xrdp with ldap accounts #2248
Replies: 3 comments 4 replies
-
|
Hi @martin82dd What do you mean by 'session number'? Please provide a few logs so we can see what's going on. Also, what do Thanks |
Beta Was this translation helpful? Give feedback.
-
|
Regards, |
Beta Was this translation helpful? Give feedback.
-
|
I must restart xrdp : systemctl restart xrdp to have a successful auth again, but always the second one failed. |
Beta Was this translation helpful? Give feedback.
-
|
The I'm not familiar with OpenOTP, but it looks like the PAM stack is calling the module, and the module isn't returning. So either the request isn't being sent, or the server isn't picking it up. Wireshark should let you determine which of these is the case. Are you seeing outgoing activity on the SOAP port? As the same PID is involved, it's possible the client is re-using the TCP connection for the second authentication. Do you have any firewalls or proxies in place between the client and the server which could be dropping the TCP connection without sending a RST? Other than that I can't suggest much. This looks like a commercial product. Do you have a support contract in place for it? |
Beta Was this translation helpful? Give feedback.
-
|
Hello, We are the provider of OpenOTP authentication server. Just to recap the issue encountered here :
According to our investigations, there is something strange with XRDP and PAM-OpenOTP integration. PAM-OpenOTP is a module for PAM authentication on Linux system which perform calls to OpenOTP authentication server for users authentications. It can be integrated with any services able to use PAM for authentication. We are able to have the XRDP authentication working with OpenOTP through PAM at some point:
Found below, the full stack of log for XRDP machine for the first authentication with OpenOTP through PAM : ------------------- 1st authentication ------------------- ==> messages <== ==> xrdp.log <== ==> messages <== ==> xrdp.log <== ==> xrdp-sesman.log <== ==> messages <== ==> secure <== ==> xrdp.log <== ==> xrdp-sesman.log <== ==> messages <== ==> secure <== ==> messages <== OpenOTP Backend log (just for your information) : 2022-05-18 11:11:09] [172.16.3.69:59204] [OpenOTP:INM7PM43] New openotpSimpleLogin SOAP request At this point, we are successfuly authenticated with xrdp user on the XRDP server through OpenOTP and RDP session is opened. ------------------- 2nd authentication ------------------- Now we try to perform the secondary/next authentications. From that point we can not be authenticated successfully any user. ==> messages <== ==> xrdp.log <== ==> messages <== ==> xrdp.log <== ==> xrdp-sesman.log <== ==> messages <== ==> xrdp.log <== ==> xrdp-sesman.log <== OpenOTP Backend log : NO LOGS, no request arrived, tcpdump show us that no communication has been sent from XRDP machine to OpenOTP server even if in /var/log/message we see the following : May 17 18:16:54 localhost openotp[5606]: Sending OpenOTP SimpleLogin request for user xrdp I can even see that the credentials are filled to my library in /var/log/messages : May 17 18:16:54 localhost xrdp[6675]: [INFO ] xrdp_wm_log_msg: sesman connect ok But it is like the request is never submitted and a failure is returned by my lib without response from the backend. Now, If we restart the XRDP and XRDP-SESMAN services, the authentication will works again one time. You can imagine that it is not viable for authentication integration ^^ My question is, is there any difference on your side during the first and next authentication ? Found also below, the xrdp-sesman PAM configuration file which is applied for authentication : #%PAM-1.0 auth required pam_env.so account required pam_nologin.so session required pam_selinux.so close session required pam_selinux.so open env_params That configuration works for SSH, it also works for the first authentication with XRDP server. Regards |
Beta Was this translation helpful? Give feedback.
-
|
Hi @rcdevs - good to hear from you. The authentication used by xrdp-sesman works like this:-
It's not optimal - you've probably spotted the memory leak already, and there are other issues (#1684). We're working on moving the authentication phase into the sub-process (see #1961). This is not as straightforward as it might seem however, as we need to handle reconnections as well as new sessions, which isn't a problem ssh has. With that background, here are the answers to your questions:-
Not that I'm aware of.
It's possible that there's some coupling between the previous PAM stack (still loaded in the main process) and the new one started with the call to Is that helpful? |
Beta Was this translation helpful? Give feedback.
-
|
Hi, Thank very much for your quick response. Regards |
Beta Was this translation helpful? Give feedback.
-
Hello,
We were wondering if you could help us use xRDP with Ldap accounts.The first login with PAM and remote account worked successfully, but the Second login with PAM (not working -Request never received on the authentication server. Same session number in PAM Logs which looks not correct.
Regards,
Beta Was this translation helpful? Give feedback.
All reactions