Zum Inhalt springen

Xrdp/Problembehebung: Unterschied zwischen den Versionen

Aus Foxwiki
Versionsgeschichte interaktiv durchsuchen
← Zum vorherigen Versionsunterschied
VisuellWikitext
Keine Bearbeitungszusammenfassung
 
(22 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt)
Zeile 1: Zeile 1:
== Unable to make xRDP connection using TLS certificate ==
'''Xrdp/Problembehebung'''
=== greped commented Jun 29, 2022 ===
I'm a novice to much of this, so I decided to use this github guide suggested to me by a nice person on this subreddit: https://github.com/neutrinolabs/xrdp/wiki/TLS-security-layer


I followed the github instructions as described, but I'm now no longer able to xRDP in with or without an SSH tunnel.
== Beschreibung ==


To provide some perspective, I'm using an Ubuntu 20.04.4 client to access a Debian 11 remote server. Both machines are updated and placed on the same VLAN.
==== XRDP-Daemon startet nach Systemneustart nicht ====
; xrdp.service log
[ERROR] trans_listen_address failed
[ERROR] xrdp_listen_main_loop: xrdp_listen_get_port failed


Here were the exact steps I took in my Debian server as root:# Security changes made to xrdp.ini and xRDP was restarted
Dieser Fehler kann beim Systemstart auftreten, da XRDP versucht, sich an eine Netzwerkschnittstelle zu binden, die noch keine IP-Adresse erhalten hat
tls_cipher=high
security_layer=tls


The system was restarted, there were no issues yet# Generate a private key and self-signed certificate
; Lösung
Hilfsdienst erstellen
* Auf Initialisierung der Schnittstelle warteen


$ openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 3650# Move key.pem (private key) and cert.pem (self-signed certificate) to /etc/xrdp/
Skript
# The path to the key.pem and cert.pem was specified in xrdp.ini (global)


certificate=/etc/xrdp/cert.pem
''/usr/local/sbin/wait-enp8s0.sh''
<syntaxhighlight lang="bash" highlight="" copy line>
#!/bin/sh
IFACE="enp8s0"
ADDR="10.20.0.1"
TIMEOUT=60


key_file=/etc/xrdp/key.pem# Users were added to ssl-cert group
i=0
# xRDP service was restarted, server was restarted
while [ "$i" -lt "$TIMEOUT" ]; do
# Was not able to log into xRDP, but SSH worked just fine
    if ip -4 addr show dev "$IFACE" | grep -q " $ADDR/"; then
        exit 0
    fi
    i=$((i+1))
    sleep 1
done


For reference, here is my xrdp.ini file: https://pastebin.com/Su2igSwn
exit 1
</syntaxhighlight>


Here were the outputs I received when I switched security_layer from rdp to tls: https://imgur.com/a/cgRqL7D
* Als nächstes muss die Datei ausführbar gemacht werden:
<syntaxhighlight lang="bash" highlight="1" copy line>
sudo chmod +x /usr/local/sbin/wait-enp8s0.sh
</syntaxhighlight>


I was able to temporarily fix the issue by going into xrdp.ini (global) and changing security_layer from tls to rdp. When I did that, xRDP worked again.
* Erstellen einer Dienst-Unit ''/etc/systemd/system/wait-enp8s0.service'':
<syntaxhighlight lang="ini" highlight="" copy line>
[Unit]
Description=Wait for 10.20.0.1 on enp8s0
After=network.target
Wants=network.target


Any suggestions?
[Service]
Type=oneshot
ExecStart=/usr/local/sbin/wait-enp8s0.sh
RemainAfterExit=yes
</syntaxhighlight>


The text was updated successfully, but these errors were encountered:
<syntaxhighlight lang="bash" highlight="1" copy line>
sudo systemctl daemon-reload
</syntaxhighlight>


=== matt335672 commented Jun 29, 2022 ===
* Schaffung einer Abhängigkeit des Hauptdienstes vom Hilfsdienst:
File permissions?
<syntaxhighlight lang="bash" highlight="1" copy line>
sudo systemctl edit xrdp
</syntaxhighlight>


