# guac-install: a one-shot Guacamole installer that its own maintainer has stepped back from

> guac-install is a shell script that installs Apache Guacamole on Ubuntu with MySQL and Tomcat, with switches for TOTP or Duo MFA and a companion upgrade script. This looks at how the installer works, the flags it exposes, and what its maintainer says about its upkeep.

**MysticRyuujin/guac-install** — Script for installing Guacamole on Ubuntu

- Repository: https://github.com/MysticRyuujin/guac-install
- Stars: 1,040 · Forks: 275
- Language: Shell
- License: not declared
- Published: 2026-10-19 · Updated: 2026-10-19 · Language: en
- Canonical page: https://hysenlabs.com/projects/mysticryuujin-guac-install

## Guacamole, MySQL and Tomcat in one pass

guac-install is a script for installing Apache Guacamole, and the repository description narrows it to Ubuntu. The topic tags give the stack: guacamole, guacamole-server, mysql, tomcat, ubuntu.

The value proposition is the one you get from a hundred install guides rolled into a single file. Guacamole is a client-server remote desktop gateway that speaks RDP, SSH and VNC, and installing the server side properly means installing a Java servlet container, a database, the Guacamole web application, and the schema that connects them. Doing that by hand is a couple of hours of package juggling on a clean machine. The script asks for two passwords and does it.

The script is described as installing Guacamole 1.6.0 on Ubuntu 16.04 or newer, with MySQL or a remote MySQL, and it says it should also work on pure Debian, Raspbian, Linux Mint 18 or LMDE 4 or newer, and Kali Linux. The version it was tested on is Debian 10.3.0, Buster, with the advice that if other versions do not work you should open an issue, and a guess at the cause, a required library having a different name.

The repository is four scripts: `guac-install.sh`, `guac-upgrade.sh`, `guac-install-server.sh` and `docker-install.sh`. The script prompts for the MySQL root password and the Guacamole user password, and the readme is emphatic that these are the credentials used to connect to the Guacamole database and that you should save them.

## The maintainer says plainly that it is not maintained

The first paragraph of the readme is the most useful thing in the repository, and it deserves to be quoted rather than paraphrased. The maintainer says they have maintained this script for quite a few years with help from other contributors, and that it seems to be getting more and more fragmented as libraries and system operating systems diverge in their package management.

They state that they do not plan on maintaining it beyond perhaps approving other people's pull requests and letting people continue to discuss issues, and that they will not archive it but are also not actively maintaining it.

That is an unusually clear status signal and it should shape the evaluation directly. The last push to the repository was on 2026-07-15, and there are no GitHub releases, so there is no version stream to pin and no tagged artefact to fall back on. The script in the repository is the artefact, and it is a moving target that depends on whatever the distribution repositories currently ship.

There is also a note attached to the workaround fixes below. The readme says the fixes described below are not to be used unless you are having issues, that you should not run them for no reason, and that you should use the distro maintainers' version unless there is a reason not to.

So even the fix notes are framed as exceptions: stick with what the distribution ships unless you have a reason not to. That is a reasonable position, and it is also the opposite of what a repository like this usually implies.

## Running it, interactively or with the passwords on the command line

The download is a wget of a short link:

```bash
wget https://git.io/fxZq5 -O guac-install.sh
```

then the usual two steps:

```bash
chmod +x guac-install.sh
```

```bash
./guac-install.sh
```

The interactive run asks for the passwords. The non-interactive form takes them on the command line, and the readme gives both the long and short spellings:

```bash
./guac-install.sh --mysqlpwd password --guacpwd password --nomfa --installmysql
```

```bash
./guac-install.sh -r password -gp password -o -i
```

Passing passwords on a command line writes them into the shell history and into the process list, so the interactive form is the better habit even in a container or an automation pipeline, where a here-document or a secrets mechanism is the way to avoid the history entry.

After installation, Guacamole is reachable at `http://<host_or_ip>:8080/guacamole/`, and the default credentials are `guacadmin` as both username and password. The readme asks you to change them or disable guacadmin after install, and on an internet-facing host that is not optional, since the default account is in every scanner's dictionary.

The Tomcat version is handled automatically. The script attempts to install `tomcat9` by default, falls back to `tomcat8` if the available version is 8.5.x or newer, and falls back to `tomcat7` otherwise, with a commented out line you can edit if you want to pin it yourself.

## The switches are the configuration surface

The readme lists every flag, which is the whole configuration model of the installer.

For the database: `-i` or `--installmysql` to install MySQL, `-n` or `--nomysql` to skip it, `-h` or `--mysqlhost` and `-p` or `--mysqlport` for a remote MySQL, and `-r` or `--mysqlpwd` for the root password. For the Guacamole database itself: `-db` or `--guacdb` for the database name, `-gu` or `--guacuser` for the user that connects to it, and `-gp` or `--guacpwd` for that user's password.

For MFA there are three mutually exclusive choices. `-o` or `--nomfa` installs neither, `-t` or `--totp` installs the TOTP extension with QR codes for Google and Microsoft Authenticator, and `-d` or `--duo` installs Duo Mobile or Duo Push. The readme warns in capitals not to install both, and notes that you can instead set the script variables `installTOTP=true` or `installDuo=true`.

The MFA story is the part worth understanding before you install, because the default is none. A freshly installed Guacamole with no second factor and a default administrator account is not a configuration you want to expose, and the script will not stop you.

