鳄梨您没有权限访问此连接”

Question

沿

• http://guac-dev.org/doc/gug/guacamole-docker.html
• http://kalzi.github.io/2015/guacamole-with-docker-containers/

与脚本行成功地建立dockerized鳄梨0.9.8后下面和登录与用户：guacadmin密码：guacadmin 我能够建立一个用户和RDP连接鳄梨的用户界面是可用 直接通过在搬运工安装脚本配置（8380在我的情况）所映射的端口，但也可以通过构成为每guacamoles手册具有反向Apache代理：

<Location /guac/ > 
    Order allow,deny 
    Allow from all 
    ProxyPass http://localhost:8380/guacamole/ flushpackets=on 
    ProxyPassReverse http://localhost:8380/guacamole/ 
    </Location> 

我试图遵循RDP连接手动 http://guac-dev.org/doc/gug/configuring-guacamole.html#rdp

但使用时反向代理结束：

这也正好给其他用户看到：

https://sourceforge.net/p/guacamole/discussion/1110834/thread/73abbe35/

我怎么能调试这种情况下，找到正确的设置？

人们似乎有点不对劲，因为作为管理员例如guacadmin我得到 试图启用并保存在下面的对话框连接权限时：

我有机会获得MySQL数据库被用于例如权限 与

mysql> show tables; 
+---------------------------------------+ 
| Tables_in_guacamole_db    | 
+---------------------------------------+ 
| guacamole_connection     | 
| guacamole_connection_group   | 
| guacamole_connection_group_permission | 
| guacamole_connection_history   | 
| guacamole_connection_parameter  | 
| guacamole_connection_permission  | 
| guacamole_system_permission   | 
| guacamole_user      | 
| guacamole_user_permission    | 
+---------------------------------------+ 

这是Dockerizing脚本的鳄梨我用

#!/bin/bash 
# 
# WF 2015-10-26 
# 
# Guacamole (semi) automatic setup of guacamole Remote Desktop server for docker 
# see 
# http://guac-dev.org/doc/gug/guacamole-docker.html 
# http://kalzi.github.io/2015/guacamole-with-docker-containers/ 
# 
# Since: 2015-10-26 
# 

# config variables 

# images 
GUAC=glyptodon/guacamole 
GUACD=glyptodon/guacd 
MYSQL=mysql 

# DB settings 
DB=guacamole_db 
DB_USER=guacamole_user 

# prefix to be used for container names 
prefix="lab" 

#ansi colors 
#http://www.csc.uvic.ca/~sae/seng265/fall04/tips/s265s047-tips/bash-using-colors.html 
blue='\033[0;34m' 
red='\033[0;31m' 
green='\033[0;32m' # '\e[1;32m' is too bright for white bg. 
endColor='\033[0m' 

# 
# a colored message 
# params: 
#  1: l_color - the color of the message 
#  2: l_msg - the message to display 
# 
color_msg() { 
    local l_color="$1" 
    local l_msg="$2" 
    echo -e "${l_color}$l_msg${endColor}" 
} 

# 
# error 
# 
# show an error message and exit 
# 
# params: 
#  1: l_msg - the message to display 
error() { 
local l_msg="$1" 
# use ansi red for error 
color_msg $red "Error: $l_msg" 1>&2 
exit 1 
} 

# 
# show usage 
# 
usage() { 
echo "usage: guac-setup" 
# -h|--help|usage|show this usage 
echo " -h|--help: show this usage" 
# -m|--mysql|run mysql in linked container 
echo " -m|--mysql:run mysql in linked container" 
# -r|--run|run|run guacamole 
echo " -p|--pull: pull guacamole" 
echo " -pf|--prefix: set the containername prefix" 
echo " -r|--run: run guacamole" 
color_msg $blue "Example:" 
echo " sudo ./guac-setup -p -pf test -r" 
exit 1 
} 

# 
# generate a random password 
# 
random_password() { 
date +%N | sha256sum | base64 | head -c 16 ; echo 
} 

# 
# run mysql in container 
# 
mysql_from_container() { 
    local l_option="$1" 
    local l_db="$2" 
    local l_dbparam="" 
    if [ "$l_db" != "" ] 
    then 
    l_dbparam=" $l_db" 
    fi 
    local l_cmd='exec mysql -h"$MYSQL_PORT_3306_TCP_ADDR" -P"$MYSQL_PORT_3306_TCP_PORT" -uroot -p"$MYSQL_ENV_MYSQL_ROOT_PASSWORD"'"$l_dbparam" 
    #echo "$l_cmd" 
    docker run $l_option --link $prefix-mysql:mysql --rm mysql sh -c "$l_cmd" 
} 

# 
# initialize the database 
# 
init_db() { 
local l_tmp=/tmp/initdb.sql 
#docker run -it $GUAC /bin/bash 
color_msg $blue creating database 

cat << EOF | mysql_from_container -i 
DROP DATABASE IF EXISTS $DB; 
CREATE DATABASE IF NOT EXISTS $DB; 
DROP USER '${DB_USER}'; 
CREATE USER '${DB_USER}' IDENTIFIED BY '${DB_PASSWD}'; 
GRANT SELECT,INSERT,UPDATE,DELETE ON guacamole_db.* TO 'guacamole_user'; 
FLUSH PRIVILEGES; 
EOF 
    color_msg $blue "getting initdb.sh" 
    docker run --rm $GUAC /opt/guacamole/bin/initdb.sh --mysql > $l_tmp 
    color_msg $blue "initializing database" 
    # pipe the result thru mysql 
    cat $l_tmp | mysql_from_container -i "$DB" 
    color_msg $blue "keeping password for db $DB at /var/lib/mysql/guac_passwd" 
    #echo $DB_PASSWD 
    echo $DB_PASSWD | docker exec -i $prefix-mysql /usr/bin/tee /var/lib/mysql/guac_passwd > /dev/null 
} 

