在 Linux 下用 Docker 搭建 Apache Guacamole

文章

林里克斯

188字数

Linux

Apache Guacamole 是无客户端远程桌面网关。它支持标准协议，例如 VNC，RDP 和 SSH 等

实验平台：CentOS 7.7.1908

docker version：17.06.2-ce

docker-compose version：1.25.4

一、搭建环境
二、配置 guacamole
三、遇到的问题
四、使用 Nginx 反向代理 HTTPS 访问

一、搭建环境

1.docker 和 docker-compose 安装省略

2.编写 docker-compose.yml

$ vim /root/guacamole/docker-compose.yml

version: '3'
services:
  guacd:
    image: guacamole/guacd
    container_name: guacd
    restart: always
    networks:
      guacamole:
        aliases:
          - guacd

  guacamole:
    image: guacamole/guacamole
    container_name: guacamole
    restart: always
    depends_on:
      - guacd
      - mysql
    networks:
      guacamole:
        aliases:
          - guacamole
    environment:
      - MYSQL_HOSTNAME=mysql
      - MYSQL_PORT=3306
      - MYSQL_DATABASE=guacamole
      - MYSQL_USER=guacamole
      - MYSQL_PASSWORD=guacamole123
      - GUACD_HOSTNAME=guacd
      - GUACD_PORT=4822
    ports:
      - 8000:8080
    links:
      - guacd
      - mysql

  mysql:
    image: registry.cn-hangzhou.aliyuncs.com/jarbo/mysql:5.7
    container_name: mysql
    restart: always
    ports:
      - 3306:3306
    volumes:
      - /volume4/docker/db/mysql/:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=mysql123

networks:
  guacamole:

3.下载启动

$ docker-compose up -d

4.创建数据库及用户

> create database guacamole default character set=utf8mb4;

> create user "guacamole"@"%" identified by "guacamole123";

> grant all on guacamole.* to guacamole;

> flush privileges;

5.跑 guacamole 用于初始化数据库的脚本，导出 SQL 文件

$ docker run --rm guacamole/guacamole /opt/guacamole/bin/initdb.sh --mysql > initdb.sql

6.初始化数据库

$ docker cp initdb.sql mysql:/root

$ docker exec -it mysql /bin/bash
   $ mysql -u guacamole -pguacamole123
   > use guacamole;
   > source /root/initdb.sql;

搭建完毕

二、配置 guacamole

1.登录访问

http://10.10.10.58:32771/guacamole/#/

默认账号：guacadmin；密码：guacadmin

配置一个 Windows 连接

连接测试

配置一个 Linux 连接

连接测试

三、遇到的问题

连接 Windows 实例报错

查看 Tomcat 日志

org.apache.guacamole.websocket.GuacamoleWebSocketTunnelEndpoint$2.run(GuacamoleWebSocketTunnelEndpoint.java:246) ~[guacamole-common-1.0.0.jar:na]
Caused by: java.net.SocketException: Socket closed
        at java.net.SocketInputStream.socketRead0(Native Method) ~[na:1.8.0_232]
        at java.net.SocketInputStream.socketRead(SocketInputStream.java:116) ~[na:1.8.0_232]
        at java.net.SocketInputStream.read(SocketInputStream.java:171) ~[na:1.8.0_232]
        at java.net.SocketInputStream.read(SocketInputStream.java:141) ~[na:1.8.0_232]
        at sun.nio.cs.StreamDecoder.readBytes(StreamDecoder.java:284) ~[na:1.8.0_232]
        at sun.nio.cs.StreamDecoder.implRead(StreamDecoder.java:326) ~[na:1.8.0_232]
        at sun.nio.cs.StreamDecoder.read(StreamDecoder.java:178) ~[na:1.8.0_232]
        at java.io.InputStreamReader.read(InputStreamReader.java:184) ~[na:1.8.0_232]
        at org.apache.guacamole.io.ReaderGuacamoleReader.read(ReaderGuacamoleReader.java:169) ~[guacamole-common-1.0.0.jar:na]
        ... 5 common frames omitted

解决报错

修改 Windows 注册表

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp]

修改“SecurityLayer” 项的值为 1
修改 “UserAuthentication” 项的值为 0

四、使用 Nginx 反向代理 HTTPS 访问

1.编辑 Nginx 配置文件

$ vim /usr/local/nginx/conf.d/guacamole.conf

server {

    listen      443 ssl;
    listen      [::]:443 ssl;

    server_name home.kjarbo.com;

    error_page 497 301 =307 https://$host:$server_port$request_uri;

    ssl_certificate /usr/local/nginx/cert/cert.pem;
    ssl_certificate_key /usr/local/nginx/cert/key.pem;
    ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    location / {
    proxy_connect_timeout 60;
    proxy_read_timeout 60;
    proxy_send_timeout 60;
    proxy_intercept_errors off;
    proxy_http_version 1.1;
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_pass http://10.10.10.58:32771/guacamole/;
    proxy_buffering off;
    proxy_cookie_path /guacamole/ /;
    access_log off;
  }
}