Xrdp - ArchWiki

Jump to content

# Xrdp

From ArchWiki

xrdp is a daemon that supports Microsoft's Remote Desktop Protocol (RDP). It uses Xvnc or xorgxrdp as a backend.

## Installation

Install the xrdpAUR package. This only supports Xvnc as the backend.

### Xorg backend

To use xorgxrdp instead for the backend, install the xorgxrdpAUR package.

## Usage

First, start the `xrdp` service. You should be able to connect an RDP client to the host on the default RDP port (3389). If successful, you will be greeted with the xrdp session manager window which allows you to choose between Xorg or Xvnc sessions and provides inputs for user authentication. The session manager UI can be highly customized by modifying `/etc/xrdp/xrdp.ini`.

The parameters used to start Xorg and Xvnc display servers can be configured in `/etc/xrdp/sesman.ini`.

After successfully starting a display server, xrdp will execute `/etc/xrdp/startwm.sh` by default. This script is meant to start a window manager (similar to .xinitrc) and will read from `~/.xinitrc` or `/etc/X11/xinit/xinitrc` if they exist. It is recommended to edit `~/.xinitrc` to start your desktop environment or window manager, but you can also edit `/etc/xrdp/startwm.sh`.

If you just close the session window and RDP connection, you can access the same session again next time you connect with RDP. When you exit the window manager or desktop environment from the session window, the session will close and a new session will be opened the next time.

## Configuration

### Running as unprivileged user and group

It is highly recommended to set the user and group under which the xrdp daemon is run to an unprivileged user. To do this, first create the `xrdp` user and group:

    # useradd xrdp -d / -c 'xrdp daemon' -s /usr/sbin/nologin

Then uncomment the following values in `xrdp.ini` to set the user which will run the daemon:

    /etc/xrdp/xrdp.ini

    runtime_user=xrdp
    runtime_group=xrdp

Also ensure that the value of `SessionSockdirGroup` in `/etc/xrdp/sesman.ini` matches the runtime group above.

After making these changes, check the file permissions required by the daemon using the script `/usr/share/xrdp/xrdp-chkpriv` and correct any issues detected.

Finally, restart the `xrdp.service` daemon.

## Tips and tricks

### Autostart at boot

The xrdpAUR package contains service files for systemd. Enable `xrdp.service`.

### Graphical acceleration

For Xorg sessions, you can enable OpenGL and Vulkan graphical acceleration by installing xorgxrdp-glamorAUR for Intel and AMD GPUs and xorgxrdp-nvidiaAUR for NVIDIA GPUs.

### Sound

Install the necessary PulseAudio modules with pulseaudio-module-xrdpAUR.

for PipeWire user, install pipewire-module-xrdpAUR.

### Non-root user

Include the following lines in `Xwrapper.config`:

    /etc/X11/Xwrapper.config

    allowed_users=anybody
    needs_root_rights=no

If the above lines are not present, the remote desktop connection from applications like Remmina will start with an empty screen.

### Access via SSH tunnel

For added security, if the server offers SSH connections you may choose to only allow local connections and then tunnel the connection over SSH. This has the advantage that you don't need to expose the xrdp port to the public internet.

Set the port for the xrdp daemon to only monitor local connections:

    /etc/xrdp/xrdp.ini

    port=tcp://.:3389

On the client, open an SSH connection with TCP forwarding to the xrdp server:

    $ ssh user@host -L 3389:localhost:3389

In the RDP client, connect to `127.0.0.1:3389` to access xrdp over the SSH tunnel.

For more information, see OpenSSH#Forwarding other ports and ssh(1).

## Troubleshooting

### Black box around cursor

If you encounter black box around mouse pointer create `~/.Xresources-xrdp` with line `Xcursor.core:1` and load it in `~/.xinitrc` like

    xrdb ~/.Xresources-xrdp
    exec startlxde

You may need to install xorg-xrdb.

### Black screen

You may get a black screen after logging into the session manager.

The last line in `~/.xinitrc` may look like `exec $(get_session "$1")`. It needs a default parameter, if not supplied in `/etc/xrdp/startwm.sh`.

One can edit the last line of `~/.xinitrc` to be `exec $(get_session "${1:-"$SESSION"}")` or `exec $(get_session "${1:-xfce}")`, depending on your preference.

Alternatively, you can also edit your call to `~/.xinitrc` in `/etc/xrdp/startwm.sh`; eg. `. ~/.initrc xfce`. This will affect all users.

### Black screen with a desktop environment

If you get a black screen and you use a desktop environment, it may be a result of D-Bus not being properly initialized. Some DEs (like KDE Plasma) might also be able to restore fully working applications/windows from a previous session, which makes it seem that "only plasmashell" is missing.