# 
# run guacamole 
# 
run() { 
    local l_prefix="$1" 
    MYSQL_ROOT_PASSWORD=`random_password` 
    color_msg $blue "starting $l_prefix-guacd" 
    docker run --name $l_prefix-guacd -d $GUACD 
    color_msg $blue "starting $l_prefix-mysql" 
    docker run --name $l_prefix-mysql -e MYSQL_ROOT_PASSWORD=$MYSQL_ROOT_PASSWORD -d mysql:latest 
    docker ps -a --filter "name=$l_prefix*" 
} 

# 
# pull images 
# 
pull() { 
    for image in $GUACD $GUAC $MYSQL 
    do 
    docker images | cut -c1-22 | grep $image 
    if [ $? -ne 0 ] 
    then 
     docker pull $image 
    else 
     color_msg $green "$image already pulled" 
    fi 
    done 
} 

# 
# start it 
# 
startit() { 
    DB_PASSWD=`docker exec -i $prefix-mysql /bin/cat /var/lib/mysql/guac_passwd` 
    # now run the whole show 
    docker run --name $prefix-guacamole --link $prefix-guacd:guacd \ 
    --link $prefix-mysql:mysql  \ 
    -e MYSQL_DATABASE=$DB \ 
    -e MYSQL_USER=$DB_USER \ 
    -e MYSQL_PASSWORD=$DB_PASSWD \ 
    -d -p 8380:8080 $GUAC 
} 

# start of script 

# check arguments 
if [ $# -eq 0 ] 
then 
    usage 
fi 
while test $# -gt 0 
do 
    case $1 in 
    # -h|--help|usage|show this usage 
    -h|--help) 
     usage;; 

    # -p|--pull|pull|pull guacamole 
    -p|--pull) 
     pull;; 

    # -pf|--prefix|set containername prefix 
    -pf|--prefix) 
     shift 
     prefix=$1 
     ;; 

    # -r|--run|run|run guacamole 
    -r|--run) 
     run $prefix;; 

    # -m|--mysql|run mysql connection to container 
    -m|--mysql) 
     mysql_from_container -it 
     ;; 

    -ms|--mysql_shell) 
     docker exec -it $prefix-mysql /bin/bash 
     ;; 

    -i|--initdb) 
     DB_PASSWD=`random_password` 
     init_db 
     ;; 

    --setup) 
     pull 
     run $prefix 
     ;; 

    --start) 
     startit 
     ;; 
    esac 
    shift 
done 

Answer 1

我怎么能调试这种情况下，找到正确的设置？

在这样的验证错误的情况下，你应该做的第一件事就是检查Tomcat的日志是否存在错误。如果发生导致Guacamole返回“权限被拒绝”的错误，则应该记录该错误并且将与产生错误的操作临时关联。

如果没有跳出来为相关的，你也可以尝试enabling debug-level logging。这涉及到内GUACAMOLE_HOME创建logback.xml文件包含以下内容：

<configuration> 

    <!-- Appender for debugging --> 
    <appender name="GUAC-DEBUG" class="ch.qos.logback.core.ConsoleAppender"> 
     <encoder> 
      <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern> 
     </encoder> 
    </appender> 

    <!-- Log at DEBUG level --> 
    <root level="debug"> 
     <appender-ref ref="GUAC-DEBUG"/> 
    </root> 

</configuration> 

如果您使用官方泊坞窗图像这样做，GUACAMOLE_HOME将/root/.guacamole，你将需要重新启动容器强制Tomcat的重新启动和重新加载鳄梨酱配置。

如果你在像Nginx或Apache这样的代理服务器后面使用Guacamole，我还会建议先尝试直接连接Guacamole。不正确的代理配置可能会阻止WebSocket工作，然后阻止回退HTTP隧道工作。从Guacamole的角度看，这样的错误配置可能会出现，您试图访问资源而未登录，导致权限错误。

Answer 2

http://guac-dev.org/doc/gug/proxying-guacamole.html#websocket-and-apache

具有必要的配置（这里示出适合于8380端口正在使用和/ guac路径）

<Location /guac/websocket-tunnel> 
    Order allow,deny 
    Allow from all 
    ProxyPass ws://localhost:8380/guacamole/websocket-tunnel 
    ProxyPassReverse ws://localhost:8380/guacamole/websocket-tunnel 
</Location> 

要激活我使用的配置：

a2enmod proxy_wstunnel 
Considering dependency proxy for proxy_wstunnel: 
Module proxy already enabled 
Enabling module proxy_wstunnel. 
To activate the new configuration, you need to run: 
    service apache2 restart 
service apache2 restart 
* Restarting web server apache2   

现在，连接直接通过端口8380和通过反向代理配置直接映射到我的主服务器上的/ guac。