Questions[xrdp](server)

I've established a connection to a server based on port-forwarded local Xrdp, through an SSH tunnel. If my understanding is correct, then I could illustrate such network as follows:

      ╷────<──port xxxx──<────╷        )
      │                       │        )                                    (            )
╷───────────╷           ╷───────────╷  )                                    (            )
│ LOCALHOST │           │ LOCALHOST │===============port ssh=================== CLIENT   )
╵───────────╵           ╵───────────╵  )                                    (            ) 
      │                       │        )                                    (            )
      ╵────>──port xrdp──>────╵        )
                                       )
               SERVER                  )

The connection between the server and client happens only in the SSH tunnel 'port ssh', which is encrypted. So I am thinking that xrdp server doesn't need any encryption configured by default in /etc/xrdp/xrdp.ini which will effectively do nothing but reducing performance.

Am I thinking correctly? If so, what xrdp config can optimize the performance?

I'm running a Rocky Linux 8.4 workstation with GNOME and MATE desktops, but I've seen the same problem on CentOS 7.9...

When I log into the machine on the local display, I can do things like administer users and set the system time using the Control Centre app (this on MATE, the tools are buried in the menu on GNOME). When I click on the tool I'll get a popup asking for my password, or there will be an "unlock" button to click before I get authenticated. This all works because my user is a member of the "wheel" administrative group.

However, when the same user logs in to the same desktop environment over xrdp, the ability to administer the system has gone. In some cases the "unlock" button is greyed out, in others when I click on the tool app icon I get a message "Error executing command as another user: Not authorized" in my .xsession-errors file.

As I understand it, the problem is down to polkit treating local and remote sessions differently, and basically blocking administrative actions from remote sessions such as xrdp, vnc etc. This is a pain, because the main reason for setting up the xrdp service was so that I could administer the machine remotely! I can work around this to some extent using sudo from a terminal, but really I want it to Just Work™.

So my question is - how do I configure polkit to treat a remote session for my admin user identically to a local session? (Always assuming that polkit is the source of my problem!)

Somehow I cannot connect with RDP for the second time to CentOS 8 running xRDP.

I tried changing KillDisconnected in sesman.ini to true without success.

I Use xrdp with the following settings:

/etc/xrdp.ini

; xrdp.ini file version number
ini_version=1

; fork a new process for each incoming connection
fork=true

; ports to listen on, number alone means listen on all interfaces
; 0.0.0.0 or :: if ipv6 is configured
; space between multiple occurrences
;
; Examples:
;   port=3389
;   port=unix://./tmp/xrdp.socket
;   port=tcp://.:3389                           127.0.0.1:3389
;   port=tcp://:3389                            *:3389
;   port=tcp://<any ipv4 format addr>:3389      192.168.1.1:3389
;   port=tcp6://.:3389                          ::1:3389
;   port=tcp6://:3389                           *:3389
;   port=tcp6://{<any ipv6 format addr>}:3389   {FC00:0:0:0:0:0:0:1}:3389
;   port=vsock://<cid>:<port>
port=3389

; 'port' above should be connected to with vsock instead of tcp
; use this only with number alone in port above
; prefer use vsock://<cid>:<port> above
use_vsock=false

; regulate if the listening socket use socket option tcp_nodelay
; no buffering will be performed in the TCP stack
tcp_nodelay=true

; regulate if the listening socket use socket option keepalive
; if the network connection disappear without close messages the connection will be closed
tcp_keepalive=true

; set tcp send/recv buffer (for experts)
#tcp_send_buffer_bytes=32768
#tcp_recv_buffer_bytes=32768

; security layer can be 'tls', 'rdp' or 'negotiate'
; for client compatible layer
security_layer=negotiate

; minimum security level allowed for client for classic RDP encryption
; use tls_ciphers to configure TLS encryption
; can be 'none', 'low', 'medium', 'high', 'fips'
crypt_level=high

; X.509 certificate and private key
; openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365
certificate=
key_file=

; set SSL protocols
; can be comma separated list of 'SSLv3', 'TLSv1', 'TLSv1.1', 'TLSv1.2', 'TLSv1.3'
ssl_protocols=TLSv1.2, TLSv1.3
; set TLS cipher suites
#tls_ciphers=HIGH

; Section name to use for automatic login if the client sends username
; and password. If empty, the domain name sent by the client is used.
; If empty and no domain name is given, the first suitable section in
; this file will be used.
autorun=

allow_channels=true
allow_multimon=true
bitmap_cache=true
bitmap_compression=true
bulk_compression=true
#hidelogwindow=true
max_bpp=32
new_cursors=true
; fastpath - can be 'input', 'output', 'both', 'none'
use_fastpath=both
; when true, userid/password *must* be passed on cmd line
#require_credentials=true
; You can set the PAM error text in a gateway setup (MAX 256 chars)
#pamerrortxt=change your password according to policy at http://url

;
; colors used by windows in RGB format
;
blue=009cb5
grey=dedede
#black=000000
#dark_grey=808080
#blue=08246b
#dark_blue=08246b
#white=ffffff
#red=ff0000
#green=00ff00
#background=626c72

;
; configure login screen
;

; Login Screen Window Title
#ls_title=My Login Title

; top level window background color in RGB format
ls_top_window_bg_color=009cb5

; width and height of login screen
ls_width=350
ls_height=430

; login screen background color in RGB format
ls_bg_color=dedede

; optional background image filename (bmp format).
#ls_background_image=

; logo
; full path to bmp-file or file in shared folder
ls_logo_filename=
ls_logo_x_pos=55
ls_logo_y_pos=50

