Skip to content

Commit 29b2a63

Browse files
itiligentitiligent
committed
v1.5.0.0
v1.5.0.0
0 parents  commit 29b2a63

14 files changed

+2250
-0
lines changed

‎1-setup.sh‎

Lines changed: 546 additions & 0 deletions
Large diffs are not rendered by default.

‎2-install-guacamole.sh‎

Lines changed: 474 additions & 0 deletions
Large diffs are not rendered by default.

‎3-install-nginx.sh‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
#!/bin/bash
2+
#######################################################################################################################
3+
# Add Nginx reverse proxy fromt end to default Guacamole install
4+
# For Ubuntu / Debian / Raspian
5+
# 3 of 4
6+
# David Harrop
7+
# August 2023
8+
#######################################################################################################################
9+
10+
# Install Nginx
11+
sudo apt-get install nginx -y &>> ${LOG_LOCATION}
12+
13+
# Configure /etc/nginx/sites-available/(local dns site name)
14+
cat >/etc/nginx/sites-available/$PROXY_SITE <<EOL
15+
server {
16+
listen 80 default_server;
17+
root /var/www/html;
18+
index index.html index.htm index.nginx-debian.html;
19+
server_name $GUAC_URL;
20+
location / {
21+
proxy_pass $GUAC_URL;
22+
proxy_buffering off;
23+
proxy_http_version 1.1;
24+
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
25+
proxy_set_header Upgrade \$http_upgrade;
26+
proxy_set_header Connection \$http_connection;
27+
access_log off;
28+
}
29+
}
30+
EOL
31+
32+
echo
33+
echo -e "${GREY}Configuring Nginx proxy to connect to Guacamole's Apache front end..."
34+
if [ $? -ne 0 ]; then
35+
echo -e "${RED}Failed. See ${LOG_LOCATION}${GREY}" 1>&2
36+
exit 1
37+
else
38+
echo -e "${LGREEN}OK${GREY}"
39+
echo
40+
fi
41+
42+
# Symlink from sites-available to sites-enabled
43+
ln -s /etc/nginx/sites-available/$PROXY_SITE /etc/nginx/sites-enabled/
44+
45+
# Make sure default Nginx site is unlinked
46+
unlink /etc/nginx/sites-enabled/default
47+
48+
# Do mandatory Nginx tweaks for logging actual client IPs through a proxy IP of 127.0.0.1 - DO NOT CHANGE COMMAND FORMATING!
49+
sudo sed -i '/pattern="%h %l %u %t &quot;%r&quot; %s %b"/a \ <!-- Allow host IP to pass through to guacamole.-->\n <Valve className="org.apache.catalina.valves.RemoteIpValve"\n internalProxies="127\.0\.0\.1|0:0:0:0:0:0:0:1"\n remoteIpHeader="x-forwarded-for"\n remoteIpProxiesHeader="x-forwarded-by"\n protocolHeader="x-forwarded-proto" />' /etc/$TOMCAT_VERSION/server.xml
50+
echo -e "${GREY}Configuring Apache Tomcat's internal proxy valve to support proxy client IP4 & IPv6 address passthough for correct logging and ACL support...${GREY}"
51+
if [ $? -ne 0 ]; then
52+
echo -e "${RED}Failed. See ${LOG_LOCATION}${GREY}" 1>&2
53+
exit 1
54+
else
55+
echo -e "${LGREEN}OK${GREY}"
56+
echo
57+
fi
58+
59+
# Allow large file transfers through Nginx
60+
sudo sed -i '/client_max_body_size/d' /etc/nginx/nginx.conf # remove this line if it already exists to prevent duplicates
61+
sudo sed -i "/Basic Settings/a \ client_max_body_size 100000000M;" /etc/nginx/nginx.conf # Add the larger file transfer size
62+
echo -e "${GREY}Boosting Nginx's 'maximum body size' parameter to support file transfers > 100 TB through the proxy...${GREY}"
63+
if [ $? -ne 0 ]; then
64+
echo -e "${RED}Failed. See ${LOG_LOCATION}${GREY}" 1>&2
65+
exit 1
66+
else
67+
echo -e "${LGREEN}OK${GREY}"
68+
echo
69+
fi
70+
71+
# Bind guacd to localhost and force all Guacamole connections via reverse proxy
72+
echo -e "${GREY}Binding guacd to 127.0.0.1 port 4822..."
73+
cat > /etc/guacamole/guacd.conf <<- "EOF"
74+
[server]
75+
bind_host = 127.0.0.1
76+
bind_port = 4822
77+
EOF
78+
if [ $? -ne 0 ]; then
79+
echo -e "${RED}Failed. See ${LOG_LOCATION}${GREY}" 1>&2
80+
exit 1
81+
else
82+
echo -e "${LGREEN}OK${GREY}"
83+
echo
84+
fi
85+
86+
# Update general ufw rules so force traffic via reverse proxy. Only Nginx and SSH will be available over the network.
87+
echo -e "${GREY}Updating firewall rules to allow only SSH and tcp 80/443..."
88+
sudo ufw default allow outgoing &>> ${LOG_LOCATION}
89+
sudo ufw default deny incoming &>> ${LOG_LOCATION}
90+
sudo ufw delete allow 8080/tcp &>> ${LOG_LOCATION}
91+
sudo ufw allow OpenSSH &>> ${LOG_LOCATION}
92+
sudo ufw allow 80/tcp &>> ${LOG_LOCATION}
93+
sudo ufw allow 443/tcp &>> ${LOG_LOCATION}
94+
echo "y" | sudo ufw enable &>> ${LOG_LOCATION}
95+
if [ $? -ne 0 ]; then
96+
echo -e "${RED}Failed. See ${LOG_LOCATION}${GREY}" 1>&2
97+
exit 1
98+
else
99+
echo -e "${LGREEN}OK${GREY}"
100+
echo
101+
fi
102+
103+
# Reload everything
104+
echo -e "${GREY}Restaring Guacamole & Ngnix..."
105+
sudo systemctl restart $TOMCAT_VERSION &>> ${LOG_LOCATION}
106+
sudo systemctl restart guacd &>> ${LOG_LOCATION}
107+
sudo systemctl restart nginx &>> ${LOG_LOCATION}
108+
if [ $? -ne 0 ]; then
109+
echo -e "${RED}Failed. See ${LOG_LOCATION}${GREY}" 1>&2
110+
exit 1
111+
else
112+
echo -e "${LGREEN}OK${GREY}"
113+
echo
114+
fi
115+
116+
# Done
117+
echo -e ${NC}

