neutrinolabs / xrdp

xrdp: an open source RDP server
http://www.xrdp.org/
Apache License 2.0
5.62k stars 1.73k forks source link

Login failed for display 0 #2164

Closed BadSpider1 closed 2 years ago

BadSpider1 commented 2 years ago

when running xrdp --nodaemon i see this

[20220301-20:57:37] [DEBUG] xrdp_wm_log_msg: connecting to sesman ip 127.0.0.1 port 3350 connecting to sesman ip 127.0.0.1 port 3350 xrdp_mm_connect: connect failed trying again... [20220301-20:57:41] [DEBUG] Closed socket 18 (AF_INET6 ::ffff:127.0.0.1 port 49518) xrdp_mm_connect: connect failed trying again... [20220301-20:57:45] [DEBUG] Closed socket 18 (AF_INET6 ::ffff:127.0.0.1 port 49586)

i have no ide what more information should i pass on so let me know

matt335672 commented 2 years ago

@BadSpider1,

If you're trying to start a session, you'll need xrdp-sesman running too. The error is telling you that xrdp can't connect to xrdp-sesman.

What exactly are you trying to achieve? It might be easier to help you with more information.

BadSpider1 commented 2 years ago

Im not currently home so I can’t provide more information however sesman was running and port 3350 was open on local host it had a weird name when I ran it trough nmap tho “findviatv” or something like that

I have installed Ubuntu desktop and xrdp on my VPS and tryed to connect (succesfully) and login (causing this)

matt335672 commented 2 years ago

Use ss to make sure sesman is listening on IPv4 - that's what xrdp is trying to connect on, looking at your log file.

Also, it's not recommended to leave sesman listening on an external interface. Support for this is going away at some point as we're moving to Unix Domain Sockets for this interface.