; for positioning labels such as username, password etc
ls_label_x_pos=30
ls_label_width=65

; for positioning text and combo boxes next to above labels
ls_input_x_pos=110
ls_input_width=210

; y pos for first label and combo box
ls_input_y_pos=220

; OK button
ls_btn_ok_x_pos=142
ls_btn_ok_y_pos=370
ls_btn_ok_width=85
ls_btn_ok_height=30

; Cancel button
ls_btn_cancel_x_pos=237
ls_btn_cancel_y_pos=370
ls_btn_cancel_width=85
ls_btn_cancel_height=30

[Logging]
LogFile=xrdp.log
LogLevel=DEBUG
EnableSyslog=true
SyslogLevel=DEBUG
; LogLevel and SysLogLevel could by any of: core, error, warning, info or debug

[Channels]
; Channel names not listed here will be blocked by XRDP.
; You can block any channel by setting its value to false.
; IMPORTANT! All channels are not supported in all use
; cases even if you set all values to true.
; You can override these settings on each session type
; These settings are only used if allow_channels=true
rdpdr=true
rdpsnd=true
drdynvc=true
cliprdr=true
rail=true
xrdpvr=true
tcutils=true

; for debugging xrdp, in section xrdp1, change port=-1 to this:
#port=/tmp/.xrdp/xrdp_display_10

; for debugging xrdp, add following line to section xrdp1
#chansrvport=/tmp/.xrdp/xrdp_chansrv_socket_7210


;
; Session types
;

; Some session types such as Xorg, X11rdp and Xvnc start a display server.
; Startup command-line parameters for the display server are configured
; in sesman.ini. See and configure also sesman.ini.
#[Xorg]
#name=Xorg
#lib=libxup.so
#username=ask
#password=ask
#ip=127.0.0.1
#port=-1
#code=20

[Xvnc]
name=Xvnc
lib=libvnc.so
username=ask
password=ask
ip=127.0.0.1
port=-1
#xserverbpp=24
#delay_ms=2000

#[vnc-any]
#name=vnc-any
#lib=libvnc.so
#ip=ask
#port=ask5900
#username=na
#password=ask
#pamusername=asksame
#pampassword=asksame
#pamsessionmng=127.0.0.1
#delay_ms=2000

#[neutrinordp-any]
#name=neutrinordp-any
#lib=libxrdpneutrinordp.so
#ip=ask
#port=ask3389
#username=ask
#password=ask

; You can override the common channel settings for each session type
#channel.rdpdr=true
#channel.rdpsnd=true
#channel.drdynvc=true
#channel.cliprdr=true
#channel.rail=true
#channel.xrdpvr=true

/etc/xrdp/sesman.ini

;; See `man 5 sesman.ini` for details

[Globals]
ListenAddress=127.0.0.1
ListenPort=3350
EnableUserWindowManager=true
; Give in relative path to user's home directory
UserWindowManager=startwm.sh
; Give in full path or relative path to /etc/xrdp
DefaultWindowManager=startwm-bash.sh
; Give in full path or relative path to /etc/xrdp
ReconnectScript=reconnectwm.sh

[Security]
AllowRootLogin=true
MaxLoginRetry=4
TerminalServerUsers=tsusers
TerminalServerAdmins=tsadmins
; When AlwaysGroupCheck=false access will be permitted
; if the group TerminalServerUsers is not defined.
AlwaysGroupCheck=false
; When RestrictOutboundClipboard=true clipboard from the
; server is not pushed to the client.
RestrictOutboundClipboard=false

[Sessions]
;; X11DisplayOffset - x11 display number offset
; Type: integer
; Default: 10
X11DisplayOffset=10

;; MaxSessions - maximum number of connections to an xrdp server
; Type: integer
; Default: 0
MaxSessions=50

;; KillDisconnected - kill disconnected sessions
; Type: boolean
; Default: false
; if 1, true, or yes, kill session after 60 seconds
KillDisconnected=false

;; DisconnectedTimeLimit - when to kill idle sessions
; Type: integer
; Default: 0
; if not zero, the seconds before a disconnected session is killed
; min 60 seconds
DisconnectedTimeLimit=0

;; IdleTimeLimit (specify in second) - wait before disconnect idle sessions
; Type: integer
; Default: 0
; Set to 0 to disable idle disconnection.
IdleTimeLimit=0

;; Policy - session allocation policy
; Type: enum [ "Default" | "UBD" | "UBI" | "UBC" | "UBDI" | "UBDC" ]
; Default: Xrdp:<User,BitPerPixel> and Xvnc:<User,BitPerPixel,DisplaySize>
; "UBD" session per <User,BitPerPixel,DisplaySize>
; "UBI" session per <User,BitPerPixel,IPAddr>
; "UBC" session per <User,BitPerPixel,Connection>
; "UBDI" session per <User,BitPerPixel,DisplaySize,IPAddr>
; "UBDC" session per <User,BitPerPixel,DisplaySize,Connection>
Policy=Default

[Logging]
LogFile=xrdp-sesman.log
LogLevel=DEBUG
EnableSyslog=1
SyslogLevel=DEBUG

;
; Session definitions - startup command-line parameters for each session type
;

[Xorg]
; Specify the path of non-suid Xorg executable. It might differ depending
; on your distribution and version. The typical path is shown as follows:
;
; Fedora 26 or later    :  param=/usr/libexec/Xorg
; Debian 9 or later     :  param=/usr/lib/xorg/Xorg
; Ubuntu 16.04 or later :  param=/usr/lib/xorg/Xorg
; Arch Linux            :  param=/usr/lib/xorg-server/Xorg
; CentOS 7              :  param=/usr/bin/Xorg or param=Xorg
;
param=Xorg
; Leave the rest paramaters as-is unless you understand what will happen.
param=-config
param=xrdp/xorg.conf
param=-noreset
param=-nolisten
param=tcp
param=-logfile
param=.xorgxrdp.%s.log

