doc/gug/reverse-proxy.html

<!DOCTYPE html> <html class="writer-html5" lang="en" > <head> <meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <title>Proxying Guacamole — Apache Guacamole Manual v1.5.5</title> <link rel="stylesheet" href="_static/pygments.css" type="text/css" /> <link rel="stylesheet" href="_static/css/theme.css" type="text/css" /> <link rel="stylesheet" href="_static/tabs.css" type="text/css" /> <link rel="stylesheet" href="_static/gug.css" type="text/css" />  <script src="_static/jquery.js?v=5d32c60e"></script> <script src="_static/_sphinx_javascript_frameworks_compat.js?v=2cd50e6c"></script> <script src="_static/documentation_options.js?v=5929fcd5"></script> <script src="_static/doctools.js?v=888ff710"></script> <script src="_static/sphinx_highlight.js?v=dc90522c"></script> <script src="_static/tabs.js?v=3ee01567"></script> <script src="_static/js/theme.js"></script> <link rel="index" title="Index" href="genindex.html" /> <link rel="search" title="Search" href="search.html" /> <link rel="next" title="Configuring Guacamole" href="configuring-guacamole.html" /> <link rel="prev" title="Installing Guacamole with Docker" href="guacamole-docker.html" /> </head> <body class="wy-body-for-nav"> <div class="wy-grid-for-nav"> <nav data-toggle="wy-nav-shift" class="wy-nav-side"> <div class="wy-side-scroll"> <div class="wy-side-nav-search" > <a href="index.html" class="icon icon-home"> Apache Guacamole </a> <div class="version"> 1.5.5 </div> <div role="search"> <form id="rtd-search-form" class="wy-form" action="search.html" method="get"> <input type="text" name="q" placeholder="Search docs" aria-label="Search docs" /> <input type="hidden" name="check_keywords" value="yes" /> <input type="hidden" name="area" value="default" /> </form> </div> </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu"> Overview <ul> <li class="toctree-l1"><a class="reference internal" href="introduction.html">Introduction</a></li> </ul> User's Guide <ul class="current"> <li class="toctree-l1"><a class="reference internal" href="guacamole-architecture.html">Implementation and architecture</a></li> <li class="toctree-l1"><a class="reference internal" href="installing-guacamole.html">Installing Guacamole natively</a></li> <li class="toctree-l1"><a class="reference internal" href="guacamole-docker.html">Installing Guacamole with Docker</a></li> <li class="toctree-l1 current"><a class="current reference internal" href="#">Proxying Guacamole</a><ul> <li class="toctree-l2"><a class="reference internal" href="#preparing-your-servlet-container">Preparing your servlet container</a><ul> <li class="toctree-l3"><a class="reference internal" href="#setting-up-the-remote-ip-valve">Setting up the Remote IP Valve</a></li> </ul> </li> <li class="toctree-l2"><a class="reference internal" href="#nginx">Nginx</a><ul> <li class="toctree-l3"><a class="reference internal" href="#proxying-with-nginx">Proxying Guacamole</a></li> <li class="toctree-l3"><a class="reference internal" href="#changing-the-path">Changing the path</a></li> <li class="toctree-l3"><a class="reference internal" href="#adjusting-file-upload-limits">Adjusting file upload limits</a></li> </ul> </li> <li class="toctree-l2"><a class="reference internal" href="#apache-and-mod-proxy">Apache and mod_proxy</a><ul> <li class="toctree-l3"><a class="reference internal" href="#proxying-with-apache">Proxying Guacamole</a></li> <li class="toctree-l3"><a class="reference internal" href="#proxying-the-websocket-tunnel">Proxying the WebSocket tunnel</a></li> <li class="toctree-l3"><a class="reference internal" href="#changing-path-with-apache">Changing the path</a></li> <li class="toctree-l3"><a class="reference internal" href="#disabling-logging-of-tunnel-requests">Disabling logging of tunnel requests</a></li> </ul> </li> </ul> </li> <li class="toctree-l1"><a class="reference internal" href="configuring-guacamole.html">Configuring Guacamole</a></li> <li class="toctree-l1"><a class="reference internal" href="jdbc-auth.html">Database authentication</a></li> <li class="toctree-l1"><a class="reference internal" href="ldap-auth.html">LDAP authentication</a></li> <li class="toctree-l1"><a class="reference internal" href="vault.html">Retrieving