Try running the desktop environment with `dbus-launch --exit-with-session` in your `~/.xinitrc` file. For KDE Plasma, you can use the command `/usr/lib/plasma-dbus-run-session-if-needed startplasma-x11` or `dbus-launch --exit-with-session startplasma-x11`.

### Green screen

If the login dialog appears, but no desktop environment starts when you click OK, change `param=Xorg` to `param=/usr/lib/Xorg` in `/etc/xrdp/sesman.ini`.

### loginctl or systemctl --user not working

Try commenting out all the references to `systemd-home` in `/etc/pam.d/system-auth`. See this issue.

### Prompts for gnome-keyring or KDE Wallet

If you are prompted to login to gnome-keyring or [KDE Wallet] when your session starts, modify the file `/etc/pam.d/xrdp-sesman` as follows:

    /etc/pam.d/xrdp-sesman

    #%PAM-1.0
    auth        include     system-remote-login
    -auth       optional    pam_gnome_keyring.so
    -auth       optional    pam_kwallet5.so
    account     include     system-remote-login
    password    include     system-remote-login
    -password   optional    pam_gnome_keyring.so    use_authtok
    session     include     system-remote-login
    -session    optional    pam_gnome_keyring.so    auto_start
    -session    optional    pam_kwallet5.so         auto_start

Then, add `etc/pam.d/xrdp-sesman` (no leading slash) to `NoUpgrade` in `/etc/pacman.conf`. If you only use gnome-keyring it is not necessary to include the kwallet5 lines, and vice versa.

### Prevent autostart items from starting

To prevent user defined `~/.config/autostart` items from starting you can set the autostart directory param on the session in the `~/.xinitrc` to use only the global `/etc/xdg/autostart` directory.

    get_session(){
        local dbus_args=(--sh-syntax)
        case "$SESSION" in
            awesome) dbus_args+=(awesome) ;;
            bspwm) dbus_args+=(bspwm-session) ;;
            budgie) dbus_args+=(budgie-desktop) ;;
            cinnamon) dbus_args+=(cinnamon-session -a /etc/xdg/autostart) ;;

### No sound

If you are using pipewire or pulseaudio, check if your modules are installed. In AUR, it's `pipewire-module-xrdp` and `pulseaudio-module-xrdp`. Remember to logout and login for them to take effect

This could also be a symptom of an issue with loginctl, so try that fix above. The following error may be encountered in the system journal:

    Failed to load module "module-x11-publish" (argument: "display=:10.0 xauthority="): initialization failed.

This is the result of systemd improperly starting PulseAudio. One workaround is to disable the user unit files `pulseaudio.service` and `pulseaudio.socket` either for your own user or for all users, and make PulseAudio start when needed by setting `autospawn` to `yes` in `/etc/pulse/client.conf`.

If sound still does not work, try manually starting PulseAudio with `pulseaudio &` in your `~/.xinitrc`.

### Two-finger scrolling is too fast

Use the xorg backend, make sure xorgxrdp is 0.9.19 or newer. Then add `XRDP_XORG_TOUCHPAD_SCROLL_HACK=yes` to the `[SessionVariables]` section of `/etc/xrdp/sesman.ini`.

See upstream issue #150 for details.

### Restricted functionality within remote system

A user may not have the same access permissions when logged into a system remotely as the same user does when logged in locally. Additional configuration may be required of the polkit permissions policies to grant access, including to mounted drives or to control network connections.

#### Mounted drives

For remote access permissions to mounted drives see udisks#Permissions.

#### NetworkManager

For remote access permissions to NetworkManager see NetworkManager#Set up PolicyKit permissions.

### H.264 codec

xrdp since 0.10.2 offers H.264 as the preferred codec. The default is turned for performance and may cause video quality degradation or sluggish, depending on the GPU. You can tune this by editing `/etc/xrdp/gfx.toml`. See `man gfx.toml` for the list of options. Usually, you could try `preset="medium"` if video quality is not good, or `order = ["RFX", "H.264"]` if you are in a good network and H.264 is causing more latency.

### Cannot use podman

podman relies on DBUS_SESSION_BUS_ADDRESS being correctly set, like `DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus` However, xrdp requires a new dbus-session and set it to a temporary location.

The solution is to set it again in your `.bashrc`

    .bashrc

    export DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$UID/bus
    export XDG_RUNTIME_DIR=/run/user/$UID

## See also

- TigerVNC - VNC, an alternative to RDP, also used as backend here.
- freerdp a rdesktop fork that supports RDP 7.1 features including network level authentication (NLA). It primarily consists of the `xfreerdp` client. In addition, the `freerdp-shadow-cli` command provides a quick and easy way to start an RDP server.

Category:

- Remote desktop

Xrdp
Add topic