[Xvnc]
param=Xvnc
param=-bs
param=-nolisten
param=tcp
param=-localhost
param=-dpi
param=96

[Chansrv]
; drive redirection, defaults to xrdp_client if not set
FuseMountName=thinclient_drives
; this value allows only the user to acess their own mapped drives.
; Make this more permissive (e.g. 022) if required.
FileUmask=077

[SessionVariables]
PULSE_SCRIPT=/etc/xrdp/pulse/default.pa

Lines added to log when trying to connect:

Nov 23 11:23:14 localhost xrdp[3175]: postBeta2ColorDepth 0xca01 (0xca00 4bpp 0xca01 8bpp 0xca02 15bpp 0xca03 16bpp 0xca04 24bpp)
Nov 23 11:23:14 localhost xrdp[3175]: highColorDepth 0x0010 (0x0004 4bpp 0x0008 8bpp 0x000f 15bpp 0x0010 16 bpp 0x0018 24bpp)
Nov 23 11:23:14 localhost xrdp[3175]: supportedColorDepths 0x000f (0x0001 24bpp 0x0002 16bpp 0x0004 15bpp 0x0008 32bpp)
Nov 23 11:23:14 localhost xrdp[3175]: earlyCapabilityFlags 0x07ad (0x0002 want32)
Nov 23 11:23:14 localhost xrdp[3175]: got client client connection type 0x00000007
Nov 23 11:23:14 localhost xrdp[3175]: xrdp_sec_process_mcs_data_CS_SECURITY:
Nov 23 11:23:14 localhost xrdp[3175]:  client supports 40 bit encryption
Nov 23 11:23:14 localhost xrdp[3175]:  client supports 128 bit encryption
Nov 23 11:23:14 localhost xrdp[3175]:  client supports 56 bit encryption
Nov 23 11:23:14 localhost xrdp[3175]:  client supports fips encryption
Nov 23 11:23:14 localhost xrdp[3175]: [20201123-11:23:13] [INFO ] adding channel item name rdpdr chan_id 1004 flags 0x80800000
Nov 23 11:23:14 localhost xrdp[3175]: [20201123-11:23:13] [INFO ] adding channel item name rdpsnd chan_id 1005 flags 0xc0000000
Nov 23 11:23:14 localhost xrdp[3175]: [20201123-11:23:13] [INFO ] adding channel item name cliprdr chan_id 1006 flags 0xc0a00000
Nov 23 11:23:14 localhost xrdp[3175]: [20201123-11:23:13] [INFO ] adding channel item name nlr3hv chan_id 1007 flags 0x84200000
Nov 23 11:23:14 localhost xrdp[3175]: [20201123-11:23:13] [INFO ] adding channel item name nlw3hv chan_id 1008 flags 0x84200000
Nov 23 11:23:14 localhost xrdp[3175]: [20201123-11:23:13] [INFO ] adding channel item name drdynvc chan_id 1009 flags 0xc0800000
Nov 23 11:23:14 localhost xrdp[3175]: error unknown xrdp_sec_process_mcs_data tag 0xc006 size 8
Nov 23 11:23:14 localhost xrdp[3175]: error unknown xrdp_sec_process_mcs_data tag 0xc00a size 8
Nov 23 11:23:14 localhost xrdp[3175]: xrdp_sec_out_mcs_data: using no security
Nov 23 11:23:14 localhost xrdp[3175]: xrdp_load_keyboard_layout: keyboard_type [4] keyboard_subtype [0]
Nov 23 11:23:14 localhost xrdp[3175]: xrdp_load_keyboard_layout: model [] variant [] layout [us] options []
Nov 23 11:23:14 localhost xrdp[3175]: [20201123-11:23:13] [INFO ] TLS connection established from 10.10.70.254 port 1113: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384
Nov 23 11:23:14 localhost xrdp[3175]: xrdp_caps_process_order: bitmap cache v3 supported
Nov 23 11:23:14 localhost xrdp[3175]: xrdp_caps_process_pointer: client supports new(color) cursor
Nov 23 11:23:14 localhost xrdp[3175]: xrdp_caps_process_glyphcache: support level 3
Nov 23 11:23:14 localhost xrdp[3175]: xrdp_process_offscreen_bmpcache: support level 1 cache size 5242880 MB cache entries 100
Nov 23 11:23:14 localhost xrdp[3175]: xrdp_caps_process_surface_cmds:
Nov 23 11:23:14 localhost xrdp[3175]:  cmdFlags 0x00000052
Nov 23 11:23:14 localhost xrdp[3175]: xrdp_caps_process_frame_ack:
Nov 23 11:23:14 localhost xrdp[3175]:  max_unacknowledged_frame_count 2
Nov 23 11:23:14 localhost xrdp[3175]: xrdp_caps_process_codecs: nscodec, codec id 1, properties len 3
Nov 23 11:23:14 localhost xrdp[3175]: xrdp_caps_process_codecs: unknown codec id 5
Nov 23 11:23:14 localhost xrdp[3175]: xrdp_caps_process_codecs: RemoteFX, codec id 3, properties len 49
Nov 23 11:23:14 localhost xrdp[3175]: yeah, up_and_running
Nov 23 11:23:14 localhost xrdp[3175]: xrdp_channel_drdynvc_start:
Nov 23 11:23:14 localhost xrdp[3175]: xrdp:xrdp_bitmap [4104192998]: xrdp_bitmap_create: noorders
Nov 23 11:23:14 localhost xrdp[3175]: [20201123-11:23:14] [DEBUG] xrdp_00003fa7_wm_login_mode_event_00000001
Nov 23 11:23:14 localhost xrdp[3175]: xrdp:xrdp_mm [4104193001]: xrdp_mm_create: bpp 16 mcs_connection_type 7 jpeg_codec_id 0 v3_codec_id 0 rfx_codec_id 3 h264_codec_id 0
Nov 23 11:23:14 localhost xrdp[3175]: [20201123-11:23:14] [INFO ] Cannot find keymap file /etc/xrdp/km-00020409.ini
Nov 23 11:23:14 localhost xrdp[3175]: [20201123-11:23:14] [INFO ] Loading keymap file /etc/xrdp/km-00000409.ini
Nov 23 11:23:14 localhost xrdp[3175]: [20201123-11:23:14] [WARN ] local keymap file for 0x00020409 found and doesn't match built in keymap, using local keymap file
Nov 23 11:23:14 localhost xrdp[3175]: xrdp_wm_login_mode_changed: login_mode is 0
Nov 23 11:23:14 localhost xrdp[3175]: in xrdp_wm_init:
Nov 23 11:23:14 localhost xrdp[3175]: xrdp_wm_init: channel rdpdr channel id 0 is allowed
