From e57ae55700c24b53262e5dabf640e0f9ec1e9291 Mon Sep 17 00:00:00 2001 From: Christian Krakau-Louis Date: Sun, 7 Sep 2025 13:44:36 +0200 Subject: [PATCH] Update install_guac.sh --- install_guac.sh | 159 ++++++++++++++++++++++++------------------------ 1 file changed, 78 insertions(+), 81 deletions(-) diff --git a/install_guac.sh b/install_guac.sh index d25aefb..9ffbef1 100644 --- a/install_guac.sh +++ b/install_guac.sh @@ -1,7 +1,10 @@ #!/bin/bash set -euo pipefail -# --- Defaults --- +# ============================================================ +# Guacamole Install Script (ARM/AMD, Ubuntu 24.04+) +# ============================================================ + GUACVERSION="1.5.5" GUAC_USER="guacamole_user" GUAC_DB="guacamole_db" @@ -9,63 +12,28 @@ TOMCAT_VER=9.0.109 CRED_FILE="/root/guacamole-credentials.txt" VERBOSE=false -# --- Temporary defaults (safe for reruns) --- +# Temporary bootstrap passwords MYSQL_ROOT_PWD="root" GUAC_PWD="guac" -# --- Colors --- YELLOW='\033[1;33m' BLUE='\033[0;34m' RED='\033[0;31m' GREEN='\033[0;32m' NC='\033[0m' -# --- Functions --- -usage() { - cat </dev/null 2>&1 ;; - *) echo -e "${RED}Unknown option: $1${NC}"; usage; exit 1 ;; - esac - shift -done - -# --- Hostname detection (IPv4 only, reverse DNS via Google DNS) --- +# ============================================================ +# Hostname detection (reverse DNS of IPv4) +# ============================================================ SERVER_NAME=${SERVER_NAME:-} if [ -z "$SERVER_NAME" ]; then PUBIP=$(curl -4 -s ifconfig.me || echo "") if [ -n "$PUBIP" ]; then apt-get install -y -qq dnsutils >/dev/null 2>&1 || true REVNAME=$(dig +short -x $PUBIP @8.8.8.8 | sed 's/\.$//' || true) - if [ -n "$REVNAME" ]; then - DEFAULT_NAME=$REVNAME - else - DEFAULT_NAME=$PUBIP - fi + DEFAULT_NAME=${REVNAME:-$PUBIP} else DEFAULT_NAME="localhost" fi @@ -75,37 +43,45 @@ if [ -z "$SERVER_NAME" ]; then SERVER_NAME=${SERVER_NAME:-$DEFAULT_NAME} else SERVER_NAME=$DEFAULT_NAME - echo -e "${YELLOW}No SERVER_NAME provided, using default (IPv4): ${SERVER_NAME}${NC}" + log "${YELLOW}No SERVER_NAME provided, using default: ${SERVER_NAME}${NC}" fi fi -# --- Install base packages --- +# ============================================================ +# Base packages +# ============================================================ log "${BLUE}>>> Installing base packages...${NC}" apt-get update -y DEBIAN_FRONTEND=noninteractive apt-get install -yq \ - xfce4 xfce4-goodies tightvncserver ufw curl wget zsh dnsutils \ - build-essential libjpeg-turbo8-dev libpng-dev libossp-uuid-dev \ - libavcodec-dev libavformat-dev libavutil-dev libswscale-dev \ - freerdp2-dev libpango1.0-dev libssh2-1-dev libtelnet-dev \ - libvncserver-dev libpulse-dev libssl-dev libvorbis-dev libwebp-dev \ - libwebsockets-dev freerdp2-x11 libtool-bin ghostscript dpkg-dev crudini \ - mariadb-server mariadb-client nginx certbot python3-certbot-nginx openssl + xfce4 xfce4-goodies tightvncserver ufw curl wget zsh dnsutils \ + build-essential libjpeg-turbo8-dev libpng-dev libossp-uuid-dev \ + libavcodec-dev libavformat-dev libavutil-dev libswscale-dev \ + freerdp2-dev libpango1.0-dev libssh2-1-dev libtelnet-dev \ + libvncserver-dev libpulse-dev libssl-dev libvorbis-dev libwebp-dev \ + libwebsockets-dev freerdp2-x11 libtool-bin ghostscript dpkg-dev crudini \ + mariadb-server mariadb-client nginx certbot python3-certbot-nginx openssl -# --- Java --- +# ============================================================ +# Java +# ============================================================ if ! command -v java >/dev/null 2>&1; then apt-get install -y openjdk-17-jre-headless fi JAVA_HOME=$(dirname $(dirname $(readlink -f $(which java)))) -log "${GREEN}JAVA_HOME detected as ${JAVA_HOME}${NC}" +log "${GREEN}JAVA_HOME=${JAVA_HOME}${NC}" -# --- Firewall --- +# ============================================================ +# Firewall +# ============================================================ ufw --force enable ufw allow ssh ufw allow 80/tcp ufw allow 443/tcp ufw reload -# --- Tomcat 9 --- +# ============================================================ +# Tomcat +# ============================================================ if [ ! -d /opt/apache-tomcat-${TOMCAT_VER} ]; then log "${BLUE}>>> Installing Tomcat ${TOMCAT_VER}...