secrets from a vault</a></li> <li class="toctree-l1"><a class="reference internal" href="duo-auth.html">Duo two-factor authentication</a></li> <li class="toctree-l1"><a class="reference internal" href="totp-auth.html">TOTP two-factor authentication</a></li> <li class="toctree-l1"><a class="reference internal" href="header-auth.html">HTTP header authentication</a></li> <li class="toctree-l1"><a class="reference internal" href="json-auth.html">Encrypted JSON authentication</a></li> <li class="toctree-l1"><a class="reference internal" href="cas-auth.html">CAS Authentication</a></li> <li class="toctree-l1"><a class="reference internal" href="openid-auth.html">OpenID Connect Authentication</a></li> <li class="toctree-l1"><a class="reference internal" href="saml-auth.html">SAML Authentication</a></li> <li class="toctree-l1"><a class="reference internal" href="radius-auth.html">RADIUS Authentication</a></li> <li class="toctree-l1"><a class="reference internal" href="adhoc-connections.html">Ad-hoc Connections</a></li> <li class="toctree-l1"><a class="reference internal" href="using-guacamole.html">Using Guacamole</a></li> <li class="toctree-l1"><a class="reference internal" href="recording-playback.html">Viewing session recordings in-browser</a></li> <li class="toctree-l1"><a class="reference internal" href="administration.html">Administration</a></li> <li class="toctree-l1"><a class="reference internal" href="troubleshooting.html">Troubleshooting</a></li> </ul> Developer's Guide <ul> <li class="toctree-l1"><a class="reference internal" href="guacamole-protocol.html">The Guacamole protocol</a></li> <li class="toctree-l1"><a class="reference internal" href="libguac.html">libguac</a></li> <li class="toctree-l1"><a class="reference internal" href="guacamole-common.html">guacamole-common</a></li> <li class="toctree-l1"><a class="reference internal" href="guacamole-common-js.html">guacamole-common-js</a></li> <li class="toctree-l1"><a class="reference internal" href="guacamole-ext.html">guacamole-ext</a></li> <li class="toctree-l1"><a class="reference internal" href="custom-protocols.html">Adding new protocols</a></li> <li class="toctree-l1"><a class="reference internal" href="custom-auth.html">Custom authentication</a></li> <li class="toctree-l1"><a class="reference internal" href="event-listeners.html">Event listeners</a></li> <li class="toctree-l1"><a class="reference internal" href="writing-you-own-guacamole-app.html">Writing your own Guacamole application</a></li> </ul> Appendices <ul> <li class="toctree-l1"><a class="reference internal" href="protocol-reference.html">Guacamole protocol reference</a></li> </ul> </div> </div> </nav> <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" > <a href="index.html">Apache Guacamole</a> </nav> <div class="wy-nav-content"> <div class="rst-content"> <div role="navigation" aria-label="Page navigation"> <ul class="wy-breadcrumbs"> <li><a href="index.html" class="icon icon-home" aria-label="Home"></a></li> <li class="breadcrumb-item active">Proxying Guacamole</li> <li class="wy-breadcrumbs-aside"> <a href="_sources/reverse-proxy.md.txt" rel="nofollow"> View page source</a> </li> </ul> <hr/> </div> <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article"> <div itemprop="articleBody"> <section id="proxying-guacamole"> <h1>Proxying Guacamole<a class="headerlink" href="#proxying-guacamole" title="Link to this heading"></a></h1> Like most web applications, Guacamole can be placed behind a reverse proxy. For production deployments of Guacamole, this is highly recommended. It provides flexibility and, if your proxy is properly configured for SSL, encryption. Proxying isolates privileged operations within native applications that can safely drop those privileges when no longer needed, using Java only for unprivileged tasks. On Linux and UNIX systems, a process must be running with root privileges to listen on any port under 1024, including the standard HTTP and HTTPS ports (80 and 443 respectively). If the servlet container instead listens on a higher port, such as the default port 8080, it can run as a reduced-privilege user, allowing the reverse proxy to bear the burden of root privileges. As a native