speidy
commented
6 years ago The relevant log is xrdp.log or just try running xrdp at the foreground ‘xrdp -ns’ and examine the output.
Also try to set the ‘tls_ciphers’ config to something else or just comment it out. בתאריך יום ו׳, 20 ביולי 2018 ב-16:18 מאת Hyper200 <notifications@github.com
:
Hi all,
Trying to configure TLS on xrdp but having issues.
`[Globals] ; xrdp.ini file version number ini_version=1
; fork a new process for each incoming connection fork=true ; tcp port to listen port=3389
address=127.0.0.1
; 'port' above should be connected to with vsock instead of tcp use_vsock=false ; regulate if the listening socket use socket option tcp_nodelay ; no buffering will be performed in the TCP stack tcp_nodelay=true ; regulate if the listening socket use socket option keepalive ; if the network connection disappear without close messages the connection will be closed tcp_keepalive=true
tcp_send_buffer_bytes=32768
tcp_recv_buffer_bytes=32768
; security layer can be 'tls', 'rdp' or 'negotiate' ; for client compatible layer security_layer=tls ; minimum security level allowed for client ; can be 'none', 'low', 'medium', 'high', 'fips'
crypt_level=medium
; X.509 certificate and private key ; openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365 certificate=/etc/xrdp/cert-mottmac.pem key_file=/etc/xrdp/key-mottmac.pem ; set SSL protocols ; can be comma separated list of 'SSLv3', 'TLSv1', 'TLSv1.1', 'TLSv1.2' ssl_protocols=TLSv1,TLSv1.1,TLSv1.2 ; set TLS cipher suites tls_ciphers=HIGH
; Section name to use for automatic login if the client sends username ; and password. If empty, the domain name sent by the client is used. ; If empty and no domain name is given, the first suitable section in ; this file will be used. autorun=
allow_channels=true allow_multimon=true bitmap_cache=true bitmap_compression=true bulk_compression=true
hidelogwindow=true
max_bpp=32 new_cursors=true ; fastpath - can be 'input', 'output', 'both', 'none' use_fastpath=both ; when true, userid/password must be passed on cmd line
require_credentials=true
; You can set the PAM error text in a gateway setup (MAX 256 chars)
pamerrortxt=change your password according to policy at http://url
; ; colors used by windows in RGB format ; blue=009cb5 grey=dedede
black=000000
dark_grey=808080
blue=08246b
dark_blue=08246b
white=ffffff
red=ff0000
green=00ff00
background=626c72
; ; configure login screen ;
; Login Screen Window Title
ls_title=My Login Title
; top level window background color in RGB format ls_top_window_bg_color=009cb5
; width and height of login screen ls_width=350 ls_height=430
; login screen background color in RGB format ls_bg_color=dedede
; optional background image filename (bmp format).
ls_background_image=
; logo ; full path to bmp-file or file in shared folder ls_logo_filename= ls_logo_x_pos=55 ls_logo_y_pos=50
; for positioning labels such as username, password etc ls_label_x_pos=30 ls_label_width=60
; for positioning text and combo boxes next to above labels ls_input_x_pos=110 ls_input_width=210
; y pos for first label and combo box ls_input_y_pos=220
; OK button ls_btn_ok_x_pos=142 ls_btn_ok_y_pos=370 ls_btn_ok_width=85 ls_btn_ok_height=30
; Cancel button ls_btn_cancel_x_pos=237 ls_btn_cancel_y_pos=370 ls_btn_cancel_width=85 ls_btn_cancel_height=30
[Logging] LogFile=xrdp.log LogLevel=DEBUG EnableSyslog=true SyslogLevel=DEBUG ; LogLevel and SysLogLevel could by any of: core, error, warning, info or debug
[Channels] ; Channel names not listed here will be blocked by XRDP. ; You can block any channel by setting its value to false. ; IMPORTANT! All channels are not supported in all use ; cases even if you set all values to true. ; You can override these settings on each session type ; These settings are only used if allow_channels=true rdpdr=true rdpsnd=true drdynvc=true cliprdr=true rail=true xrdpvr=true tcutils=true
; for debugging xrdp, in section xrdp1, change port=-1 to this:
port=/tmp/.xrdp/xrdp_display_10
; for debugging xrdp, add following line to section xrdp1
chansrvport=/tmp/.xrdp/xrdp_chansrv_socket_7210
; ; Session types ;
; Some session types such as Xorg, X11rdp and Xvnc start a display server. ; Startup command-line parameters for the display server are configured ; in sesman.ini. See and configure also sesman.ini. [Xorg] name=Xorg lib=libxup.so username=ask password=ask ip=127.0.0.1 port=-1 code=20
[X11rdp] name=X11rdp lib=libxup.so username=ask password=ask ip=127.0.0.1 port=-1 xserverbpp=24 code=10
[Xvnc] name=Xvnc lib=libvnc.so username=ask password=ask ip=127.0.0.1 port=-1
xserverbpp=24
delay_ms=2000
[console] name=console lib=libvnc.so ip=127.0.0.1 port=5900 username=na password=ask
delay_ms=2000
[vnc-any] name=vnc-any lib=libvnc.so ip=ask port=ask5900 username=na password=ask
pamusername=asksame
pampassword=asksame
pamsessionmng=127.0.0.1
delay_ms=2000
[sesman-any] name=sesman-any lib=libvnc.so ip=ask port=-1 username=ask password=ask
delay_ms=2000
[neutrinordp-any] name=neutrinordp-any lib=libxrdpneutrinordp.so ip=ask port=ask3389 username=ask password=ask
; You can override the common channel settings for each session type
channel.rdpdr=true
channel.rdpsnd=true
channel.drdynvc=true
channel.cliprdr=true
channel.rail=true
channel.xrdpvr=true`
If i have security_layer=rdp the connection works and i can login.
