Category: Networking and VPN
Managed Apache Guacamole: remote desktop from the browser
A web page with the company sign-in from which each person opens the desktop of their office PC or a server, without installing a VPN or any program and without leaving remote desktop open to the internet.
- Where it runs
- In your account, in your name
- Backups
- With tested restores
- Updates
- Planned and documented
- Licence
- Open source, Apache License 2.0
In short
Apache Guacamole is an open source remote desktop gateway: people sign in from the browser and it connects over RDP, VNC or SSH to the computers inside, with nothing to install on each person's computer. We set it up on your server, add two-factor authentication or your single sign-on, give each person access only to their own computers, record sessions where needed, back up the configuration and keep it up to date.
Or call us on 644 00 76 20
What do we look after?
Starting Guacamole with Docker takes a little while. What needs care is everything around it: two-factor authentication on the sign-in page, each person reaching only their own computers, leavers removed, and the gateway kept up to date, because it is the front door to the office. This is what we keep under control:
Gateway
Guacamole and guacd in containers, with HTTPS, a fixed domain name and the configuration in a repository.
Sign-in
Two-factor authentication with TOTP or Duo, or the company account over OpenID Connect, SAML or LDAP.
Permissions
Each person and each group with only their own computers; joiners and leavers the same day.
Connections
RDP to Windows, VNC to other desktops and SSH to servers, with the credentials stored safely.
Logging and recording
Who reached which computer and when and, where needed, the recorded session.
Monitoring
Gateway down, certificates about to expire, failed sign-in attempts and outdated versions.
How does it work?
Guacamole has two parts: a web application, which is the page where people sign in, and guacd, which speaks RDP, VNC or SSH to the computers inside and sends the picture to the browser. From the internet only the HTTPS page is visible; the computers’ remote desktop only accepts connections from the gateway.
| Access method | What has to be installed | When we suggest it |
|---|---|---|
| Guacamole in the browser | Nothing: a browser is enough | People who connect from varied devices or who you do not want installing anything |
| VPN with WireGuard or OpenVPN | The VPN client and the remote desktop client | A few people, each with their company laptop |
| Private network with NetBird or Tailscale | The client on each device | Spread-out teams, servers in several clouds and per-person rules |
All three options get the important part right: remote desktop is not left open to the internet. The differences, security and Windows licensing are covered in the guide to remote desktop for working from home.
What problems do we run into most often?
- A sign-in page without two-factor authentication, with a username and password as the only protection for the whole office.
- A default administrator account that nobody changed after installation.
- Connections saved with a shared account, so nobody knows who really logged in.
- The computers’ remote desktop still open to the internet as well as the gateway.
- A gateway left without updates for years, when it is precisely the piece published on the internet.
- A database without backups: if the server breaks, every user and connection has to be set up again by hand.
How do we handle backups, updates and restores?
Users, groups, permissions and connections live in a database (PostgreSQL or MySQL) that we back up encrypted off the server, together with the container and proxy configuration, kept in a repository. Every so often we restore on another machine and check that people can sign in and open their desktops. If you record sessions, we decide with you where they are stored and for how long, and include them in the backup.
Before updating Guacamole we read the release notes, take a backup and test the new version separately when the change is large, because the sign-in extensions must match the application version. The operating system and the proxy get security patches in a scheduled, announced window.
Who is it for?
- An accountancy firm or a law office with people working from home that wants each person to open their office PC or the desktop server from home without installing anything, with two-factor authentication and with a leaver’s access cut off immediately.
- A company with external staff or collaborators who need to reach one or two specific computers without being given a VPN into the whole network.
- A technical team with Linux and Windows servers that wants to use SSH and remote desktop from a single place, with single sign-on and logged sessions.
How do we protect the gateway?
The gateway is the front door to the office, so it only exposes HTTPS, with a proxy in front, the default administrator account removed, and two-factor authentication or single sign-on for everyone, whether with Microsoft, Google or your own Keycloak. The computers inside only accept remote desktop, VNC or SSH from the gateway, and each person only sees their own connections. Failed sign-in attempts and connections go to Wazuh if you have a SIEM, and we watch the gateway and its certificates from monitoring with Grafana and Prometheus.
