[Support] jasonbean - Apache Guacamole

[hot22shot]

16 hours ago, Taddeusz said:

If your Guacamole container is connected to a custom network you need to go to Unraid’s Docker settings and enable “Host access to custom networks”.

 

Nope that's not it : I'm using the bridge interface and anyway this option is already set on my server.

And the error message suggest that Guacamole reach the SSH server but can't finish the handshake.

 

I think I may have the root cause, here's the debug logs from guacd when an attempt is made :

guacd[385]: DEBUG:      Client is using protocol version "VERSION_1_3_0"
guacd[385]: DEBUG:      Successfully connected to host 192.168.1.40, port 22
guacd[385]: ERROR:      SSH handshake failed.

 

The connection is effective but the handshake couldn't go through.

Now here's the logs from unraid :

Mar 26 08:42:08 <my unraid hostname> sshd[7790]: Unable to negotiate with 172.17.0.22 port 58070: no matching hos
t key type found. Their offer: ssh-rsa,ssh-dss [preauth]

 

So the SSH connection fails because guacd and sshd couldn't find a common ground.

The only way I could make it worked is allowing ssh-rsa again in unraid :

 

To permit using old RSA keys for OpenSSH 8.8+, add the following lines to your sshd_config:

HostKeyAlgorithms=ssh-rsa,[email protected]
PubkeyAcceptedAlgorithms=+ssh-rsa,[email protected]

 

 

Edited March 26, 2022 by hot22shot

[Taddeusz]

@hot22shot It sounds like you're using a host key. If that's the case you should probably regenerate the host key on your Unraid server to not use the insecure old RSA algorithm rather than bypassing the limitation.

[evakq8r]

Have tried setting this up today, and can't get the web UI to load the login prompt without throwing this:

 

 

There's no errors in the Apache Guacamole docker, nor MariaDB. The user and password work for the database I setup for this container, so I'm at a loss.

 

Have tried both Unraid templates (with and without mariadb), Docker has 'host access to custom networks' enabled, and have also tried different networks (br0 to give the container it's own IP, as well as my reverse proxy network).

 

Probably something simple, but any help would be appreciated. Thanks.

[Taddeusz]

27 minutes ago, evakq8r said:

Have tried setting this up today, and can't get the web UI to load the login prompt without throwing this:

 

 

There's no errors in the Apache Guacamole docker, nor MariaDB. The user and password work for the database I setup for this container, so I'm at a loss.

 

Have tried both Unraid templates (with and without mariadb), Docker has 'host access to custom networks' enabled, and have also tried different networks (br0 to give the container it's own IP, as well as my reverse proxy network).

 

Probably something simple, but any help would be appreciated. Thanks.

You’re using it with an external database? Did you import the database schema using the SQL file?

[evakq8r]

1 hour ago, Taddeusz said:

You’re using it with an external database? Did you import the database schema using the SQL file?

 

Yes using an external DB and also imported the schema. For whatever reason though, I just reinstalled it from scratch and made no changes to config, and 'it just works'.

 

NFI why, but I'm not questioning it.

[joshbgosh10592]

I feel like a complete noob, but how do you even edit the guacamole.properties? nano, vim, nor vi seem to work...

[Taddeusz]

8 minutes ago, joshbgosh10592 said:

I feel like a complete noob, but how do you even edit the guacamole.properties? nano, vim, nor vi seem to work...

I personally use nano. I haven’t had any problems. What kind of problem are you having editing the properties file?

[joshbgosh10592]

On 3/30/2022 at 10:55 PM, Taddeusz said:

I personally use nano. I haven’t had any problems. What kind of problem are you having editing the properties file?

I also typically use nano, but when I try to edit it (using the container's CLI), no commands work - not nano, not ping, not even vi. I have a feeling I'm just doing something wrong and it's a simple mistake lol..

[alturismo]

2 minutes ago, joshbgosh10592 said:

when I try to edit it (using the container's CLI), no commands work

cause the programs are not installed inside the docker ...

 

depends now how you can access the mashine, the guacamole.properties is located in /mnt/user/appdata/.....

 

so either use the unraid terminal and use nano or a client and access the share ...

 

[joshbgosh10592]

49 minutes ago, alturismo said:

cause the programs are not installed inside the docker ...

 

depends now how you can access the mashine, the guacamole.properties is located in /mnt/user/appdata/.....

 

so either use the unraid terminal and use nano or a client and access the share ...

 

Yup, sorry, like I said, I felt like a complete noob and was making a stupid, simple mistake. Thank you! I'm very new to dockers and forgot that their data is just a folder inside the appdata share.

[JonathanM]

8 hours ago, joshbgosh10592 said:

Thank you! I'm very new to dockers and forgot that their data is just a folder inside the appdata share.

Only the part of the container that has a mapping is elsewhere. Understanding the difference between the container's own filesystem, the host filesystem, and how the two interact with mapping is one of the core principles that you need to get familiar with when working with docker containers.

[BMCave]

TOPIC: TOTP field not showing on hosted site.

I have set up TOTP for ApacheGuacamole and it is working on the local host fine.
I have reversed proxied (Using NginxProxyManager) it to a custom domain and it worked without the TOTP but not with TOTP enabled the page is displayed but

there is no entry to type the one time password.

 

The network response when clicking the Continue:

POST https://vm.domain.com/api/tokens
400 Bad Request

[EDIT] - SOLVED:
One of my Cache Drives was completely filled.
Freeing up space on that drive resolved the issue. 


