past the types of events were quite
limited (there were four: login success, login failure, tunnel connect,
tunnel disconnect), but with the 1.6.0 release this has been expanded to
include quite a few more:
https://github.com/apache/guacamole-client/tree/1.6.0/guacamole-ext/src/main/java/org/apache/guacamole/net/event
Another option is to write an Authentication Provider that takes action
when a user logs in - similar to the event listener, but gives you the
possibility of putting something into the authentication workflow, rather
than just listening for and reacting to events.
Of course, both of those options rely on your ability to write some Java
code - developing an extension of some form or another - but there are a
couple of ways to accomplish this outside of Guacamole itself. Back in a
previously life I actually used Guacaomole to front some VDI images on
which I hosted some shared applications, and, while I used Guacamole for
the front-end, I used HAProxy as a load balancer and then used some scripts
to query the HAProxy status and react when the number of connections
changed on one of the pools of systems that I was presenting to users. It
was a poor man's replacement for VMware Horizon (View) or Citrix
XenDesktop, but it worked - I could at least control power on the VMs and
start and stop them on-demand. You can do similar things these days with
other on-premise load balancers and many of the cloud options - for
example, I know AWS's load balancer can scale EC2, ECS, or EKS instances
for you based on demand. And platforms like Kubernetes have built-in
options for load balancing, so you can probably accomplish similar things
on containers on your choice of K8s cluster.
-Nick
Re: SSH Proxy using guacd
Posted by viktor_krumm <vi...@proton.me.INVALID>.
I looked at that possibility a bit of time back. I chose to build an Event Listener (https://guacamole.apache.org/doc/gug/event-listeners.html) to forward the event to another custom service that would fork and handle the docker containers.
Sent with [Proton Mail](https://proton.me/mail/home) secure email.
On Monday, August 25th, 2025 at 6:30 PM, Jamie Love <jl...@nsquared.nz> wrote:
> Thanks Nick, great to see the feature is in the works.
> I appreciate the complexity and effort required to get these sorts of features working.
>
> One final question which I haven't been able to find an answer for. I have been wanting to run a docker-based Firefox (e.g. https://hub.docker.com/r/linuxserver/firefox) behind guacamole for per-user on-demand browser usage. There doesn't seem to be any obvious mechanism to do this, except possibly hooking into the database and monitoring for login events. Would that be the way?
>
> Thanks
> Jamie
>
> On Tue, 26 Aug 2025, at 5:14 AM, Nick Couchman wrote:
>
>> On Sun, Aug 24, 2025 at 11:47 PM Jamie Love <jl...@nsquared.nz> wrote:
>>
>>> Hi there,
>>> I'm fairly sure the answer is to extend the existing SSH backend to guacd, however I was wondering if it was possible to set up guacd to ssh to a remote server via a proxy host. The equivalent of this setup in a ~/.ssh/config file:
>>>
>>> Host server-a
>>> HostName 192.168.10.19
>>> User usera
>>>
>>> Host server-b
>>> HostName 10.3.80.40
>>> ProxyJump server-a
>>> User usera
>>
>> Not, yet - this is actually in the works, with a Jira issue and some pull requests out there to cover it:
>> https://github.com/apache/guacamole-server/pull/534
>> https://github.com/apache/guacamole-client/pull/1003
>> https://issues.apache.org/jira/browse/GUACAMOLE-312
>>
>> -Nick
Re: SSH Proxy using guacd
Posted by Jamie Love <jl...@nsquared.nz>.
Thanks Nick, great to see the feature is in the works.
I appreciate the complexity and effort required to get these sorts of features working.
One final question which I haven't been able to find an answer for. I have been wanting to run a docker-based Firefox (e.g. https://hub.docker.com/r/linuxserver/firefox) behind guacamole for per-user on-demand browser usage. There doesn't seem to be any obvious mechanism to do this, except possibly hooking into the database and monitoring for login events. Would that be the way?
Thanks
Jamie
On Tue, 26 Aug 2025, at 5:14 AM, Nick Couchman wrote:
> On Sun, Aug 24, 2025 at 11:47 PM Jamie Love <jl...@nsquared.nz> wrote:
>> __
>> Hi there,
>> I'm fairly sure the answer is to extend the existing SSH backend to guacd, however I was wondering if it was possible to set up guacd to ssh to a remote server via a proxy host. The equivalent of this setup in a ~/.ssh/config file:
>>
>> Host server-a
>> HostName 192.168.10.19
>> User usera
>>
>> Host server-b
>> HostName 10.3.80.40
>> ProxyJump server-a
>> User usera
>>
>>
>
> Not, yet - this is actually in the works, with a Jira issue and some pull requests out there to cover it:
> https://github.com/apache/guacamole-server/pull/534
> https://github.com/apache/guacamole-client/pull/1003
> https://issues.apache.org/jira/browse/GUACAMOLE-312
>
> -Nick
Re: SSH Proxy using guacd
Posted by Nick Couchman <vn...@apache.org>.
On Sun, Aug 24, 2025 at 11:47 PM Jamie Love <jl...@nsquared.nz> wrote:
> Hi there,
> I'm fairly sure the answer is to extend the existing SSH backend to guacd,
> however I was wondering if it was possible to set up guacd to ssh to a
> remote server via a proxy host. The equivalent of this setup in a
> ~/.ssh/config file:
>
> Host server-a
> HostName 192.168.10.19
> User usera
>
> Host server-b
> HostName 10.3.80.40
> ProxyJump server-a
> User usera
>
>
>
Not, yet - this is actually in the works, with a Jira issue and some pull
requests out there to cover it:
https://github.com/apache/guacamole-server/pull/534
https://github.com/apache/guacamole-client/pull/1003
https://issues.apache.org/jira/browse/GUACAMOLE-312
-Nick