[
https://issues.apache.org/jira/browse/GUACAMOLE-2044?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Maurice Snoeren updated GUACAMOLE-2044:
---------------------------------------
Attachment: (was: guacamole_data_diode_design.png)
> Secure remote access for critical networks using data-diode architecture
> ------------------------------------------------------------------------
>
> Key: GUACAMOLE-2044
> URL: https://issues.apache.org/jira/browse/GUACAMOLE-2044
> Project: Guacamole
> Issue Type: New Feature
> Components: guacamole, guacd
> Reporter: Maurice Snoeren
> Priority: Minor
> Labels: security
>
> To create remote access for critical networks and systems, it would be nice
> to be able to communicate over a data-diode infrastructure. Data-diodes
> provide a physical (or hardware enforced) network isolation between networks.
> The current design idea is to put the data-diodes between the Guacamole
> client and the guacd server.
> Currently, I am already busy with a data-diode implementation apart from the
> Guacamole project. This can be found on
> [https://github.com/macsnoeren/guacamole-datadiode.] At this moment we have
> implemented the first working version (v2.0) that enables Guacamole to
> communicate over a data-diode infrastructure. That prohibit lateral movement
> over the connected network, but allow remote access to the critical systems.
> Next step is to research and develop the solution for the approval process
> that allow people to approve or deny incoming connections requested from
> Guacamole server. That provides the required security and control for high
> critical environments. If interested, please have a look to our repository.
> Do not hesitate to get into contact with me if you have questions.
> Final note is that I am also looking for integrating this functionality in
> the Guacamole project itself. That can be done by (1) still use separate
> proxies as proposed by our project currently or (2) integrate gmlbroker into
> Guacamole server and gcdbroker into guacd. The gmguard always will be a
> separate system to maintain the integrity and security of the connections.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