On Debian (unless you're building from source), xrdp runs as the <tt>xrdp</tt> user.
* Inhalt der Datei:
<syntaxhighlight lang="ini" highlight="" copy line>
[Unit]
After=wait-enp8s0.service
Requires=wait-enp8s0.service
</syntaxhighlight>


You only need to worry about the ssl-cert group if you're using the standard Debian 'snakeoil' certificates. If you're setting up your own certificates you don't need to do this.
* Neustart des Dienstes
<syntaxhighlight lang="bash" highlight="1" copy line>
sudo systemctl daemon-reload
</syntaxhighlight>


What do you get for <tt>ls -l /etc/xrdp/key.pem /etc/xrdp/cert.pem</tt>?
== Installation ==
<syntaxhighlight lang="bash" highlight="1" line copy>
</syntaxhighlight>


Certificate should be owned by <tt>root:root</tt>, permissions 644. Key should be owned by <tt>root:xrdp</tt> and should have permissions 640.
== Aufruf ==
<syntaxhighlight lang="bash" highlight="1" line copy>
</syntaxhighlight>


=== greped commented Jun 30, 2022 ===
=== Optionen ===
@matt335672 Thank you, when I run the command I see the below permissions:-rw-r--r-- 1 root root 1558 Jun 26 22:57 /etc/xrdp/cert.pem-rw------- 1 root root 1704 Jun 26 22:55 /etc/xrdp/key.pem
{| class="wikitable sortable options gnu big"
|-
! Unix !! GNU !! Parameter !! Beschreibung
|-
| || || ||
|-
|}


It sounds to me like I should try "<tt>$ chmod 644 /etc/xrdp/cert.pem</tt>" and "<tt>$ chmod 640 /etc/xrdp/key.pem</tt>", correct?
=== Parameter ===
=== Umgebungsvariablen ===
=== Exit-Status ===
{| class="wikitable options col1center big"
|-
! Wert !! Beschreibung
|-
| 0 || Erfolg
|-
| >0  || Fehler
|}


=== metalefty commented Jul 1, 2022 ===
== Anwendung ==
In addition to that,
<syntaxhighlight lang="bash" highlight="1" line copy>
chown :xrdp /etc/xrdp/key.pem
</syntaxhighlight>


<!-- output -->
<syntaxhighlight lang="bash" highlight="" line>
</syntaxhighlight>


=== matt335672 commented Jul 1, 2022 ===
=== Problembehebung ===
The cert is fine. It's world-readable, as it should be as it contains no secrets.


The key does contain a secret and so it needs to be readable by xrdp. If you do the <tt>chmod 640 ...</tt> and the <tt>chown :xrdp</tt> as @metalefty suggests, you should end up with:-
== Konfiguration ==
-rw-r----- 1 root xrdp 1704 Jun 26 22:55 /etc/xrdp/key.pem
=== Dateien ===
{| class="wikitable options big"
|-
! Datei !! Beschreibung
|-
| ||
|-
| ||
|}


Does that make sense?
<noinclude>


=== matt335672 commented Aug 11, 2022 ===
== Anhang ==
No further input - closing.
=== Siehe auch ===
<div style="column-count:2">
<categorytree hideroot=on mode="pages">{{BASEPAGENAME}}</categorytree>
</div>
----
{{Special:PrefixIndex/{{BASEPAGENAME}}/}}


=== AvabAlexander commented Aug 31, 2022 ===
=== Dokumentation ===
For those googling and finding this. I had the exact same error and it worked for me after I executed these suggested commands:
<!--
; Man-Page
# [https://manpages.debian.org/stable/procps/pgrep.1.de.html prep(1)]


<tt>chmod 644 /etc/xrdp/cert.pemchmod 640 /etc/xrdp/key.pemchown :xrdp /etc/xrdp/key.pem</tt>
; Info-Pages
-->


=== eliassal commented Nov 12, 2023 ===
=== Links ===
Fantatstic, this helped me acces my kalilinux 2023 purple with xrdp. I followed instructions /1https://www.kali.org/docs/general-use/xfce-with-rdpbut it stops at starting the service and when I tried to RDP to the kali box my login was rejected. After issuing the 3 commands, I was able to RDP like a charm, so many thanks. Thanks @matt335672 again for your help
==== Projekt ====
==== Weblinks ====


