鱷梨您沒有權限訪問此連接」

Question

沿

• http://guac-dev.org/doc/gug/guacamole-docker.html
• http://kalzi.github.io/2015/guacamole-with-docker-containers/

與腳本行成功地建立dockerized鱷梨0.9.8後下面和登錄與用戶：guacadmin密碼：guacadmin 我能夠建立一個用戶和RDP連接鱷梨的用戶界面是可用 直接通過在搬運工安裝腳本配置（8380在我的情況）所映射的端口，但也可以通過構成爲每guacamoles手冊具有反向Apache代理：

<Location /guac/ > 
    Order allow,deny 
    Allow from all 
    ProxyPass http://localhost:8380/guacamole/ flushpackets=on 
    ProxyPassReverse http://localhost:8380/guacamole/ 
    </Location> 

我試圖遵循RDP連接手動 http://guac-dev.org/doc/gug/configuring-guacamole.html#rdp

但使用時反向代理結束：

這也正好給其他用戶看到：

https://sourceforge.net/p/guacamole/discussion/1110834/thread/73abbe35/

我怎麼能調試這種情況下，找到正確的設置？

人們似乎有點不對勁，因爲作爲管理員例如guacadmin我得到 試圖啓用並保存在下面的對話框連接權限時：

我有機會獲得MySQL數據庫被用於例如權限 與

mysql> show tables; 
+---------------------------------------+ 
| Tables_in_guacamole_db    | 
+---------------------------------------+ 
| guacamole_connection     | 
| guacamole_connection_group   | 
| guacamole_connection_group_permission | 
| guacamole_connection_history   | 
| guacamole_connection_parameter  | 
| guacamole_connection_permission  | 
| guacamole_system_permission   | 
| guacamole_user      | 
| guacamole_user_permission    | 
+---------------------------------------+ 

這是Dockerizing腳本的鱷梨我用

#!/bin/bash 
# 
# WF 2015-10-26 
# 
# Guacamole (semi) automatic setup of guacamole Remote Desktop server for docker 
# see 
# http://guac-dev.org/doc/gug/guacamole-docker.html 
# http://kalzi.github.io/2015/guacamole-with-docker-containers/ 
# 
# Since: 2015-10-26 
# 

# config variables 

# images 
GUAC=glyptodon/guacamole 
GUACD=glyptodon/guacd 
MYSQL=mysql 

# DB settings 
DB=guacamole_db 
DB_USER=guacamole_user 

# prefix to be used for container names 
prefix="lab" 

#ansi colors 
#http://www.csc.uvic.ca/~sae/seng265/fall04/tips/s265s047-tips/bash-using-colors.html 
blue='\033[0;34m' 
red='\033[0;31m' 
green='\033[0;32m' # '\e[1;32m' is too bright for white bg. 
endColor='\033[0m' 

# 
# a colored message 
# params: 
#  1: l_color - the color of the message 
#  2: l_msg - the message to display 
# 
color_msg() { 
    local l_color="$1" 
    local l_msg="$2" 
    echo -e "${l_color}$l_msg${endColor}" 
} 

# 
# error 
# 
# show an error message and exit 
# 
# params: 
#  1: l_msg - the message to display 
error() { 
local l_msg="$1" 
# use ansi red for error 
color_msg $red "Error: $l_msg" 1>&2 
exit 1 
} 

# 
# show usage 
# 
usage() { 
echo "usage: guac-setup" 
# -h|--help|usage|show this usage 
echo " -h|--help: show this usage" 
# -m|--mysql|run mysql in linked container 
echo " -m|--mysql:run mysql in linked container" 
# -r|--run|run|run guacamole 
echo " -p|--pull: pull guacamole" 
echo " -pf|--prefix: set the containername prefix" 
echo " -r|--run: run guacamole" 
color_msg $blue "Example:" 
echo " sudo ./guac-setup -p -pf test -r" 
exit 1 
} 

# 
# generate a random password 
# 
random_password() { 
date +%N | sha256sum | base64 | head -c 16 ; echo 
} 

# 
# run mysql in container 
# 
mysql_from_container() { 
    local l_option="$1" 
    local l_db="$2" 
    local l_dbparam="" 
    if [ "$l_db" != "" ] 
    then 
    l_dbparam=" $l_db" 
    fi 
    local l_cmd='exec mysql -h"$MYSQL_PORT_3306_TCP_ADDR" -P"$MYSQL_PORT_3306_TCP_PORT" -uroot -p"$MYSQL_ENV_MYSQL_ROOT_PASSWORD"'"$l_dbparam" 
    #echo "$l_cmd" 
    docker run $l_option --link $prefix-mysql:mysql --rm mysql sh -c "$l_cmd" 
} 

# 
# initialize the database 
# 
init_db() { 
local l_tmp=/tmp/initdb.sql 
#docker run -it $GUAC /bin/bash 
color_msg $blue creating database 

cat << EOF | mysql_from_container -i 
DROP DATABASE IF EXISTS $DB; 
CREATE DATABASE IF NOT EXISTS $DB; 
DROP USER '${DB_USER}'; 
CREATE USER '${DB_USER}' IDENTIFIED BY '${DB_PASSWD}'; 
GRANT SELECT,INSERT,UPDATE,DELETE ON guacamole_db.* TO 'guacamole_user'; 
FLUSH PRIVILEGES; 
EOF 
    color_msg $blue "getting initdb.sh" 
    docker run --rm $GUAC /opt/guacamole/bin/initdb.sh --mysql > $l_tmp 
    color_msg $blue "initializing database" 
    # pipe the result thru mysql 
    cat $l_tmp | mysql_from_container -i "$DB" 
    color_msg $blue "keeping password for db $DB at /var/lib/mysql/guac_passwd" 
    #echo $DB_PASSWD 
    echo $DB_PASSWD | docker exec -i $prefix-mysql /usr/bin/tee /var/lib/mysql/guac_passwd > /dev/null 
} 

