xRDP – How to secure Xrdp Connection using SSH Tunnels on Ubuntu 20.04

Hello World, 

Recently, we have received a request from one of our readers to describe how to secure a little bit more the xRDP connection by using SSH tunnels.  In a previous post called  “Ubuntu 14.10 – How to secure Xrdp Connection using SSH”,   we described the process to achieve such configuration.  This post would be still valid as long as you are running a legacy version of xRDP software ( i.e. version  0.6.x).  

Newer versions  (i.e. version 0.9.x) of the xRDP packages has introduced some major changes and the procedure to create SSH Tunnel and connect through xRDP software needs to be updated.  This is the purpose of this post ! 

So, let’s go through the process….! 

xRDP over SSH Tunnel – Setup Guide

Nowadays, especially with the COVID-19 crisis, more and more people needs to work from home.  This makes software solution like RDP or XRDP the perfect way to remote connect to your server and perform the necessary work remotely.  However, working remotely means also that you might be more vulnerable to attacks if you simply perform a direct connection to your xRDP server through port 3389.  To overcome this situation and improve security posture of your xRDP server, the general approach consist of  using SSH protocol to create a tunnel between the client and the host.    

This step by step guide  will quickly explain how to perform such configuration.  So, if you need to have a more secure solution, this approach might be useful to you.

Step 1 – Installing xRDP Software

xRDP package is a piece of software that allow a user to remotely connect to a Linux machine.  The xRDP package when installed will be providing remote desktop capabilities to your users.  There are different ways to perform the installation of xRDP.  You can perform a manual installation or you can decide to use our famous xrdp-installer-1.2.sh script. which can be download at this location

The post “xRDP – Easy install xRDP on Ubuntu 16.04,18.04,19.10 & 20.04 (Script Version 1.2)” explains quite extensively how to use it. The script really easy the installation of the package and perform some additional post-configuration actions that provide the best user experience you can get with xRDP software on top of Ubuntu 20.04. 

If you never used the script or if you are new to xRDP, and you want to quickly have xRDP installed, please perform the following actions from you terminal session as a normal user (no sudo)

cd ~/Downloads
wget http://www.c-nergy.be/downloads/xrdp-installer-1.2.zip
unzip xrdp-installer-1.2.zip
chmod +x xrdp-installer-1.2.sh
./xrdp-installer-1.2.sh

After you have performed your xrdp installation, it’s time to test your connection.  Using the remote desktop client, you should be able to connect and reconnect to your Ubuntu machine.  If everything is ok, it’s time to move to the next step….

Step 2 – Installing the SSH server on Ubuntu

Since we have installed the xRDP package, we are able to perform remote connections to our Ubuntu machine.  However, the connection is a direct connection to the server without ssh tunnels.  To create ssh tunnels, the server hosting xRDP software needs to have also the SSH Server package installed.  So, we need to install an additional piece of software in order to be able to create our ssh tunnel.  

Again, in order to get it quickly installed, open your command prompt on the Ubuntu machine and execute the following commands 

sudo apt-get install openssh-server

ssh-xrdp-01

Click on Picture for Better Resolution

You should be prompted for a password.  Provide the password and press enter.  You might then be prompted to confirm the installation of the package.  Type y and press enter  

ssh-xrdp-02

Click on Picture for Better Resolution

Wait for completion. When done, you will have your openssh server installed and up and running.  No need to reboot 

ssh-xrdp-03

Click on Picture for Better Resolution

Note :

If needed, it’s possible to perform additional configuration in order to secure even more your ssh server.  As this is not the scope of this post, we will not provide any information about hardening the SSH server.   This post is meanly aiming to demonstrate how to access your xRDP through ssh tunnels. 

PS: If people have best practices for configuring ssh, please let us know and we will publish them including the credits 

Step 3 – Enforce SSH connection 

So far, we have installed xRDP software and SSH Server software and that’s it ! 

The current setup does not prevent a user to perform a direct connection to our xRDP server and ssh tunnel is not necessary in order to remote connect to your Ubuntu machine.   Obviously, we want to change this behavior.  We want to use SSH tunnels before being allowed to make remote desktop connections.  How do we enforce that ? We will tweak the xRDP server configuration and force the service to listen to only from ip address 127.0.0.1.