- BrowserAny device, nothing to install
- KeycloakSign-in and two-factor
- GuacamoleWeb gateway and guacd
- Desktops and serversRDP, VNC or SSH, only from the gateway
Where do we set it up?
In your account, with the provider you already use or the one that fits best. If the data has to stay in the EU, Hetzner and OVHcloud are the European options.
Providers we set it up on
- Hetzner
- AWS
- Google Cloud
- Azure
- DigitalOcean
- OVH
- Own server
| Provider | How we set it up | Things to bear in mind |
|---|---|---|
| Hetzner | A small cloud server with Guacamole in containers and a tunnel or private network to the office, with the Hetzner firewall open only on 443. | Usually the simplest option for a gateway that does not depend on the office connection. |
| AWS | An EC2 instance or a container in your VPC, behind a load balancer holding the certificate, to reach private desktops and servers. | |
| Google Cloud | A Compute Engine machine in your VPC network, with firewall rules that only let the gateway reach the computers. | |
| Azure | A virtual machine in the virtual network of your Windows servers, with Microsoft Entra ID sign-in over OpenID Connect or SAML. | A good fit if the company already works with Microsoft 365. |
| DigitalOcean | A Droplet inside your VPC with Cloud Firewall in front. | |
| OVH | A Public Cloud instance or a dedicated server with a private network (vRack) to your servers. | |
| Own server | Guacamole on a small machine in the office or on the virtualisation server, published over HTTPS through the router. | If the office loses power or its connection, nobody gets in from outside; for many people, a cloud gateway is better. |
What is included
- Apache Guacamole in containers (the web application and guacd) on your server or in your cloud account, with HTTPS and your own domain name.
- Sign-in with two-factor authentication (TOTP or Duo) or with the company account: Microsoft, Google or Keycloak over OpenID Connect or SAML, or your Active Directory over LDAP.
- Connections over RDP to Windows PCs and servers, over VNC to other desktops and over SSH to Linux servers, each person only to their own.
- Remote desktop, VNC and SSH closed to the internet: only the gateway reaches the computers inside.
- Joiners and leavers handled the same day: whoever leaves the company loses access to every computer at once.
- Session recording where needed, with playback in the browser and a log of who reached which computer and when.
- Backups of the user and connection database and of the configuration, with a tested restore.
- Updates to Guacamole, the operating system and the proxy, and monitoring of the gateway and of sign-in attempts.
Frequently asked questions
Guacamole or a VPN?
With a VPN each person installs a program and, once inside, opens remote desktop with the usual client. With Guacamole nothing is installed: people sign in from the browser and only reach the computers assigned to them. If people work from their company laptop, a VPN is the simplest choice; if they connect from varied devices or you do not want them to install anything, Guacamole fits better. Sometimes we set up both.
Are there licences to pay?
Guacamole is open source, under the Apache License 2.0, with no per-user licence. What does not change is Windows licensing: if several people work at the same time on a Windows server, you still need Windows Server and Remote Desktop access licences (RDS CALs), whether they come in through Guacamole or any other way.
Can we add two-factor authentication or our single sign-on?
Yes. Guacamole has extensions for two-factor authentication with TOTP, the code app on the phone, or with Duo, and for signing in with OpenID Connect or SAML, such as Microsoft Entra ID, Google or your own Keycloak. It can also check users against your Active Directory over LDAP.
Does it work with our usual programs, such as accounting software or LexNET?
Yes, because what you see in the browser is the office desktop, with its programs installed. What works worse than with the Remote Desktop program is using a card reader or a smart card certificate inside the session, working with several screens, or printing. If you sign with a card, we test it with you first and, if it does not fit, we suggest another way in.
What happens if the gateway goes down?
Nobody can get in from outside until it is back, although the office computers keep working. That is why we monitor it, back up its database and configuration off the server, and have rehearsed bringing it up on another machine. If access is critical, a VPN can be kept as a second way in.
Tell us about your case
Call or write to us and we'll tell you where you stand and where to start. Free, no strings attached.
Or call us on 644 00 76 20
Official documentation consulted
The technical details on this page are based on:
Reviewed on