Zum Inhalt springen

Xrdp/Problembehebung: Unterschied zwischen den Versionen

Aus Foxwiki
Versionsgeschichte interaktiv durchsuchen
VisuellWikitext
Die Seite wurde neu angelegt: „= Unable to make xRDP connection using TLS certificate #2297 = === greped commented Jun 29, 2022 === I'm a novice to much of this, so I decided to use this github guide suggested to me by a nice person on this subreddit: https://github.com/neutrinolabs/xrdp/wiki/TLS-security-layer I followed the github instructions as described, but I'm now no longer able to xRDP in with or without an SSH tunnel. To provide some perspective, I'm using an Ubuntu 20.04.4…“
 
 
(23 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt)
Zeile 1: Zeile 1:
= Unable to make xRDP connection using TLS certificate #2297 =
'''Xrdp/Problembehebung'''
=== greped commented Jun 29, 2022 ===
I'm a novice to much of this, so I decided to use this github guide suggested to me by a nice person on this subreddit: https://github.com/neutrinolabs/xrdp/wiki/TLS-security-layer


I followed the github instructions as described, but I'm now no longer able to xRDP in with or without an SSH tunnel.
== Beschreibung ==


To provide some perspective, I'm using an Ubuntu 20.04.4 client to access a Debian 11 remote server. Both machines are updated and placed on the same VLAN.
==== XRDP-Daemon startet nach Systemneustart nicht ====
; xrdp.service log
[ERROR] trans_listen_address failed
[ERROR] xrdp_listen_main_loop: xrdp_listen_get_port failed


Here were the exact steps I took in my Debian server as root:# Security changes made to xrdp.ini and xRDP was restarted
Dieser Fehler kann beim Systemstart auftreten, da XRDP versucht, sich an eine Netzwerkschnittstelle zu binden, die noch keine IP-Adresse erhalten hat


tls_cipher=high
; Lösung
security_layer=tls
Hilfsdienst erstellen
* Auf Initialisierung der Schnittstelle warteen


The system was restarted, there were no issues yet# Generate a private key and self-signed certificate
Skript


$ openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 3650# Move key.pem (private key) and cert.pem (self-signed certificate) to /etc/xrdp/
''/usr/local/sbin/wait-enp8s0.sh''
# The path to the key.pem and cert.pem was specified in xrdp.ini (global)
<syntaxhighlight lang="bash" highlight="" copy line>
#!/bin/sh
IFACE="enp8s0"
ADDR="10.20.0.1"
TIMEOUT=60


certificate=/etc/xrdp/cert.pem
i=0
while [ "$i" -lt "$TIMEOUT" ]; do
    if ip -4 addr show dev "$IFACE" | grep -q " $ADDR/"; then
        exit 0
    fi
    i=$((i+1))
    sleep 1
done


key_file=/etc/xrdp/key.pem# Users were added to ssl-cert group
exit 1
# xRDP service was restarted, server was restarted
</syntaxhighlight>
# Was not able to log into xRDP, but SSH worked just fine


For reference, here is my xrdp.ini file: https://pastebin.com/Su2igSwn
* Als nächstes muss die Datei ausführbar gemacht werden:
<syntaxhighlight lang="bash" highlight="1" copy line>
sudo chmod +x /usr/local/sbin/wait-enp8s0.sh
</syntaxhighlight>


Here were the outputs I received when I switched security_layer from rdp to tls: https://imgur.com/a/cgRqL7D
* Erstellen einer Dienst-Unit ''/etc/systemd/system/wait-enp8s0.service'':
<syntaxhighlight lang="ini" highlight="" copy line>
[Unit]
Description=Wait for 10.20.0.1 on enp8s0
After=network.target
Wants=network.target


I was able to temporarily fix the issue by going into xrdp.ini (global) and changing security_layer from tls to rdp. When I did that, xRDP worked again.
[Service]
Type=oneshot
ExecStart=/usr/local/sbin/wait-enp8s0.sh
RemainAfterExit=yes
</syntaxhighlight>


Any suggestions?
<syntaxhighlight lang="bash" highlight="1" copy line>
sudo systemctl daemon-reload
</syntaxhighlight>


The text was updated successfully, but these errors were encountered:
* Schaffung einer Abhängigkeit des Hauptdienstes vom Hilfsdienst:
<syntaxhighlight lang="bash" highlight="1" copy line>
sudo systemctl edit xrdp
</syntaxhighlight>