To do that, perform the following actions 

Open your Terminal console and type the following command 

sudo gedit /etc/xrdp/xrdp.ini

ssh-xrdp-04

Click on Picture for Better Resolution

The xrdp.ini file opens. Locate the line 

port=3389

ssh-xrdp-05

Click on Picture for Better Resolution

You have to replace this line (i.e. port=3389) by the following line 

port=tcp://.:3389

ssh-xrdp-06

Click on Picture for Better Resolution

Save the file.  To have the change applied, you will also need to restart the xrdp service.  To perform this action, you simply issue the following command  

sudo systemctl restart xrdp

ssh-xrdp-07

Click on Picture for Better Resolution

After you have made this change, if you try to perform directly (without ssh tunnel) a remote desktop connection, you will see that your connection will try to initiate the connection

ssh-xrdp-08

Click on Picture for Better Resolution

But at the end, the connection will fail as the xRDP server is not responding on ip addresses other that 127.0.0.1

ssh-xrdp-09

Click on Picture for Better Resolution

That’s all you need to enforce ssh connection before remote desktop to your Ubuntu Machine…So, how do you perform xRDP connection now ?  Keep reading….

How to connect to xRDP through SSH Tunnel

To perform your xRDP connection when ssh tunnel is enforced, you will need to perform some additional steps.   More specifically, you will first need to create the ssh connection.  To perform the ssh connection to your Ubuntu machine, you will first need to have a valid ssh client.  If you are using Windows Operating system, you have multiple options.  The most known ssh client is putty.exe.   If Windows 10 is used,  there is also a built-in ssh client available as well.  So, let’s explain quickly how to perform the ssh tunnel using different solutions….

Perform the SSH Connection to your xRDP Server

In this step, we will first show you to perform the ssh tunnel.  Then, when the ssh tunnel is established, we will show you how to perform the rdp connection to xRDP.

Configuring ssh tunnels using Putty.exe

Putty is the most used ssh client.  You can download it and install it (if you go for the msi package).  You can find putty at this location.  When installed, you can start the tool and you will see a screen similar to the following 

ssh-xrdp-10

Click on Picture for Better Resolution

Configuring ssh tunnels

When putty is installed, open it.  You will see in the putty client that you have to provide information about the machine you want to connect to.  So, in this field, provide hostname/ip address of the ubuntu machine you want to connect to.

 

ssh-xrdp-12

Click on Picture for Better Resolution

Then in the left menu, expand the SSH node and go to Tunnels.

ssh-xrdp-13

Click on Picture for Better Resolution

In the Tunnel page, you will have to provide

  • a source port (we have used 5555 but you can use any port available on your windows system)
  • a destination (we have used the syntax localhost:3389  where the port 3389 is the default xrdp port )
  • Click on the Add button

ssh-xrdp-14

Click on Picture for Better Resolution

At the end of the configuration, you need to ensure that your configuration is similar as the screenshot below

ssh-xrdp-15

Click on Picture for Better Resolution

Go back to the Session node, on the left menu, Provide a name for your connection and press Save. This will ensure that you do not need to redo configuration each time you need to connect through SSH Tunnels to your xRDP server.

ssh-xrdp-11

Click on Picture for Better Resolution

It’s time connect through SSH.  Open your putty client, load your saved profile and client open

ssh-xrdp-16

Click on Picture for Better Resolution

The first time you will make the connection, you will be prompted to accept the connection.  Press yes

ssh-xrdp-17

Click on Picture for Better Resolution

After some time, you will be prompted for a user account and a password.  If the information provided is correct, you will be connected to your Ubuntu machine through ssh.  

ssh-xrdp-18

Click on Picture for Better Resolution

Using putty.exe command line

As alternative, you can also use the command line version of putty to perform your ssh tunnel.   To connect to your xRDP server through ssh, you can issue the following command 

ssh  %user%@%servername-or-ip% -L %LocalPort%:127.0.0.1:%RemotePort%

ssh-xrdp-34

Click on Picture for Better Resolution

In the screenshot, you can see that we are performing a connection using the user test, to the xRDP server with ip 192.168.1.52 using the localport 5555 and connecting remotely to xRDP server on port 3389.

Openssh Client on Windows 10

If you are running a recent version of Windows 10, there is an built-in openssh client available.  To use it, you can simply open Powershell console and issue the following command 

ssh

If the ssh client is installed on your Windows 10, you will see an output similar to the following….

ssh-xrdp-29

Click on Picture for Better Resolution

In order to initiate the ssh tunnel, you will have to issue the following command 

ssh %user%@%servername-or-ip% -L %LocalPort%:127.0.0.1:%RemotePort%

ssh-xrdp-33

Click on Picture for Better Resolution

As you can see, this is the same syntax as putty.exe command line version.  We thought that it would be interesting to mention that Windows 10 also provide a built-in ssh client tool. 

