I am wondering how to check if my xrdp connection is using a recent TLS?

[paulvirtuel]

As title says, I would like to make sure my xrdp connection is using TLS 1.2 or better.

I am connecting from a Windows 10 machine with remote desktop to a Linux Debian bookworm running xrdp/xorgxrdp/xfce4.

Also, I am wondering if this link from 2020 is still relevant to enable TLS, or should I search for something more recent:
https://github.com/neutrinolabs/xrdp/wiki/TLS-security-layer

[metalefty]

Try this.

ssl_protocols=TLSv1.2, TLSv1.3
security_layer=tls

[paulvirtuel]

Thanks. I could make it work on my remote VM but funny enough, I could not make it work on my local VM.

And even after reverting my changes and choosing security_layer=rdp, I cannot log to my local VM anymore using RD.
Using putty as a different user, I was able to get those logs. Not sure if it can help finding my problem:

[20240123-13:49:35] [INFO ] address [0.0.0.0] port [3389] mode 1
[20240123-13:49:35] [INFO ] listening to port 3389 on 0.0.0.0
[20240123-13:49:35] [INFO ] xrdp_listen_pp done
[20240123-13:49:37] [INFO ] starting xrdp with pid 25191
[20240123-13:49:37] [INFO ] address [0.0.0.0] port [3389] mode 1
[20240123-13:49:37] [INFO ] listening to port 3389 on 0.0.0.0
[20240123-13:49:37] [INFO ] xrdp_listen_pp done
[20240123-13:50:05] [INFO ] Socket 12: AF_INET6 connection received from ... port 57323
[20240123-13:50:05] [INFO ] Socket 12: AF_INET6 connection received from ... port 57324
[20240123-13:50:05] [INFO ] Security protocol: configured [RDP], requested [SSL|HYBRID|HYBRID_EX|RDP], selected [RDP]
[20240123-13:50:05] [ERROR] libxrdp_force_read: header read error
[20240123-13:50:05] [ERROR] libxrdp_force_read: header read error
[20240123-13:50:05] [ERROR] [ITU-T X.224] Connection Sequence: CR-TPDU (Connection Request) failed
[20240123-13:50:05] [ERROR] Processing [ITU-T T.125] Connect-Initial failed
[20240123-13:50:05] [ERROR] xrdp_sec_incoming: xrdp_iso_incoming failed
[20240123-13:50:05] [ERROR] [MCS Connection Sequence] receive connection request failed
[20240123-13:50:05] [ERROR] xrdp_rdp_incoming: xrdp_sec_incoming failed
[20240123-13:50:05] [ERROR] xrdp_sec_incoming: xrdp_mcs_incoming failed
[20240123-13:50:05] [ERROR] xrdp_process_main_loop: libxrdp_process_incoming failed
[20240123-13:50:05] [ERROR] xrdp_rdp_incoming: xrdp_sec_incoming failed
[20240123-13:50:05] [ERROR] xrdp_iso_send: trans_write_copy_s failed
[20240123-13:50:05] [ERROR] xrdp_process_main_loop: libxrdp_process_incoming failed
[20240123-13:50:05] [ERROR] Sending [ITU T.125] DisconnectProviderUltimatum failed
[20240123-13:50:05] [ERROR] xrdp_iso_send: trans_write_copy_s failed
[20240123-13:50:05] [ERROR] Sending [ITU T.125] DisconnectProviderUltimatum failed
[20240123-13:50:08] [INFO ] Socket 12: AF_INET6 connection received from ... port 57325
[20240123-13:50:08] [INFO ] Socket 12: AF_INET6 connection received from ... port 57326
[20240123-13:50:08] [INFO ] Security protocol: configured [RDP], requested [RDP], selected [RDP]
[20240123-13:50:08] [ERROR] libxrdp_force_read: header read error
[20240123-13:50:08] [ERROR] [ITU-T X.224] Connection Sequence: CR-TPDU (Connection Request) failed
[20240123-13:50:08] [ERROR] xrdp_sec_incoming: xrdp_iso_incoming failed
[20240123-13:50:08] [ERROR] xrdp_rdp_incoming: xrdp_sec_incoming failed
[20240123-13:50:08] [INFO ] Connected client computer name: SOME_PC_NAME
[20240123-13:50:08] [ERROR] xrdp_process_main_loop: libxrdp_process_incoming failed
[20240123-13:50:08] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc006 is unknown (ignored)
[20240123-13:50:08] [ERROR] xrdp_iso_send: trans_write_copy_s failed
[20240123-13:50:08] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc00a is unknown (ignored)
[20240123-13:50:08] [ERROR] Sending [ITU T.125] DisconnectProviderUltimatum failed

I tried several times to restart the xrdp service followed by the login sequence.
I tried running the kill_xrdp.sh script.
I checked that the user was not already logged in.
I also created another user to login using putty so I could monitor.

