Trying to deny file transfer from server to client - XRDP 0.9.17 / Ubuntu 22.04

[McSh4dow]

Hi!

I've set EnableFuseMount=false in [Chansrv] section in sesman.ini. Unfortunately I am still able to transfer files from xrdp server (U22.04) to my client (Win10) - the other way is being blocked. There is no thinclient_drives mounted.

Is there a way to block the file transfer from xrdp server to the clients? Shouldn't it be done by setting EnableFuseMount to false?

I also tried umount thinclient_drives on logon and also using another mount point (/tmp/FuseMount) with chmod 700, so users cannot access it -> No success...

For these tests I went from Ubuntu 20.04 (focal) to Ubuntu 22.04 (jammy) and updated xrdp (from 0.9.12 to 0.9.17) in the same process.

Thanks for your help and best wishes
McSh4dow

[akarl10]

A quick look at the source I think such a policy option does not exist. As you found out fuse is only needed for client to server, not the other way around.
In the server to client case the server has direct read access to the file and "simply" transfers that to the client (xrdp-chansrv openes the file). The other way xrdp fakes the path of the file you want to copy to a supposedly local file under thinclient_drives/.clipboard, else the server side application has no way to get the file content (the application, ex. dolphin/kio_file openes the file).

The best would probably open a new issue and ask for a policy to disable file transfer via clipboard.

[matt335672]

@McSh4dow - for the record, can you add more detail as to how you are transferring the files?

If you're using the clipboard for this, you might want to look into #2081 and #2082, merged for xrdp v0.9.19.

[TOMATO-ONE]

Hello. @McSh4dow

I understood that what you want to do is to prevent users from being able to copy files from the Ubuntu 22.04 desktop in any way.

I think that can be done by setting xrdp.ini.
I believe there are three ways to do this.

1. Disable the RDP virtual channel. Note that this will disable the clipboard as well as sound redirection, etc.

[Global]
allow_channels=false

2. Disables the clipboard in all sections.

[Channels]
cliprdr=false

3. Disables the clipboard on a section-by-section basis, overriding the setting in the [Channels] section.
   Here is an example for the [Xorg] section.

[Xorg]
channels.cliprdr=false

Note that if you set EnableFuseMount=true in sesman.ini, then rdpdr must also be false.

[Channels]
rdpdr=false

or

[Xorg]
channel.rdpdr=false

This setting also disables clipboard copy/paste of strings, see @matt335672 's point #2081 #2082 for finer control.

I hope this will be of use to you.