BadSpider1 commented 2 years ago

ss

Alright i cant find it or i´m blind wich is probably more possible the output is

Netid State  Recv-Q Send-Q                                   Local Address:Port                      Peer Address:Port  Process
u_str ESTAB  0      0                                                    * 65870                                * 64782 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 68599                                * 70383 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 74675                                * 73477 
u_str ESTAB  0      0                                                    * 25585                                * 25586 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 22255                                * 23486 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 71084                                * 72780 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 27493                                * 27492 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 70657                                * 70388 
u_str ESTAB  0      0                                                    * 73375                                * 72684 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 24370                                * 24962 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 71892                                * 72767 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 26902                                * 25042 
u_str ESTAB  0      0                                                    * 24960                                * 26711 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 65408                                * 66541 
u_str ESTAB  0      0                                                    * 20918                                * 20282 
u_str ESTAB  0      0                                                    * 73479                                * 74677 
u_str ESTAB  0      0                                                    * 66532                                * 67960 
u_str ESTAB  0      0                                                    * 70388                                * 70657 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 31310                                * 30497 
u_str ESTAB  0      0                                                    * 72775                                * 72776 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 64782                                * 65870 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 66920                                * 65402 
u_str ESTAB  0      0                                                    * 73477                                * 74675 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 26266                                * 25582 
u_str ESTAB  0      0                                                    * 24962                                * 24370 
u_str ESTAB  0      0                                                    * 65402                                * 66920 
u_str ESTAB  0      0                                                    * 30521                                * 28563 
u_str ESTAB  0      0                                  /run/cups/cups.sock 75830                                * 73476 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 26238                                * 27580 
u_str ESTAB  0      0                                                    * 25042                                * 26902 
u_str ESTAB  0      0                                                    * 66541                                * 65408 
u_str ESTAB  0      0                                  /run/cups/cups.sock 74994                                * 73468 
u_str ESTAB  0      0                                                    * 28538                                * 0     
u_str ESTAB  0      0                                                    * 25582                                * 26266 
u_str ESTAB  0      0                                                    * 22976                                * 22978 
u_str ESTAB  0      0                                                    * 62296                                * 63669 
u_str ESTAB  0      0                                                    * 70383                                * 68599 
u_str ESTAB  0      0                                                    * 72767                                * 71892 
u_str ESTAB  0      0                                                    * 25331                                * 25896 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 22978                                * 22976 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 67960                                * 66532 
u_str ESTAB  0      0                                                    * 64787                                * 64330 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 72684                                * 73375 
u_str ESTAB  0      0                                                    * 27675                                * 27676 
u_str ESTAB  0      0      /var/lib/oracle-cloud-agent/tmp/plugin870431803 30321                                * 29282 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 20282                                * 20918 
u_str ESTAB  0      0                                                    * 73468                                * 74994 
u_str ESTAB  0      0                                                    * 27580                                * 26238 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 24056                                * 25125 
u_str ESTAB  0      0                                                    * 26633                                * 24368 
u_str ESTAB  0      0                                                    * 72780                                * 71084 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 25896                                * 25331 
u_str ESTAB  0      0                                                    * 23486                                * 22255 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 64330                                * 64787 
u_str ESTAB  0      0                                                    * 30497                                * 31310 
u_str ESTAB  0      0                                                    * 72776                                * 72775 
u_str ESTAB  0      0                                                    * 27492                                * 27493 
u_str ESTAB  0      0                                                    * 29282                                * 30321 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 24368                                * 26633 
u_str ESTAB  0      0                                                    * 73476                                * 75830 
u_str ESTAB  0      0                                                    * 27676                                * 27675 
u_str ESTAB  0      0                                                    * 25125                                * 24056 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 26711                                * 24960 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 63669                                * 62296 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 28563                                * 30521 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 74677                                * 73479 
u_str ESTAB  0      0                                                    * 25586                                * 25585 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 21109                                * 22409 
u_str ESTAB  0      0                                                    * 25751                                * 26710 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 20586                                * 21681 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 26710                                * 25751 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 24369                                * 25752 
u_str ESTAB  0      0                                                    * 38334                                * 37754 
u_str ESTAB  0      0                                                    * 21681                                * 20586 
u_str ESTAB  0      0                                                    * 25674                                * 24366 
u_str ESTAB  0      0                                                    * 22409                                * 21109 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 37754                                * 38334 
u_str ESTAB  0      0                                                    * 25752                                * 24369 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 24366                                * 25674 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 64894                                * 67591 
u_str ESTAB  0      0                                                    * 67591                                * 64894 
u_str ESTAB  0      0                                                    * 30867                                * 28324 
u_str ESTAB  0      0                                                    * 24136                                * 24137 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 25598                                * 28751 
u_str ESTAB  0      0                                                    * 74475                                * 72674 
u_str ESTAB  0      0                                                    * 23950                                * 24367 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 74136                                * 72504 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 24371                                * 24316 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 86629                                * 87463 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 28324                                * 30867 
u_str ESTAB  0      0                                                    * 67156                                * 68672 
u_str ESTAB  0      0                                                    * 24326                                * 24372 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 68672                                * 67156 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 28321                                * 29235 
u_str ESTAB  0      0                                                    * 66651                                * 67594 
u_str ESTAB  0      0                                                    * 24316                                * 24371 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 24963                                * 24048 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 68671                                * 67154 
u_str ESTAB  0      0                                                    * 74672                                * 74673 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 1817                                 * 19418 
u_str ESTAB  0      0                                                    * 72509                                * 74137 
u_str ESTAB  0      0                                                    * 24365                                * 24364 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 85823                                * 87466 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 72674                                * 74475 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 74137                                * 72509 
u_str ESTAB  0      0                                                    * 24364                                * 24365 
u_str ESTAB  0      0                                                    * 87466                                * 85823 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 24367                                * 23950 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 67594                                * 66651 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 24137                                * 24136 
u_str ESTAB  0      0                                                    * 24048                                * 24963 
u_str ESTAB  0      0                                                    * 67154                                * 68671 
u_str ESTAB  0      0                                                    * 87463                                * 86629 
u_str ESTAB  0      0                                                    * 28751                                * 25598 
u_str ESTAB  0      0                                                    * 19418                                * 1817  
u_str ESTAB  0      0                                                    * 29235                                * 28321 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 74673                                * 74672 
u_str ESTAB  0      0                                                    * 72504                                * 74136 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 24372                                * 24326 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 39368                                * 36845 
u_str ESTAB  0      0                          /run/systemd/journal/stdout 39446                                * 41102 
u_str ESTAB  0      0                                                    * 41355                                * 39613 
u_str ESTAB  0      0                                                    * 36845                                * 39368 
u_str ESTAB  0      0                                                    * 30585                                * 30586 
u_str ESTAB  0      0                                                    * 30586                                * 30585 
u_str ESTAB  0      0                          /run/dbus/system_bus_socket 39613                                * 41355 
u_str ESTAB  0      0                                                    * 41102                                * 39446 
icmp6 UNCONN 0      0                                             *%enp0s3:ipv6-icmp                            *:*     
tcp   ESTAB  0      0                                            10.0.0.76:ssh                     xxx.xxx.xxx.xx:1225  
tcp   ESTAB  0      0                                   [::ffff:10.0.0.76]:ms-wbt-server  [::ffff:xxx.xxx.xxx.xx]:1329 

also now when running nmap on the VPS i get this

Nmap scan report for localhost (127.0.0.1) Host is up (0.00064s latency).

PORT STATE SERVICE VERSION 3350/tcp closed findviatv

BadSpider1 commented 2 years ago

obrazek

matt335672 commented 2 years ago

closed in nmap means the firewall is not blocking the connection, and there's nothing on it.

On my dev machine (xrdp is built with IPv6 support) I can see xrdp-sesman running:-

$ ps -ef | grep sesman
root        1545       1  0 10:06 ?        00:00:00 /usr/local/sbin/xrdp-sesman
xxx         1588    1158  0 10:07 pts/0    00:00:00 grep --color=auto sesman
$ sudo ss -alnp 'sport = :3350'
Netid  State   Recv-Q  Send-Q   Local Address:Port   Peer Address:Port Process  
tcp    LISTEN  0       2                [::1]:3350           [::]:*     users:(("xrdp-sesman",pid=1545,fd=11))

Is sesman running on your machine?

