1. Pilae
2. Apps
3. Apache Guacamole

Running Apache Guacamole in production: what it takes

1. Place guacd beside the machines it reaches

   guacd, the web app and PostgreSQL run from the upstream images, pinned to a release we have run. guacd sits on the private network next to the machines it opens sessions to, and a site of your own can have its own guacd, since each connection can name the guacd it goes through. Port 4822 accepts the web app and nothing else.

2. Sign-on through Keycloak, permissions by group

   The OpenID Connect extension signs people in through Keycloak, whose client is set up for the implicit flow Guacamole uses. Group names arrive in the groups claim and match Guacamole user groups that hold the connection permissions, so someone removed from a group in the directory loses its connections at their next sign-in. SAML works the same way for an identity provider that only speaks SAML.

3. Pin host keys and certificates

   Guacamole checks no SSH host identity unless it is given one, so every SSH connection carries its host key, and RDP connections carry the certificate fingerprints of their servers rather than ignoring certificates. TLS ends at a proxy in front of Tomcat, whose RemoteIpValve trusts that proxy alone, so the history and the brute-force ban record the address of each person and not of the proxy.

4. Record per connection, play back in the browser

   Recordings are written to a directory named after each history entry, where the history recording storage extension finds them, and the connection history shows a View link beside each recorded session. Key events are recorded only where you ask for them, because they capture everything typed. Recordings older than your retention period are deleted on a schedule.

5. Back up, restore, then upgrade in your window

   The database and the recordings go offsite daily, encrypted, to your chosen country. Once a month we restore both into a scratch environment, open a connection and play a recording from the copy. Restarting the web app or guacd ends every open session, so each upgrade, with the database scripts the release ships, is tested on a copy by the Pilae Agent and applied in your window once you approve.

What Apache Guacamole is, and who runs it

Apache Guacamole system requirements

Before anything is deployed, this is what has to exist. We size it with you in the first session, and we say so when your own hardware is already enough.

CPU and memory

4 vCPU · 8 GBOur starting point for guacd, the web app and PostgreSQL on one machine. guacd does the work: it holds every RDP, SSH and VNC session open and encodes the screen for the browser, so it grows with the sessions open at once rather than with the number of users.

Database

PostgreSQL · guacamole-auth-jdbcHolds users, groups, connections, permissions and the connection history. Guacamole does not create its own tables: the schema scripts ship with the extension and run once, and the guacadmin account they create, with the password guacadmin, is replaced before anyone else signs in.

Proxy daemon

guacamole/guacd · TCP 4822guacd authenticates no one, and upstream warns that an exposed guacd is a jumping point to other systems. Ours accepts connections from the web app alone, over the private network.

Recordings

Shared volume · mode 2750guacd writes the recordings and the web app reads them for playback, so both mount the same directory, owned by the guacd user and readable by the group the web app runs as, with the setgid bit so new recordings keep that group. It is sized for the retention period you set.

Target machines

RDP 3389 · SSH 22 · VNC 5900Open to the guacd address only. Windows needs Remote Desktop turned on, which Home editions cannot accept. Nothing from Guacamole is installed on any of them.

DNS and TLS

1 private hostnameFor example remote.acme.internal, resolved on the private network only. The OpenID Connect redirect URI is the address people type, so it is chosen once.

Migrating from TeamViewer to Apache Guacamole

TeamViewer puts an agent on every machine and brokers each session through its own servers. Guacamole installs nothing on the machines it reaches: guacd opens RDP, SSH or VNC to them over your private network, and the browser draws the session. So what moves is a list of machines, the protocol each one speaks and the groups allowed to open it, written as one import file. What does not come across is attended support for a laptop outside your network. Guacamole reaches only what guacd can route to, so helping someone on their home connection stays a job for a support tool. Unattended access to servers and office desktops is the part that moves.

1. List the machines still in use

   With the owners, we go through the TeamViewer device list and keep the machines people still open, with the directory groups who use each one. The rest are retired with the subscription instead of being carried across.

2. Switch on the native protocol

   Windows servers and Pro or Enterprise desktops get Remote Desktop with Network Level Authentication, Linux servers already run SSH, and desktops whose screen someone must see get a VNC server. Each accepts those ports from guacd alone. Windows Home machines cannot accept Remote Desktop and are listed first.

3. Import connections and permissions

   Connection groups are created first, because the import places connections in groups that already exist. The connections, with the directory groups allowed to use each one, then go into one CSV, JSON or YAML file, loaded through the Import button in the web app. User groups named in the file that do not exist yet are created. Each owner opens their connections once before anyone else moves.

4. Uninstall TeamViewer machine by machine

   Once a machine has been reached through Guacamole by its usual people for a full working week, the TeamViewer client comes off it and the device leaves the account. The subscription ends with the last machine.

Who reaches what through Guacamole

What Pilae is responsible for

Where it runs

zur1, fra1, fal1, gra1, ams1, hel1, lon1, ash1, hil1, sin1, tok1, syd1, on-premZurich, Frankfurt, Falkenstein, Gravelines, Amsterdam, Helsinki, London, Ashburn, Hillsboro, Singapore, Tokyo, Sydney, Your own hardware

Who holds the credentials

You do. Ours are separate, named, logged and revocable with one command. We ask before anything changes outside an agreed window.

If you leave

The machine, the data, the compose files and the runbook are already yours. Nothing stops when our access does.

What running Apache Guacamole costs

On Starter, Apache Guacamole runs in Pilae Cloud for CHF 449EUR 479USD 559 a month, hosting and onboarding included. On Business, it is one of up to three apps for CHF 1,590EUR 1,690USD 1,990 a month, on your own servers or in Pilae Cloud. Enterprise is quoted. The plans set what each includes; these are the inputs that move the price around them.

Instance size

The CPU, memory and, where a model runs, the GPUs the app needs for your users and your data.

High availability

One machine with tested restores, or a replicated setup that keeps serving when a node fails.

Storage and backups

How much data it holds, how long backups are kept, and point-in-time recovery for its database.

Plan and support

Starter, Business or Enterprise: support hours, response times in the contract and how often we review the service with you.

Region

Your own hardware, where the infrastructure is already yours, or a Pilae Cloud region, where machines are priced per month. On Starter, Pilae chooses the site.

Sign-on and integrations

Single sign-on, directory sync, mail relays and the other systems the app has to reach.

Apache Guacamole: common questions

Also in engineering and security