xRDP – Infamous “Authentication required to refresh system repositories” popup on Ubuntu 19.04 – The correct fix !!

Griffon

 

 

Hello world,

In a previous post (xRDP – New “Authentication Required…” Popup showing up in Ubuntu 19.04), we have discussed about a minor issue that has been introduced with the release of Ubuntu 19.04.  After installing xRDP on top of Ubuntu 19.04 operating system, and when performing the remote connection, you would notice that a authentication popup is showing up.  This popup will be showing up each time you perform a remote connection to your Ubuntu machine. 

The issue was similar to the “infamous Authentication required to create managed color device” and same approach would be used to fix this new annoying popup dialog box.  However, we have found that the proposed solution in our previous post (xRDP – New “Authentication Required…” Popup showing up in Ubuntu 19.04) was actually introducing a new issue.  This issue was basically preventing software installation from remote sessions. 

After some investigations, we have been able to identify the issue and we are now writing up a new post that would explain what to do in order to fix both issues (the authentication popup and the no permissions to perform software installation within remote Session.)   

So, let’s quickly tackle this….

Note :  xrdp-installer-1.0.sh script already contains the fix and you can use the script to automate xRDP installation and provide the best remote session experience to your users… 

Reminder  – Quick Problem Description 

All Ubuntu Releases

If you are using xRDP on top of Ubuntu for a long time, you probably remember the infamous authentication popup annoyance (see here). If you have performed a manual installation of xRDP package on Ubuntu, when performing your remote connection, you would see an annoying authentication popup showing up. You can decide to enter your credentials or dismiss the popup but chances are that you will be prompted two or three times and the popup will be displayed again.  This popup would appear each time that you perform a remote connection to your Ubuntu machine.

manualxrdp_7

Click on picture for better Resolution

Luckily, this issue is well known and we already provided a fix for it.  You can find more information about this issue and the solution in the following posts

If you are using our famous xRDP installation scripts, you do not need to perform these actions as they are carried out by the script.   Our scripts is basically taking care of most of annoyances a user can get when performing a remote connection to Ubuntu through xRDP. 

Ubuntu 19.04 Release and later 

Since the release of Ubuntu 19.04, when installing xRDP software on top of it, a new authentication popup is showing up when performing a remote desktop connection. The new authentication popup is showing the following message

Authentication required to refresh system repositories.

This issue, started to show up in Ubuntu 19.04. Ubuntu 19.10, is also behaving in a similar way.

manualxrdp_9

Click on picture for better Resolution

We initially tackled this issue in the following post  but this solution is generating another side effect.   So, we have been working hard to find what was causing the side effect.  After some investigations, we found out what the problem was and we are providing the correct way to fix this issue in this post. Keep reading and jump to the solution section….

Fixing the issue the proper way…. 

Based on our previous posts about these kind of issues (see here, here and here),  we know that the problem is related to Polkit technology used within Ubuntu operating system.  Polkit check if a user is authorized to perform a certain number of actions.  Different Polkit rules are being applied when a user is logged on locally on a machine or when remotely connected to the system.  Basically, when remotely connected, the Polkit rules are more restrictive and we need to create exceptions in order for the user to perform actions that would not prompt for authentication dialog box when locally connected on a computer. 

To create these polkit exceptions, we will need to create some additional files that would override the default authorization rules.  These files needs to be created in the following location ( you need to have admin rights to copy/create files in this location !!!) 

/etc/polkit-1/localauthority/50-local.d/

We already know that to fix the “Authentication required to create managed color device” popup, we simply have created a file called 45-allow-colord.pkla and populate it with the following content. 

[Allow Colord all Users]
Identity=unix-user:*
Action=org.freedesktop.color-manager.create-device;org.freedesktop.color-manager.create-profile;org.freedesktop.color-manager.delete-device;org.freedesktop.color-manager.delete-profile;org.freedesktop.color-manager.modify-device;org.freedesktop.color-manager.modify-profile
ResultAny=no
ResultInactive=no
ResultActive=yes

You should create this file on machines running Ubuntu 16.04 and later in order to avoid the authentication color device popup to show up.  Again, as a reminder, using our famous installation script, this file will be created automatically for you and you should not experience the issue. 