BadSpider1 commented 2 years ago

it appears to be running

root 28582 1 0 15:05 ? 00:00:00 /usr/sbin/xrdp-sesman root 28943 2811 0 15:07 pts/0 00:00:00 grep --color=auto sesman

Yet the nmap still says closed

nmap -sC -sV localhost -p 3350 Starting Nmap 7.80 ( https://nmap.org ) at 2022-03-03 15:09 UTC Nmap scan report for localhost (127.0.0.1) Host is up (0.00035s latency).

PORT STATE SERVICE VERSION 3350/tcp closed findviatv

BadSpider1 commented 2 years ago

Alright found out that when sesman is bound to 0.0.0.0 it is open however the same error remain attaching the current config

`;; See `man 5 sesman.ini` for details

[Globals]
ListenAddress=0.0.0.0
ListenPort=3350
EnableUserWindowManager=true
; Give in relative path to user's home directory
UserWindowManager=startwm.sh
; Give in full path or relative path to /etc/xrdp
DefaultWindowManager=startwm.sh
; Give in full path or relative path to /etc/xrdp
ReconnectScript=reconnectwm.sh

[Security]
AllowRootLogin=true
MaxLoginRetry=4
TerminalServerUsers=tsusers
TerminalServerAdmins=tsadmins
; When AlwaysGroupCheck=false access will be permitted
; if the group TerminalServerUsers is not defined.
AlwaysGroupCheck=false
; When RestrictOutboundClipboard=true clipboard from the
; server is not pushed to the client.
RestrictOutboundClipboard=false

[Sessions]
;; X11DisplayOffset - x11 display number offset
; Type: integer
; Default: 10
X11DisplayOffset=10

;; MaxSessions - maximum number of connections to an xrdp server
; Type: integer
; Default: 0
MaxSessions=50

;; KillDisconnected - kill disconnected sessions
; Type: boolean
; Default: false
; if 1, true, or yes, kill session after 60 seconds
KillDisconnected=false

;; DisconnectedTimeLimit - when to kill idle sessions
; Type: integer
; Default: 0
; if not zero, the seconds before a disconnected session is killed
; min 60 seconds
DisconnectedTimeLimit=0

;; IdleTimeLimit (specify in second) - wait before disconnect idle sessions
; Type: integer
; Default: 0
; Set to 0 to disable idle disconnection.
IdleTimeLimit=0

;; Policy - session allocation policy
; Type: enum [ "Default" | "UBD" | "UBI" | "UBC" | "UBDI" | "UBDC" ]
; Default: Xrdp:<User,BitPerPixel> and Xvnc:<User,BitPerPixel,DisplaySize>
; "UBD" session per <User,BitPerPixel,DisplaySize>
; "UBI" session per <User,BitPerPixel,IPAddr>
; "UBC" session per <User,BitPerPixel,Connection>
; "UBDI" session per <User,BitPerPixel,DisplaySize,IPAddr>
; "UBDC" session per <User,BitPerPixel,DisplaySize,Connection>
Policy=Default

[Logging]
LogFile=xrdp-sesman.log
LogLevel=DEBUG
EnableSyslog=1
SyslogLevel=DEBUG

;
; Session definitions - startup command-line parameters for each session type
;

[Xorg]
; Specify the path of non-suid Xorg executable. It might differ depending
; on your distribution and version. The typical path is shown as follows:
;
; Fedora 26 or later    :  param=/usr/libexec/Xorg
; Debian 9 or later     :  param=/usr/lib/xorg/Xorg
; Ubuntu 16.04 or later :  param=/usr/lib/xorg/Xorg
; Arch Linux            :  param=/usr/lib/xorg-server/Xorg
; CentOS 7              :  param=/usr/bin/Xorg or param=Xorg
;
param=/usr/lib/xorg/Xorg
; Leave the rest paramaters as-is unless you understand what will happen.
param=-config
param=xrdp/xorg.conf
param=-noreset
param=-nolisten
param=tcp
param=-logfile
param=.xorgxrdp.%s.log

[Xvnc]
param=Xvnc
param=-bs
param=-nolisten
param=tcp
param=-localhost
param=-dpi
param=96

[Chansrv]
; drive redirection, defaults to xrdp_client if not set
FuseMountName=thinclient_drives
; this value allows only the user to acess their own mapped drives.
; Make this more permissive (e.g. 022) if required.
FileUmask=077

[SessionVariables]
PULSE_SCRIPT=/etc/xrdp/pulse/default.pa`
[Globals]
; xrdp.ini file version number
ini_version=1

; fork a new process for each incoming connection
fork=true

; ports to listen on, number alone means listen on all interfaces
; 0.0.0.0 or :: if ipv6 is configured
; space between multiple occurrences
;
; Examples:
;   port=3389
;   port=unix://./tmp/xrdp.socket
;   port=tcp://.:3389                           127.0.0.1:3389
;   port=tcp://:3389                            *:3389
;   port=tcp://<any ipv4 format addr>:3389      192.168.1.1:3389
;   port=tcp6://.:3389                          ::1:3389
;   port=tcp6://:3389                           *:3389
;   port=tcp6://{<any ipv6 format addr>}:3389   {FC00:0:0:0:0:0:0:1}:3389
;   port=vsock://<cid>:<port>
port=3389

