Empty TerminalServerAdmins makes users unable to login, nothing relevant in logs

[alexmyczko]

Empty TerminalServerAdmins setting causes no users can log in at all.

How is that related to "this option is currently ignored"?

.TP
\fBTerminalServerAdmins\fR=\fIgroup\fR
\fIThis option is currently ignored!\fR Only members of this group can
have session management rights.

[matt335672]

Hi @alexmyczko

What version of xrdp are you looking at? I can try to reproduce.

[alexmyczko]

This is with 0.9.24, to make it clear what the configuration of sesman.ini is like, here an example:

TerminalServerUsers=anygroupyouruserispartof
TerminalServerAdmins=
AlwaysGroupCheck=true

to be fully verbose with the versions, here's the versions of xrdp and xorgxrdp

ii  xorgxrdp       1:0.9.19-1       amd64        Remote Desktop Protocol (RDP) modules for X.org
ii  xrdp           0.9.24-5~bpo12+1 amd64        Remote Desktop Protocol (RDP) server

[matt335672]

I'm not seeing that here.

The TerminalServerAdmins value is checked for management functions of the SCP protocol in v0.9.x and those were never fully developed. They're gone in v0.10.x

Have a look in the xrdp-sesman.log and see what's happening to the user authentication.

[alexmyczko]

it's strange, it failed to login, however now it works, nothing special in xrdp-sesman.log anymore, but xrdp.log shows

==> xrdp.log <==
[20240930-12:50:29] [INFO ] connected ok
[20240930-12:50:33] [ERROR] xrdp_sec_recv: xrdp_mcs_recv failed
[20240930-12:50:33] [ERROR] xrdp_rdp_recv: xrdp_sec_recv failed
[20240930-12:50:33] [ERROR] libxrdp_process_data: xrdp_rdp_recv failed
[20240930-12:50:33] [ERROR] xrdp_process_data_in: xrdp_process_loop failed
[20240930-12:50:33] [ERROR] SSL_shutdown: Failure in SSL library (protocol error?)
[20240930-12:50:33] [ERROR] SSL: error:0A000126:SSL routines::unexpected eof while reading

[alexmyczko]

i can confirm, using the wrong username breaks it.

[matt335672]

This should be fixed in v0.10.x as we've moved to using UIDs instead of usernames to match users.

[matt335672]

SSL(TLS) is used for the client connection. That looks like the normal logging when a connection is terminated at the client end.

My money is on the TerminalServerUsers group not being quite right. That would certainly cause it. All that stuff is checked in xrdp-sesman however, so in the event of a problem in this area that will give us a place to start investigations.

[alexmyczko]

we have two machines, and now login worked on the first one, but second one failed:

[20240930-12:57:06] [INFO ] sesman connect ok
[20240930-12:57:06] [INFO ] sending login info to session manager. Please wait...
[20240930-12:57:06] [INFO ] xrdp_wm_log_msg: login failed for user USERNAME
[20240930-12:57:06] [INFO ] login failed for user USERNAME
[20240930-12:57:21] [ERROR] xrdp_bitmap_load_bmp: error bitmap file [/usr/share/xrdp/background.bmp] does not exist
[20240930-12:57:21] [ERROR] xrdp_bitmap_load_bmp: error bitmap file [/usr/share/xrdp/logo.bmp] does not exist
[20240930-12:57:30] [ERROR] xrdp_sec_recv: xrdp_mcs_recv failed
[20240930-12:57:30] [ERROR] xrdp_rdp_recv: xrdp_sec_recv failed
[20240930-12:57:30] [ERROR] libxrdp_process_data: xrdp_rdp_recv failed
[20240930-12:57:30] [ERROR] xrdp_process_data_in: xrdp_process_loop failed
[20240930-12:57:30] [ERROR] SSL_shutdown: Failure in SSL library (protocol error?)
[20240930-12:57:30] [ERROR] SSL: error:0A000126:SSL routines::unexpected eof while reading

however, the user was also using the wrong username, SOMETHING\username instead of just username, user is in a meeting now, and should try again with the right user...