=== matt335672 commented Jun 29, 2022 ===
* Inhalt der Datei:
File permissions?
<syntaxhighlight lang="ini" highlight="" copy line>
[Unit]
After=wait-enp8s0.service
Requires=wait-enp8s0.service
</syntaxhighlight>


On Debian (unless you're building from source), xrdp runs as the <tt>xrdp</tt> user.
* Neustart des Dienstes
<syntaxhighlight lang="bash" highlight="1" copy line>
sudo systemctl daemon-reload
</syntaxhighlight>


You only need to worry about the ssl-cert group if you're using the standard Debian 'snakeoil' certificates. If you're setting up your own certificates you don't need to do this.
== Installation ==
<syntaxhighlight lang="bash" highlight="1" line copy>
</syntaxhighlight>


What do you get for <tt>ls -l /etc/xrdp/key.pem /etc/xrdp/cert.pem</tt>?
== Aufruf ==
<syntaxhighlight lang="bash" highlight="1" line copy>
</syntaxhighlight>


Certificate should be owned by <tt>root:root</tt>, permissions 644. Key should be owned by <tt>root:xrdp</tt> and should have permissions 640.
=== Optionen ===
{| class="wikitable sortable options gnu big"
|-
! Unix !! GNU !! Parameter !! Beschreibung
|-
| || || ||
|-
|}


=== greped commented Jun 30, 2022 ===
=== Parameter ===
@matt335672 Thank you, when I run the command I see the below permissions:-rw-r--r-- 1 root root 1558 Jun 26 22:57 /etc/xrdp/cert.pem-rw------- 1 root root 1704 Jun 26 22:55 /etc/xrdp/key.pem
=== Umgebungsvariablen ===
=== Exit-Status ===
{| class="wikitable options col1center big"
|-
! Wert !! Beschreibung
|-
| 0 || Erfolg
|-
| >0  || Fehler
|}


It sounds to me like I should try "<tt>$ chmod 644 /etc/xrdp/cert.pem</tt>" and "<tt>$ chmod 640 /etc/xrdp/key.pem</tt>", correct?
== Anwendung ==
<syntaxhighlight lang="bash" highlight="1" line copy>
</syntaxhighlight>


=== metalefty commented Jul 1, 2022 ===
<!-- output -->
In addition to that,
<syntaxhighlight lang="bash" highlight="" line>
chown :xrdp /etc/xrdp/key.pem
</syntaxhighlight>


=== Problembehebung ===


=== matt335672 commented Jul 1, 2022 ===
== Konfiguration ==
The cert is fine. It's world-readable, as it should be as it contains no secrets.
=== Dateien ===
{| class="wikitable options big"
|-
! Datei !! Beschreibung
|-
| ||
|-
| ||
|}


The key does contain a secret and so it needs to be readable by xrdp. If you do the <tt>chmod 640 ...</tt> and the <tt>chown :xrdp</tt> as @metalefty suggests, you should end up with:-
<noinclude>
-rw-r----- 1 root xrdp 1704 Jun 26 22:55 /etc/xrdp/key.pem


Does that make sense?
== Anhang ==
=== Siehe auch ===
<div style="column-count:2">
<categorytree hideroot=on mode="pages">{{BASEPAGENAME}}</categorytree>
</div>
----
{{Special:PrefixIndex/{{BASEPAGENAME}}/}}


=== matt335672 commented Aug 11, 2022 ===
=== Dokumentation ===
No further input - closing.
<!--
; Man-Page
# [https://manpages.debian.org/stable/procps/pgrep.1.de.html prep(1)]


=== AvabAlexander commented Aug 31, 2022 ===
; Info-Pages
For those googling and finding this. I had the exact same error and it worked for me after I executed these suggested commands:
-->


<tt>chmod 644 /etc/xrdp/cert.pemchmod 640 /etc/xrdp/key.pemchown :xrdp /etc/xrdp/key.pem</tt>
=== Links ===
==== Projekt ====
==== Weblinks ====