; 'port' above should be connected to with vsock instead of tcp
; use this only with number alone in port above
; prefer use vsock://<cid>:<port> above
use_vsock=false

; regulate if the listening socket use socket option tcp_nodelay
; no buffering will be performed in the TCP stack
tcp_nodelay=true

; regulate if the listening socket use socket option keepalive
; if the network connection disappear without close messages the connection will be closed
tcp_keepalive=true

; set tcp send/recv buffer (for experts)
#tcp_send_buffer_bytes=32768
#tcp_recv_buffer_bytes=32768

; security layer can be 'tls', 'rdp' or 'negotiate'
; for client compatible layer
security_layer=negotiate

; minimum security level allowed for client for classic RDP encryption
; use tls_ciphers to configure TLS encryption
; can be 'none', 'low', 'medium', 'high', 'fips'
crypt_level=high

; X.509 certificate and private key
; openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365
; note this needs the user xrdp to be a member of the ssl-cert group, do with e.g.
;$ sudo adduser xrdp ssl-cert
certificate=
key_file=

; set SSL protocols
; can be comma separated list of 'SSLv3', 'TLSv1', 'TLSv1.1', 'TLSv1.2', 'TLSv1.3'
ssl_protocols=TLSv1.2, TLSv1.3
; set TLS cipher suites
#tls_ciphers=HIGH

; Section name to use for automatic login if the client sends username
; and password. If empty, the domain name sent by the client is used.
; If empty and no domain name is given, the first suitable section in
; this file will be used.
autorun=

allow_channels=true
allow_multimon=true
bitmap_cache=true
bitmap_compression=true
bulk_compression=true
#hidelogwindow=true
max_bpp=32
new_cursors=true
; fastpath - can be 'input', 'output', 'both', 'none'
use_fastpath=both
; when true, userid/password *must* be passed on cmd line
#require_credentials=true
; You can set the PAM error text in a gateway setup (MAX 256 chars)
#pamerrortxt=change your password according to policy at http://url

;
; colors used by windows in RGB format
;
blue=009cb5
grey=dedede
#black=000000
#dark_grey=808080
#blue=08246b
#dark_blue=08246b
#white=ffffff
#red=ff0000
#green=00ff00
#background=626c72

;
; configure login screen
;

; Login Screen Window Title
#ls_title=My Login Title

; top level window background color in RGB format
ls_top_window_bg_color=009cb5

; width and height of login screen
ls_width=350
ls_height=430

; login screen background color in RGB format
ls_bg_color=dedede

; optional background image filename (bmp format).
#ls_background_image=

; logo
; full path to bmp-file or file in shared folder
ls_logo_filename=
ls_logo_x_pos=55
ls_logo_y_pos=50

; for positioning labels such as username, password etc
ls_label_x_pos=30
ls_label_width=65

; for positioning text and combo boxes next to above labels
ls_input_x_pos=110
ls_input_width=210

; y pos for first label and combo box
ls_input_y_pos=220

; OK button
ls_btn_ok_x_pos=142
ls_btn_ok_y_pos=370
ls_btn_ok_width=85
ls_btn_ok_height=30

; Cancel button
ls_btn_cancel_x_pos=237
ls_btn_cancel_y_pos=370
ls_btn_cancel_width=85
ls_btn_cancel_height=30

[Logging]
LogFile=xrdp.log
LogLevel=DEBUG
EnableSyslog=true
SyslogLevel=DEBUG
; LogLevel and SysLogLevel could by any of: core, error, warning, info or debug

[Channels]
; Channel names not listed here will be blocked by XRDP.
; You can block any channel by setting its value to false.
; IMPORTANT! All channels are not supported in all use
; cases even if you set all values to true.
; You can override these settings on each session type
; These settings are only used if allow_channels=true
rdpdr=true
rdpsnd=true
drdynvc=true
cliprdr=true
rail=true
xrdpvr=true
tcutils=true

; for debugging xrdp, in section xrdp1, change port=-1 to this:
#port=/tmp/.xrdp/xrdp_display_10

; for debugging xrdp, add following line to section xrdp1
#chansrvport=/tmp/.xrdp/xrdp_chansrv_socket_7210

;
; Session types
;

; Some session types such as Xorg, X11rdp and Xvnc start a display server.
; Startup command-line parameters for the display server are configured
; in sesman.ini. See and configure also sesman.ini.
[Xorg]
name=Xorg
lib=libxup.so
username=ask
password=ask
ip=External ip (just for the test) same error even for 127.0.0.1
port=-1
code=20

[Xvnc]
name=Xvnc
lib=libvnc.so
username=ask
password=ask
ip=127.0.0.1
port=-1
#xserverbpp=24
#delay_ms=2000

[vnc-any]
name=vnc-any
lib=libvnc.so
ip=ask
port=ask5900
username=na
password=ask
#pamusername=asksame
#pampassword=asksame
#pamsessionmng=127.0.0.1
#delay_ms=2000

