Access Your Machines with Guacamole

A few months ago, my colleague Rich Lucente wrote a nice post about how to use Apache Guacamole on OpenShift to access Red Hat JBoss Developer Studio.

I really liked the approach, but, coming from a "sysadmin" background, I was interested to see how the basic functionality of Guacamole could provide a way to access remote machines only using a browser, quite handy during "night's watch".

Prepare OpenShift Container Platform

I won't cover OpenShift deployment, and will assume you use something like the following to quickly set up a testing cluster:

export IP=`ip a l  eth0 | grep 'inet ' | cut -d' ' -f6 | awk -F'/' '{ print $1}'`

oc cluster up --public-hostname $IP.xip.io --routing-suffix $IP.xip.io

Deploying Guacamole

The following commands are used to:

• Create a project holding Guacamole components.
• Allow access as root for the Guacamole containers. Note:This is bad, but at least limited to this specific project and allows you to use images provided by Guacamole folks.
• Provisions a MySQL instance to hold Guacamole data.
• Initialize MySQL.
• Launch a Guacamole pod and connect to the MySQL instance. Note:This pod actually "contains" two containers.
• Expose the Guacamole UI with a route.

oc new-project guacamole

oadm policy add-scc-to-user anyuid -z default -n guacamole

oc new-app mysql MYSQL_USER=guacamole MYSQL_PASSWORD=guacamole MYSQL_DATABASE=guacamole

oc volume dc/mysql --add --name=mysql-volume-1 -t pvc --claim-name=mysql-claim --claim-size=1G --overwrite

oc run guacamole --image=guacamole/guacamole --restart=Never --command -- /opt/guacamole/bin/initdb.sh --mysql

oc logs guacamole > initdb.sql

oc delete pod guacamole

export MYSQLPOD=`oc get pod -o jsonpath='{.items[*].metadata.name}' | grep mysql`

oc rsh $MYSQLPOD /opt/rh/rh-mysql57/root/bin/mysql -h 127.0.0.1 -P 3306 -u guacamole -pguacamole guacamole < initdb.sql

oc new-app guacamole/guacamole+guacamole/guacd --name=guacamole -e GUACAMOLE_HOME=/tmp -e GUACD_HOSTNAME=127.0.0.1 -e GUACD_PORT=4822 -e  MYSQL_HOSTNAME=mysql.guacamole.svc.cluster.local -e MYSQL_PORT=3306 -e MYSQL_DATABASE=guacamole -e MYSQL_USER=guacamole -e MYSQL_PASSWORD=guacamole

oc expose service guacamole --port=8080 --path=/guacamole

Check Guacamole Is Up

You can use the following to see if pods are properly running:

oc get pod

NAME                READY     STATUS    RESTARTS   AGE

guacamole-1-5wvw4   2/2       Running   4          5d

mysql-2-cld6t       1/1       Running   2          5d

To grab the route of the Guacamole UI:

oc get route guacamole -o jsonpath='{.spec.host}'

Use the App

Now we can access Guacamole application using the existing route. The login page for Guacamole will appear. Use the default username and password of guacadmin/guacadmin.

The application is pretty straightforward to use, so feel free to add extra users (and optionally allow them to change their own password).

To add new connections, go to the settings screen using the upper right button:

From there, set a ssh or a vnc connection (you will need a vncserver running on the end machine):

Once your connections are set, you are ready!

Conclusion

By using this procedure, we quickly obtain a platform enabling us to connect to our end machines with a browser, in a secured way and by only exposing the Guacamole URL in OpenShift. OpenShift and container technology gives us an easy way to make use of such applications, without having to go into details of the installation process. There is much more that can be done using Guacamole, like access from a mobile device or scp, so check documentation for more information.