The pkla file above only fixes the manage color device popup dialog box.   To fix the “Infamous Authentication required to refresh system repositories”, we will be creating another  polkit exception file that we have called 46-allow-update-repo.pkla (also saved under /etc/polkit-1/localauthority/50-local.d).   This file should contains the following information

[Allow Package Management all Users]
Identity=unix-user:*
Action=org.freedesktop.packagekit.system-sources-refresh
ResultAny=yes
ResultInactive=yes
ResultActive=yes

When done, try to perform a remote connection and if everything works as expected, you should have access to your remote desktop with no “Authentication Required popup” showing up.  You are basically ready to work with no more annoying popups.

Compared to the previous fix, we simply simplified the polkit exception file and we are tackling only the system-sources-refresh rules with the new *.pkla file presented here above.  This action has basically fixed the authentication issue but also allows now users to perform software installation from software center within their remote session….  Please note that this specific file should be only created on Ubuntu 19.04 and later as previous versions of Ubuntu does not present such issue…. 

Final Notes

This is it for this post !  

Based on user feedback and customer feedback, we have been able to identify a minor issue that was preventing users to perform software installation through software center.  In this post, we have been specifically tackling the authentication popups that would show up on Ubuntu machines if no polkit exception files were not created.  This post was focusing on the new Authentication popup showing up in Ubuntu 19.04 and later and how to deal correctly with it. 

The proper fix has been implemented in the new xrdp-installer-1.0.sh script only !!!  From now on, you should be only using a single script in order to perform either a standard installation or a custom installation of xRDP on top of Ubuntu 16.04 or later….  You should now be able to enjoy your remote connection to Ubuntu with no annoying popups showing up and with the possibility to install software from software center in the similar way you would do as if logged on locally….. Enjoy ! 

The coming post will quickly cover the software install issue….so everybody knows about the issue and the fix…

Till next time 

See ya 

References : 

 

15 thoughts on “xRDP – Infamous “Authentication required to refresh system repositories” popup on Ubuntu 19.04 – The correct fix !!”

  1. Hi, I tried it on a CentOS 8 VM and it seems to work also on that architecture. More tests to come.

  2. @Daniel;

    Thank you for the feedback and for testing it on different distribution….hope this can be useful to anyone out there 🙂
    If you want to share your findings, do not hesitate to provide comments

    Till next time
    See ya

  4. @Arno,

    Thank you for the feedback and for visiting our web site…. Happy to see that this is working great on other Distro as well
    Till next time
    See ya

  5. I’m trying to get this to work on OpenSUSE 15.2 with no luck. Maybe something specific to the OS?

  6. Hello Phil,

    We are not really working with OpenSuse. However, if we look into the reference documentation for Polkit and OpenSuse (https://doc.opensuse.org/documentation/leap/security/html/book-security/cha-security-policykit.html), we can find some useful information. The Authorization rules that needs to override polkit policies should be created under /etc/polkit-1/rules.d. Then reading information about the authorization rules, we see that the documentation mentioned that the javascript language should be used. So we would expect that the content of the file would look like (you need to change the group in order to reflect your infra !!!!)

    /* Allow system refresh without authentication xRDP Session */
    polkit.addRule(function(action, subject) {
    if (action.id = org.freedesktop.packagekit.system-sources-refresh" &&
    subject.isInGroup("admin")) {
    return polkit.Result.YES;
    }
    });

    Hope this help
    Till next time
    See ya

  8. @Luuk,

    Thank you for visiting our blog and confirming that this procedure is indeed working and can be useful to other people having the same issue
    Till next time
    See ya

  10. This has saved me big headache, I’m setting up some computers to work remotely with ZeroTier and these issues plus the color profile ones were giving me a headache.

    Thanks a lot for the good work! This was done on Ubuntu 20.04 LTS.

  11. @Bernald,

    Thank you for your visiting and positive feedback. Happy to see that this is still working as expected. Please note that we have developed a modest script that can be used to automate xrdp installation and take care of these small issues. You can get it for free by looking at https://www.c-nergy.be/products.html. the page will allow you to download the script and provide you a link to how to use the script

    Hope this help
    Till next time
    See ya

  13. @Jim,

    Thank you for your feedback and for visiting our blog… Good to see that this tip works also against Rocky Linux…

    Till next time
    See ya

  15. @HowieS,

    Thank you for visiting our blog and sharing your experience. We are happy to see that this post helped you fixing your issue. As an additional information, you might want to try our little xrdp-installer script which will perform all the post-configuration actions and should easy and simplify the xrdp installation process…

    Till Next time
    See ya

Leave a Reply