Title
Upgrade guacd to FreeRDP 3.x / Add Kerberos Support for AD "Protected Users" (RDP)
Platform
Web-app
Is it related to an issue?
Currently, it is impossible to establish an RDP connection via Termix using an Active Directory account that is a member of the "Protected Users" group. This group strictly enforces Kerberos authentication and outright denies NTLM fallback. Connections fail with Windows Event IDs 4822 and 4776 (NTLM fallback rejected by the Domain Controller) and Guacamole reports Access denied by server.
Root Cause Analysis:
After debugging the guacd container and mounting a host-joined Kerberos Keytab + SSSD pipes, I've identified two main roadblocks in the current Termix guacd image:
FreeRDP 2.x Limitation: Running find / -name "libfreerdp*.so*" inside the container reveals that the RDP engine is linked against libfreerdp2.so.2.11.7. FreeRDP 2.x is notoriously unreliable with Kerberos ticket delegation via Guacamole, often ignoring valid Kerberos setups and forcing an NTLM fallback.
Missing Kerberos Libraries: The base Alpine image lacks the fundamental krb5 and krb5-libs packages. Even if a user properly joins the Docker host to the AD domain and mounts /etc/krb5.conf and /etc/krb5.keytab, the container physically cannot execute kinit or process the tickets natively.
Steps to Reproduce:
Setup Termix and configure an RDP connection to a Windows Domain Controller.
Attempt to log in using an AD account belonging to the "Protected Users" group (Security Mode: NLA).
The connection drops immediately.
DC Event Viewer shows Event 4822 (NTLM blocked for Protected User) and Event 4776.
The Solution
To support strict Microsoft AD Tiering models and Enterprise Security standards, please consider the following:
Upgrade the RDP Engine: Compile the guacd image against FreeRDP 3.x, which natively and reliably supports Kerberos authentication and clean fallback handling. (Note: Guacamole 1.6.0 supports FreeRDP 3, though it might still default to 2.x for RAIL support).
Include Kerberos Tools: Add krb5 and krb5-libs to the guacd Dockerfile so the container can interact with host-mounted Kerberos caches or keytabs.
Alternative: If maintaining FreeRDP 2.x is strictly required for legacy compatibility, consider providing a separate Docker tag (e.g., guacd:latest-freerdp3 or guacd:enterprise) aimed at strict AD environments.
Additional Context
In current setups, administrators are forced to either remove their accounts from the "Protected Users" group or create less secure accounts just to use Termix as a Jump-Host. Supporting FreeRDP 3.x + Kerberos closes this massive security gap and makes Termix fully compliant with Enterprise IT-Security best practices.
Title
Upgrade guacd to FreeRDP 3.x / Add Kerberos Support for AD "Protected Users" (RDP)
Platform
Web-app
Is it related to an issue?
Currently, it is impossible to establish an RDP connection via Termix using an Active Directory account that is a member of the "Protected Users" group. This group strictly enforces Kerberos authentication and outright denies NTLM fallback. Connections fail with Windows Event IDs 4822 and 4776 (NTLM fallback rejected by the Domain Controller) and Guacamole reports Access denied by server.
Root Cause Analysis:
After debugging the guacd container and mounting a host-joined Kerberos Keytab + SSSD pipes, I've identified two main roadblocks in the current Termix guacd image:
FreeRDP 2.x Limitation: Running find / -name "libfreerdp*.so*" inside the container reveals that the RDP engine is linked against libfreerdp2.so.2.11.7. FreeRDP 2.x is notoriously unreliable with Kerberos ticket delegation via Guacamole, often ignoring valid Kerberos setups and forcing an NTLM fallback.
Missing Kerberos Libraries: The base Alpine image lacks the fundamental krb5 and krb5-libs packages. Even if a user properly joins the Docker host to the AD domain and mounts /etc/krb5.conf and /etc/krb5.keytab, the container physically cannot execute kinit or process the tickets natively.
Steps to Reproduce:
Setup Termix and configure an RDP connection to a Windows Domain Controller.
Attempt to log in using an AD account belonging to the "Protected Users" group (Security Mode: NLA).
The connection drops immediately.
DC Event Viewer shows Event 4822 (NTLM blocked for Protected User) and Event 4776.
The Solution
To support strict Microsoft AD Tiering models and Enterprise Security standards, please consider the following:
Upgrade the RDP Engine: Compile the guacd image against FreeRDP 3.x, which natively and reliably supports Kerberos authentication and clean fallback handling. (Note: Guacamole 1.6.0 supports FreeRDP 3, though it might still default to 2.x for RAIL support).
Include Kerberos Tools: Add krb5 and krb5-libs to the guacd Dockerfile so the container can interact with host-mounted Kerberos caches or keytabs.
Alternative: If maintaining FreeRDP 2.x is strictly required for legacy compatibility, consider providing a separate Docker tag (e.g., guacd:latest-freerdp3 or guacd:enterprise) aimed at strict AD environments.
Additional Context
In current setups, administrators are forced to either remove their accounts from the "Protected Users" group or create less secure accounts just to use Termix as a Jump-Host. Supporting FreeRDP 3.x + Kerberos closes this massive security gap and makes Termix fully compliant with Enterprise IT-Security best practices.