Secure Access with an HTML5 Gateway

1. If the PSM HTML5 Gateway is running within a Docker container, open a terminal inside the container:

   sudo docker exec -ti <container name> bash

   For example:

   sudo docker exec -ti <PSM gateway FQDN> bash

2. For v13.0.1 and higher, if the PSM HTML5 Gateway is running within a Podman container, open a terminal inside the container:

   sudo podman exec -ti <container name> bash

   For example:

   sudo podman exec -ti <PSM gateway FQDN> bash

3. Set the following parameters in the daemon configuration file deployed in /etc/guacamole/guacd.conf:

   Parameter	Description
   log_level	The output level of the Gateway service log: debug info warning error

4. If the PSM HTML5 Gateway is running within a container, run the exit command to return to the host terminal and then run the following commands to restart the container:

   • v13.0

     sudo docker kill <container name> sudo docker start <container name>

     For example:

     sudo docker kill <PSM gateway FQDN> sudo docker start <PSM gateway FQDN>

   • v13.0.1 and higher

     sudo ./html5_console.sh purge <container name> sudo ./html5_console.sh start <container name>

     For example:

     sudo ./html5_console.sh purge <PSM gateway FQDN> sudo ./html5_console.sh start <PSM gateway FQDN>

Otherwise, restart the guacd with the following command:

/etc/init.d/guacd restart

1. If the PSM HTML5 Gateway is running within a container, open a terminal inside the container:

   • v13.0

     sudo docker exec -ti <container name> bash

     For example:

     sudo docker exec -ti <PSM gateway FQDN> bash

   • v13.0.1 and higher

     • Docker

       sudo docker exec -ti <container name> bash

       For example:

       sudo docker exec -ti <PSM gateway FQDN> bash

     • Podman

       sudo podman exec -ti <container name> bash

       For example:

       sudo podman exec -ti <PSM gateway FQDN> bash

2. Edit the webapp configuration file deployed in /etc/opt/CARKpsmgw/webapp/psmgw.conf:

   TargetCommunicationType
   Description	The communication type with PSM Default = RDP
   Accepted Values	TLS RDP
   InternalCommunicationType
   Description	The communication between the webapp and the daemon service Default = TLS For TLS to work, Secure Access with an HTML5 Gateway. For non-production environments, you can change this parameter to Normal, eliminating the need to secure the connection between the guacd and the webapp
   Accepted Values	TLS Normal
   IgnoreCertificateVerification
   Description	Whether to ignore foreign certificates when connecting to PSM Default = false
   Accepted Values	true false
   EnableCORS
   Description	Note: For PVWA versions earlier than 11.2, you must set EnableCORS to Yes to enable HTML5 sessions. Whether to enable or disable Cross Origin Resource Sharing. Once enabled, the following headers are added: Access-Control-Allow-Origin - The origin of the request. If AllowedOrigins is not set to ALL, the origin is only added if it exists on the allowed origins list. Access-Control-Allow-Methods= POST, GET, OPTIONS Access-Control-Allow-Credentials = true Access-Control-Max-Age = 3600 Access-Control-Allow-Headers = x-requested-with, x-ca66666, content-type, accept, authorization Default = No
   Accepted Values	Yes No
   AllowedOrigins
   Description	Define the allowed origins to Cross Origin Resource Sharing. Use this parameter when the EnableCORS parameter is set to Yes Default = All
   Accepted Values	All - Accept all origins from all requests Comma separated values - A comma separated list of values of allowed origins of requests For example: <first domain name>.com,<second domain name>.com,<third domain name>.com
   ClipboardControl
   Description	Enhance security by restricting the ability to copy text to/from the remote target Default = Bidirectional To use the clipboard tool, see Interaction between the local and remote machines
   Accepted Values	Bidirectional - Enables users to copy text to and from the local workstation and remote target, in both directions ClientToServer - Enables users to copy text from the local workstation to the remote target ServerToClient - Enables users to copy text from the remote target to the local workstation None - Disables any copying of text to and from the local workstation and remote target
   EnableFileTransfer
   Description	Enable copying files to and from the remote target Default = Yes   You cannot copy folders. To copy files, see Interaction between the local and remote machines When connecting using a PSM-WinSCP connection, WinSCP must be configured to properly copy large files. See WinSCP for details
   Accepted Values	Yes - Enables users to copy files to and from the local workstation and remote target, in both directions   The AllowMappingLocalDrives parameter must also be enabled to copy files. No - Disables any copying of files to and from the local workstation and remote target   To disable the copy files function, the EnableFileTransfer must be set to No . It is not enough to disable the AllowMappingLocalDrives parameter.
   EnableJWTValidation
   Description	Enable or disable JWT validation to authenticate the requests to the HTML5 gateway Default = yes
   Accepted Values	yes no
   EndPointAddress
   Description	The address of the API that generates the token for JWT validation. For example, https://<PVWA hostname>/passwordvault If EnableJWTValidation = no, there is no need to set this parameter For details, see JWT validation
   Accepted Values
   ServerKeyboardLayout
   Description	The type of keyboard layout to implement. Default = en-us-qwerty
   Accepted Values	fr-fr-azerty fr-be-azerty fr-ch-qwertz de-ch-qwertz de-de-qwertz en-us-qwerty en-gb-qwerty hu-hu-qwertz it-it-qwerty ja-jp-qwerty pt-br-qwerty es-es-qwerty es-latam-qwerty sv-se-qwerty tr-tr-qwerty ca-psm-unicode failsafe
   EnableFontSmoothing
   Description	Set text rendering with smooth edges for improved session quality
   Accepted Values	true false
   PSMFirstConnectionTimeout
   Description	The maximum time in milliseconds that the HTML5 gateway waits for the first connection response from PSM This improves tolerance in environments with network latency. Default = 9000
   Accepted Values	1 – 59000

3. Restart the web server.

4. If the PSM HTML5 Gateway is running within a container, run the following commands on a terminal inside the container:

   sh /opt/tomcat/bin/shutdown.sh sh /opt/tomcat/bin/startup.sh

   Otherwise, run the following command:

   sudo service tomcat restart