Docker Compose Install
Deployment of Keeper Connection Manager using Docker Compose
This section describes how to install Keeper Connection Manager using Docker by building a customized docker-compose orchestration file.
Windows
Amazon Linux 2
CentOS7, RHEL
In addition to installing Docker, please install the
haveged package to ensure that the environment is capable of generating enough entropy for creating secure random numbers.sudo yum install epel-release
sudo yum install haveged
sudo systemctl start haveged
sudo systemctl enable haveged
Ubuntu
Install the
haveged package to ensure that the environment is capable of generating enough entropy for creating secure random numbers.sudo apt-get install haveged
Now that you have Docker running on your instance, you need to generate a docker-compose.yml file that must be transferred to a working directory on your machine.
An example
docker-compose.yml file for a deployment of Keeper Connection Manager which uses Let's Encrypt for its SSL certificate and an automatically-initialized database for authentication is provided below with a MySQL and PostgreSQL option.Using MySQL
Using PostgreSQL
version: "3"
services:
guacd:
image: keeper/guacd:2
restart: unless-stopped
environment:
ACCEPT_EULA: "Y"
volumes:
- "common-storage:/var/lib/guacamole:rw"
db:
image: keeper/guacamole-db-mysql:2
restart: unless-stopped
environment:
ACCEPT_EULA: "Y"
MYSQL_RANDOM_ROOT_PASSWORD: "yes"
GUACAMOLE_DATABASE: guacamole_db
GUACAMOLE_USERNAME: guacamole_user
GUACAMOLE_PASSWORD: some_strong_password
GUACAMOLE_ADMIN_PASSWORD: some_strong_password
guacamole:
image: keeper/guacamole:2
restart: unless-stopped
environment:
ACCEPT_EULA: "Y"
GUACD_HOSTNAME: guacd
MYSQL_HOSTNAME: db
MYSQL_DATABASE: guacamole_db
MYSQL_USERNAME: guacamole_user
MYSQL_PASSWORD: some_password
volumes:
- "common-storage:/var/lib/guacamole:rw"
ssl:
image: keeper/guacamole-ssl-nginx:2
restart: unless-stopped
ports:
- "80:80"
- "443:443"
environment:
ACCEPT_EULA: "Y"
GUACAMOLE_HOSTNAME: guacamole
SSL_HOSTNAME: keeper.mycompany.com
LETSENCRYPT_ACCEPT_TOS: "Y"
LETSENCRYPT_EMAIL: [email protected]
volumes:
common-storage:
Copy this file to your target KCM instance. Please note that you'll need to modify a few of the fields immediately:
- GUACAMOLE_PASSWORD and MYSQL_PASSWORD need to match, and should be a randomly generated strong password. We recommend using your Keeper vault for generating a password. Avoid using special characters like backslashes, dollar signs and forward slashes.
- GUACAMOLE_ADMIN_PASSWORD is the password for the default "guacadmin" user login. This should be a strong and randomly generated password. We recommend using your Keeper vault for generating a password. Avoid using special characters like backslashes, dollar signs and forward slashes.
- SSL_HOSTNAME needs to be the FQDN you set up to point to this server. Make sure that the DNS is routable to the IP from the outside world, and ports 80/443 are open so that Let's Encrypt can register the certificate.
version: "3"
services:
guacd:
image: keeper/guacd:2
restart: unless-stopped
environment:
ACCEPT_EULA: "Y"
volumes:
- "common-storage:/var/lib/guacamole:rw"
db:
image: keeper/guacamole-db-postgres:2
restart: unless-stopped
environment:
ACCEPT_EULA: "Y"
POSTGRES_PASSWORD: some_strong_password
GUACAMOLE_DATABASE: guacamole_db
GUACAMOLE_USERNAME: guacamole_user
GUACAMOLE_PASSWORD: some_strong_password
GUACAMOLE_ADMIN_PASSWORD: some_strong_password
guacamole:
image: keeper/guacamole:2
restart: unless-stopped
environment:
ACCEPT_EULA: "Y"
GUACD_HOSTNAME: "guacd"
POSTGRES_HOSTNAME: "db"
POSTGRES_DATABASE: "guacamole_db"
POSTGRES_USERNAME: "guacamole_user"
POSTGRES_PASSWORD: "xxxxxxx"
volumes:
- "common-storage:/var/lib/guacamole:rw"
ssl:
image: keeper/guacamole-ssl-nginx:2
restart: unless-stopped
ports:
- "80:80"
- "443:443"
environment:
ACCEPT_EULA: "Y"
GUACAMOLE_HOSTNAME: guacamole
SSL_HOSTNAME: keeper.mycompany.com
LETSENCRYPT_ACCEPT_TOS: "Y"
LETSENCRYPT_EMAIL: [email protected]
volumes:
common-storage:
Copy this file to your target KCM instance. Please note that you'll need to modify a few of the fields immediately:
- GUACAMOLE_PASSWORD and POSTGRES_PASSWORD need to match, and should be a randomly generated strong password. We recommend using your Keeper vault for generating a password. Avoid using special characters like backslashes, dollar signs and forward slashes.