=== eliassal commented Nov 12, 2023 ===
<!--
Fantatstic, this helped me acces my kalilinux 2023 purple with xrdp. I followed instructions /1https://www.kali.org/docs/general-use/xfce-with-rdpbut it stops at starting the service and when I tried to RDP to the kali box my login was rejected. After issuing the 3 commands, I was able to RDP like a charm, so many thanks. Thanks @matt335672 again for your help
{{DEFAULTSORT:new}}
{{DISPLAYTITLE:new}}
-->


=== metalefty commented Nov 12, 2023 ===
[[Kategorie:new]]
I believe it's documented in <tt>/usr/share/doc/xrdp/README.Debian</tt> . I recommend you guys see distro-specific README when using the distro package.
https://salsa.debian.org/debian-remote-team/xrdp/-/blob/debian/0.9.21.1-1/debian/README.Debian?ref_type=tags


=== eliassal commented Nov 12, 2023 ===
</noinclude>
@metalefty Thanks, but in the link you provided it indicates onlyConsider using TLS encryption instead of the default RDP encryption.........but it does not say how (I am not a security expert), can you please tell me how this can be done?Thanks again


=== metalefty commented Nov 13, 2023 ===
=== Weblinks ===
It is definitely there!
# https://github.com/neutrinolabs/xrdp/issues/2297
# https://pastebin.com/Su2igSwn


Don't forget that xrdp might have to be a member of the ssl-cert group to read your private key.
[[Kategorie:xrdp]]
 
=== eliassal commented Nov 14, 2023 ===
@metalefty xrdp is not a user it is a group, what I understand that we cant add a group to a group. So my comment is "How to make xrdp member of ssl-cert? Thanks
 
=== metalefty commented Nov 14, 2023 ===
I'm not familiar with Kali Linux however xrdp is a user and also a group at least on Debian/Ubuntu. So we CAN add xrdp user to ssl-cert group.
 
ubuntu@jammy:~$ id xrdp
uid=114(xrdp) gid=123(xrdp) groups=123(xrdp)
root@jammy:/etc/ssl/private# ls -l
total 4
-rw-r----- 1 root ssl-cert 1704 Nov 14 08:12 ssl-cert-snakeoil.key
 
The following command adds xrdp user to ssl-cert group.
 
root@jammy:/etc/ssl/private# usermod -G ssl-cert xrdp
root@jammy:/etc/ssl/private# id xrdp
uid=114(xrdp) gid=123(xrdp) groups=123(xrdp),122(ssl-cert)
 
There is also a guide added by Debian maintainers in <tt>xrdp.ini</tt>. I think the documents added by Debian team are very good. All Debian-specific SSL stuff is already explained in their documentation. So I recommend everyone to read Debian documentation first when using xrdp on Debian-based distro.https://salsa.debian.org/debian-remote-team/xrdp/-/blob/debian/0.9.21.1-1/debian/patches/document-certs.diff
 
<tt>adduser xrdp ssl-cert</tt> will make the same result with <tt>usermod -G ssl-cert xrdp</tt>.
 
root@jammy:/etc/ssl/private# id xrdp
uid=114(xrdp) gid=123(xrdp) groups=123(xrdp)
root@jammy:/etc/ssl/private# adduser xrdp ssl-cert
Adding user `xrdp' to group `ssl-cert' ...
Adding user xrdp to group ssl-cert
Done.
root@jammy:/etc/ssl/private# id xrdp
uid=114(xrdp) gid=123(xrdp) groups=123(xrdp),122(ssl-cert)
 
=== eliassal commented Nov 14, 2023 ===
So many thanks @metalefty , OK, I did and will read the doc, but tell me I need also to execute the 3 mentioned commands as wellchmod 644 /etc/xrdp/cert.pemchmod 640 /etc/xrdp/key.pemchown :xrdp /etc/xrdp/key.pem
 
=== metalefty commented Nov 14, 2023 ===
Then it might be a Debian documentation issue. Report it to Debian team. We're not responsible on that.
 
Anyway, Debian does distro-specific customization on SSL certiticates. Following Debian documentation is the most standard way that package maintainer expects. If their guide will not working, report it them.
 
