Question with the risk of sounding very stupid: I get that you don't need to install anything on the controlling machine, but what about the controlled machine? I suppose you need to install some kind of software there? There needs to be some kind of access control, no? I didn't see anything on the website though.
Which utterly obvious piece of the equation thing am I missing?
Seems I'm the idiot then, missed the "gateway" bit... so this basically sits between something providing VNC/RDP and makes it accessible with just a web server?
Usually, you need an RDP client and a remote RDP server. In Guacamole, the "RDP client" part is handled by the Guacamole server. The HTML 5 frontend that users see is not a fully fledged RDP client, but merely a display and input device for the Guacamole server, which is the actual RDP client.
Which utterly obvious piece of the equation thing am I missing?