=== metalefty commented Nov 12, 2023 ===
<!--
I believe it's documented in <tt>/usr/share/doc/xrdp/README.Debian</tt> . I recommend you guys see distro-specific README when using the distro package.
{{DEFAULTSORT:new}}
https://salsa.debian.org/debian-remote-team/xrdp/-/blob/debian/0.9.21.1-1/debian/README.Debian?ref_type=tags
{{DISPLAYTITLE:new}}
-->


=== eliassal commented Nov 12, 2023 ===
[[Kategorie:new]]
@metalefty Thanks, but in the link you provided it indicates onlyConsider using TLS encryption instead of the default RDP encryption.........but it does not say how (I am not a security expert), can you please tell me how this can be done?Thanks again


=== metalefty commented Nov 13, 2023 ===
</noinclude>
It is definitely there!


Don't forget that xrdp might have to be a member of the ssl-cert group to read your private key.
=== Weblinks ===
# https://github.com/neutrinolabs/xrdp/issues/2297
# https://pastebin.com/Su2igSwn


=== eliassal commented Nov 14, 2023 ===
[[Kategorie:xrdp]]
@metalefty xrdp is not a user it is a group, what I understand that we cant add a group to a group. So my comment is "How to make xrdp member of ssl-cert? Thanks
 
=== metalefty commented Nov 14, 2023 ===
I'm not familiar with Kali Linux however xrdp is a user and also a group at least on Debian/Ubuntu. So we CAN add xrdp user to ssl-cert group.
 
ubuntu@jammy:~$ id xrdp
uid=114(xrdp) gid=123(xrdp) groups=123(xrdp)
root@jammy:/etc/ssl/private# ls -l
total 4
-rw-r----- 1 root ssl-cert 1704 Nov 14 08:12 ssl-cert-snakeoil.key
 
The following command adds xrdp user to ssl-cert group.
 
root@jammy:/etc/ssl/private# usermod -G ssl-cert xrdp
root@jammy:/etc/ssl/private# id xrdp
uid=114(xrdp) gid=123(xrdp) groups=123(xrdp),122(ssl-cert)
 
There is also a guide added by Debian maintainers in <tt>xrdp.ini</tt>. I think the documents added by Debian team are very good. All Debian-specific SSL stuff is already explained in their documentation. So I recommend everyone to read Debian documentation first when using xrdp on Debian-based distro.https://salsa.debian.org/debian-remote-team/xrdp/-/blob/debian/0.9.21.1-1/debian/patches/document-certs.diff
 
<tt>adduser xrdp ssl-cert</tt> will make the same result with <tt>usermod -G ssl-cert xrdp</tt>.
 
root@jammy:/etc/ssl/private# id xrdp
uid=114(xrdp) gid=123(xrdp) groups=123(xrdp)
root@jammy:/etc/ssl/private# adduser xrdp ssl-cert
Adding user `xrdp' to group `ssl-cert' ...
Adding user xrdp to group ssl-cert
Done.
root@jammy:/etc/ssl/private# id xrdp
uid=114(xrdp) gid=123(xrdp) groups=123(xrdp),122(ssl-cert)
 
=== eliassal commented Nov 14, 2023 ===
So many thanks @metalefty , OK, I did and will read the doc, but tell me I need also to execute the 3 mentioned commands as wellchmod 644 /etc/xrdp/cert.pemchmod 640 /etc/xrdp/key.pemchown :xrdp /etc/xrdp/key.pem
 
=== metalefty commented Nov 14, 2023 ===
Then it might be a Debian documentation issue. Report it to Debian team. We're not responsible on that.
 
Anyway, Debian does distro-specific customization on SSL certiticates. Following Debian documentation is the most standard way that package maintainer expects. If their guide will not working, report it them.
 
=== pharaonic-faery commented Dec 3, 2023 ===
@eliassal
 
OK, I did and will read the doc, but tell me I need also to execute the 3 mentioned commands as wellchmod 644 /etc/xrdp/cert.pemchmod 640 /etc/xrdp/key.pemchown :xrdp /etc/xrdp/key.pem
 
I don’t know about Kali Linux, but on Debian, it's not necessary. The SSL private key is owned by the "ssl-cert" group. The "xrdp" user is the user that runs the "xrdp" binary, and has to have access to the key if you want a TLS connexion. So either you add the "xrdp" user to the "ssl-cert" group ( <tt>sudo adduser xrdp ssl-cert</tt> ), or you change the group owning the key to the "xrdp" group ( <tt>chown :xrdp /etc/xrdp/key.pem</tt> ), which the "xrdp" user is part of.
 