[matt335672]

Could you provide the xrdp-sesman.log contents? The xrdp log all looks OK.

[paulvirtuel]

Thanks for helping, here is the xrdp-sesman.log for that time period:

[20240123-13:47:10] [INFO ] cleanup_sockets:
[20240123-13:47:10] [INFO ] Process 24992 has exited
[20240123-13:47:10] [INFO ] ++ terminated session: username USER_NAME, display :11.0, session_pid 24992, ip ...:57315 - socket: 12
[20240123-13:49:35] [INFO ] sesman_main_loop: sesman asked to terminate
[20240123-13:49:35] [INFO ] starting xrdp-sesman with pid 25181
[20240123-13:50:09] [INFO ] Socket 12: AF_INET6 connection received from ::1 port 60262
[20240123-13:50:09] [INFO ] Terminal Server Users group is disabled, allowing authentication
[20240123-13:50:09] [INFO ] ++ created session (access granted): username USER_NAME, ip ... - socket: 12
[20240123-13:50:09] [INFO ] starting Xorg session...
[20240123-13:50:09] [INFO ] Found X server running at /tmp/.X11-unix/X10
[20240123-13:50:09] [INFO ] Starting session: session_pid 25198, display :11.0, width 1440, height 900, bpp 24, client ip ...:57325 - socket: 12, user name USER_NAME
[20240123-13:50:09] [INFO ] [session start] (display 11): calling auth_start_session from pid 25198
[20240123-13:50:09] [ERROR] sesman_data_in: scp_process_msg failed
[20240123-13:50:09] [ERROR] sesman_main_loop: trans_check_wait_objs failed, removing trans
[20240123-13:50:09] [INFO ] Starting X server on display 11: /usr/lib/xorg/Xorg :11 -auth .Xauthority -config xrdp/xorg.conf -noreset -nolisten tcp -logfile .xorgxrdp.%s.log
[20240123-13:50:09] [INFO ] Found X server running at /tmp/.X11-unix/X11
[20240123-13:50:09] [INFO ] Found X server running at /tmp/.X11-unix/X11
[20240123-13:50:09] [INFO ] Session started successfully for user USER_NAME on display 11
[20240123-13:50:09] [INFO ] Starting the xrdp channel server for display 11
[20240123-13:50:09] [INFO ] Found X server running at /tmp/.X11-unix/X11
[20240123-13:50:09] [INFO ] Session in progress on display 11, waiting until the window manager (pid 25200) exits to end the session
[20240123-13:50:09] [INFO ] Starting the default window manager on display 11: /etc/xrdp/startwm.sh
[20240123-13:50:10] [WARN ] Window manager (pid 25200, display 11) exited quickly (1 secs). This could indicate a window manager config problem
[20240123-13:50:10] [INFO ] Calling auth_stop_session and auth_end from pid 25198
[20240123-13:50:10] [INFO ] Terminating X server (pid 25201) on display 11
[20240123-13:50:10] [INFO ] Terminating the xrdp channel server (pid 25209) on display 11
[20240123-13:50:10] [INFO ] X server on display 11 (pid 25201) returned exit code 0 and signal number 0
[20240123-13:50:10] [INFO ] xrdp channel server for display 11 (pid 25209) exit code 0 and signal number 0
[20240123-13:50:10] [INFO ] cleanup_sockets:
[20240123-13:50:10] [INFO ] Process 25198 has exited
[20240123-13:50:10] [INFO ] ++ terminated session: username USER_NAME, display :11.0, session_pid 25198, ip ...:57325 - socket: 12

[matt335672]

Check you're not logged on to your local VM on the virtual machine console (FAQ here)

If that's not it, let's trace your startup script. Use this command from your other user to start tracing it:-

sudo -u USER_NAME sh -x /etc/xrdp/startwm.sh

[paulvirtuel]

Sorry for the late reply. I had to reboot the local VM for other reasons and the problem went away. I will try your suggestion when the problem reappears.