- GUACAMOLE_ADMIN_PASSWORD is the password for the default "guacadmin" user login. This should be a strong and randomly generated password. We recommend using your Keeper vault for generating a password. Avoid using special characters like backslashes, dollar signs and forward slashes.
- SSL_HOSTNAME needs to be the FQDN you set up to point to this server. Make sure that the DNS is routable to the IP from the outside world, and ports 80/443 are open so that Let's Encrypt can register the certificate.
If you plan to use a custom SSL certificate instead of Let's Encrypt, replace the "ssl" section of the Docker Compose file with a section that looks like this:
ssl:
image: keeper/guacamole-ssl-nginx:2
restart: unless-stopped
ports:
- "80:80"
- "443:443"
environment:
SELF_SIGNED: "N"
ACCEPT_EULA: "Y"
GUACAMOLE_HOSTNAME: "guacamole"
SSL_HOSTNAME: "keeper.mycompany.com"
CERTIFICATE_FILE: "/var/lib/guacamole/your_certificate.pem"
PRIVATE_KEY_FILE: "/var/lib/guacamole/your_private_key.key"
volumes:
- "C:\Users\Path\To\Cert:/var/lib/guacamole:ro"
In this case,
CERTIFICATE_FILE is the PEM-encoded certificate including the intermediate certificate chain. The PRIVATE_KEY_FILE is the private key file. Also, note that in the above snippet, there is a volume mount that assigns the local filesystem to the target container. You should only modify the
C:\Users\Path\To\Cert portion of the string. On linux environments it will be /path/to/cert.On Windows, open a Command Prompt. On Linux, open the terminal shell. Navigate to the location of the
docker-compose.yml file that was saved in step 2.To start up the environment, simply type the below command:
docker compose up -d
Note: Some versions require "docker-compose" with a hyphen.
That's it. If everything is successful, you can open the Keeper Connection Manager login screen on the specified FQDN.
Keeper Connection Manager Login Screen
- If you have not set up a proper domain name routing to the server, you can temporarily host-hack the local system in order to at least access the user interface and start testing.
- If you're using your own SSL certificate, we don't recommend using a wildcard cert. A certificate that has been explicitly created for the Keeper Connection Manager endpoint is the best practice since you'll be storing the SSL private key on the device.
- If you're using Windows, you will need to modify your Windows Defender Firewall to open up ports 443 to the Docker service.
- Running
docker compose downwill delete all data in the container including users, connections and history. To simply stop the containers, usedocker compose stop.
Below is a description of each of the images.
Image name | Base image | Description |
|---|---|---|
The Apache Guacamole web application, deployed under Apache Tomcat. | ||
The Apache Guacamole proxy daemon, guacd, with support for native protocols such as RDP and SSH. | ||
An instance of MySQL, automatically initialized with the Apache Guacamole database schema. | ||
An instance of PostgreSQL, automatically initialized with the Apache Guacamole database schema. | ||
An instance of NGINX which automatically provides SSL termination for Keeper Connection Manager.
|
Now that your Keeper Connection Manager instance is running, you can login as guacadmin and start setting up some connections. Follow the Using Keeper Connection Manager documentation for next steps.
The next several sections of this installation guide provide detailed information about each specific Docker image, if you plan to customize or modify the environment.
Last modified 1mo ago