# 
# run guacamole 
# 
run() { 
    local l_prefix="$1" 
    MYSQL_ROOT_PASSWORD=`random_password` 
    color_msg $blue "starting $l_prefix-guacd" 
    docker run --name $l_prefix-guacd -d $GUACD 
    color_msg $blue "starting $l_prefix-mysql" 
    docker run --name $l_prefix-mysql -e MYSQL_ROOT_PASSWORD=$MYSQL_ROOT_PASSWORD -d mysql:latest 
    docker ps -a --filter "name=$l_prefix*" 
} 

# 
# pull images 
# 
pull() { 
    for image in $GUACD $GUAC $MYSQL 
    do 
    docker images | cut -c1-22 | grep $image 
    if [ $? -ne 0 ] 
    then 
     docker pull $image 
    else 
     color_msg $green "$image already pulled" 
    fi 
    done 
} 

# 
# start it 
# 
startit() { 
    DB_PASSWD=`docker exec -i $prefix-mysql /bin/cat /var/lib/mysql/guac_passwd` 
    # now run the whole show 
    docker run --name $prefix-guacamole --link $prefix-guacd:guacd \ 
    --link $prefix-mysql:mysql  \ 
    -e MYSQL_DATABASE=$DB \ 
    -e MYSQL_USER=$DB_USER \ 
    -e MYSQL_PASSWORD=$DB_PASSWD \ 
    -d -p 8380:8080 $GUAC 
} 

# start of script 

# check arguments 
if [ $# -eq 0 ] 
then 
    usage 
fi 
while test $# -gt 0 
do 
    case $1 in 
    # -h|--help|usage|show this usage 
    -h|--help) 
     usage;; 

    # -p|--pull|pull|pull guacamole 
    -p|--pull) 
     pull;; 

    # -pf|--prefix|set containername prefix 
    -pf|--prefix) 
     shift 
     prefix=$1 
     ;; 

    # -r|--run|run|run guacamole 
    -r|--run) 
     run $prefix;; 

    # -m|--mysql|run mysql connection to container 
    -m|--mysql) 
     mysql_from_container -it 
     ;; 

    -ms|--mysql_shell) 
     docker exec -it $prefix-mysql /bin/bash 
     ;; 

    -i|--initdb) 
     DB_PASSWD=`random_password` 
     init_db 
     ;; 

    --setup) 
     pull 
     run $prefix 
     ;; 

    --start) 
     startit 
     ;; 
    esac 
    shift 
done 

Answer 1

我怎麼能調試這種情況下，找到正確的設置？

在這樣的驗證錯誤的情況下，你應該做的第一件事就是檢查Tomcat的日誌是否存在錯誤。如果發生導致Guacamole返回「權限被拒絕」的錯誤，則應該記錄該錯誤並且將與產生錯誤的操作臨時關聯。

如果沒有跳出來爲相關的，你也可以嘗試enabling debug-level logging。這涉及到內GUACAMOLE_HOME創建logback.xml文件包含以下內容：

<configuration> 

    <!-- Appender for debugging --> 
    <appender name="GUAC-DEBUG" class="ch.qos.logback.core.ConsoleAppender"> 
     <encoder> 
      <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern> 
     </encoder> 
    </appender> 

    <!-- Log at DEBUG level --> 
    <root level="debug"> 
     <appender-ref ref="GUAC-DEBUG"/> 
    </root> 

</configuration> 

如果您使用官方泊塢窗圖像這樣做，GUACAMOLE_HOME將/root/.guacamole，你將需要重新啓動容器強制Tomcat的重新啓動和重新加載鱷梨醬配置。

如果你在像Nginx或Apache這樣的代理服務器後面使用Guacamole，我還會建議先嚐試直接連接Guacamole。不正確的代理配置可能會阻止WebSocket工作，然後阻止回退HTTP隧道工作。從Guacamole的角度看，這樣的錯誤配置可能會出現，您試圖訪問資源而未登錄，導致權限錯誤。

Answer 2

http://guac-dev.org/doc/gug/proxying-guacamole.html#websocket-and-apache

具有必要的配置（這裏示出適合於8380端口正在使用和/ guac路徑）

<Location /guac/websocket-tunnel> 
    Order allow,deny 
    Allow from all 
    ProxyPass ws://localhost:8380/guacamole/websocket-tunnel 
    ProxyPassReverse ws://localhost:8380/guacamole/websocket-tunnel 
</Location> 

要激活我使用的配置：

a2enmod proxy_wstunnel 
Considering dependency proxy for proxy_wstunnel: 
Module proxy already enabled 
Enabling module proxy_wstunnel. 
To activate the new configuration, you need to run: 
    service apache2 restart 
service apache2 restart 
* Restarting web server apache2   

現在，連接直接通過端口8380和通過反向代理配置直接映射到我的主服務器上的/ guac。