${NC}" cd /opt @@ -137,17 +113,17 @@ fi systemctl daemon-reload systemctl enable --now tomcat9 -# --- Guacamole --- +# ============================================================ +# Guacamole +# ============================================================ cd /root SERVER="https://downloads.apache.org/guacamole/${GUACVERSION}" -if [ ! -d guacamole-server-${GUACVERSION} ]; then - wget -q ${SERVER}/source/guacamole-server-${GUACVERSION}.tar.gz - tar -xzf guacamole-server-${GUACVERSION}.tar.gz - wget -q ${SERVER}/binary/guacamole-${GUACVERSION}.war -O /etc/guacamole.war - wget -q ${SERVER}/binary/guacamole-auth-jdbc-${GUACVERSION}.tar.gz - tar -xzf guacamole-auth-jdbc-${GUACVERSION}.tar.gz -fi +wget -q ${SERVER}/source/guacamole-server-${GUACVERSION}.tar.gz -O guacamole-server-${GUACVERSION}.tar.gz +tar -xzf guacamole-server-${GUACVERSION}.tar.gz +wget -q ${SERVER}/binary/guacamole-${GUACVERSION}.war -O /etc/guacamole.war +wget -q ${SERVER}/binary/guacamole-auth-jdbc-${GUACVERSION}.tar.gz -O guacamole-auth-jdbc-${GUACVERSION}.tar.gz +tar -xzf guacamole-auth-jdbc-${GUACVERSION}.tar.gz if ! command -v guacd >/dev/null 2>&1; then cd guacamole-server-${GUACVERSION} @@ -181,8 +157,25 @@ mkdir -p /etc/guacamole/extensions /etc/guacamole/lib cp /etc/guacamole.war /opt/tomcat9/webapps/guacamole.war cp guacamole-auth-jdbc-${GUACVERSION}/mysql/guacamole-auth-jdbc-mysql-${GUACVERSION}.jar /etc/guacamole/extensions/ -# --- MySQL setup with defaults --- -log "${BLUE}>>> Setting up MySQL with defaults...${NC}" +# ============================================================ +# JDBC Connector +# ============================================================ +log "${BLUE}>>> Installing JDBC driver for MySQL/MariaDB...${NC}" +if apt-cache show libmariadb-java 2>/dev/null | grep -q Package; then + apt-get install -y libmariadb-java + ln -sf /usr/share/java/mariadb-java-client.jar /etc/guacamole/lib/mysql-connector-java.jar + log "${GREEN}MariaDB JDBC connector installed.${NC}" +else + cd /tmp + wget -q https://dev.mysql.com/get/Downloads/Connector-J/mysql-connector-j-8.3.0.tar.gz + tar -xzf mysql-connector-j-8.3.0.tar.gz + cp mysql-connector-j-8.3.0/mysql-connector-j-8.3.0.jar /etc/guacamole/lib/mysql-connector-java.jar + log "${GREEN}MySQL Connector/J installed.${NC}" +fi + +# ============================================================ +# MySQL setup +# ============================================================ mysql -u root < /etc/nginx/sites-available/guacamole <>> Installing Tailscale...${NC}" +# ============================================================ +# Tailscale +# ============================================================ +log "${BLUE}>>> Installing Tailscale...${NC}" curl -fsSL https://tailscale.com/install.sh | sh systemctl enable --now tailscaled @@ -277,32 +275,33 @@ if [ -t 0 ]; then else TSKEY="" fi - if [ -n "${TSKEY:-}" ]; then tailscale up --authkey=${TSKEY} --ssh else tailscale up --ssh fi -# --- Final credential rotation (MySQL only) --- +# ============================================================ +# Rotate MySQL passwords at the end +# ============================================================ FINAL_MYSQL_ROOT_PWD=$(openssl rand -base64 20) FINAL_GUAC_PWD=$(openssl rand -base64 20) mysql -u root -proot -e "ALTER USER 'root'@'localhost' IDENTIFIED BY '${FINAL_MYSQL_ROOT_PWD}';" mysql -u root -p${FINAL_MYSQL_ROOT_PWD} -e "ALTER USER '${GUAC_USER}'@'localhost' IDENTIFIED BY '${FINAL_GUAC_PWD}'; FLUSH PRIVILEGES;" -# Update guacamole.properties with new DB password crudini --set /etc/guacamole/guacamole.properties '' mysql-password "${FINAL_GUAC_PWD}" - systemctl restart tomcat9 -# --- Save credentials --- +# ============================================================ +# Save credentials +# ============================================================ cat > ${CRED_FILE} <