[neutrinordp-any]
name=neutrinordp-any
lib=libxrdpneutrinordp.so
ip=ask
port=ask3389
username=ask
password=ask

; You can override the common channel settings for each session type
#channel.rdpdr=true
#channel.rdpsnd=true
#channel.drdynvc=true
#channel.cliprdr=true
#channel.rail=true
#channel.xrdpvr=true`
matt335672 commented 2 years ago

What do you get for:-

sudo ss -alnp 'sport = :3350'
xrdp -v
BadSpider1 commented 2 years ago

root:/home/ubuntu# sudo ss -alnp 'sport = :3350' Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process tcp LISTEN 0 2 :3350 :* users:(("xrdp-sesman",pid=29017,fd=7)) root:/home/ubuntu# xrdp -v xrdp 0.9.12 A Remote Desktop Protocol Server. Copyright (C) 2004-2018 Jay Sorg, Neutrino Labs, and all contributors. See https://github.com/neutrinolabs/xrdp for more information.

matt335672 commented 2 years ago

OK - that looks good.

/var/log/xrdp-seman.log should now have an indication that a connect is happening, and (if so) what's happening with the login. Have a look and see what's in there.

BadSpider1 commented 2 years ago
[20220303-15:12:45] [WARN ] unknown protocol version specified. connection refused.
[20220303-15:12:45] [DEBUG] Closed socket 8 (AF_INET6 ::ffff:10.0.0.53 port 3350)
[20220303-15:12:45] [INFO ] A connection received from ::ffff:xxx.xxx.xxx.xx port 21642

How could i resolve that ?

matt335672 commented 2 years ago

That's an unusual message.

It means the connection from xrdp to sesman isn't recognised as the format of the packet is wrong.

I suspect that's caused by the nmap scan. Have you got anything more useful in there related to the login attempt?

BadSpider1 commented 2 years ago

Nothing

matt335672 commented 2 years ago

We can be pretty sure that xrdp and sesman are talking because of your screen shot above.

I've just had a look at the v0.9.12 code. The logging in this area isn't good for a failed login. We've worked on improving it quite a bit since that release.

Have another go, and then get a system log for the last two minutes with sudo journalctl -S -2m. It's likely the PAM stack is logging something relating to the attempt, even though sesman doesn't appear to be.