‎4a-install-ssl-self-signed-nginx.sh‎

Lines changed: 219 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,219 @@
1+
#!/bin/bash
2+
#######################################################################################################################
3+
# Add self signed SSL certificates to Guacamole with Nginx reverse proxy
4+
# For Ubuntu / Debian / Raspian
5+
# 4a of 4
6+
# David Harrop
7+
# April 2023
8+
#######################################################################################################################
9+
10+
# To run manually and regenerate certificates, this script must be run in the current user enviroment [-E switch]
11+
# to provide certifacate outputs correctly. Runing just as sudo will save certs to sudo's home path
12+
# sudo -E ./4a-install-ssl-self-signed-nginx.sh [your-dns-name.local] [3650]
13+
14+
# Hack to assist with displaying "$" symbols and " ' quotes in a (cut/pasteable) bash screen output format for Nginx configs
15+
SHOWASTEXT1='$mypwd'
16+
SHOWASTEXT2='"Cert:\LocalMachine\Root"'
17+
18+
# Discover all IPv4 interfaces addresses to bind to new SSL certficates
19+
echo
20+
echo -e "${GREY}Discovering the default route interface and DNS names to bind with the new SSL certificate..."
21+
# Dump interface info and copy this output to a temp file
22+
DUMP_IPS=$(ip -o addr show up primary scope global | while read -r num dev fam addr rest; do echo ${addr%/*}; done)
23+
echo $DUMP_IPS > $TMP_DIR/dump_ips.txt
24+
25+
# Filter out anything but numerical characters, then add output to a temporary list
26+
grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}" $TMP_DIR/dump_ips.txt > $TMP_DIR/ip_list.txt
27+
28+
# Separate each row in the temporary ip_list.txt file and further split each single row into a separate new temp file for each individual IP address found
29+
sed -n '1p' $TMP_DIR/ip_list.txt > $TMP_DIR/1st_ip.txt
30+
#sed -n '2p' $TMP_DIR/ip_list.txt > $TMP_DIR/2nd_ip.txt # uncomment for 2nd interface
31+
#sed -n '3p' $TMP_DIR/ip_list.txt > $TMP_DIR/3rd_ip.txt # uncomment for 3rd interface etc
32+
33+
# Assign each individual IP address temp file a discreet variable for use in the certificate parameters setup
34+
IP1=$(cat $TMP_DIR/1st_ip.txt)
35+
#IP2=$(cat $TMP_DIR/2nd_ip.txt) # uncomment for 2nd interface
36+
#IP3=$(cat $TMP_DIR/3rd_ip.txt) # uncomment for 3rd interface etc
37+
if [ $? -ne 0 ]; then
38+
echo -e "${RED}Failed. See ${LOG_LOCATION}${GREY}" 1>&2
39+
exit 1
40+
else
41+
echo -e "${GREEN}OK${GREY}"
42+
echo
43+
fi
44+
45+
echo
46+
echo -e "${GREY}New self signed SSL certificate attributes are shown below...${GREY}"
47+
echo -e "${DGREY}"
48+
49+
# Display the new SSL cert parameters. Prompt for change if required
50+
cat <<EOF | tee -a $TMP_DIR/cert_attributes.txt
51+
[req]
52+
distinguished_name = req_distinguished_name
53+
x509_extensions = v3_req
54+
prompt = no
55+
string_mask = utf8only
56+
57+
[req_distinguished_name]
58+
C = $CERT_COUNTRY
59+
ST = $CERT_STATE
60+
L = $CERT_LOCATION
61+
O = $CERT_ORG
62+
OU = $CERT_OU
63+