application, the reverse proxy can make system calls to safely drop root privileges once the port is open; a Java application like Tomcat cannot do this. <section id="preparing-your-servlet-container"> <h2>Preparing your servlet container<a class="headerlink" href="#preparing-your-servlet-container" title="Link to this heading"></a></h2> Your servlet container is most likely already configured to listen for HTTP connections on port 8080 as this is the default. If this is the case, and you can already access Guacamole over port 8080 from a web browser, you need not make any further changes to its configuration. If you have changed this, perhaps with the intent of proxying Guacamole over AJP, change it back. Using Guacamole over AJP is unsupported as it is known to cause problems, namely: <ol class="arabic simple"> <li>WebSocket will not work over AJP, forcing Guacamole to fallback to HTTP, possibly resulting in reduced performance.</li> <li>Apache 2.4.3 and older does not support the HTTP PATCH method over AJP, preventing the Guacamole management interface from functioning properly.</li> </ol> The connector entry within <code class="docutils literal notranslate">conf/server.xml</code> should look like this: <div class="highlight-xml notranslate"><div class="highlight"><pre><Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" URIEncoding="UTF-8" redirectPort="8443" /> </pre></div> </div> Be sure to specify the <code class="docutils literal notranslate">URIEncoding="UTF-8"</code> attribute as above to ensure that connection names, user names, etc. are properly received by the web application. If you will be creating connections that have Cyrillic, Chinese, Japanese, or other non-Latin characters in their names or parameter values, this attribute is required. <section id="setting-up-the-remote-ip-valve"> <h3>Setting up the Remote IP Valve<a class="headerlink" href="#setting-up-the-remote-ip-valve" title="Link to this heading"></a></h3> By default, when Tomcat is behind a reverse proxy, the remote IP address of the client that it sees is that of the proxy rather than the original client. In order to allow applications hosted within Tomcat, like Guacamole, to see the actual IP address of the client, you have to configure both the reverse proxy and Tomcat. Because the remote IP address in Guacamole is used for auditing of user logins and connections and could potentially be used for authentication, it is important that you are either in direct control of the proxy server or you explicitly trust it. Passing the remote IP address is done using the <code class="docutils literal notranslate">X-Forwarded-For</code> header, and, as with most HTTP headers, attackers can attempt to spoof this header in order to manipulate the behavior of the web server, gain unauthorized access to the system, or attempt to disguise the host or IP address they are coming from. One final caveat: This may not work as expected if there are other upstream proxy servers between your reverse proxy and the clients access Guacamole. Other proxies or firewalls can mask the IP address of the client, and if the configuration of those is not within your control you may end up with multiple clients appearing to come from the same IP address or host. Make sure you take this into account when configuring the system and looking at the data provided. Configuring Tomcat to pass through the remote IP address provided by the reverse proxy in the <code class="docutils literal notranslate">X-Forwarded-For</code> header requires the configuration of what Tomcat calls a Valve. In this case, it is the <a class="reference external" href="https://tomcat.apache.org/tomcat-8.5-doc/config/valve.html#Remote_IP_Valve"><code class="docutils literal notranslate">RemoteIpValve</code></a> and is configured in the <code class="docutils literal notranslate">conf/server.xml</code> file, in the <code class="docutils literal notranslate"><Host></code> section: <div class="highlight-xml notranslate"><div class="highlight"><pre><Valve className="org.apache.catalina.valves.RemoteIpValve" internalProxies="127.0.0.1" remoteIpHeader="x-forwarded-for" remoteIpProxiesHeader="x-forwarded-by" protocolHeader="x-forwarded-proto" /> </pre></div> </div> The <code class="docutils literal notranslate">internalProxies</code> value should be set to the IP address or addresses of any and all reverse proxy servers that will be accessing this Tomcat instance directly. Often it is run on the same system that runs Tomcat, but in other cases (for example, when running Docker), it may be on a different system/container and may need to be set to the actual IP address of the reverse proxy system. Only proxy servers listed in the <code class="docutils literal notranslate">internalProxies</code> or <code class="docutils literal notranslate">trustedProxies</code> parameters will be allowed to manipulate the remote IP address information. The other parameters in this configuration line allow you to control which headers coming from the proxy server(s) are used for various remote host information. They are as follows: <dl class="simple myst"> <dt><code class="docutils literal notranslate">remoteIpHeader</code></dt><dd>The header that is queried to learn the client IP address of the client that originated the request. The standard value is <code class="docutils literal notranslate">X-Forwarded-For</code>, but can be configured to any header you like. The IP address in this header will be available to Java applications in the <code class="docutils literal notranslate">request.getRemoteAddr()</code> method. </dd> <dt><code class="docutils literal notranslate">remoteIpProxiesHeader</code></dt><dd>The header that is queried to learn the IP address of the proxy server that forwarded the request. The default value is <code class="docutils literal notranslate">X-Forwarded-By</code>, but can be configured to any header that fits your environment. This value will only be allowed by the valve if the proxy used is listed in the <code class="docutils literal notranslate">trustedProxies</code> parameter. Otherwise this header will not be available. </dd> <dt><code class="docutils literal notranslate">protocolHeader</code></dt><dd>The header that is queried to determine the protocol that the client used to connect to the service. The default value is <code class="docutils literal notranslate">X-Forwarded-Proto</code>, but can be configured to fit your environment. </dd> </dl> In addition to configuring Tomcat to properly handle these headers, you also may need to configure your reverse proxy appropriately to send the headers. You can find instructions for this in <a class="reference internal" href="#nginx">Nginx</a> - the Apache web server passes it through by default. </section> </section> <section id="nginx"> <h2>Nginx<a class="headerlink" href="#nginx" title="Link to this heading"></a></h2> Nginx can be used as a reverse proxy, and supports WebSocket out-of-the-box <a class="reference external" href="http://nginx.com/blog/websocket-nginx/">since version 1.3</a>. Both Apache and Nginx require some additional configuration for proxying of WebSocket to work properly. <section id="proxying-with-nginx"> <h3>Proxying Guacamole<a class="headerlink" href="#proxying-with-nginx" title="Link to this heading"></a></h3> Nginx does support WebSocket for proxying, but requires that the “Connection” and “Upgrade” HTTP headers are set explicitly due to the nature of the WebSocket protocol. From the Nginx documentation: <blockquote> <div>NGINX supports WebSocket by allowing a tunnel to be set up between a client and a back-end server. For NGINX to send the Upgrade request from the client to the back-end server, Upgrade and Connection headers must be set explicitly. … </div></blockquote> The proxy configuration belongs within a dedicated <a class="reference external" href="http://nginx.org/en/docs/http/ngx_http_core_module.html#location%3E"><code class="docutils literal notranslate">location</code></a> block, declaring the backend hosting Guacamole and explicitly specifying the “<code class="docutils literal notranslate">Connection</code>” and “<code class="docutils literal notranslate">Upgrade</code>” headers mentioned earlier: <div class="highlight-nginx notranslate"><div class="highlight"><pre>location /guacamole/ { proxy_pass http://HOSTNAME:8080; proxy_buffering off; proxy_http_version 1.1; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; access_log