How could I live without a Browser ... IN MY BROWSER ... for so long? 🤔 😜
#FreeBSD, jailed #guacamole authenticating via #LDAP against a #Samba #ActiveDirectory, connecting via #RDP to this machine running #Xrdp as well as some #Windows "server" 😎
@jhx For writing some kind of "howto", I'll have to find a sane scope ... otherwise there would be just too much to describe I guess 😮
I could of course assume you already have
- network segmentation with a #DMZ
- a working "domain" setup with a directory and #DNS (e.g. #samba, but could be #OpenLDAP with #bind9 as well)
- (virtual) machines providing #RDP (with #xrdp in case of #Linux or #FreeBSD)
- a working mechanism to distribute X.509 #TLS #certificates (I request them from #letsencrypt using #uacme and distribute them with simple shell scripts using special-purpose restricted #SSH keys)
With all that in place, it would "just" be describing the setup of #guacamole in a #FreeBSD #jail, enabling #TLS on all connection paths...
@zirias @jhx I’ve been excitedly following your NFS project because I’m wanting to understand how to integrate with #FreeIPA or #Kanidm as one may with active directory or samba.
Personally I've not loved guac for VNC/RDP when I've got perfectly serviceble client software, but I certainly wouldn't mind proper video-terminal authn too!
@josephholsten @jhx Well, I'm certainly not a fan of this "do everything in the browser" movement, quite to the contrary, instead of making things really simpler, it adds tons of complexity. But on the other hand, you can't do anything about it, given more and more public and "enterprise" networks are configured to ONLY allow http/https outbound 😞
I want to be able to access my systems from anywhere, and I've been running #shellinabox for years, which is nice and simple and most of the time, a terminal is all you need. Still #guacamole can offer a nice addition also allowing graphical remote logins. Regarding security, anything "remote desktop" has inherent complexity and especially Microsoft had a history of vulns, so it really makes sense to have some authenticating gateway in between for access from the internet 😉
Felix Palmen 📯
jhx
: j@fabrica:~/src; 