Nov 23 11:23:14 localhost xrdp[3175]: xrdp_wm_init: channel rdpsnd channel id 1 is allowed
Nov 23 11:23:14 localhost xrdp[3175]: xrdp_wm_init: channel cliprdr channel id 2 is allowed
Nov 23 11:23:14 localhost xrdp[3175]: xrdp_wm_init: channel nlr3hv channel id 3 is disabled
Nov 23 11:23:22 localhost Dicomizer[2654]: [Info] Scan watchfolder : /home/dicom/Watchfolder/
Nov 23 11:23:22 localhost Dicomizer[2654]: [Info] Scan watchfolder : /home/dicom/Watchfolder/
Nov 23 11:23:25 localhost xrdp-sesman[3174]: (3174)(139867984213824)[INFO ] A connection received from 127.0.0.1 port 48524
Nov 23 11:23:25 localhost xrdp[16295]: (16295)(139693899400640)[INFO ] xrdp_wm_log_msg: sesman connect ok
Nov 23 11:23:25 localhost xrdp-sesman[3174]: (3174)(139867984213824)[INFO ] ++ created session (access granted): username root, ip 10.10.70.254:1113 - socket: 12
Nov 23 11:23:25 localhost xrdp-sesman[3174]: (3174)(139867984213824)[INFO ] starting Xvnc session...
Nov 23 11:23:25 localhost xrdp[16295]: (16295)(139693899400640)[INFO ] xrdp_wm_log_msg: login successful for display 10
Nov 23 11:23:25 localhost xrdp-sesman[16299]: (16299)(139867984213824)[INFO ] calling auth_start_session from pid 16299
Nov 23 11:23:25 localhost systemd-logind[2688]: New session c2 of user root.
Nov 23 11:23:25 localhost systemd[1]: Started Session c2 of user root.
Nov 23 11:23:25 localhost xrdp-sesman[16301]: (16301)(139867984213824)[INFO ] Xvnc :10 -auth .Xauthority -geometry 3840x2160 -depth 16 -rfbauth /root/.vnc/[email protected]:10 -bs -nolisten tcp -localhost -dpi 96
Nov 23 11:23:25 localhost xrdp-sesman[3174]: Xvnc TigerVNC 1.9.0 - built Nov  8 2019 23:18:11
Nov 23 11:23:25 localhost xrdp-sesman[3174]: Copyright (C) 1999-2018 TigerVNC Team and many others (see README.rst)
Nov 23 11:23:25 localhost xrdp-sesman[3174]: See http://www.tigervnc.org for information on TigerVNC.
Nov 23 11:23:25 localhost xrdp-sesman[3174]: Underlying X server release 12003000, The X.Org Foundation
Nov 23 11:23:25 localhost xrdp-sesman[3174]: Mon Nov 23 11:23:25 2020
Nov 23 11:23:25 localhost xrdp-sesman[3174]: vncext:      VNC extension running!
Nov 23 11:23:25 localhost xrdp-sesman[3174]: vncext:      Listening for VNC connections on local interface(s), port 5910
Nov 23 11:23:25 localhost xrdp-sesman[3174]: vncext:      created VNC server for screen 0
Nov 23 11:23:26 localhost xrdp-sesman[3174]: Mon Nov 23 11:23:26 2020
Nov 23 11:23:26 localhost xrdp-sesman[3174]: Connections: accepted: 127.0.0.1::56666
Nov 23 11:23:26 localhost xrdp-sesman[16299]: (16299)(139867984213824)[CORE ] waiting for window manager (pid 16300) to exit
Nov 23 11:23:26 localhost xrdp-sesman[3174]: SConnection: Client needs protocol version 3.3
Nov 23 11:23:26 localhost xrdp-sesman[3174]: VNCSConnST:  Server default pixel format depth 16 (16bpp) little-endian rgb565
Nov 23 11:23:26 localhost xrdp-sesman[3174]: VNCSConnST:  Client pixel format depth 16 (16bpp) little-endian rgb565
Nov 23 11:23:26 localhost dbus-daemon[4947]: [session uid=0 pid=4947] Activating via systemd: service name='org.a11y.Bus' unit='at-spi-dbus-bus.service' requested by ':1.4' (uid=0 pid=16457 comm="/usr/libexec/gnome-session-check-accelerated " label="system_u:system_r:unconfined_service_t:s0")
Nov 23 11:23:26 localhost systemd[4475]: Starting Accessibility services bus...
Nov 23 11:23:26 localhost dbus-daemon[4947]: [session uid=0 pid=4947] Successfully activated service 'org.a11y.Bus'
Nov 23 11:23:26 localhost systemd[4475]: Started Accessibility services bus.
Nov 23 11:23:26 localhost at-spi-bus-launcher[16474]: dbus-daemon[16479]: Activating service name='org.a11y.atspi.Registry' requested by ':1.0' (uid=0 pid=16457 comm="/usr/libexec/gnome-session-check-accelerated " label="system_u:system_r:unconfined_service_t:s0")
Nov 23 11:23:26 localhost dbus-daemon[4947]: [session uid=0 pid=4947] Activating via systemd: service name='org.gtk.vfs.Daemon' unit='gvfs-daemon.service' requested by ':1.6' (uid=0 pid=16457 comm="/usr/libexec/gnome-session-check-accelerated " label="system_u:system_r:unconfined_service_t:s0")
Nov 23 11:23:26 localhost systemd[4475]: Starting Virtual filesystem service...
Nov 23 11:23:26 localhost at-spi-bus-launcher[16474]: dbus-daemon[16479]: Successfully activated service 'org.a11y.atspi.Registry'
Nov 23 11:23:26 localhost at-spi-bus-launcher[16474]: SpiRegistry daemon is running with well-known name - org.a11y.atspi.Registry
Nov 23 11:23:26 localhost dbus-daemon[4947]: [session uid=0 pid=4947] Successfully activated service 'org.gtk.vfs.Daemon'
Nov 23 11:23:26 localhost systemd[4475]: Started Virtual filesystem service.
Nov 23 11:23:26 localhost gnome-session[16300]: gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.Shell'
Nov 23 11:23:26 localhost gnome-session[16300]: gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.A11ySettings'