The companion upgrade script, `guac-upgrade.sh`, handles an existing instance installed by this script or guide, and it also updates the TOTP or Duo extensions if you used them. Its flag set is narrower: only the MySQL host, MySQL port and Guacamole database switches are available there, which makes sense since the rest of the configuration was decided at install time.

## Reverse proxying, and two platform workarounds

The readme includes the reverse proxy configuration for Nginx and Apache, which you will need because Guacamole's WebSocket-based rendering does not work through a naive proxy.

```nginx
location /guacamole/ {
    proxy_pass http://HOSTNAME:8080/guacamole/;
    proxy_buffering off;
    proxy_http_version 1.1;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    access_log off;
}
```

The `proxy_buffering off` and the `Upgrade` and `Connection` headers are the parts that matter, because Guacamole streams its rendering over a WebSocket and a buffering or non-upgraded proxy breaks the session. The readme points at the official documentation for the reverse proxy setup as well.

The two platform workarounds are about broken installations rather than about the normal path. Ubuntu users having issues with RDP have reported adding the Remmina PPA and installing the FreeRDP development packages, and Debian users having the same problem have reported adding the buster-backports repository for the same packages plus `libpulse-dev`.

The SSH note is the most interesting of the three, because it is a change in the platform rather than in the application. The readme says SSH does not work with Ubuntu 22.04, because Guacamole only supports `ssh-dss` and `ssh-rsa` and both have been disabled in Ubuntu 22.04. The stated workaround is adding `HostKeyAlgorithms +ssh-rsa` to the end of `/etc/ssh/sshd_config` on the Ubuntu machine and restarting sshd. The readme ends that section with a warning to use it at your own risk, and it is worth reading that warning carefully, since re-enabling an old host key algorithm on a server is a security change and not a configuration tweak.

## Where guac-install is the wrong tool

Three limits are clear, and one of them is the maintainer's own advice.

The first is the version pinning. The script targets Guacamole 1.6.0 and Ubuntu 16.04 or newer, and it was tested on Debian 10.3.0. The fallbacks for Tomcat are written against the package naming of that era, which is exactly the fragmentation the maintainer describes. On a current distribution the script will usually work, and when it does not the failure is a missing or renamed library, and the fix is either the reported workaround or a patch from a contributor. That is a workable but hands-on support model.

The second is the shape of the deployment. This is a single script that installs a single instance, with a reverse proxy configured by hand afterwards, and no configuration management, no inventory, no idempotency beyond what the script itself provides. For one lab or one homelab host that is the right amount of tooling. For a fleet, a configuration management system running the distribution's package plus the Guacamole schema migration is the more honest answer.

The third is the operational default. The script leaves the default administrator account in place, the readme asks you to change or disable it, and the upgrade script carries a warning that upgrading from versions older than a couple of dot fixes ago has not been tested and that you should take backups first. A script that runs as root over a network-installed package set is fine, but it is a script that wants to be run on a host you are willing to rebuild.

For an evaluator, the two questions to ask are whether the host has a current Guacamole package, in which case the script is unnecessary, and whether the host is one where it does not, in which case the script is the shortest path and the readme tells you exactly which known issues to expect.

## Conclusion

guac-install fits a sysadmin standing up a single Guacamole instance on a Debian or Ubuntu host in a lab, a homelab or a small office, who wants the database, the Tomcat deployment and the schema created in one pass. It does not fit a production deployment, and it is the wrong choice for anything that needs a repeatable, reviewable configuration as code. Before you run it, read the warning about the default `guacadmin` credentials and the note that the workarounds for RDP and SSH are for broken installations only, and take a backup before using the upgrade script on an existing instance.

## FAQ

### How do I install Guacamole with guac-install?

Download the script with `wget https://git.io/fxZq5 -O guac-install.sh`, make it executable with `chmod +x guac-install.sh`, and run `./guac-install.sh` as root. The interactive run asks for the MySQL root password and the Guacamole user password, and Guacamole is then reachable at http://<host_or_ip>:8080/guacamole/.

### Is guac-install still maintained?

No, and the readme says so directly. The maintainer states they do not plan on maintaining it beyond approving other people's pull requests and letting issues be discussed, that they will not archive it, and that they are not actively maintaining it. The last push was on 2026-07-15 and the repository has no releases.

### Can guac-install install MFA support?

Yes, with `-t` or `--totp` for the TOTP extension using Google or Microsoft Authenticator, and `-d` or `--duo` for Duo Mobile or Duo Push. The readme warns not to install both, and MFA is off by default, so pass `-o` or `--nomfa` to keep it that way explicitly.

### Why does SSH not work with Guacamole on Ubuntu 22.04?

The readme explains that Guacamole only supports ssh-dss and ssh-rsa, and that both have been disabled in Ubuntu 22.04. The stated workaround is adding `HostKeyAlgorithms +ssh-rsa` to /etc/ssh/sshd_config and restarting sshd, with a warning to use it at your own risk.

### What are the default credentials after installing Guacamole?

The default username and password are both `guacadmin`. The readme asks you to change them or disable the guacadmin account after the install, and on any host reachable from the internet that step should be treated as mandatory.

## Sources

- [Issues](https://github.com/MysticRyuujin/guac-install/issues)
- [MysticRyuujin/guac-install on GitHub](https://github.com/MysticRyuujin/guac-install)
- [README](https://github.com/MysticRyuujin/guac-install/blob/main/README.md)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/mysticryuujin-guac-install