off; } </pre></div> </div> Here, <code class="docutils literal notranslate">HOSTNAME</code> is the hostname or IP address of the machine hosting your servlet container, and 8080 is the port that servlet container is configured to use. You will need to replace these values with the correct values for your server. Related to the <code class="docutils literal notranslate">RemoteIpValve</code> configuration for tomcat, documented in <a class="reference internal" href="#tomcat-remote-ip">Setting up the Remote IP Valve</a>, the <code class="docutils literal notranslate">proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;</code> line is important if you want the <code class="docutils literal notranslate">X-Forwarded-For</code> header to be passed through to the web application server and available to applications running inside it. <div class="admonition important"> Important Do not forget to specify “<code class="docutils literal notranslate">proxy_buffering off</code>”. Most proxies, including Nginx, will buffer all data sent over the connection, waiting until the connection is closed before sending that data to the client. As Guacamole’s HTTP tunnel relies on streaming data to the client over an open connection, excessive buffering will effectively block Guacamole connections, rendering Guacamole useless. If the option “<code class="docutils literal notranslate">proxy_buffering off</code>” is not specified, Guacamole may not work. </div> </section> <section id="changing-the-path"> <h3>Changing the path<a class="headerlink" href="#changing-the-path" title="Link to this heading"></a></h3> If you wish to serve Guacamole through Nginx under a path other than <code class="docutils literal notranslate">/guacamole/</code>, the easiest method is to simply rename the <code class="docutils literal notranslate">.war</code> file. For example, if intending to server Guacamole at <code class="docutils literal notranslate">/new-path/</code>, you would: <ol class="arabic"> <li>Rename <code class="docutils literal notranslate">guacamole.war</code> to <code class="docutils literal notranslate">new-path.war</code>.</li> <li>Update the path within the Nginx configuration to reflect the new path: <div class="highlight-nginx notranslate"><div class="highlight"><pre>location /new-path/ { proxy_pass http://HOSTNAME:8080; proxy_buffering off; proxy_http_version 1.1; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; access_log off; } </pre></div> </div> </li> </ol> Alternatively, the configuration can be altered slightly to handle requests at a different location externally while still serving internal requests at <code class="docutils literal notranslate">/guacamole/</code>: <div class="highlight-nginx notranslate"><div class="highlight"><pre>location /new-path/ { proxy_pass http://HOSTNAME:8080/guacamole/; proxy_buffering off; proxy_http_version 1.1; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; access_log off; } </pre></div> </div> </section> <section id="adjusting-file-upload-limits"> <h3>Adjusting file upload limits<a class="headerlink" href="#adjusting-file-upload-limits" title="Link to this heading"></a></h3> When proxying Guacamole through Nginx, you may run into issues with the default limitations that Nginx places on file uploads (1MB). The errors you receive can be non-intuitive (permission denied, for example), but may be indicative of these limits. The <code class="docutils literal notranslate">client_max_body_size</code> parameter can be set within the <code class="docutils literal notranslate">location</code> block to configure the maximum file upload size: <div class="highlight-nginx notranslate"><div class="highlight"><pre>location /guacamole/ { proxy_pass http://HOSTNAME:8080; proxy_buffering off; proxy_http_version 1.1; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; client_max_body_size 1g; access_log off; } </pre></div> </div> </section> </section> <section id="apache-and-mod-proxy"> <h2>Apache and mod_proxy<a class="headerlink" href="#apache-and-mod-proxy" title="Link to this heading"></a></h2> Apache supports reverse proxy configurations through <a class="reference