Nov 23 11:23:26 localhost gnome-session[16300]: gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Clipboard'
Nov 23 11:23:26 localhost gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.Shell'
Nov 23 11:23:26 localhost gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.A11ySettings'
Nov 23 11:23:26 localhost gnome-session[16300]: gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Color'
Nov 23 11:23:26 localhost gnome-session[16300]: gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Datetime'
Nov 23 11:23:26 localhost gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Clipboard'
Nov 23 11:23:26 localhost gnome-session[16300]: gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Housekeeping'
Nov 23 11:23:26 localhost gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Color'
Nov 23 11:23:26 localhost gnome-session[16300]: gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Keyboard'
Nov 23 11:23:26 localhost gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Datetime'
Nov 23 11:23:26 localhost gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Housekeeping'
Nov 23 11:23:26 localhost gnome-session[16300]: gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.MediaKeys'
Nov 23 11:23:26 localhost gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Keyboard'
Nov 23 11:23:26 localhost gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.MediaKeys'
Nov 23 11:23:26 localhost gnome-session[16300]: gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Mouse'
Nov 23 11:23:26 localhost gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Mouse'
Nov 23 11:23:26 localhost gnome-session[16300]: gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Power'
Nov 23 11:23:26 localhost gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Power'
Nov 23 11:23:26 localhost gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.PrintNotifications'
Nov 23 11:23:26 localhost gnome-session[16300]: gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.PrintNotifications'
Nov 23 11:23:26 localhost gnome-session[16300]: gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Rfkill'
Nov 23 11:23:26 localhost gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Rfkill'
Nov 23 11:23:26 localhost gnome-session[16300]: gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.ScreensaverProxy'
Nov 23 11:23:26 localhost gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.ScreensaverProxy'
Nov 23 11:23:26 localhost gnome-session[16300]: gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Sharing'
Nov 23 11:23:26 localhost gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Sharing'
Nov 23 11:23:26 localhost gnome-session[16300]: gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Smartcard'
Nov 23 11:23:26 localhost gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Smartcard'
Nov 23 11:23:26 localhost gnome-session[16300]: gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Sound'
Nov 23 11:23:26 localhost gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Sound'
Nov 23 11:23:26 localhost gnome-session[16300]: gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Wacom'
Nov 23 11:23:26 localhost gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.Wacom'
Nov 23 11:23:26 localhost gnome-session[16300]: gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.XSettings'
Nov 23 11:23:26 localhost gnome-session-binary[16300]: WARNING: Unable to find required component 'org.gnome.SettingsDaemon.XSettings'
Nov 23 11:23:26 localhost gnome-session-binary[16300]: Entering running state
Nov 23 11:23:26 localhost gnome-session[16300]: Unable to init server: Could not connect: Connection refused
Nov 23 11:23:26 localhost journal[16501]: Cannot open display:
Nov 23 11:23:26 localhost gvfsd[16485]: A connection to the bus can't be made
Nov 23 11:23:26 localhost gnome-session[16300]: gnome-session-binary[16300]: GLib-GIO-WARNING: Error releasing name org.gnome.SessionManager: The connection is closed
Nov 23 11:23:26 localhost gnome-session-binary[16300]: GLib-GIO-WARNING: Error releasing name org.gnome.SessionManager: The connection is closed
Nov 23 11:23:26 localhost systemd[4475]: Stopping D-Bus User Message Bus...
Nov 23 11:23:26 localhost xrdp-sesman[16299]: (16299)(139867984213824)[CORE ] window manager (pid 16300) did exit, cleaning up session
Nov 23 11:23:26 localhost xrdp-sesman[16299]: (16299)(139867984213824)[INFO ] calling auth_stop_session and auth_end from pid 16299
Nov 23 11:23:26 localhost systemd[4475]: Stopped D-Bus User Message Bus.
Nov 23 11:23:26 localhost xrdp-sesman[3174]: Connections: closed: 127.0.0.1::56666 (Server shutdown)
Nov 23 11:23:26 localhost xrdp-sesman[3174]: EncodeManager: Framebuffer updates: 1
Nov 23 11:23:26 localhost xrdp-sesman[3174]: EncodeManager:   Raw:
Nov 23 11:23:26 localhost xrdp-sesman[3174]: EncodeManager:     Solid: 136 rects, 8.2944 Mpixels
Nov 23 11:23:26 localhost xrdp-sesman[3174]: EncodeManager:            15.8219 MiB (1:1 ratio)
Nov 23 11:23:26 localhost xrdp-sesman[3174]: EncodeManager:   Total: 136 rects, 8.2944 Mpixels
Nov 23 11:23:26 localhost xrdp-sesman[3174]: EncodeManager:          15.8219 MiB (1:1 ratio)
Nov 23 11:23:26 localhost xrdp-sesman[3174]: ComparingUpdateTracker: 0 pixels in / 0 pixels out
Nov 23 11:23:26 localhost xrdp-sesman[3174]: ComparingUpdateTracker: (1:-nan ratio)
Nov 23 11:23:26 localhost xrdp-sesman[3174]: (3174)(139867984213824)[INFO ] ++ terminated session:  username root, display :10.0, session_pid 16299, ip 10.10.70.254:1113 - socket: 12
Nov 23 11:23:26 localhost systemd[4475]: Started D-Bus User Message Bus.
Nov 23 11:23:26 localhost systemd-logind[2688]: Session c2 logged out. Waiting for processes to exit.
Nov 23 11:23:26 localhost xrdp-sesman[3174]: chansrv::main: using log file [/root/.local/share/xrdp/xrdp-chansrv.10.log]
Nov 23 11:23:26 localhost xrdp-sesman[3174]: [20201123-11:23:26] [CORE ] main: app started pid 16320(0x00003fc0)
Nov 23 11:23:26 localhost xrdp-sesman[3174]: [20201123-11:23:26] [INFO ] main: DISPLAY env var set to :10.0
Nov 23 11:23:26 localhost xrdp-sesman[3174]: [20201123-11:23:26] [INFO ] main: using DISPLAY 10
Nov 23 11:23:26 localhost xrdp-sesman[3174]: [20201123-11:23:26] [INFO ] channel_thread_loop: thread start
Nov 23 11:23:26 localhost xrdp-sesman[3174]: [20201123-11:23:26] [INFO ] Socket 12: AF_UNIX connection received
Nov 23 11:23:26 localhost xrdp-sesman[3174]: process_message_channel_setup: chan name 'rdpdr' id 0 flags 00000000
Nov 23 11:23:26 localhost xrdp-sesman[3174]: process_message_channel_setup: chan name 'rdpsnd' id 1 flags 00000000
Nov 23 11:23:26 localhost xrdp-sesman[3174]: process_message_channel_setup: chan name 'cliprdr' id 2 flags 00000000
Nov 23 11:23:26 localhost xrdp-sesman[3174]: process_message_channel_setup: chan name 'nlr3hv' id 3 flags 00000000
Nov 23 11:23:26 localhost xrdp-sesman[3174]: process_message_channel_setup: chan name 'nlw3hv' id 4 flags 00000000
Nov 23 11:23:26 localhost xrdp-sesman[3174]: process_message_channel_setup: chan name 'drdynvc' id 5 flags 00000000
Nov 23 11:23:26 localhost xrdp-sesman[3174]: xrdp-chansrv [4104204839]: xcommon_init: connected to display ok
Nov 23 11:23:26 localhost xrdp-sesman[3174]: xrdp-chansrv [4104204839]: sound_init:
Nov 23 11:23:26 localhost xrdp-sesman[3174]: xrdp-chansrv [4104204839]: audin_init:
Nov 23 11:23:26 localhost xrdp-sesman[3174]: xrdp-chansrv [4104204931]: sound_process_output_format:
Nov 23 11:23:26 localhost xrdp-sesman[3174]: xrdp-chansrv [4104204931]:       wFormatTag      1
Nov 23 11:23:26 localhost xrdp-sesman[3174]: xrdp-chansrv [4104204931]:       nChannels       2
Nov 23 11:23:26 localhost xrdp-sesman[3174]: xrdp-chansrv [4104204931]:       nSamplesPerSec  44100
Nov 23 11:23:26 localhost xrdp-sesman[3174]: xrdp-chansrv [4104204931]:       nAvgBytesPerSec 176400
Nov 23 11:23:26 localhost xrdp-sesman[3174]: xrdp-chansrv [4104204931]:       nBlockAlign     4
Nov 23 11:23:26 localhost xrdp-sesman[3174]: xrdp-chansrv [4104204931]:       wBitsPerSample  16
Nov 23 11:23:26 localhost xrdp-sesman[3174]: xrdp-chansrv [4104204931]:       cbSize          0
Nov 23 11:23:26 localhost xrdp-sesman[3174]: xrdp-chansrv [4104204931]: sound_process_output_format:
Nov 23 11:23:26 localhost xrdp-sesman[3174]: xrdp-chansrv [4104204931]:       wFormatTag      1
Nov 23 11:23:26 localhost xrdp-sesman[3174]: xrdp-chansrv [4104204931]:       nChannels       2
Nov 23 11:23:26 localhost xrdp-sesman[3174]: xrdp-chansrv [4104204931]:       nSamplesPerSec  22050
Nov 23 11:23:26 localhost xrdp-sesman[3174]: xrdp-chansrv [4104204931]:       nAvgBytesPerSec 88200
Nov 23 11:23:26 localhost xrdp-sesman[3174]: xrdp-chansrv [4104204931]:       nBlockAlign     4
Nov 23 11:23:26 localhost xrdp-sesman[3174]: xrdp-chansrv [4104204931]:       wBitsPerSample  16
Nov 23 11:23:26 localhost xrdp-sesman[3174]: xrdp-chansrv [4104204931]:       cbSize          0
Nov 23 11:23:26 localhost xrdp-sesman[3174]: xrdp-chansrv [4104205032]: sound_process_training: round trip time 101
Nov 23 11:23:26 localhost xrdp-sesman[3174]: xrdp-chansrv [4104205048]: scard_init:
Nov 23 11:23:26 localhost xrdp-sesman[3174]: chansrv:smartcard_pcsc [4104205048]: scard_pcsc_init:
Nov 23 11:23:26 localhost xrdp-sesman[3174]: chansrv:smartcard_pcsc [4104205048]: scard_pcsc_init: g_remove_dir failed
Nov 23 11:23:26 localhost xrdp-sesman[3174]: [20201123-11:23:26] [INFO ] term_signal_handler: got signal 15
Nov 23 11:23:26 localhost xrdp-sesman[3174]: [20201123-11:23:26] [INFO ] xserver_fatal_handler: entered.......
Nov 23 11:23:36 localhost systemd-logind[2688]: Removed session c2.

