• HWIKI

    Build. Break. Explain.

    What is RDP (Remote Desktop Protocol)

    By h0ag's avatar h0ag | On | 333 views

    Written by h0ag RDP, or Remote Desktop Protocol, as the name suggests, is a protocol that allows us to control a desktop remotely. But what do we call a "desktop"? In our case, a desktop refers to the interface obtained through various graphical environments available on Linux, such as Gnome, KDE, XFCE, etc. It is the environment in which we will navigate.

    1. Prerequisites

    To configure RDP on the server machine, you first need to install a desktop environment. You must choose the environment on which you want to configure RDP. In our case, we will use Gnome on Debian 12.

    > Warning: In this article, we will perform installation and configuration commands as the root user. If you are not root, you will need to prepend sudo to the commands. To switch to the root account, use the command:

    bash
    # Switch to root account
sudo -i

    To exit the root account

    bash
    # Exit root account
exit

    To install Gnome on Debian, execute these commands:

    bash
    # Install gnome
apt update
apt upgrade
apt install task-gnome-desktop

    > If you already have a desktop environment installed, you can skip to the next steps.

    2. Installing xrdp

    Before installing xrdp, if you haven't done so recently, simply type the following commands:

    bash
    # Update system
apt update
apt upgrade

    Once the system is up to date, we will install xrdp using the following command:

    bash
    # Install xrdp
apt install xrdp

    Once the installation is complete, we need to configure a few small things.

    1. First, we must add the xrdp user to the ssl-cert group. This allows the xrdp service to read the machine's SSL certificate private key so it can establish an encrypted and secure RDP connection. To do this, enter the command:
    bash
    # Add xrdp user to ssl-cert group
adduser xrdp ssl-cert

    Once the user is in the group, restart the service:

    bash
    # Restart xrdp
systemctl restart xrdp
    1. Next, ensure the service starts automatically when the machine boots:
    bash
    # Enable xrdp on boot
systemctl enable xrdp

    This is not mandatory, but it prevents you from having to type the start command every time you reboot.

    bash
    systemctl start xrdp

    Now that these actions are complete, we can use RDP to connect to this machine. You can verify that the service is running correctly with this command:

    bash
    # Check xrdp status
systemctl status xrdp

    If it is active, your xrdp server is ready.

    3. Firewall

    This section applies if you have an active firewall on your machine. For this example, we will use UFW.

    By default, the xrdp service listens on port 3389 and uses the TCP communication protocol. To ensure packets are not blocked by the firewall, we must allow traffic using TCP on port 3389.

    Use the following command:

    bash
    # Allow port 3389
ufw allow 3389/tcp
    bash
    # Reload ufw
ufw reload

    4. Configuring XRDP

    Now, we will modify the default configuration.

    First, back up the default configuration in case of any issues. Copy the default config files with the following commands:

    bash
    cp /etc/xrdp/xrdp.ini /etc/xrdp/xrdp.ini.old
cp /etc/xrdp/sesman.ini /etc/xrdp/sesman.ini.old

    Now we can modify it to our liking using any text editor (nano, vim, etc.).

    xrdp.ini

    The xrdp.ini file is the heart of the xrdp service configuration. It defines global service parameters (login screen appearance and session options). This file is separated into several sections recognized by titles in brackets []

    [Globals]

    In this section, we configure the main parameters of the service.

    • port=3389: Defines the TCP port on which xrdp listens for incoming RDP connections. The default is 3389. Note: When choosing a port, for security reasons and to avoid conflicts, ensure the new port is not already used by another service. If the port is changed, remember to update the firewall rules.

    • fork=true: Indicates if a new process should be created for each incoming connection. true allows for connection isolation.

    • security_layer=negotiate: Indicates the security level used. Default is negotiate, which allows the client and server to negotiate the most secure method between TLS and RDP.

    • certificate=, key_file=, ssl_protocols=: Crucial parameters for security. They define the allowed SSL/TLS protocol versions (TLSv1.2, TLSv1.3 by default) and the paths to the certificate and private key to secure RDP connections with TLS.

    • ls_width=350, ls_height=430 Dimensions of the login window. Default is 350x430.

    • ls_top_window_bg_color=FFFFFF Color corresponding to the rest of the window outside the login box.

    • ls_bg_color=c92fb9 Color corresponding to the background of the login box.

    • ls_logo_filename= Image on the login window. Use a .bmp format image.

    [Logging]

    The logging section controls where and how xrdp records its activity information.

    • LogFile=xrdp.log: Name of the file where logs are recorded. This file is found in /var/log.

    • LogLevel=INFO: Determines the verbosity of the logs. There are 6 levels:

    Level Objective Description and Usage
    core Kernel Failures Logs only critical messages indicating severe failures or unrecoverable core software issues. Rarely used alone.
    error Critical Errors Records events that prevent a specific function (or the entire connection) from working. Corrective action is needed.
    warning Warnings Signals potentially problematic or abnormal events that are not errors but are worth noting. The service continues to run.
    info General Info Default level. Records general service progress events, such as startup/shutdown, new RDP connections, and authentication steps.
    debug Debug Info Provides finer technical details on xrdp behavior. Useful for diagnosing functional issues like session failures or configuration problems.
    trace Detailed Traces The most verbose level. Records exhaustive details on every function, variable, and network packet. Use only for deep diagnostics as it can fill the disk and impact performance.

    [Channels]

    This section lists the RDP virtual channels used for additional data transfer between client and server. Channels not in this list will be blocked.

    • rdpdr=true: Redirection of file drives (disks, USB devices).
    • rdpsnd=true: Sound redirection.
    • cliprdr=true: Clipboard redirection (copy/cut/paste).
    • rail=true: Remote Application Integrated Locally (Remote Apps).

    sesman.ini

    The sesman.ini file is the heart of session management. It handles what happens after authentication. It is responsible for starting the desktop environment, managing the session, and session security.

    [Globals]

    This section defines the basic behavior of the session manager.

    • ListenAddress=127.0.0.1
    • ListenPort=3350

    To explain what happens here, let's use a restaurant analogy:

    • xrdp (port 3389) is the Host/Hostess who welcomes clients and asks for their reservation (username and password).
    • sesman (port 3350) is the Chef, the one who prepares the table and the meal—in our case, the desktop session.
    • ListenAddress=127.0.0.1 is the internal phone line between the Host and the Chef.
    • UserWindowManager=startwm.sh: This part tells sesman which script to execute to start the desktop environment (xfce, gnome, kde). We can modify the startwm.sh file depending on which desktop environment is installed on the machine.

    [Security]

    This section controls who can connect and what they can do.

    • AllowRootLogin=true: Allows connection to the root account. Default is true. If you want to forbid it, change to false.
    • TerminalServerUsers=tsusers: Defines a group name (default tsusers). If this group exists, only users who are members of this group can connect.
    • AlwaysGroupCheck=false: Works with the TerminalServerUsers line.
    • If false: If the tsusers group does not exist, everyone can connect.
    • If true: The tsusers group must exist, and the user must be a member to connect.
    • RestrictOutboundClipboard=none
    • RestrictInboundClipboard=none: Configures clipboard restriction policies.

    5. How to connect to RDP on Linux

    > (Note: To connect, use an RDP client such as Remmina on Linux, or Remote Desktop Connection on Windows, and enter the IP address of your server).

    6. References