BadSpider1 commented 2 years ago
`Mar 04 13:27:12 workstation systemd[1]: Stopping xrdp daemon...
Mar 04 13:27:12 workstation xrdp[1498]: (1498)(281472913997840)[DEBUG] Closed socket 11 (AF_INET6 :: port 3389)
Mar 04 13:27:12 workstation xrdp[1500]: (1500)(281472913997840)[DEBUG] Closed socket 12 (AF_INET6 ::ffff:10.0.0.53 port 3389)
Mar 04 13:27:12 workstation xrdp[1500]: (1500)(281472913997840)[DEBUG] xrdp_mm_module_cleanup
Mar 04 13:27:12 workstation systemd[1]: xrdp.service: Succeeded.
Mar 04 13:27:12 workstation systemd[1]: Stopped xrdp daemon.
Mar 04 13:27:12 workstation systemd[1]: Stopping xrdp session manager...
Mar 04 13:27:12 workstation systemd[1]: xrdp-sesman.service: Control process exited, code=exited, status=1/FAILURE
Mar 04 13:27:12 workstation xrdp-sesman[1488]: (1488)(281473779841280)[INFO ] shutting down sesman 1
Mar 04 13:27:12 workstation xrdp-sesman[1488]: (1488)(281473779841280)[DEBUG] Closed socket 7 (AF_INET6 :: port 3350)
Mar 04 13:27:12 workstation systemd[1]: xrdp-sesman.service: Failed with result 'exit-code'.
Mar 04 13:27:12 workstation systemd[1]: Stopped xrdp session manager.
Mar 04 13:27:12 workstation systemd[1]: Starting xrdp session manager...
Mar 04 13:27:12 workstation xrdp-sesman[1526]: (1526)(281473877481728)[DEBUG] libscp initialized
Mar 04 13:27:12 workstation xrdp-sesman[1526]: (1526)(281473877481728)[DEBUG] Testing if xrdp-sesman can listen on 0.0.0.0 port 3350.
Mar 04 13:27:12 workstation xrdp-sesman[1526]: (1526)(281473877481728)[DEBUG] Closed socket 5 (AF_INET6 :: port 3350)
Mar 04 13:27:12 workstation xrdp-sesman[1527]: (1527)(281473877481728)[INFO ] starting xrdp-sesman with pid 1527
Mar 04 13:27:12 workstation systemd[1]: Started xrdp session manager.
Mar 04 13:27:12 workstation xrdp-sesman[1527]: (1527)(281473877481728)[INFO ] listening to port 3350 on 0.0.0.0
Mar 04 13:27:12 workstation systemd[1]: Starting xrdp daemon...
Mar 04 13:27:12 workstation xrdp[1536]: (1536)(281473811906576)[INFO ] address [0.0.0.0] port [3389] mode 1
Mar 04 13:27:12 workstation xrdp[1536]: (1536)(281473811906576)[INFO ] listening to port 3389 on 0.0.0.0
Mar 04 13:27:12 workstation xrdp[1536]: (1536)(281473811906576)[INFO ] xrdp_listen_pp done
Mar 04 13:27:12 workstation xrdp[1536]: (1536)(281473811906576)[DEBUG] Closed socket 7 (AF_INET6 :: port 3389)
Mar 04 13:27:12 workstation systemd[1]: xrdp.service: Can't open PID file /run/xrdp/xrdp.pid (yet?) after start: Operation not permitted
Mar 04 13:27:13 workstation systemd[1]: Started xrdp daemon.
Mar 04 13:27:14 workstation xrdp[1537]: (1537)(281473811906576)[INFO ] starting xrdp with pid 1537
Mar 04 13:27:14 workstation xrdp[1537]: (1537)(281473811906576)[INFO ] address [0.0.0.0] port [3389] mode 1
Mar 04 13:27:14 workstation xrdp[1537]: (1537)(281473811906576)[INFO ] listening to port 3389 on 0.0.0.0
Mar 04 13:27:14 workstation xrdp[1537]: (1537)(281473811906576)[INFO ] xrdp_listen_pp done
Mar 04 13:27:19 workstation xrdp[1537]: (1537)(281473811906576)[INFO ] Socket 12: AF_INET6 connection received from ::ffff:xxx.xxx.xxx.xx port 1384
Mar 04 13:27:19 workstation xrdp[1537]: (1537)(281473811906576)[DEBUG] Closed socket 12 (AF_INET6 ::ffff:10.0.0.53 port 3389)
Mar 04 13:27:19 workstation xrdp[1540]: (1540)(281473811906576)[DEBUG] Closed socket 11 (AF_INET6 :: port 3389)
Mar 04 13:27:19 workstation xrdp[1540]: (1540)(281473811906576)[INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
Mar 04 13:27:19 workstation xrdp[1540]: (1540)(281473811906576)[INFO ] Using default X.509 key file: /etc/xrdp/key.pem
Mar 04 13:27:19 workstation xrdp[1540]: (1540)(281473811906576)[DEBUG] TLSv1.3 enabled
Mar 04 13:27:19 workstation xrdp[1540]: (1540)(281473811906576)[DEBUG] TLSv1.2 enabled
Mar 04 13:27:19 workstation xrdp[1540]: (1540)(281473811906576)[DEBUG] Security layer: requested 11, selected 1
Mar 04 13:27:19 workstation xrdp[1540]: (1540)(281473811906576)[DEBUG] Closed socket 12 (AF_INET6 ::ffff:10.0.0.53 port 3389)
Mar 04 13:27:19 workstation xrdp[1537]: (1537)(281473811906576)[INFO ] Socket 12: AF_INET6 connection received from ::ffff:xxx.xxx.xxx.xx port 1385
Mar 04 13:27:19 workstation xrdp[1537]: (1537)(281473811906576)[DEBUG] Closed socket 12 (AF_INET6 ::ffff:10.0.0.53 port 3389)
Mar 04 13:27:19 workstation xrdp[1541]: (1541)(281473811906576)[DEBUG] Closed socket 11 (AF_INET6 :: port 3389)
Mar 04 13:27:19 workstation xrdp[1541]: (1541)(281473811906576)[INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
Mar 04 13:27:20 workstation xrdp[1541]: (1541)(281473811906576)[INFO ] Using default X.509 key file: /etc/xrdp/key.pem
Mar 04 13:27:20 workstation xrdp[1541]: (1541)(281473811906576)[DEBUG] TLSv1.3 enabled
Mar 04 13:27:20 workstation xrdp[1541]: (1541)(281473811906576)[DEBUG] TLSv1.2 enabled
Mar 04 13:27:20 workstation xrdp[1541]: (1541)(281473811906576)[DEBUG] Security layer: requested 11, selected 1
Mar 04 13:27:20 workstation xrdp[1541]: (1541)(281473811906576)[INFO ] connected client computer name: DESKTOP-I85N31P
Mar 04 13:27:20 workstation xrdp[1541]: (1541)(281473811906576)[INFO ] adding channel item name rdpdr chan_id 1004 flags 0x80800000
Mar 04 13:27:20 workstation xrdp[1541]: (1541)(281473811906576)[INFO ] adding channel item name rdpsnd chan_id 1005 flags 0xc0000000
Mar 04 13:27:20 workstation xrdp[1541]: (1541)(281473811906576)[INFO ] adding channel item name cliprdr chan_id 1006 flags 0xc0a00000
Mar 04 13:27:20 workstation xrdp[1541]: (1541)(281473811906576)[INFO ] adding channel item name drdynvc chan_id 1007 flags 0xc0800000
Mar 04 13:27:20 workstation xrdp[1541]: (1541)(281473811906576)[INFO ] TLS connection established from ::ffff:xxx.xxx.xxx.xx port 1385: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384
Mar 04 13:27:20 workstation xrdp[1541]: (1541)(281473811906576)[DEBUG] xrdp_00000605_wm_login_mode_event_00000001
Mar 04 13:27:20 workstation xrdp[1541]: (1541)(281473811906576)[INFO ] Cannot find keymap file /etc/xrdp/km-00000405.ini
Mar 04 13:27:20 workstation xrdp[1541]: (1541)(281473811906576)[INFO ] Cannot find keymap file /etc/xrdp/km-00000405.ini
Mar 04 13:27:20 workstation xrdp[1541]: (1541)(281473811906576)[INFO ] Loading keymap file /etc/xrdp/km-00000409.ini
Mar 04 13:27:20 workstation xrdp[1541]: (1541)(281473811906576)[WARN ] local keymap file for 0x00000405 found and doesn't match built in keymap, using local keymap file
Mar 04 13:27:22 workstation xrdp[1541]: (1541)(281473811906576)[DEBUG] xrdp_wm_log_msg: connecting to sesman ip 130.61.44.111 port 3350
Mar 04 13:27:22 workstation xrdp-sesman[1527]: (1527)(281473877481728)[INFO ] A connection received from ::ffff:130.61.44.111 port 57384
Mar 04 13:27:22 workstation xrdp[1541]: (1541)(281473811906576)[INFO ] xrdp_wm_log_msg: sesman connect ok
BadSpider1 commented 2 years ago

