Resetting Guacamole OTP for an user

I’ve implemented Guacamole for remote access, for the time being it uses the builtin OTP module. In the future I might migrate to LemonLDAP or Keycloak for 2FA, for the time being the solution if good enough and works with zero configuration after module installation 🙂

Chapter 9. TOTP two-factor authentication

My particular setup is pulling users from FreeIPA through LDAP, but also uses MySQL as a supplement to handle the connections definitions and things like the OTP plugin information.

From time to time, an user would need to re-enroll a device because the original device was stolen or reset. Did a quick search, but couldn’t find a clean/easy option to reset it from the GUI in version 1.3.0.


As a quick fix (don’t want to have to rethink this each time a user has this requirement), I created a simple script to do the job for me.

All you need to do is setup your mysql DB connection in ~/.my.cnf and get the script from here:

https://github.com/ciroiriarte/sysadmin-scripts/blob/main/guacamole-reset-user-otp.sh

In most Linux machines, you can copy it to ~/bin/.

mkdir ~/bin
wget https://raw.githubusercontent.com/ciroiriarte/sysadmin-scripts/main/guacamole-reset-user-otp.sh
chmod +x guacamole-reset-user-otp.sh

If you run the script with no options, it will show you the syntax

me@workstation:>; guacamole-reset-user-otp.sh
Usage: /home/me/bin/guacamole-reset-user-otp.sh <username>
      /home/me/bin/guacamole-reset-user-otp.sh ciro.iriarte

And the execution should be as simple as:

guacamole-reset-user-otp.sh the.user

Author: ciroiriarte

I'm an IT professional interested in infrastructure technologies, working as an Architect for a Service Provider present in 9 markets. Works includes technologies related to Distributed App environments, Operating Systems, OS Virtualization, SDN & VNF.

Leave a Reply

Your email address will not be published. Required fields are marked *