Before proceeding, be sure to check out my post on getting guacamole up and running using Docker images – here.
Updated 12/04; reflected availability of 0.9.12-incubating version of guacamole.
First, you’ll need to register for a Free Duo account, go to: https://duo.com/
Create a new Auth API application: Dashboard > Applications > Protect an Application > Web SDK
- Scroll down, under Settings and change the name to “Guacamole,” or something of your choice.
- Copy out the following information (you’ll need this for the guacamole.properties file):
- Integration Key
- Secret Key
- API hostname
Finally, generate a duo “application key” on your docker host – note you do not have to input this anywhere on your Duo configuration.
dd if=/dev/random count=1 | sha256sum
Now from your docker host we will create a skeleton extensions directory and guacamole.properties file that will be passed through to the guacamole docker image. Don’t worry, we’ll only add the Duo-specific config/ extension files here, the docker images will sort the rest out for us!
We will create this skeleton home directory under: /var/docker/config/guacamole/
# From Docker HOST execute these commands
mkdir -p /var/docker/config/guacamole/extensions/
tar zxvf guacamole-auth-duo-0.9.12-incubating.tar.gz
mv guacamole-auth-duo-0.9.12-incubating/guacamole-auth-duo-0.9.12-incubating.jar /var/docker/config/guacamole/extensions/
### Duo MFA Config
duo-api-hostname: <as per duo config>
duo-integration-key: <as per duo config>
duo-secret-key: <as per duo config>
duo-application-key: <generate using command above>
# Now save/ close the text file
Finally, we’ll now drop and recreate the guacamole docker image with Duo support – note this will stop access / any running sessions. Note how we pass through the config folder and then define it as a path within the container which GUACAMOLE_HOME then uses.
Be sure to verify syntax of this command – i.e.
- Database name
- Database user account/ password
- guacd and mysql linked docker container names
docker stop guacamole
docker rm guacamole
docker run --name guacamole --link guacd:guacd --link guac-mysql:mysql \
-e MYSQL_DATABASE='guacamole' \
-e MYSQL_USER='guacamole' \
-v /var/docker/config/guacamole:/config \
-e GUACAMOLE_HOME=/config \
-e MYSQL_PASSWORD='<your password>' \
-d -p 8080:8080 guacamole/guacamole
The guacamole container should now be started and you should be able to login/ assign MFA to your guacamole account.
Be sure to reset your browser cache as otherwise you will be presented with an error when logging on.