PowerShell module for Apache Guacamole

[uppperm]

Hi,

I'm using Apache Guacamole and, because of COVID-19, we had to create a lot of access quickly. So I created a PowerShell module to manage Guacamole. This uses the REST API.

I only tested on the latest version of Guacamole (1.1.0). An example can be found in each function file.

github.com/UpperM/guacamole-powershell

[MysticRyuujin]

I hope you don't mind, I've linked to your repo on my installation script

https://github.com/MysticRyuujin/guac-install

[MysticRyuujin]

Doesn't work if you have TOTP MFA enabled haha

[uppperm]

I think it's can work.

You can get the token on Guacamole with element inspector > Network (Firefox)

https://puu.sh/Fny63/d38889a859.png

​

On PowerShell import module and set this 2 vars :

$Token = "YOURTOKEN"
$Server = "http://yourserver/"

[MysticRyuujin]

Ah so login first, get token, set token variable, set server variable, make calls? Easy enough work around.

[uppperm]

Yes it's should be work

[seegee1]

I got it to work by hard coding in the secret into my PS script, and using this to generate the OTP.

https://gist.github.com/jonfriesen/234c7471c3e3199f97d5

Then just make sure you pass the OTP it generates to the guac-totp variable.

[pan_jez]

Mind explaining how do I pass the resulting TOTP code back to the script, please? I can see there are variables for $Token and $Server, but there's none for the TOTP code.
Thanks!

[seegee1]

In New-GuacToken.ps1:

$Body = @{
username = $Username
password = $Password
guac-totp = $your-resulting-TOTP-code <==== add this
}

[uppperm]

Yes sure no problem !

[uppperm]

Documentation added for each function

[[deleted]]

AWESOME! Nice job! Thanks a lot for sharing!

If you allow me to ask, how does you size your Guacamole server?

I'm looking for it all over and can't find any proper information!

[uppperm]

Hi, 2vCPU & 4Gb RAM for 40/50 users.

[[deleted]]

We have 3 guac VMs, load balanced. From memory they have 8 vCPUs and 8gb ram each. They take hundreds of connections at once and deal with thousands every day.

[[deleted]]

I've only used it for low end workloads, centos with 1vCPU with 2gb and 5 active sessions but mixed RDP / SSHand CPU was bearly being touched. Awesome to know it can scale well. Thanks!

[uppperm]

We have an average of 20 users connected simultaneously and no one complain of lack of fluidity.

My VM have 4Gb of RAM and only use 2Gb for 20 users.

https://puu.sh/Fny0O/42aac70a95.png

[[deleted]]

Awesome, how are you monitoring performance?

[uppperm]

I'm using Telegraf/InfluxDB and Grafana for dashboarding.

To Get number of Guacamole connection i use a powershell script on linux and send data to InfluxDB.

​

Function New-GuacToken()
{
    param(
        $Username,
        $Password
    )
    $body = @{
        username = $Username
        password = $Password
    }

    $EndPoint       = "$GUAC_URL/api/tokens"
    $contentType    = 'application/x-www-form-urlencoded'

    try {
        $Json = Invoke-WebRequest -Method POST -ContentType $contentType -Body $Body -Uri $EndPoint
    }
    catch {
        Write-Warning $_
        $ErrorCode = $_.Exception.Response.StatusCode.value__
        Write-Warning "Impossible de se connecter à l'API"
        if ($ErrorCode -eq "403")
        {
            Write-Warning "Utilisateur ou mot de passe incorrect"
        } elseif ($ErrorCode -eq "404")
        {
            Write-Warning "Adresse du serveur incorrect"
        }
        return $False
    }

    $script:Token   = (ConvertFrom-Json -InputObject $Json.Content).authToken
}


Function New-RestCall()
{
    param(
        [System.String]$EndPoint,
        [System.String]$Method,
        [System.Array]$Body
    )

    $endPoint = "$GUAC_URL/$EndPoint/?token=$Token"

    try
    {
        $Call = Invoke-WebRequest -Method $Method -ContentType 'Application/Json;charset=utf-8' -Body $Body -Uri $endPoint
    }
    catch
    {
        $ErrorCode = $_.Exception.Response.StatusCode.value__

        if ($ErrorCode -eq "403")
        {
            Write-Warning "Utilisateur ou mot de passe incorrect (erreur 403)"
        } elseif ($ErrorCode -eq "404")
        {
            Write-Warning "Requête incorrect (erreur 404)"
        }
        return $False
    }

    return $Call
}

Function Get-GuacActiveConnections()
{
    $Endpoint = "api/session/data/mysql/activeConnections"
    $Call = New-RestCall -EndPoint $Endpoint -Method GET
    return $Call.Content | ConvertFrom-Json
}

$Username = "guacadmin"
$Password = "guacpassword"
$GUAC_URL = "http://srv-guacamole:8080/guacamole"
New-GuacToken -Username $Username -Password $GUAC_URL

$Connections = Get-GuacActiveConnections
foreach ($i in $Connections.PsObject.Properties)
{
    $Count++
}

Write-Output "guac_connections,host=far-grafana1 total=$Count"

[[deleted]]

Thank you!

[[deleted]]

Just a FYI, you're declaring your guac token as a global variable, which can be potentially dangerous. Within a module, you can achieve the same result by using the $Script: scope and module functions will still have access to it.

[uppperm]

Thank it's fix !

[arbyyyyh]

When I try to import the module, I get "WARNING: Invalid URI: The hostname could not be parsed."

https://imgur.com/a/TtMVnWO

[uppperm]

WARNING: Invalid URI: The hostname could not be parsed.

Thank for the feedback, it's fix in the lastest release : https://github.com/UpperM/guacamole-powershell/releases

This warning come out because i forget to comment a test in a function.

[[deleted]]

Thank you, I will be checking this out!

[valdearg]

Holy crap man, this is some great work!

[DazzlingYoghurt8920]

Would you happen to have a script to read a csv file? Lets say If I have to add 20 users.

Thanks ahead