external" href="http://httpd.apache.org/docs/2.4/mod/mod_proxy.html">mod_proxy</a>. Apache 2.4.5 and later also support proxying of WebSocket through a sub-module called <a class="reference external" href="http://httpd.apache.org/docs/2.4/mod/mod_proxy_wstunnel.html">mod_proxy_wstunnel</a>. Both of these modules will need to be enabled for proxying of Guacamole to work properly. Lacking mod_proxy_wstunnel, it is still possible to proxy Guacamole, but Guacamole will be unable to use WebSocket. It will instead fallback to using the HTTP tunnel, resulting in reduced performance. <section id="proxying-with-apache"> <h3>Proxying Guacamole<a class="headerlink" href="#proxying-with-apache" title="Link to this heading"></a></h3> Configuring Apache to proxy HTTP requests requires using the <code class="docutils literal notranslate">ProxyPass</code> and <code class="docutils literal notranslate">ProxyPassReverse</code> directives, which are provided by the mod_proxy module. These directives describe how HTTP traffic should be routed to the web server behind the proxy: <div class="highlight-apache notranslate"><div class="highlight"><pre><Location /guacamole/> Order allow,deny Allow from all ProxyPass http://HOSTNAME:8080/guacamole/ flushpackets=on ProxyPassReverse http://HOSTNAME:8080/guacamole/ </Location> </pre></div> </div> Here, <code class="docutils literal notranslate">HOSTNAME</code> is the hostname or IP address of the machine hosting your servlet container, and <code class="docutils literal notranslate">8080</code> is the port that servlet container is configured to use. You will need to replace these values with the correct values for your server. <div class="admonition important"> Important Do not forget the <code class="docutils literal notranslate">flushpackets=on</code> option. Most proxies, including mod_proxy, will buffer all data sent over the connection, waiting until the connection is closed before sending that data to the client. As Guacamole’s HTTP tunnel relies on streaming data to the client over an open connection, excessive buffering will effectively block Guacamole connections, rendering Guacamole useless. If the option <code class="docutils literal notranslate">flushpackets=on</code> is not specified, Guacamole may not work. </div> </section> <section id="proxying-the-websocket-tunnel"> <h3>Proxying the WebSocket tunnel<a class="headerlink" href="#proxying-the-websocket-tunnel" title="Link to this heading"></a></h3> Apache will not automatically proxy WebSocket connections, but you can proxy them separately with Apache 2.4.5 and later using mod_proxy_wstunnel. After enabling mod_proxy_wstunnel a secondary <code class="docutils literal notranslate">Location</code> section can be added which explicitly proxies the Guacamole WebSocket tunnel, located at <code class="docutils literal notranslate">/guacamole/websocket-tunnel</code>: <div class="highlight-apache notranslate"><div class="highlight"><pre><Location /guacamole/> Order allow,deny Allow from all ProxyPass http://HOSTNAME:8080/guacamole/ flushpackets=on ProxyPassReverse http://HOSTNAME:8080/guacamole/ </Location> <Location /guacamole/websocket-tunnel> Order allow,deny Allow from all ProxyPass ws://HOSTNAME:8080/guacamole/websocket-tunnel ProxyPassReverse ws://HOSTNAME:8080/guacamole/websocket-tunnel </Location> </pre></div> </div> Lacking this, Guacamole will still work by using normal HTTP, but network latency will be more pronounced with respect to user input, and performance may be lower. <div class="admonition important"> Important The <code class="docutils literal notranslate">Location</code> section for <code class="docutils literal notranslate">/guacamole/websocket-tunnel</code> must be placed after the <code class="docutils literal notranslate">Location</code> section for the rest of Guacamole. Apache evaluates all Location sections, giving priority to the last section that matches. If the <code class="docutils literal notranslate">/guacamole/websocket-tunnel</code> section comes first, the section for <code class="docutils literal notranslate">/guacamole/</code> will match instead, and WebSocket will not be proxied correctly. </div> </section> <section id="changing-path-with-apache"> <h3>Changing the path<a class="headerlink" href="#changing-path-with-apache" title="Link to this heading"></a></h3> If you wish to serve Guacamole through Apache under a path other than <code class="docutils literal notranslate">/guacamole/</code>, the easiest method is to simply rename the <code class="docutils literal notranslate">.war</code> file. For example, if intending to server Guacamole at <code class="docutils literal notranslate">/new-path/</code>, you would: <ol class="arabic"> <li>Rename <code class="docutils literal notranslate">guacamole.war</code> to <code class="docutils literal notranslate">new-path.war</code>.