Probably got it to work however im not getting any image

this is what sesman nodaemon says

X.Org X Server 1.20.13
X Protocol Version 11, Revision 0
Build Operating System: linux Ubuntu
Current Operating System: Linux workstation 5.13.0-1018-oracle #22~20.04.1-Ubuntu SMP Wed Feb 16 09:29:33 UTC 2022 aarch64
Kernel command line: BOOT_IMAGE=/boot/vmlinuz-5.13.0-1018-oracle root=UUID=10b1122d-31eb-4451-b603-4f044688e458 ro console=tty1 console=ttyS0 nvme.shutdown_timeout=10 libiscsi.debug_libiscsi_eh=1 crash_kexec_post_notifiers
Build Date: 14 December 2021  02:14:13PM
xorg-server 2:1.20.13-1ubuntu1~20.04.2 (For technical support please see http://www.ubuntu.com/support)
Current version of pixman: 0.38.4
        Before reporting problems, check http://wiki.x.org
        to make sure that you have the latest version.
Markers: (--) probed, (**) from config file, (==) default setting,
        (++) from command line, (!!) notice, (II) informational,
        (WW) warning, (EE) error, (NI) not implemented, (??) unknown.
(++) Log file: ".xorgxrdp.10.log", Time: Fri Mar  4 15:24:50 2022
(++) Using config file: "/etc/X11/xrdp/xorg.conf"
(==) Using system config directory "/usr/share/X11/xorg.conf.d"
xorgxrdpSetup:
xrdpdevSetup:
rdpmousePlug:
rdpkeybPlug:
rdpIdentify:
rdpDriverFunc: op 10
rdpProbe:
rdpProbe: found DRMDevice xorg.conf value [/dev/dri/renderD128]
rdpProbe: found DRI3 xorg.conf value [1]
rdpPreInit:
rdpPreInit: /dev/dri/renderD128 open failed
rdpScreenInit: virtualX 800 virtualY 600 rgbBits 8 depth 24
rdpScreenInit: pfbMemory bytes 1920000
rdpScreenInit: pfbMemory 0xffff918cc010
rdpSimdInit: assigning yuv functions
rdpClientConInit: disconnect idle session after [0] sec
rdpClientConInit: kill disconnected [0] timeout [0] sec
rdpXvInit: depth 24
rdpScreenInit: out
rdpCreateScreenResources:
rdpmousePreInit: drv 0xaaaaf008c3b0 info 0xaaaaf02242a0, flags 0x0
rdpmouseControl: what 0
rdpmouseDeviceInit:
rdpmouseCtrl:
rdpRegisterInputCallback: type 1 proc 0xffff91ab5cc0
rdpmouseControl: what 1
rdpmouseDeviceOn:
rdpkeybPreInit: drv 0xaaaaf008c080 info 0xaaaaf0394a30, flags 0x0
rdpkeybControl: what 0
rdpkeybDeviceInit:
rdpkeybChangeKeyboardControl:
rdpkeybChangeKeyboardControl: autoRepeat on
rdpRegisterInputCallback: type 0 proc 0xffff91aa23b8
rdpkeybControl: what 1
rdpkeybDeviceOn:
rdpDeferredRandR:
rdpResizeSession: width 1024 height 768
  calling RRScreenSizeSet
rdpRRScreenSetSize: width 1024 height 768 mmWidth 271 mmHeight 203
rdpRRGetInfo:
  screen resized to 1024x768
  RRScreenSizeSet ok 1
rdpResizeSession: width 640 height 480
  calling RRScreenSizeSet
rdpRRScreenSetSize: width 640 height 480 mmWidth 169 mmHeight 127
rdpRRGetInfo:
  screen resized to 640x480
  RRScreenSizeSet ok 1
rdpInDeferredRepeatCallback:
rdpkeybChangeKeyboardControl:
rdpkeybChangeKeyboardControl: autoRepeat off
[20220304-15:24:50] [CORE ] waiting for window manager (pid 2457) to exit
chansrv::main: using log file [/home/ubuntu/.local/share/xrdp/xrdp-chansrv.10.log]
[20220304-15:24:50] [CORE ] main: app started pid 2466(0x000009a2)
[20220304-15:24:50] [INFO ] main: DISPLAY env var set to :10.0
[20220304-15:24:50] [INFO ] main: using DISPLAY 10
[20220304-15:24:50] [INFO ] channel_thread_loop: thread start
rdpRRGetInfo:
[20220304-15:24:50] [CORE ] window manager (pid 2457) did exit, cleaning up session
[20220304-15:24:50] [INFO ] calling auth_stop_session and auth_end from pid 2456
[20220304-15:24:50] [DEBUG] cleanup_sockets:
[20220304-15:24:50] [INFO ] term_signal_handler: got signal 15
rdpmouseControl: what 2
rdpmouseDeviceOff:
rdpkeybControl: what 2
rdpkeybDeviceOff:
[20220304-15:24:50] [INFO ] channel_thread_loop: g_term_event set
rdpkeybControl: what 3
rdpkeybUnInit: drv 0xaaaaf008c080 info 0xaaaaf0394a30, flags 0x0
rdpUnregisterInputCallback: proc 0xffff91aa23b8
rdpmouseControl: what 3
rdpmouseUnInit: drv 0xaaaaf008c3b0 info 0xaaaaf02242a0, flags 0x0
rdpUnregisterInputCallback: proc 0xffff91ab5cc0
[20220304-15:24:50] [DEBUG] cleanup_sockets: deleting /run/xrdp/sockdir/xrdpapi_10
xrdp-chansrv [1435016618]: segfault_signal_handler: entered.......
[20220304-15:24:50] [INFO ] ++ terminated session:  username ubuntu, display :10.0, session_pid 2456, ip ::ffff:178.255.168.31:1084 - socket: 12
rdpCloseScreen:
xorgxrdpDownDown:
xorgxrdpDownDown: 1
rdpClientConDeinit:
rdpClientConDeinit: deleting file /run/xrdp/sockdir/xrdp_display_10
rdpClientConDeinit: deleting file /run/xrdp/sockdir/xrdp_disconnect_display_10
(II) Server terminated successfully (0). Closing log file.