How to Connect  to your xRDP Server over ssh connection

After you have made your ssh connection, it’s time to connect to your xRDP server and get access to your Desktop through RDP protocol.  So, how do you do this ?  Based on our ssh configuration explained above,  we will be using the port 5555 on the local machine which will be “redirected” to port 3389 on the xRDP server.  Let’s demonstrate this.  

So, first ensure that you have you performed your ssh connection.  In the screenshot below, we have been using the putty client.  When this is done, you can start your remote desktop client and enter the following information : localhost:5555

ssh-xrdp-19

Click on Picture for Better Resolution

At this stage, you should see that your client is indeed performing the connection to your xRDP server 

ssh-xrdp-20

Click on Picture for Better Resolution

If everything is configured correctly and process has been followed accordingly, the xRDP login page will be displayed and you will be prompted for a username and a password

ssh-xrdp-21

Click on Picture for Better Resolution

If your credentials are correct, you will be able to access your Ubuntu desktop through Remote Desktop software

ssh-xrdp-22

Click on Picture for Better Resolution

Important Limitation – Two Accounts needed !! 

Because the modern xRDP package does not allow the same user account to be logged concurrently locally and remotely, the same limitation applies for ssh tunnels.  More specifically, if a user is logged on locally on Ubuntu, the same user will not be able to perform a remote desktop connection.  If the user is remotely connected, the same user account will not be able to login locally on the Ubuntu machine.   

Now, if you are performing your ssh connection using user account UserA and you try to connect to your Ubuntu machine through xRDP, using again UserA, the connection will start but you will get disconnected immediately.  So, this means that in order to use ssh tunnels, you will need to use two accounts

  • one account used to perform the ssh connection and,
  • one account used to perform the xRDP connection 

In the screenshot below, you can see that we have performed the ssh connection using the account test.  Then, when performing the xRDP connection, in the login page, we have used the account griffon which make the remote connection possible !! 

ssh-xrdp-23

Click on Picture for Better Resolution

Final Notes

And Voila !   This is it for this post ! 

We have (finally) updated the instructions that needs to be followed in order to secure your xRDP connections through ssh tunnels.  Initially, we provided the information in the post “Ubuntu 14.10 – How to secure Xrdp Connection using SSH” but this information is a little bit outdated as new version of xRDP package has been released.   This post provides all the necessary information that are needed to securely connect to your xRDP server through ssh tunnels.  

The configuration steps are not too complicated and this can improve indeed general security. New xRDP packages introduce a new behavior that also impact the ssh tunnels.  A user cannot be connected locally and remotely at the same time.  It’s either a local connection or a remote connection !  Because of this change in xRDP software, you will need to use two different accounts : one account to perform the ssh connection and one account to perform the xRDP connection through the ssh tunnel.  

We hope that our readers will enjoy this updated post about xRDP and ssh tunnels 

Till next time

See ya

 

 

 

4 thoughts on “xRDP – How to secure Xrdp Connection using SSH Tunnels on Ubuntu 20.04

  1. Do you know if there is some ongoing work to be able to use a single user for remote and local connections, and easily reconnect to the same session, similat to what happens on Windows? The other strange behavior is having to login twice remotely, once in xrdp and once with gnome for instance.
    Are the issues within xrdp, X, or the window manager and their login component?
    If you know about existing feature requests, could you post the links to them?
    Thanks.

  2. @Alban,

    To answer your questions
    – as far as we know, the fact that you cannot connect to the console session is by design in xRDP. The only alternative would be to use VNC solution if you want to connect using same user.
    – Easy reconnection should be available out of the box. If you disconnect a remote session, you should be able to reconnect to the same session
    – not sure to understand the login twice remotely….If you perform the xrDP connection, you will be presented the xRDP login page which will give you access to the Gnome Desktop interface (with no other login prompt)
    – The way it works seems to be inherited from xrdp and xorgxrdp backend solution + possibly GDM login manager
    – About feature requests, you can always have a look at the Github (https://github.com/neutrinolabs/xrdp/pulls) and submit your own requests/questions/comments

    Hope this help
    Till next time
    See ya

  3. I’ve made all by this instruction. But I have some strange problem. If I boot my machine, connect by ssh and try connect to xrdp I see black screen. After this I login to system locally, restart xrdp and try connect to xrdp all things work well. So I have to restart xrdp once after boot OS

  4. @Azat,

    the xrdp service should start automatically at boot time. We didn’t encounter this issue… When time permit, we will further investiage
    Thank for your visit and for sharing your findings
    Till next time
    See ya

Leave a Reply