If set to TLS my windows client gets the following error: [image: capture] https://user-images.githubusercontent.com/37409036/43004183-e6dae94e-8c26-11e8-91a9-8033983bc13b.PNG
Trying to debug the issue but the log is not that helpful:
`==> xrdp-sesman.log <== [20180720-14:09:16] [DEBUG] Closed socket 5 (AF_INET6 ::1 port 3350) [20180720-14:09:16] [INFO ] starting xrdp-sesman with pid 1579 [20180720-14:09:16] [INFO ] listening to port 3350 on 127.0.0.1 [20180720-14:15:21] [INFO ] shutting down sesman 1 [20180720-14:15:21] [DEBUG] Closed socket 7 (AF_INET6 ::1 port 3350) [20180720-14:15:23] [DEBUG] libscp initialized [20180720-14:15:23] [DEBUG] Testing if xrdp-sesman can listen on 127.0.0.1 port 3350. [20180720-14:15:23] [DEBUG] Closed socket 5 (AF_INET6 ::1 port 3350) [20180720-14:15:23] [INFO ] starting xrdp-sesman with pid 1693 [20180720-14:15:23] [INFO ] listening to port 3350 on 127.0.0.1
==> xrdp.log <== [20180720-14:16:34] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:127.0.0.1 port 49928 [20180720-14:16:34] [DEBUG] Closed socket 12 (AF_INET6 ::ffff:127.0.0.1 port 3389) [20180720-14:16:34] [DEBUG] Closed socket 11 (AF_INET6 :: port 3389) [20180720-14:16:34] [DEBUG] TLSv1.2 enabled [20180720-14:16:34] [DEBUG] TLSv1.1 enabled [20180720-14:16:34] [DEBUG] TLSv1 enabled [20180720-14:16:34] [DEBUG] Security layer: requested 11, selected 1 [20180720-14:16:34] [DEBUG] Closed socket 12 (AF_INET6 ::ffff:127.0.0.1 port 3389)`
I can't seem to figure it out - Does anyone have any suggestions or does this look like a bug?
Its running on Kali linux, xrdp version is
'ii xorgxrdp 1:0.2.6-1 amd64 Remote Desktop Protocol (RDP) modules for X.org ii xrdp 0.9.6-1 amd64 Remote Desktop Protocol (RDP) server'
Thanks for any help.
Joe.
— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/neutrinolabs/xrdp/issues/1172, or mute the thread https://github.com/notifications/unsubscribe-auth/ADTH1H3MN-MxK9xcpi5JzYtRa4Wx7-nDks5uIdiVgaJpZM4VYBTR .
-- Idan Freiberg
GPG FP: 8108 7EC9 806E 4980 75F2 72B3 8AD3 2D04 337B 1F18
Hyper200
metalefty
ivanbaldo
merrx
Kofa1
guruevi
Hi all,
Trying to configure TLS on xrdp but having issues.
If i have security_layer=rdp the connection works and i can login.
If set to TLS my windows client gets the following error:
Trying to debug the issue but the log is not that helpful:
I can't seem to figure it out - Does anyone have any suggestions or does this look like a bug?
The RDP connection is being sent via a SSH tunnel hence the 127.0.0.1 addresses.
Its running on Kali linux, xrdp version is
Thanks for any help.
Joe.