CN = $PROXY_SITE
64+
65+
[v3_req]
66+
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
67+
extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection
68+
subjectAltName = @alt_names
69+
70+
[alt_names]
71+
DNS.1 = $PROXY_SITE
72+
IP.1 = $IP1
73+
EOF
74+
# Add IP.2 & IP.3 into the above cat <<EOF as needed.
75+
#IP.2 = $IP3
76+
#IP.3 = $IP3
77+
# Additional DNS names can also be manually added into the above cat <<EOF as needed.
78+
#DNS.2 =
79+
#DNS.3 =
80+
81+
# Set default certificate file destinations. These can be adapted for any other SSL application.
82+
DIR_SSL_CERT="/etc/nginx/ssl/cert"
83+
DIR_SSL_KEY="/etc/nginx/ssl/private"
84+
85+
# Setup SSL certificate variables
86+
SSLNAME=$1
87+
SSLDAYS=$2
88+
89+
if [[ $SSLDAYS == "" ]]; then
90+
$SSLDAYS = 3650
91+
fi
92+
93+
echo "Creating a new Certificate ..."
94+
openssl req -x509 -nodes -newkey rsa:2048 -keyout $SSLNAME.key -out $SSLNAME.crt -days $SSLDAYS -config $TMP_DIR/cert_attributes.txt
95+
96+
# Make directories to place SSL Certificate if they don't exist
97+
if [[ ! -d $DIR_SSL_KEY ]]; then
98+
sudo mkdir -p $DIR_SSL_KEY
99+
fi
100+
101+
if [[ ! -d $DIR_SSL_CERT ]]; then
102+
sudo mkdir -p $DIR_SSL_CERT
103+
fi
104+
105+
# Place SSL Certificate within defined path
106+
sudo cp $SSLNAME.key $DIR_SSL_KEY/$SSLNAME.key
107+
sudo cp $SSLNAME.crt $DIR_SSL_CERT/$SSLNAME.crt
108+
109+
# Create a PFX formatted key for easier import to Windows hosts and change permissions to enable copying elsewhere
110+
sudo openssl pkcs12 -export -out $SSLNAME.pfx -inkey $SSLNAME.key -in $SSLNAME.crt -password pass:1234
111+
sudo chmod 0774 $SSLNAME.pfx
112+
echo -e "${GREY}Creating a selection of self signed certificates for Nginx and Windows/Linux browser clients...${GREY}"
113+
if [ $? -ne 0 ]; then
114+
echo -e "${RED}Failed. See ${LOG_LOCATION}${GREY}" 1>&2
115+
exit 1
116+
else
117+
echo -e "${GREEN}OK${GREY}"
118+
echo
119+
fi
120+
121+
# Backup the current Nginx config before update
122+
cp /etc/nginx/sites-enabled/${PROXY_SITE} $DOWNLOAD_DIR/${PROXY_SITE}-nginx.bak
123+
echo -e "${GREY}Backing up previous Nginx proxy to $DOWNLOAD_DIR/$PROXY_SITE-nginx.bak"
124+
if [ $? -ne 0 ]; then
125+
echo -e "${RED}Failed. See ${LOG_LOCATION}${GREY}" 1>&2
126+
exit 1
127+
else
128+
echo -e "${GREEN}OK${GREY}"
129+
echo
130+
fi
131+
132+
# Update Nginx config to accept the new certificates
133+
cat > /etc/nginx/sites-available/$PROXY_SITE <<EOL | > /dev/null
134+
server {
135+
#listen 80 default_server;
136+
root /var/www/html;
137+
index index.html index.htm index.nginx-debian.html;
138+
server_name $PROXY_SITE;
139+
location / {
140+
proxy_pass $GUAC_URL;
141+
proxy_buffering off;
142+
proxy_http_version 1.1;
143+
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
144+
proxy_set_header Upgrade \$http_upgrade;
145+
proxy_set_header Connection \$http_connection;
146+
access_log off;
147+
}
148+
listen 443 ssl;
149+
ssl_certificate /etc/nginx/ssl/cert/$SSLNAME.crt;
150+
ssl_certificate_key /etc/nginx/ssl/private/$SSLNAME.key;
151+
ssl_session_cache shared:SSL:1m;
