[
https://issues.apache.org/jira/browse/GUACAMOLE-2044?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Maurice Snoeren updated GUACAMOLE-2044:
---------------------------------------
Description:
To create remote access for critical networks and systems, it would be nice to
be able to communicate over a data-diode infrastructure. Data-diodes provide a
physical (or hardware enforced) network isolation between networks. The current
design idea is to put the data-diodes between the Guacamole client and the
guacd server.
Currently, I am already busy with a data-diode implementation apart from the
Guacamole project. This can be found on
[https://github.com/macsnoeren/guacamole-datadiode.] At this moment we have
implemented the first working version (v2.0) that enables Guacamole to
communicate over a data-diode infrastructure. That prohibit lateral movement
over the connected network, but allow remote access to the critical systems.
Next step is to research and develop the solution for the approval process that
allow people to approve or deny incoming connections requested from Guacamole
server. That provides the required security and control for high critical
environments. If interested, please have a look to our repository. Do not
hesitate to get into contact with me if you have questions.
Final note is that I am also looking for integrating this functionality in the
Guacamole project itself. That can be done by (1) still use separate proxies as
proposed by our project currently or (2) integrate gmlbroker into Guacamole
server and gcdbroker into guacd. The gmguard always will be a separate system
to maintain the integrity and security of the connections.
was:
To create remote access for critical networks and systems, it would be nice to
be able to communicate over a data-diode infrastructure. Data-diodes provide a
physical (or hardware enforced) network isolation between networks. The current
design idea is to put the data-diodes between the Guacamole client and the
guacd server.
Currently, I am already busy with a data-diode implementation apart from the
Guacamole. This can be found on
[https://github.com/macsnoeren/guacamole-datadiode.] I am still in testing
phase and will shortly test this out in a production environment. I have added
a global design picture in the attachment. However, it would be nice if the
Guacamole project would natively support the use of a data-diode architecture.
This new feature can be implemented due to the great work of the Guacamole
protocol. A text-based streaming protocol that can be easily validated and send
over UDP-channels. How it would work with SSL is not yet thought of. First step
is to get it to work in my proof-of-concept.
Today I had a look to the source code of the Guacamole project and build the
Guacamole client. Got some ideas and created a global design for the native
support to the Guacamole project concerning data-diodes. I also attached that
image to this ticket.
> Secure remote access for critical networks using data-diode architecture
> ------------------------------------------------------------------------
>
> Key: GUACAMOLE-2044
> URL: https://issues.apache.org/jira/browse/GUACAMOLE-2044
> Project: Guacamole
> Issue Type: New Feature
> Components: guacamole, guacd
> Reporter: Maurice Snoeren
> Priority: Minor
> Labels: security
> Attachments: guacamole_data_diode_design.png,
> guacamole_data_diode_native_design.png
>
>
> To create remote access for critical networks and systems, it would be nice
> to be able to communicate over a data-diode infrastructure. Data-diodes
> provide a physical (or hardware enforced) network isolation between networks.
> The current design idea is to put the data-diodes between the Guacamole
> client and the guacd server.
> Currently, I am already busy with a data-diode implementation apart from the
> Guacamole project. This can be found on
> [https://github.com/macsnoeren/guacamole-datadiode.] At this moment we have
> implemented the first working version (v2.0) that enables Guacamole to
> communicate over a data-diode infrastructure. That prohibit lateral movement
> over the connected network, but allow remote access to the critical systems.
> Next step is to research and develop the solution for the approval process
> that allow people to approve or deny incoming connections requested from
> Guacamole server. That provides the required security and control for high
> critical environments. If interested, please have a look to our repository.
> Do not hesitate to get into contact with me if you have questions.
> Final note is that I am also looking for integrating this functionality in
> the Guacamole project itself. That can be done by (1) still use separate
> proxies as proposed by our project currently or (2) integrate gmlbroker into
> Guacamole server and gcdbroker into guacd. The gmguard always will be a
> separate system to maintain the integrity and security of the connections.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