The 2 other commands ( <tt>chmod 644 /etc/xrdp/cert.pem</tt> and <tt>chmod 640 /etc/xrdp/key.pem</tt> ) seem unnecessary, since the 2 files already have 644 (cert) and 640 (key) permissions (on Debian at least). If you want to make sure, you can run <tt>sudo stat -L -c %a /etc/xrdp/key.pem</tt> and <tt>sudo stat -L -c %a /etc/xrdp/cert.pem</tt> commands.
 
=== eliassal commented Mar 18, 2024 ===
Hi @metalefty , its me again. I downloaded the kali linux 2024, followed all steps but still I get "Connection Refused". I thought it was a firewall issue. I did
 
ufw allow 3389/tcp but it seems that no firewall is installed
 
Always getting "Could not open connection to the host, on port 3389"I tried to telnet to 3389 port from win machine I getConnecting To 192.168.10.240...Could not open connection to the host, on port 3389: Connect failed
 
When I run Port scanner, 3389 is not listening in spite of the fact that xrdp is up and running on the kali linux machine. Doing
 
netstat -tnlp | grep 3389
 
returns nothing, how can this be possible? Thanks for your help
 
=== eliassal commented Mar 18, 2024 ===
After digging in the xrdp.ini file, I sawport=vsock://-1:3389I changed it toport=tcp://:3389and hop it worked fine and was able to connect using RDP

Aktuelle Version vom 2. Januar 2026, 14:03 Uhr

Xrdp/Problembehebung

Beschreibung

XRDP-Daemon startet nach Systemneustart nicht

xrdp.service log
[ERROR] trans_listen_address failed
[ERROR] xrdp_listen_main_loop: xrdp_listen_get_port failed

Dieser Fehler kann beim Systemstart auftreten, da XRDP versucht, sich an eine Netzwerkschnittstelle zu binden, die noch keine IP-Adresse erhalten hat

Lösung

Hilfsdienst erstellen

  • Auf Initialisierung der Schnittstelle warteen

Skript

/usr/local/sbin/wait-enp8s0.sh 

#!/bin/sh
IFACE="enp8s0"
ADDR="10.20.0.1"
TIMEOUT=60

i=0
while [ "$i" -lt "$TIMEOUT" ]; do
    if ip -4 addr show dev "$IFACE" | grep -q " $ADDR/"; then
        exit 0
    fi
    i=$((i+1))
    sleep 1
done

exit 1
  • Als nächstes muss die Datei ausführbar gemacht werden:
sudo chmod +x /usr/local/sbin/wait-enp8s0.sh
  • Erstellen einer Dienst-Unit /etc/systemd/system/wait-enp8s0.service:
[Unit]
Description=Wait for 10.20.0.1 on enp8s0
After=network.target
Wants=network.target

[Service]
Type=oneshot
ExecStart=/usr/local/sbin/wait-enp8s0.sh
RemainAfterExit=yes

sudo systemctl daemon-reload
  • Schaffung einer Abhängigkeit des Hauptdienstes vom Hilfsdienst:
sudo systemctl edit xrdp
  • Inhalt der Datei:
[Unit]
After=wait-enp8s0.service
Requires=wait-enp8s0.service
  • Neustart des Dienstes
sudo systemctl daemon-reload

Installation

Aufruf

Optionen

Unix GNU Parameter Beschreibung

Parameter

Umgebungsvariablen

Exit-Status

Wert Beschreibung
0 Erfolg
>0 Fehler

Anwendung

Problembehebung

Konfiguration

Dateien

Datei Beschreibung


Anhang

Siehe auch


Dokumentation

Links

Projekt

Weblinks


Weblinks

  1. https://github.com/neutrinolabs/xrdp/issues/2297
  2. https://pastebin.com/Su2igSwn
Abgerufen von „https://wiki.foxtom.de/index.php?title=Xrdp/Problembehebung&oldid=159610“