[
https://issues.apache.org/jira/browse/GUACAMOLE-2044?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18096432#comment-18096432
]
Maurice Snoeren commented on GUACAMOLE-2044:
--------------------------------------------
At this moment we have developed a full working version of the Guacamole Remote
Access solution over a three diode architecture. See project
[https://github.com/macsnoeren/guacamole-datadiode.] The repository README.md
explains the design and working principle. It is possible that you can test it
out (also without having the actual data-diodes). Information about the
solution and the why, you can look at
[https://github.com/macsnoeren/guacamole-datadiode/blob/main/documentation/PAPER.md.]
While data-diodes are becoming more and more important, it would be nice that
Guacamole supports data-diodes out-of-the-box. Note that only two suppliers in
the world are currently providing remote access over data-diodes. It would be
very nice that an open source Remote Access solution will be available to work
with data-diodes. This could make Guacamole also interesting for high-critical
operations. Two options can be chosen to adapt the Guacamole project to work
with data-diodes:
# Keep is as proposed by
[https://github.com/macsnoeren/guacamole-datadiode|https://github.com/macsnoeren/guacamole-datadiode.]
and embed the proxy application into the Guacamole project to maintain this
code base together with the changes of Guacamole main functionality. This is
the most easy solution.
# Integrate the gmlbroker into the Guacamole Server as option "communicate
over data-diodes" with the necessary options and gcdbroker into guacd. The
gmguard should always be a different software to make sure that only key
strokes and mouse moves are communicated.
It would be interesting when we could discuss this feature request in the
future. We are happy to help and support. At this moment we will start from
september 2026 with the research and development of an improved approval
process. This approval process creates the possibility to accept incoming
connections by an external entity.
> Secure remote access for critical networks using data-diode architecture
> ------------------------------------------------------------------------
>
> Key: GUACAMOLE-2044
> URL: https://issues.apache.org/jira/browse/GUACAMOLE-2044
> Project: Guacamole
> Issue Type: New Feature
> Components: guacamole, guacd
> Reporter: Maurice Snoeren
> Priority: Minor
> Labels: security
> Attachments: guacamole_data_diode_design.png,
> guacamole_data_diode_native_design.png
>
>
> To create remote access for critical networks and systems, it would be nice
> to be able to communicate over a data-diode infrastructure. Data-diodes
> provide a physical (or hardware enforced) network isolation between networks.
> The current design idea is to put the data-diodes between the Guacamole
> client and the guacd server.
> Currently, I am already busy with a data-diode implementation apart from the
> Guacamole. This can be found on
> [https://github.com/macsnoeren/guacamole-datadiode.] I am still in testing
> phase and will shortly test this out in a production environment. I have
> added a global design picture in the attachment. However, it would be nice if
> the Guacamole project would natively support the use of a data-diode
> architecture.
> This new feature can be implemented due to the great work of the Guacamole
> protocol. A text-based streaming protocol that can be easily validated and
> send over UDP-channels. How it would work with SSL is not yet thought of.
> First step is to get it to work in my proof-of-concept.
> Today I had a look to the source code of the Guacamole project and build the
> Guacamole client. Got some ideas and created a global design for the native
> support to the Guacamole project concerning data-diodes. I also attached that
> image to this ticket.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
