On Fri, May 22, 2026 at 10:56 AM Devine, Harry (FAA) <[email protected]> wrote:
> So Red Hat asked me to capture a tcpdump of the connection attempt. I did > 2 pcap files: 1 between Guac and the VNC server (connection fails), and 1 > between the VNC client and VNC server (connection works). I had our > network admin use Wireshark to examine both pcap files. Here’s what he > found: > > > > Guac -> VNC: > > - the Guac server sends the connection request; > - the VNC server sends back a challenge (hex value); > - the Guac server sends back the same challenge (hex value) but no > password is encrypted, and VNC server rejects it, resulting in > “Authentication Failed” > > > > VNC client -> VNC server: > > - the VNC client sends the connection request; > - the VNC server sends back a challenge (hex value); > - the VNC client sends back a different response (hex value), > indicating that the password entered by the user has been encrypted, and > the VNC server accepts it and allows the connection. > > > > Based on these findings, I believe that Guacamole is not handling the > password encryption via DES between itself and the VNC server. Would you > like me to send you my pcap files? > > > > Thoughts? > I'm still baffled by the fact that you're not being prompted for credentials when you try to connect. The results from above make perfect sense if no password is being sent, but, in the absence of credentials being provided as part of the connection, it should pop up and prompt you for the password, and I've no idea why that isn't happening. What happens if you provide the password as part of the connection parameters? Does it succeed or fail? And, if it fails, do you get the same results in the pcap (no password being sent back)? Also, I'm completely grasping at straws, here, but this message is interesting: May 20 13:59:56 guac-test server[14719]: 13:59:56.316 [http-nio-8080-exec-5] INFO o.a.g.t.h.RestrictedGuacamoleHTTPTunnelServlet - Using HTTP tunnel (not WebSocket). Performance may be sub-optimal. I don't think any of the credential prompting in Guacamole is tied to the use of Websockets vs. straight HTTP, but I'll have to see if I can disable Websockets in my environment and verify that. -Nick
