RDP in browser and behind reverse proxy is just nice as it works everywhere ... without talking to IT why i need port x or y etc ...

thats why i prefer guacamole meanwhile over all others, specially RDP due resizing is just insane good and a winner.

Guacamole RCE disclosure released yesterday: https://research.checkpoint.com/2020/apache-guacamole-rce/

Exploit demonstrated by Check Point:

 

Successful exploit requires access to the underlying host so not the end of the world.  Still worth mentioning though, especially if one has a concern about an internal threat actor.

They put out a statement the other day saying that the recently released 1.2.0 fixed this problem.

Okay, I guess I'm happy enough with the update code now. I had a revelation that the sql update scripts are cumulative so say upgrading from 0.9.13 requires running both the 0.9.14 and 1.0.0 scripts. I'll come up with a better way to do this but for now this is what I have. If someone can come up with a more elegant way to do this feel free to submit a pull request and I'll check it out.

 

I'm still trying to figure out if there's a way I could provide database updates when using the nomariadb container.

 

As always, please let me know if you have any problems.

16 hours ago, Taddeusz said:

Okay, I guess I'm happy enough with the update code now. I had a revelation that the sql update scripts are cumulative so say upgrading from 0.9.13 requires running both the 0.9.14 and 1.0.0 scripts. I'll come up with a better way to do this but for now this is what I have. If someone can come up with a more elegant way to do this feel free to submit a pull request and I'll check it out.

 

I'm still trying to figure out if there's a way I could provide database updates when using the nomariadb container.

 

As always, please let me know if you have any problems.

Works like a charm for me! Saw that you added the OpenID-fix to firstrun.sh as well and it worked!

- Thanks!

I would like to rename or disable guacadmin, how to do so? 

I cant even seem to be able to change the standard password, it just says permission denied..

Edited July 7, 20205 yr by nuhll

10 minutes ago, nuhll said:

I would like to rename or disable guacadmin, how to do so? 

I cant even seem to be able to change the standard password, it just says permission denied..

I would think that the user you're trying to do this with would need the proper permissions: Administer system, Create new users, etc.

@nuhll You would need to have at least one user that is able to administer system, create users, and create user groups.

This is logic. I created "test" and gave him all rights. 

Okay, if ound the problem.

 

You NEED to be logged in as the 2. user before you can change the guacadmin account (you cant change your own password it seems)

Just now, nuhll said:

Okay, if ound the problem.

 

You NEED to be logged in as the 2. user before you can change the guacadmin account (you cant change your own password it seems)

You can change your own password if you have the “can change own password” permission. The guacadmin account should be able to change its own password unless you removed that permission.

Nope.

 

 

Edited July 9, 20205 yr by nuhll

Just now, nuhll said:

Nope.

 

 

Did you try a longer more complex password? I changed my guacadmin password a long time ago so I know it’s possible. I used a rather long complex password though.

3 minutes ago, nuhll said:

Nope.

 

 

Were you logged on as guacadmin?

@nuhll Have you tried logging in as guacadmin and then going to Settings and then Preferences? You can change the password there.

6 minutes ago, Taddeusz said:

@nuhll Have you tried logging in as guacadmin and then going to Settings and then Preferences? You can change the password there.

The screen i shared IS while logged into GUACADMIN.

 

When i log into my 2. user i can change the password of guacadmin tho, but this is very unintuitive...  

Edited July 9, 20205 yr by nuhll

Just now, nuhll said:

The screen i shared IS while logged into GUACADMIN.

 

When i log into my 2. user i can change the password of guacadmin tho, but this is very unintuitive...  

To change the logged in user’s password you have to go to the Preferences tab. It makes sense for security purposes so someone can’t blindly change the logged in user’s password without knowing their current password.

4 minutes ago, Taddeusz said:

To change the logged in user’s password you have to go to the Preferences tab. It makes sense for security purposes so someone can’t blindly change the logged in user’s password without knowing their current password.

Actually this doenst make any sense, but when i k now it i can work with that.

 

You cant change your own password because of security reasons if you dont know your own password, but you can change all other passwords without knowing theirs...

 

anyway, thanks for the help, i simply disabled the guacadmin.

 

One question: i added the SSH from unraid to this app, but sadly right click paste doenst work... any idea? (in the http terminal this works)

Edited July 9, 20205 yr by nuhll

Just now, nuhll said:

Actually this doenst make any sense, but when i k now it i can work with that.

 

You cant change your own password because of security reasons if you dont know your own password, but you can change all other passwords without knowing theirs...

I see your point but if the logged in user is not an admin then it makes perfect sense. If you’re in an environment where security is a more serious concern walking away from your desk while logged in as admin is the real problem.

1 minute ago, Taddeusz said:

I see your point but if the logged in user is not an admin then it makes perfect sense. If you’re in an environment where security is a more serious concern walking away from your desk while logged in as admin is the real problem.

Yes, that makes sense. Youre right. Any idea about right click paste?

1 minute ago, nuhll said:

Yes, that makes sense. Youre right. Any idea about right click paste?

In the password input fields?

1 minute ago, Taddeusz said:

In the password input fields?

No.

I added the SSH from unraid to guacamole. 

 

But i cant right click paste in the window, like i could if i used the http ssh terminal from unraid.

Edited July 9, 20205 yr by nuhll

1 minute ago, nuhll said:

No.

I added the SSH from unraid to guacamole. 

 

But i cant right click paste in the window, like i could if i used the http ssh terminal from unraid.

Press shift-ctrl-alt on your keyboard and paste whatever you need into the Clipboard text box. Then you can right click in the terminal and it will paste.

Is there no workaround or setting to have the same "workflow" as if i would run the terminal via http from unraid?

1 minute ago, nuhll said:

Is there no workaround or setting to have the same "workflow" as if i would run the terminal via http from unraid?

works fine here in chrome, did u gave the rights when browser asked for ? 1st time connect ...