152+
ssl_session_timeout 5m;
153+
}
154+
server {
155+
return 301 https://\$host\$request_uri;
156+
listen 80 default_server;
157+
root /var/www/html;
158+
index index.html index.htm index.nginx-debian.html;
159+
server_name $PROXY_SITE;
160+
location / {
161+
proxy_pass $GUAC_URL;
162+
proxy_buffering off;
163+
proxy_http_version 1.1;
164+
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
165+
proxy_set_header Upgrade \$http_upgrade;
166+
proxy_set_header Connection \$http_connection;
167+
access_log off;
168+
}
169+
}
170+
EOL
171+
172+
echo -e "${GREY}Configuring Nginx proxy to use self signed SSL certificates and setting up automatic HTTP to HTTPS redirect...${GREY}"
173+
if [ $? -ne 0 ]; then
174+
echo -e "${RED}Failed. See ${LOG_LOCATION}${GREY}" 1>&2
175+
exit 1
176+
else
177+
echo -e "${GREEN}OK${GREY}"
178+
echo
179+
fi
180+
181+
printf "${GREY}+-------------------------------------------------------------------------------------------------------------
182+
${GREEN}+ WINDOWS CLIENT SELF SIGNED SSL BROWSER CONFIG - SAVE THIS BEFORE CONTINUING!${GREY}
183+
+
184+
+ 1. In ${DOWNLOAD_DIR} is a Windows friendly version of the new certificate ${LYELLOW}$SSLNAME.pfx${GREY}
185+
+ 2. Copy this .pfx file to a location accessible by Windows.
186+
+ 3. Import the PFX file into your Windows client with the below Powershell commands (as administrator):
187+
\n"
188+
echo -e "${SHOWASTEXT1} = ConvertTo-SecureString -String "1234" -Force -AsPlainText"
189+
echo -e "Import-pfxCertificate -FilePath $SSLNAME.pfx -Password "${SHOWASTEXT1}" -CertStoreLocation "${SHOWASTEXT2}""
190+
echo -e "(Clear your browser cache and restart your browser to test.)"
191+
printf "${GREY}+-------------------------------------------------------------------------------------------------------------
192+
${GREEN}+ LINUX CLIENT SELF SIGNED SSL BROWSER CONFIG - SAVE THIS BEFORE CONTINUING!${GREY}
193+
+
194+
+ 1. In In ${DOWNLOAD_DIR} is also the Linux native OpenSSL certificate ${LYELLOW}$SSLNAME.crt${GREY}
195+
+ 2. Copy this file to a location accessible by Linux.
196+
+ 3. Import the CRT file into your Linux client certificate store with the below command (as sudo):
197+
\n"
198+
echo -e "certutil -d sql:$HOME/.pki/nssdb -A -t "CT,C,c" -n $SSLNAME -i $SSLNAME.crt"
199+
echo -e "(If certutil is not installed, run apt-get install libnss3-tools)"
200+
printf "+-------------------------------------------------------------------------------------------------------------\n"
201+
echo
202+
echo -e "${LYELLOW}The above SSL browser config instructions are also saved in ${LGREEN}$LOG_LOCATION${GREY}"
203+
echo
204+
205+
# Reload everything
206+
echo -e "${GREY}Restaring Guacamole & Ngnix..."
207+
sudo systemctl restart $TOMCAT_VERSION
208+
sudo systemctl restart guacd
209+
sudo systemctl restart nginx
210+
if [ $? -ne 0 ]; then
211+
echo -e "${RED}Failed. See ${LOG_LOCATION}${GREY}" 1>&2
212+
exit 1
213+
else
214+
echo -e "${LGREEN}OK${GREY}"
215+
echo
216+
fi
217+
218+
# Done
219+
echo -e ${NC}

0 commit comments

Comments
 (0)