Clientless Remote Access
Traditional remote desktop solutions require users to install a thick client (like a VPN agent or the RDP app) on their personal devices, which is often difficult for non-technical users. Apache Guacamole is a clientless remote desktop gateway. It translates RDP, VNC, and SSH protocols directly into HTML5. This means your employees can securely access their corporate Windows desktops or Linux terminal servers from anywhere in the world using nothing but a standard web browser (like Chrome or Safari), without installing any software.
Step 1: Install the Required Dependencies
Guacamole consists of two main components: the guacd proxy daemon (written in C) and the Java-based web application. You must install a significant number of dependencies on your Debian server to compile the C daemon.
Open your terminal and run:
sudo apt update
sudo apt install build-essential libcairo2-dev libjpeg62-turbo-dev libpng-dev libtool-bin libossp-uuid-dev libavcodec-dev libavformat-dev libavutil-dev libswscale-dev freerdp2-dev libpango1.0-dev libssh2-1-dev libtelnet-dev libvncserver-dev libwebsockets-dev libpulse-dev libssl-dev libvorbis-dev libwebp-dev tomcat9 default-jdk -y
Step 2: Download and Compile Guacamole Server
Download the latest Guacamole server source code (e.g., version 1.5.3) from the official Apache website, extract it, and compile the daemon:
wget https://apache.org/dyn/closer.lua/guacamole/1.5.3/source/guacamole-server-1.5.3.tar.gz?action=download -O guacamole-server-1.5.3.tar.gz
tar -xzf guacamole-server-1.5.3.tar.gz
cd guacamole-server-1.5.3
./configure --with-systemd-dir=/etc/systemd/system
make
sudo make install
sudo ldconfig
Step 3: Start the Guacd Proxy Daemon
Reload the systemd daemon so it recognizes the newly compiled service, enable it to start on boot, and start it:
sudo systemctl daemon-reload
sudo systemctl enable --now guacd
Step 4: Deploy the Web Application
The Guacamole web app is distributed as a pre-compiled Java .war file. You simply need to download it and drop it into Tomcat’s webapps directory.
wget https://apache.org/dyn/closer.lua/guacamole/1.5.3/binary/guacamole-1.5.3.war?action=download -O guacamole.war
sudo cp guacamole.war /var/lib/tomcat9/webapps/
Tomcat will automatically extract the .war file and launch the application.
Step 5: Configure the Connections File
For a basic setup, you can define your users and remote servers in a static XML file (though LDAP and database integrations are recommended for enterprise environments).
Create the configuration directory and the mapping file:
sudo mkdir -p /etc/guacamole
sudo nano /etc/guacamole/user-mapping.xml
Add a configuration block linking a specific username to a specific remote Windows PC (e.g., at 192.168.1.100):
<user-mapping>
<authorize username="john.doe" password="StrongPassword123">
<connection name="Johns Work PC">
<protocol>rdp</protocol>
<param name="hostname">192.168.1.100</param>
<param name="port">3389</param>
<param name="ignore-cert">true</param>
</connection>
</authorize>
</user-mapping>
Restart Tomcat to apply the changes (sudo systemctl restart tomcat9). Open a web browser on your personal computer and navigate to http://your-debian-server:8080/guacamole. Log in as john.doe, and a full Windows Remote Desktop session will load instantly within the HTML5 canvas.