=== pharaonic-faery commented Dec 3, 2023 ===
@eliassal
 
OK, I did and will read the doc, but tell me I need also to execute the 3 mentioned commands as wellchmod 644 /etc/xrdp/cert.pemchmod 640 /etc/xrdp/key.pemchown :xrdp /etc/xrdp/key.pem
 
I don’t know about Kali Linux, but on Debian, it's not necessary. The SSL private key is owned by the "ssl-cert" group. The "xrdp" user is the user that runs the "xrdp" binary, and has to have access to the key if you want a TLS connexion. So either you add the "xrdp" user to the "ssl-cert" group ( <tt>sudo adduser xrdp ssl-cert</tt> ), or you change the group owning the key to the "xrdp" group ( <tt>chown :xrdp /etc/xrdp/key.pem</tt> ), which the "xrdp" user is part of.
 
The 2 other commands ( <tt>chmod 644 /etc/xrdp/cert.pem</tt> and <tt>chmod 640 /etc/xrdp/key.pem</tt> ) seem unnecessary, since the 2 files already have 644 (cert) and 640 (key) permissions (on Debian at least). If you want to make sure, you can run <tt>sudo stat -L -c %a /etc/xrdp/key.pem</tt> and <tt>sudo stat -L -c %a /etc/xrdp/cert.pem</tt> commands.
 
=== eliassal commented Mar 18, 2024 ===
Hi @metalefty , its me again. I downloaded the kali linux 2024, followed all steps but still I get "Connection Refused". I thought it was a firewall issue. I did
 
ufw allow 3389/tcp but it seems that no firewall is installed
 
Always getting "Could not open connection to the host, on port 3389"I tried to telnet to 3389 port from win machine I getConnecting To 192.168.10.240...Could not open connection to the host, on port 3389: Connect failed
 
When I run Port scanner, 3389 is not listening in spite of the fact that xrdp is up and running on the kali linux machine. Doing
 
netstat -tnlp | grep 3389
 
returns nothing, how can this be possible? Thanks for your help
 
=== eliassal commented Mar 18, 2024 ===
After digging in the xrdp.ini file, I sawport=vsock://-1:3389I changed it toport=tcp://:3389and hop it worked fine and was able to connect using RDP

Aktuelle Version vom 2. Januar 2026, 14:03 Uhr

Xrdp/Problembehebung

Beschreibung

XRDP-Daemon startet nach Systemneustart nicht

xrdp.service log
[ERROR] trans_listen_address failed
[ERROR] xrdp_listen_main_loop: xrdp_listen_get_port failed

Dieser Fehler kann beim Systemstart auftreten, da XRDP versucht, sich an eine Netzwerkschnittstelle zu binden, die noch keine IP-Adresse erhalten hat

Lösung

Hilfsdienst erstellen

  • Auf Initialisierung der Schnittstelle warteen

Skript

/usr/local/sbin/wait-enp8s0.sh 

#!/bin/sh
IFACE="enp8s0"
ADDR="10.20.0.1"
TIMEOUT=60

i=0
while [ "$i" -lt "$TIMEOUT" ]; do
    if ip -4 addr show dev "$IFACE" | grep -q " $ADDR/"; then
        exit 0
    fi
    i=$((i+1))
    sleep 1
done

exit 1
  • Als nächstes muss die Datei ausführbar gemacht werden:
sudo chmod +x /usr/local/sbin/wait-enp8s0.sh
  • Erstellen einer Dienst-Unit /etc/systemd/system/wait-enp8s0.service:
[Unit]
Description=Wait for 10.20.0.1 on enp8s0
After=network.target
Wants=network.target

[Service]
Type=oneshot
ExecStart=/usr/local/sbin/wait-enp8s0.sh
RemainAfterExit=yes

sudo systemctl daemon-reload
  • Schaffung einer Abhängigkeit des Hauptdienstes vom Hilfsdienst:
sudo systemctl edit xrdp
  • Inhalt der Datei:
[Unit]
After=wait-enp8s0.service
Requires=wait-enp8s0.service
  • Neustart des Dienstes
sudo systemctl daemon-reload

Installation

Aufruf

Optionen

Unix GNU Parameter Beschreibung

Parameter

Umgebungsvariablen

Exit-Status

Wert Beschreibung
0 Erfolg
>0 Fehler

Anwendung

Problembehebung

Konfiguration

Dateien

Datei Beschreibung


Anhang

Siehe auch


Dokumentation

Links

Projekt

Weblinks


Weblinks

  1. https://github.com/neutrinolabs/xrdp/issues/2297
  2. https://pastebin.com/Su2igSwn
Abgerufen von „https://wiki.foxtom.de/index.php?title=Xrdp/Problembehebung&oldid=159610“