 

Edited April 9, 2022 by BMCave

[BMCave]

3 hours ago, BMCave said:

TOPIC: TOTP field not showing on hosted site.

I have set up TOTP for ApacheGuacamole and it is working on the local host fine.
I have reversed proxied (Using NginxProxyManager) it to a custom domain and it worked without the TOTP but not with TOTP enabled the page is displayed but

there is no entry to type the one time password.

 

The network response when clicking the Continue:

POST https://vm.domain.com/api/tokens
400 Bad Request


 

I i modify the post request on the first login page and add the one time password in it seems to work. 
 

[Taddeusz]

@BMCave Have you tried clearing your cache?

[BMCave]

On 4/4/2022 at 4:36 PM, Taddeusz said:

@BMCave Have you tried clearing your cache?

That was indeed the issue! One of my shares were set up incorrectly and filled one of the cache drives once clearing the drives it was working as expected.

Is there an explanation as to why this would affect something like this?

[Taddeusz]

15 hours ago, BMCave said:

That was indeed the issue! One of my shares were set up incorrectly and filled one of the cache drives once clearing the drives it was working as expected.

Is there an explanation as to why this would affect something like this?

I actually meant your browser cache but that would probably cause all sorts of random weirdness. In this case it was probably having issues writing to the database.

[hot22shot]

On 3/27/2022 at 7:02 PM, Taddeusz said:

@hot22shot It sounds like you're using a host key. If that's the case you should probably regenerate the host key on your Unraid server to not use the insecure old RSA algorithm rather than bypassing the limitation.

 

I do not use host key for authentification.

I think the core issue is with the algorithms used to exchange keys between guacd and unraid.

Unraid is using a recent version of openSSH, on the other end guacd use libssh2 and your image docker use version 1.8.

 

The error message I got from unraid seems to be resolved with the uprade of libssh2, would you consider bumping to 1.10 ?

 

[Taddeusz]

3 hours ago, hot22shot said:

 

I do not use host key for authentification.

I think the core issue is with the algorithms used to exchange keys between guacd and unraid.

Unraid is using a recent version of openSSH, on the other end guacd use libssh2 and your image docker use version 1.8.

 

The error message I got from unraid seems to be resolved with the uprade of libssh2, would you consider bumping to 1.10 ?

 

Not saying it’s not a problem but I have no problem connecting to my own Unraid SSH. I’m running 6.9.2. Unless something has changed with 6.10? I’m not going to be running 6.10 until it’s final. I just don't have the hardware to test this one container on the next version of Unraid. I don't want to risk my one Unraid server.

Edited April 15, 2022 by Taddeusz

[hot22shot]

8 minutes ago, Taddeusz said:

Not saying it’s not a problem but I have no problem connecting to my own Unraid SSH. I’m running 6.9.2. Unless something has changed with 6.10? I’m not going to be running 6.10 until it’s final. I just don't have the hardware to test this one container on the next version of Unraid. I don't want to risk my one Unraid server.

 

Well i don't have a 6.9.2 environment anymore, but I suppose that openSSH has been bumped since then.

6.10.0-RC4 comes with OpenSSH 8.8+ which disabled RSA by default : 

 

This release disables RSA signatures using the SHA-1 hash algorithm by default.

 

I can test any new container if you want.

[Taddeusz]

@hot22shot Looking at it further I'd have to switch to building guacd myself rather than using their pre-built guacd container. Their pre-built guacd container uses Debian buster-slim as it's base which has libssh2-1 version 1.8.0-2.1. For their upcoming 1.5.0 version they've switched to using Ubuntu 21.10 which has libssh2-1 version 1.9.0-3. I'm not sure which version of the libssh2-1 library would negotiate correctly with Unraid 6.10?

Edited April 15, 2022 by Taddeusz

[hot22shot]

On 4/15/2022 at 5:32 PM, Taddeusz said:

@hot22shot Looking at it further I'd have to switch to building guacd myself rather than using their pre-built guacd container. Their pre-built guacd container uses Debian buster-slim as it's base which has libssh2-1 version 1.8.0-2.1. For their upcoming 1.5.0 version they've switched to using Ubuntu 21.10 which has libssh2-1 version 1.9.0-3. I'm not sure which version of the libssh2-1 library would negotiate correctly with Unraid 6.10?

 

To be honest I'm not sure. Do you know when the 1.5 is due ?

 

 

[Taddeusz]

10 minutes ago, hot22shot said:

 

To be honest I'm not sure. Do you know when the 1.5 is due ?

 

 

They’ve been doing annual major version releases so probably not till January or February next year. I will try and experiment when I can. I can’t really promise a timeline.

[hot22shot]

I just tried this container : https://github.com/abesnier/docker-guacamole

Similar to yours but based on debian bullseye with libssh2 version 1.9.0-2 and it doesn't work.

[saatalir]

Hi guys, I just installed the ApacheGuacamole App from Taddeusz repo.

For some reason I get an invalid login message the moment the installation finishes and I go to 

login to the Apache server for the 1st time using the default guacadmin username/password.

Any idea why that would be happening?

Any help is greatly appreciated

[CryoRig]

@hot22shot@Taddeusz
its a known problem with how guac and libssh read some types of ssh keys
Good news its fixed but its not out yet
Guacamole Issues: 745 / 945 / 1504

https://github.com/apache/guacamole-server/pull/349
https://issues.apache.org/jira/browse/GUACAMOLE-745

 

Which means you have to buils a dev version of guac or wait for the next release...