and this happens on xrdp nodaemon

[20220304-15:24:53] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 41684)
[20220304-15:24:53] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 41686)
[20220304-15:24:57] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 41758)
[20220304-15:24:57] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 41760)
[20220304-15:25:00] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 41824)
[20220304-15:25:00] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 41826)
[20220304-15:25:04] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 41890)
[20220304-15:25:04] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 41892)
[20220304-15:25:07] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 41956)
[20220304-15:25:07] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 41958)
[20220304-15:25:11] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42022)
[20220304-15:25:11] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42024)
[20220304-15:25:14] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42090)
[20220304-15:25:14] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42092)
[20220304-15:25:18] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42154)
[20220304-15:25:18] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42156)
[20220304-15:25:21] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42220)
[20220304-15:25:22] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42222)
[20220304-15:25:25] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42288)
[20220304-15:25:25] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42290)
[20220304-15:25:28] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42356)
[20220304-15:25:29] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42358)
[20220304-15:25:32] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42424)
[20220304-15:25:32] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42426)
[20220304-15:25:35] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42492)
[20220304-15:25:36] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42494)
[20220304-15:25:39] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42560)
[20220304-15:25:39] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42562)
[20220304-15:25:42] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42626)
[20220304-15:25:43] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42628)
[20220304-15:25:46] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42692)
[20220304-15:25:46] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42694)
[20220304-15:25:49] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42756)
[20220304-15:25:50] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42760)
[20220304-15:25:53] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42822)
[20220304-15:25:53] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42824)
[20220304-15:25:56] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42886)
[20220304-15:25:57] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42888)
[20220304-15:26:00] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42956)
[20220304-15:26:00] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 42958)
[20220304-15:26:03] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 43022)
[20220304-15:26:04] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 43024)
[20220304-15:26:07] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 43088)
[20220304-15:26:07] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 43090)
[20220304-15:26:11] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 43154)
[20220304-15:26:11] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 43156)
[20220304-15:26:14] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 43220)
[20220304-15:26:14] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 43222)
[20220304-15:26:18] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 43288)
[20220304-15:26:18] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 43292)
[20220304-15:26:21] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 43358)
[20220304-15:26:21] [DEBUG] Closed socket 19 (AF_INET6 ::ffff:127.0.0.1 port 43360)

how do i fix that ?

matt335672 commented 2 years ago

@BadSpider1 - I don't understand what "getting any image" means.

It looks like you're logging in OK now. What exactly is happening at that point?

BadSpider1 commented 2 years ago

Forgot to close sorry fixed it and dont know how