!! Important Note !!

This post applies only up to xrdp package version 0.6.x. 

Any new recent xrdp package (i.e. 0.9.x), an updated post with detailed configuration details can be found at How to secure Xrdp Connection using SSH Tunnels on Ubuntu 20.04

 

Hello World,

Again, we are back on our favourite topic (I should say your favourite topic) : xrdp.  Recently, I have received some comments about the xrdp software solution and the security level.  As long as you use the xrdp solution on your internal network, there is not much security issues.

However, some other people would like to increase the security level of the xrdp solution.  A standard way to have more secure connection in Linux world is to use ssh protocol and create tunnels between client and hosts.  In some of the comments we have received some users have tried (and suceeded) to configure a xrdp over ssh solution.

This post will quickly explain how to perform such configuration.  So, if you need to have a more secure solution, this post might be for you.

Let’s go

Step 1 – Installing the SSH server on Ubuntu

To create ssh tunnels, we need to have the correct package installed on the Ubuntu machine.  In this post, we assume that you have installed Ubuntu 14.10 and you have already configured your XRDP server solution.  At this stage, if you want to enforce security and use ssh protocol, you will first need to install the openssh server on ubuntu.

To to this, you will perform the following actions

1. Open the Ubuntu Center, in the search box, type openssh server and press enter. in the ubuntu Software center, select the openssh-server.

Click on picture for better resolution

2. Click on the install button and you will get prompted for credentials. Provide you credentials and Press OK

Click on picture for better resolution

3. Wait for installation to complete

Click on picture for better resolution

When installation completes, you are ready to go.  You can perform additional configuration in order to secure your ssh server.  This is not the scope of this post.  We just want to demonstrate how to xrdp over ssh. After installing the openssh-server package we have a up and running ssh server ready to be used.

PS: If people have best practices for configuring ssh, please let us know and we will publish them including the credits 

We can move to the next section

Step 2 – installing and configuring xrdp

This step should already been performed.  However, if you start from scratch, you will need to install and configure xrdp on your server as well.  We will not explain how to perform this operation in this post but ucky you, you can find a full explanation on how to perform the install & configuration using the following link

• XRDP – Reconnect to existing sessions made easier – New xrdp package on Ubuntu repository

After you have performed your xrdp installation, it’s time to test your connection.  Using the remote desktop client, you should be able to connect and reconnect to your Ubuntu machine.  If everything is ok, it’s time to move to the next step….

Step 3 – Configure your Client for SSH Connections

Get a ssh client (i.e putty.exe)

In this post, we assume that you want to have remote access to your ubuntu machine from a Windows 7/8 computer.  You will need to install a ssh client first.  We are using the putty.exe client.  You will need to download it and install it (if you go for the msi package).  You can find putty at this location

Configuring putty for xrdp connections

When putty is installed, open it.  You will see in the putty client that you have to provide information about the machine you want to connect to (number 1 on the screenshot).  So, in this field, provide hostname/ip address of the ubuntu machine you want to connect to.

Click on picture for better resolution

Then in the left menu, expand the SSH node and go to Tunnels.

In the Tunnel page, you will have to provide

• a source port (we have used 5555 but you can use any port available on your windows system)
• a destination (we have used the syntax localhost:3389  where the port 3389 is the default xrdp port )

Click on picture for better resolution

You have to click on the Add button. At the end, you should see something like the screenshot below

 

Click on picture for better resolution

Note :

If you go back to the session node (on the left menu), you can save the session settings.  I would recommend this so you do not have to perform this setup each time

Click on picture for better resolution

 

Step 4 – Test your xrdp over ssh connection

At this stage, everything should be configured properly and you can try to connect to your server using xrdp over a SSH tunnel.  So, before connecting to xrdp, you first need to create the ssh tunnel.  To do this, you will open your putty client, load the saved configuration session (in my screenshot above it’s called xrdp_over_ssh) and click open in putty client.

A terminal box will be displayed and you will be prompted for a username and a password

Click on picture for better resolution

If everything is ok, you should get the greetings of the system.  You can check that you are indeed connected to an Ubuntu 14.10 machine.

You have just created you tunnel.  Now, it’s time to perform a remote desktop connection.  So, you will open your remote desktop client and you will type the following : localhost:5555

 

Click on picture for better resolution

Yes, you read it correclty.  You will perform a remote desktop connection (request) to your host on the port 5555 and the ssh client will forward your request to the xrdp server on port 3389.  This is what the configuration we have performed will do.   If everything goes well, you will be presented with the xrdp login box.  You can now enter your credentials and you will have a secure ssh connection to your xrdp server.

 

Enforce SSH connection over Xrdp

The setup above allows you to create ssh secure connection to your xrdp server and access the remote desktop over the ssh tunnel. The configuration above does not enforce the usage of ssh.  In other words, if you try to connect directly to your xrdp server, you will have no problem to access the xrdp login box and access your remote desktop session.   This situation might be ok for your. We can imagine that when you are connected on your internal network, you do not want to use ssh tunnels but when your are outside, you would have the possibility to perform a ssh connection first which is more secure obviously.

If you want to enforce the ssh connection, you will need to modify the /etc/xrdp/xrdp.ini file on the Ubuntu machine.  In the [Global] section, we will add at the end of the section, the following line

address=127.0.0.1

Click on picture for better resolution

 

You need to restart the xrdp service by issuing the following command

• sudo service xrdp restart

 

What you are actually saying when using this option is that no remote connection can be performed on the Ubuntu machine (for xrdp).  If you try to perform a direct connection to your xrdp server from your windows system, this should fail because you are not authorized to connect to it.

If you perform the ssh connection first and then try the xrdp connection, you should go through and you should have access to your remote desktop session.  This is because we have basically started the xrdp from the localhost machine given that we are connected through ssh first.

Final Notes

And Voila!  We are done. If you have followed this post, you should be able to perform a secure connection over ssh to your xrdp server.  The configuration steps are not that complicated.  As long as your xrdp server works accordingly, you can add an additional level of security using ssh tunnels

I hope you enjoyed this post

Till next time

See ya