Instalação Nativa do Apache Guacamole 1.6.0 com Tomcat 9 (Ubuntu)

Pré-requisitos

Atualize o sistema:

sudo apt update && sudo apt upgrade -y

Instale as dependências necessárias:

sudo apt install build-essential libcairo2-dev libjpeg62-turbo-dev libpng-dev libtool-bin uuid-dev freerdp2-dev libavcodec-dev libavutil-dev \
libssh2-1-dev libtelnet-dev libvncserver-dev libwebsockets-dev libpulse-dev libssl-dev libvorbis-dev libwebp-dev \
tomcat9-common ghostscript autoconf automake wget unzip -y

---

Compilar o guacamole-server

cd /usr/local/src
sudo wget https://dlcdn.apache.org/guacamole/1.6.0/source/guacamole-server-1.6.0.tar.gz
sudo tar -xvzf guacamole-server-1.6.0.tar.gz
cd guacamole-server-1.6.0
sudo autoreconf -fi
sudo ./configure --with-init-dir=/etc/init.d
sudo make
sudo make install
sudo ldconfig
sudo systemctl enable guacd
sudo systemctl start guacd

Verifique se está rodando:

sudo systemctl status guacd

---

Instalar o Guacamole Client (WebApp)

Baixe e mova o .war:

cd /var/lib
sudo mkdir tomcat9  # (se não existir)
cd /var/lib/tomcat9/webapps
sudo wget https://dlcdn.apache.org/guacamole/1.6.0/binary/guacamole-1.6.0.war -O guacamole.war

Defina o diretório de configuração:

sudo mkdir /etc/guacamole
echo "GUACAMOLE_HOME=/etc/guacamole" | sudo tee -a /etc/default/tomcat9

---

Configurar guacamole.properties

Crie o arquivo:

sudo nano /etc/guacamole/guacamole.properties

Conteúdo:

guacd-hostname: localhost
guacd-port: 4822
user-mapping: /etc/guacamole/user-mapping.xml

---

Criar user-mapping.xml

sudo nano /etc/guacamole/user-mapping.xml

Exemplo:

<user-mapping>
    <authorize username="guacadmin" password="guacadmin">
        <connection name="Example Server">
            <protocol>rdp</protocol>
            <param name="hostname">127.0.0.1</param>
            <param name="port">3389</param>
        </connection>
    </authorize>
</user-mapping>

---

Verificar funcionamento

Reinicie o Tomcat:

sudo systemctl restart tomcat9

Acesse:

http://SEU_IP:8080/guacamole/

Usuário padrão:

guacadmin / guacadmin

---

Alterar senha do guacadmin

1. Faça login como guacadmin
2. Clique no nome de usuário → Configurações
3. Acesse Usuários → guacadmin
4. Altere a senha e salve

Se for redirecionado direto para o cliente RDP, acesse manualmente:

http://SEU_IP:8080/guacamole/#/settings/users

---

Instalar Tomcat 9 (manual, recomendado)

cd /opt
sudo wget https://dlcdn.apache.org/tomcat/tomcat-9/v9.0.111/bin/apache-tomcat-9.0.111.tar.gz
sudo tar -xvzf apache-tomcat-9.0.111.tar.gz
sudo mv apache-tomcat-9.0.111 tomcat9

Crie o serviço systemd:

sudo nano /etc/systemd/system/tomcat9.service

Cole:

[Unit]
Description=Apache Tomcat 9
After=network.target

[Service]
Type=forking
User=tomcat
Group=tomcat
Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64"
Environment="CATALINA_PID=/opt/tomcat9/temp/tomcat.pid"
Environment="CATALINA_HOME=/opt/tomcat9"
Environment="CATALINA_BASE=/opt/tomcat9"
Environment="GUACAMOLE_HOME=/etc/guacamole"
ExecStart=/opt/tomcat9/bin/startup.sh
ExecStop=/opt/tomcat9/bin/shutdown.sh

[Install]
WantedBy=multi-user.target

Ative e inicie:

sudo systemctl daemon-reexec
sudo systemctl daemon-reload
sudo systemctl enable tomcat9
sudo systemctl start tomcat9

Verifique:

sudo ls -lh /opt/tomcat9/webapps/

Acesse:

http://SEU_IP:8080/guacamole/

---

Configurar HTTPS (Let's Encrypt)

1. Parar Tomcat temporariamente:

sudo systemctl stop tomcat9

2. Emitir certificado para o domínio:

sudo certbot certonly --standalone -d guac.meusite.com

Certificados ficam em:

/etc/letsencrypt/live/guac.meusite.com/

3. Converter para formato .p12:

sudo openssl pkcs12 -export \
  -in /etc/letsencrypt/live/guac.meusite.com/fullchain.pem \
  -inkey /etc/letsencrypt/live/guac.meusite.com/privkey.pem \
  -out /opt/tomcat9/conf/keystore.p12 \
  -name tomcat \
  -CAfile /etc/letsencrypt/live/guac.meusite.com/chain.pem \
  -caname root \
  -password pass:senhaGuac@2024

4. Editar server.xml:

sudo nano /opt/tomcat9/conf/server.xml

Adicione:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="200" SSLEnabled="true" scheme="https" secure="true"
           keystoreFile="/opt/tomcat9/conf/keystore.p12"
           keystorePass="senhaGuac@2024"
           keystoreType="PKCS12"
           clientAuth="false" sslProtocol="TLS"/>

5. Reiniciar Tomcat:

sudo systemctl start tomcat9

6. Acessar via HTTPS:

https://guac.meusite.com:8443/guacamole/

---

Conclusão

Seu Apache Guacamole 1.6.0 está instalado, funcionando com Tomcat 9, e configurado para HTTPS seguro via Let's Encrypt.

Dica: para iniciar automaticamente em boot e manter logs limpos, adicione logrotate e monitore os serviços guacd e tomcat9 com:

sudo systemctl status guacd tomcat9