</li> <li>Update the paths within the Apache configuration to reflect the new path: <div class="highlight-apache notranslate"><div class="highlight"><pre><Location /new-path/> Order allow,deny Allow from all ProxyPass http://HOSTNAME:8080/new-path/ flushpackets=on ProxyPassReverse http://HOSTNAME:8080/new-path/ </Location> <Location /new-path/websocket-tunnel> Order allow,deny Allow from all ProxyPass ws://HOSTNAME:8080/new-path/websocket-tunnel ProxyPassReverse ws://HOSTNAME:8080/new-path/websocket-tunnel </Location> </pre></div> </div> </li> </ol> Alternatively, the configuration can be altered slightly to handle requests at a different location externally while still serving internal requests at <code class="docutils literal notranslate">/guacamole/</code>: <div class="highlight-apache notranslate"><div class="highlight"><pre><Location /new-path/> Order allow,deny Allow from all ProxyPass http://HOSTNAME:8080/guacamole/ flushpackets=on ProxyPassReverse http://HOSTNAME:8080/guacamole/ </Location> <Location /new-path/websocket-tunnel> Order allow,deny Allow from all ProxyPass ws://HOSTNAME:8080/guacamole/websocket-tunnel ProxyPassReverse ws://HOSTNAME:8080/guacamole/websocket-tunnel </Location> </pre></div> </div> </section> <section id="disabling-logging-of-tunnel-requests"> <h3>Disabling logging of tunnel requests<a class="headerlink" href="#disabling-logging-of-tunnel-requests" title="Link to this heading"></a></h3> If WebSocket is unavailable, Guacamole will fallback to using an HTTP-based tunnel. The Guacamole HTTP tunnel works by transferring a continuous stream of data over multiple short-lived streams, each associated with a separate HTTP request. By default, Apache will log each of these requests, resulting in a rather bloated access log. There is little value in a log file filled with identical tunnel requests, so it is recommended to explicitly disable logging of those requests. Apache does provide a means of matching URL patterns and setting environment variables based on whether the URL matches. Logging can then be restricted to requests which lack this environment variable: <div class="highlight-apache notranslate"><div class="highlight"><pre>SetEnvIf Request_URI "^/guacamole/tunnel" dontlog CustomLog /var/log/apache2/guac.log common env=!dontlog </pre></div> </div> Note that if you are serving Guacamole under a path different from <code class="docutils literal notranslate">/guacamole/</code>, you will need to change the value of <code class="docutils literal notranslate">Request_URI</code> above accordingly. </section> </section> </section> </div> </div> <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer"> <a href="guacamole-docker.html" class="btn btn-neutral float-left" title="Installing Guacamole with Docker" accesskey="p" rel="prev"> Previous</a> <a href="configuring-guacamole.html" class="btn btn-neutral float-right" title="Configuring Guacamole" accesskey="n" rel="next">Next </a> </div> <hr/> <div role="contentinfo"> Copyright © 2024 <a href="http://www.apache.org/">The Apache Software Foundation</a>, Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>. Apache Guacamole, Guacamole, Apache, the Apache feather logo, and the Apache Guacamole project logo are trademarks of The Apache Software Foundation. </div> Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a> provided by <a href="https://readthedocs.org">Read the Docs</a>. </footer> </div> </div> </section> </div> <script> jQuery(function () { SphinxRtdTheme.Navigation.enable(true); }); </script> </body> </html>

doc/gug/reverse-proxy.html (510 lines of code) (raw):