I am running into a problem where xRDP fails to respond to any RDP requests sent to a VM instance running in OCP under Ubuntu Server 20.04 with GNOME GUI installed (via sudo tasksel install ubuntu-desktop). The instance has UFW in "inactive" status and the VCN security list is configured to allow all ports from my NAT IP.

The instance successfully receives packets in dst port 3389 as seen in the following capture done on the OCP instance:

ubuntu@hitc-lab-vm1:~$ sudo tcpdump -nn -i ens3 port 3389
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens3, link-type EN10MB (Ethernet), capture size 262144 bytes
03:01:34.578853 IP <omitted>.56726 > 172.20.1.2.3389: Flags [S], seq 972912567, win 64240, options [mss 1460,nop,nop,sackOK], length 0
03:01:35.579071 IP <omitted>.56726 > 172.20.1.2.3389: Flags [S], seq 972912567, win 64240, options [mss 1460,nop,nop,sackOK], length 0
03:01:37.579039 IP <omitted>.56726 > 172.20.1.2.3389: Flags [S], seq 972912567, win 64240, options [mss 1460,nop,nop,sackOK], length 0
^C
3 packets captured
3 packets received by filter
0 packets dropped by kernel

If I cat /var/log/xrdp.log, I see no mentioning of the session request, even though the packets get to the server:

ubuntu@hitc-lab-vm1:~$ sudo cat /var/log/xrdp.log
[20200922-02:39:22] [INFO ] address [0.0.0.0] port [3389] mode 1
[20200922-02:39:22] [INFO ] listening to port 3389 on 0.0.0.0
[20200922-02:39:22] [INFO ] xrdp_listen_pp done
[20200922-02:39:22] [DEBUG] Closed socket 7 (AF_INET6 :: port 3389)
[20200922-02:39:24] [INFO ] starting xrdp with pid 2426
[20200922-02:39:24] [INFO ] address [0.0.0.0] port [3389] mode 1
[20200922-02:39:24] [INFO ] listening to port 3389 on 0.0.0.0
[20200922-02:39:24] [INFO ] xrdp_listen_pp done
[20200922-02:40:03] [DEBUG] Closed socket 11 (AF_INET6 :: port 3389)
[20200922-02:40:03] [INFO ] address [0.0.0.0] port [3389] mode 1
[20200922-02:40:03] [INFO ] listening to port 3389 on 0.0.0.0
[20200922-02:40:03] [INFO ] xrdp_listen_pp done
[20200922-02:40:03] [DEBUG] Closed socket 7 (AF_INET6 :: port 3389)
[20200922-02:40:05] [INFO ] starting xrdp with pid 2687
[20200922-02:40:05] [INFO ] address [0.0.0.0] port [3389] mode 1
[20200922-02:40:05] [INFO ] listening to port 3389 on 0.0.0.0
[20200922-02:40:05] [INFO ] xrdp_listen_pp done

xrdp-sesman log shows a very similar story but with the relevant ports into localhost from the sesman process:

ubuntu@hitc-lab-vm1:~$ sudo cat /var/log/xrdp-sesman.log
[20200922-02:39:22] [DEBUG] libscp initialized
[20200922-02:39:22] [DEBUG] Testing if xrdp-sesman can listen on 127.0.0.1 port 3350.
[20200922-02:39:22] [DEBUG] Closed socket 5 (AF_INET6 ::1 port 3350)
[20200922-02:39:22] [INFO ] starting xrdp-sesman with pid 2416
[20200922-02:39:22] [INFO ] listening to port 3350 on 127.0.0.1
[20200922-02:40:03] [INFO ] shutting down sesman 1
[20200922-02:40:03] [DEBUG] Closed socket 7 (AF_INET6 ::1 port 3350)
[20200922-02:40:03] [DEBUG] libscp initialized
[20200922-02:40:03] [DEBUG] Testing if xrdp-sesman can listen on 127.0.0.1 port 3350.
[20200922-02:40:03] [DEBUG] Closed socket 5 (AF_INET6 ::1 port 3350)
[20200922-02:40:03] [INFO ] starting xrdp-sesman with pid 2666
[20200922-02:40:03] [INFO ] listening to port 3350 on 127.0.0.1

If I spin up an Ubuntu Server 20.04 VM in VMware, install ubuntu-desktop through tasksel, then install xrdp, everything works as expected. Any help here is greatly appreciated.

