Xrdp

xrdp
is a daemon that supports Microsoft's
Remote Desktop Protocol
(RDP).
It uses Xvnc or xorgxrdp as a backend.
Installation
Install
the
xrdp
AUR
package. This only supports Xvnc as the backend.
Xorg backend
To use xorgxrdp instead for the backend,
install
the
xorgxrdp
AUR
package.
Usage
First,
start
the
xrdp
service. You should be able to connect an RDP client to the host on the default RDP port (3389). If successful, you will be greeted with the
xrdp
session manager window which allows you to choose between
Xorg
or
Xvnc
sessions and provides inputs for user authentication. The session manager UI can be highly customized by modifying
/etc/xrdp/xrdp.ini
.
The parameters used to start
Xorg
and
Xvnc
display servers can be configured in
/etc/xrdp/sesman.ini
.
After successfully starting a display server,
xrdp
will execute
/etc/xrdp/startwm.sh
by default. This script is meant to start a window manager (similar to
.xinitrc
) and will read from
~/.xinitrc
or
/etc/X11/xinit/xinitrc
if they exist. It is recommended to edit
~/.xinitrc
to start your desktop environment or window manager, but you can also edit
/etc/xrdp/startwm.sh
.
If you just close the session window and RDP connection, you can access the same session again next time you connect with RDP. When you exit the window manager or desktop environment from the session window, the session will close and a new session will be opened the next time.
Configuration
Running as unprivileged user and group
It is highly recommended to set the user and group under which the xrdp daemon is run to an unprivileged user. To do this, first create the
xrdp
user and group:
# useradd xrdp -d / -c 'xrdp daemon' -s /usr/sbin/nologin
Then uncomment the following values in
xrdp.ini
to set the user which will run the daemon:
/etc/xrdp/xrdp.ini
runtime_user=xrdp
runtime_group=xrdp
Also ensure that the value of
SessionSockdirGroup
in
/etc/xrdp/sesman.ini
matches the runtime group above.
After making these changes, check the file permissions required by the daemon using the script
/usr/share/xrdp/xrdp-chkpriv
and correct any issues detected.
Finally,
restart
the
xrdp.service
daemon.
Tips and tricks
Autostart at boot
The
xrdp
AUR
package contains service files for systemd.
Enable
xrdp.service
.
Graphical acceleration
For Xorg sessions, you can enable
OpenGL
and
Vulkan
graphical acceleration by installing
xorgxrdp-glamor
AUR
for Intel and AMD GPUs and
xorgxrdp-nvidia
AUR
for NVIDIA GPUs.
Sound
Install the necessary
PulseAudio
modules with
pulseaudio-module-xrdp
AUR
.
for
PipeWire
user, install
pipewire-module-xrdp
AUR
.
Non-root user
Include the following lines in
Xwrapper.config
:
/etc/X11/Xwrapper.config
allowed_users=anybody
needs_root_rights=no
If the above lines are not present, the remote desktop connection from applications like
Remmina
will start with an empty screen.
Access via SSH tunnel
For added security, if the server offers SSH connections you may choose to only allow local connections and then tunnel the connection over SSH. This has the advantage that you don't need to expose the xrdp port to the public internet.
Set the port for the xrdp daemon to only monitor local connections:
/etc/xrdp/xrdp.ini
port=tcp://.:3389
On the client, open an SSH connection with TCP forwarding to the xrdp server:
$ ssh
user@host
-L 3389:localhost:3389
In the RDP client, connect to
127.0.0.1:3389
to access xrdp over the SSH tunnel.
For more information, see
OpenSSH#Forwarding other ports
and
ssh(1)
.
Troubleshooting
Black box around cursor
If you encounter black box around mouse pointer create
~/.Xresources-xrdp
with line
Xcursor.core:1
and load it in
~/.xinitrc
like
xrdb ~/.Xresources-xrdp
exec startlxde
You may need to install
xorg-xrdb
.
Black screen
You may get a black screen after logging into the session manager.
The last line in
~/.xinitrc
may look like
exec $(get_session "$1")
. It needs a default parameter, if not supplied in
/etc/xrdp/startwm.sh
.
One can edit the last line of
~/.xinitrc
to be
exec $(get_session "${1:-"$SESSION"}")
or
exec $(get_session "${1:-xfce}")
, depending on your preference.
Alternatively, you can also edit your call to
~/.xinitrc
in
/etc/xrdp/startwm.sh
; eg.
. ~/.initrc xfce
. This will affect all users.
Black screen with a desktop environment
If you get a black screen and you use a desktop environment, it may be a result of
D-Bus
not being properly initialized. Some DEs (like KDE Plasma) might also be able to restore fully working applications/windows from a previous session, which makes it seem that "only plasmashell" is missing.