I've installed ffmpeg on an AWS instance and have been unsuccessfuly trying to record an X session, to which I've connected over x11rdp, with the client being Microsoft Remote Desktop.

Here's the terminal command I am using and its output:

$ ffmpeg -f x11grab -s `xdpyinfo | grep 'dimensions:'|awk '{print $2}'` -r 25 -i $DISPLAY -pix_fmt yuv420p out.mp4
ffmpeg version N-80023-gd55568d Copyright (c) 2000-2016 the FFmpeg developers
  built with gcc 4.8 (Ubuntu 4.8.4-2ubuntu1~14.04.3)
  configuration: --prefix=/home/ubuntu/ffmpeg_build --pkg-config-flags=--static --extra-cflags=-I/home/ubuntu/ffmpeg_build/include --extra-ldflags=-L/home/ubuntu/ffmpeg_build/lib --bindir=/home/ubuntu/bin --enable-gpl --enable-libass --enable-libfreetype --enable-libtheora --enable-libvorbis --enable-libx264 --enable-libx265 --enable-x11grab --enable-nonfree
  libavutil      55. 24.100 / 55. 24.100
  libavcodec     57. 42.100 / 57. 42.100
  libavformat    57. 36.100 / 57. 36.100
  libavdevice    57.  0.101 / 57.  0.101
  libavfilter     6. 45.100 /  6. 45.100
  libswscale      4.  1.100 /  4.  1.100
  libswresample   2.  0.101 /  2.  0.101
  libpostproc    54.  0.100 / 54.  0.100
[x11grab @ 0x315b520] XFixes not available, cannot draw the mouse.
[x11grab @ 0x315b520] Stream #0: not enough frames to estimate rate; consider increasing probesize
Input #0, x11grab, from ':11.0':
  Duration: N/A, start: 1463527353.437056, bitrate: N/A
    Stream #0:0: Video: rawvideo (BGR[0] / 0x524742), bgr0, 1920x1080, 25 fps, 1000k tbr, 1000k tbn
File 'out.mp4' already exists. Overwrite ? [y/N] y
[libx264 @ 0x31644e0] using cpu capabilities: MMX2 SSE2Fast SSSE3 SSE4.2 AVX AVX2 FMA3 LZCNT BMI2
[libx264 @ 0x31644e0] profile High, level 4.0
[libx264 @ 0x31644e0] 264 - core 142 r2389 956c8d8 - H.264/MPEG-4 AVC codec - Copyleft 2003-2014 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=6 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00
[mp4 @ 0x3162e20] Using AVStream.codec to pass codec parameters to muxers is deprecated, use AVStream.codecpar instead.
Output #0, mp4, to 'out.mp4':
  Metadata:
    encoder         : Lavf57.36.100
    Stream #0:0: Video: h264 ([33][0][0][0] / 0x0021), yuv420p, 1920x1080, q=2-31, 25 fps, 12800 tbn
    Metadata:
      encoder         : Lavc57.42.100 libx264
    Side data:
      cpb: bitrate max/min/avg: 0/0/0 buffer size: 0 vbv_delay: -1
Stream mapping:
  Stream #0:0 -> #0:0 (rawvideo (native) -> h264 (libx264))
Press [q] to stop, [?] for help
frame=  306 fps= 63 q=-1.0 Lsize=      27kB time=00:00:12.12 bitrate=  18.2kbits/s speed=2.51x    
video:22kB audio:0kB subtitle:0kB other streams:0kB global headers:0kB muxing overhead: 19.554649%
[libx264 @ 0x31644e0] frame I:2     Avg QP: 7.50  size:   426
[libx264 @ 0x31644e0] frame P:77    Avg QP: 9.14  size:    77
[libx264 @ 0x31644e0] frame B:227   Avg QP:12.67  size:    69
[libx264 @ 0x31644e0] consecutive B-frames:  1.0%  0.0%  1.0% 98.0%
[libx264 @ 0x31644e0] mb I  I16..4: 100.0%  0.0%  0.0%
[libx264 @ 0x31644e0] mb P  I16..4:  0.0%  0.0%  0.0%  P16..4:  0.0%  0.0%  0.0%  0.0%  0.0%    skip:100.0%
[libx264 @ 0x31644e0] mb B  I16..4:  0.0%  0.0%  0.0%  B16..8:  0.0%  0.0%  0.0%  direct: 0.0%  skip:100.0%
[libx264 @ 0x31644e0] 8x8 transform intra:0.0%
[libx264 @ 0x31644e0] coded y,uvDC,uvAC intra: 0.0% 0.0% 0.0% inter: 0.0% 0.0% 0.0%
[libx264 @ 0x31644e0] i16 v,h,dc,p: 99%  0%  1%  0%
[libx264 @ 0x31644e0] i8c dc,h,v,p: 100%  0%  0%  0%
[libx264 @ 0x31644e0] Weighted P-Frames: Y:0.0% UV:0.0%
[libx264 @ 0x31644e0] kb/s:14.61

Opening out.mp4 in vlc results in a black screen.

I've reviewed a series of forum posts as well as probably all of the questions/answers in stackexchange and have attempted just as many solutions, but none seem to do the trick.

Interestingly, this question lists attempting the following:

$ xwd -root -silent -display :99.0 | xwdtopnm |pnmtojpeg > screen.jpg

That command definitely worked as well, substituting $DISPLAY for :99.0.