Try running the desktop environment with
dbus-launch --exit-with-session
in your
~/.xinitrc
file. For KDE Plasma, you can use the command
/usr/lib/plasma-dbus-run-session-if-needed startplasma-x11
or
dbus-launch --exit-with-session startplasma-x11
.
Green screen
If the login dialog appears, but no desktop environment starts when you click OK, change
param=Xorg
to
param=/usr/lib/Xorg
in
/etc/xrdp/sesman.ini
.
loginctl or systemctl --user not working
Try commenting out all the references to
systemd-home
in
/etc/pam.d/system-auth
. See
this issue
.
Prompts for gnome-keyring or KDE Wallet
If you are prompted to login to gnome-keyring or [KDE Wallet] when your session starts, modify the file
/etc/pam.d/xrdp-sesman
as follows:
/etc/pam.d/xrdp-sesman
#%PAM-1.0
auth        include     system-remote-login
-auth       optional    pam_gnome_keyring.so
-auth       optional    pam_kwallet5.so
account     include     system-remote-login
password    include     system-remote-login
-password   optional    pam_gnome_keyring.so    use_authtok
session     include     system-remote-login
-session    optional    pam_gnome_keyring.so    auto_start
-session    optional    pam_kwallet5.so         auto_start
Then, add
etc/pam.d/xrdp-sesman
(no leading slash) to
NoUpgrade
in
/etc/pacman.conf
. If you only use gnome-keyring it is not necessary to include the kwallet5 lines, and vice versa.
Prevent autostart items from starting
To prevent user defined
~/.config/autostart
items from starting you can set the autostart directory param on the session in the
~/.xinitrc
to use only the global
/etc/xdg/autostart
directory.
get_session(){
    local dbus_args=(--sh-syntax)
    case "$SESSION" in
        awesome) dbus_args+=(awesome) ;;
        bspwm) dbus_args+=(bspwm-session) ;;
        budgie) dbus_args+=(budgie-desktop) ;;
        cinnamon) dbus_args+=(cinnamon-session -a /etc/xdg/autostart) ;;
No sound
If you are using pipewire or pulseaudio, check if your modules are installed. In AUR, it's
pipewire-module-xrdp
and
pulseaudio-module-xrdp
. Remember to logout and login for them to take effect
This could also be a symptom of an issue with
loginctl
, so try that fix
above
. The following error may be encountered in the system
journal
:
Failed to load module "module-x11-publish" (argument: "display=:10.0 xauthority="): initialization failed.
This is the result of
systemd
improperly starting PulseAudio. One workaround is to
disable
the
user unit
files
pulseaudio.service
and
pulseaudio.socket
either for your own user or for all users, and make PulseAudio start when needed by setting
autospawn
to
yes
in
/etc/pulse/client.conf
.
If sound still does not work, try manually starting PulseAudio with
pulseaudio &
in your
~/.xinitrc
.
Two-finger scrolling is too fast
Use the xorg backend, make sure xorgxrdp is 0.9.19 or newer. Then add
XRDP_XORG_TOUCHPAD_SCROLL_HACK=yes
to the
[SessionVariables]
section of
/etc/xrdp/sesman.ini
.
See
upstream issue #150
for details.
Restricted functionality within remote system
A user may not have the same access permissions when logged into a system remotely as the same user does when logged in locally. Additional configuration may be required of the
polkit
permissions policies to grant access, including to mounted drives or to control network connections.
Mounted drives
For remote access permissions to mounted drives see
udisks#Permissions
.
NetworkManager
For remote access permissions to NetworkManager see
NetworkManager#Set up PolicyKit permissions
.
H.264 codec
xrdp since 0.10.2 offers H.264 as the preferred codec. The default is turned for performance and may cause video quality degradation or sluggish, depending on the GPU. You can tune this by editing
/etc/xrdp/gfx.toml
. See
man gfx.toml
for the list of options. Usually, you could try
preset="medium"
if video quality is not good, or
order = ["RFX", "H.264"]
if you are in a good network and H.264 is causing more latency.
Cannot use podman
podman relies on DBUS_SESSION_BUS_ADDRESS being correctly set, like
DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus
However, xrdp requires a new dbus-session and set it to a temporary location.
The solution is to set it again in your
.bashrc
.bashrc
export DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$UID/bus
export XDG_RUNTIME_DIR=/run/user/$UID
See also
TigerVNC
- VNC, an alternative to RDP, also used as backend here.
freerdp
a rdesktop fork that supports RDP 7.1 features including network level authentication (NLA). It primarily consists of the
xfreerdp
client. In addition, the
freerdp-shadow-cli
command provides a quick and easy way to start an RDP server.