xRDP – cannot read /etc/xrdp/key.pem. Permission denied error #5976
Labels
Milestone
Comments
|
I recognised this but thought it is only relevant if you do key authentication instead of password authentication, isn't it? Sadly the guide you linked as well doesn't say anything about what it's used for. However, that those are symlinks to the dummy/snakeoil certificate (shipped by So instead of setting it up to use snakeoil, we should find out what exactly it is, how to use it properly, document that and disable it completely by default (so that it does not try to load the snakeoil cert). |
MichaIng
added
the
Visual 🌹
|
Okay its about TLS encryption for client connections via TLS. A key and a cert needs to be set both: https://manpages.debian.org/bullseye/xrdp/xrdp.ini.5.en.html#certificate This generally makes sense to have enabled OOTB, but I'm not sure what the Windows RDP client does when not trusting the cert, which would be the case with the default snake oil one or any self-signed one, unless going through the process or adding it to the trusted certs/CA store. |
|
Found the Debian bug report about this: https://bugs.debian.org/860890
How I hate such kind of answers. This is one of the reasons so many "How to start with Linux" guides recommend Ubuntu over Debian, which is otherwise nonsense... Why is the We'll do this in |
MichaIng
added a commit
that referenced
this issue
Feb 12, 2023
- Init v8.15 - DietPi-Software | XRDP: TLS via snakeoil certificate is now enabled OOTB. This leads to a warning shown on Windows RDP clients until either a proper certificate signed by a trusted CA is used (e.g. by Let's Encrypt), or it is muted for the particular server via checkbox at the client. Many thanks to @amibumping for providing the needed step: #5976
MichaIng
added
Enhancement 💨
Solution available 🥂
|
Done with: f8a272a |
This was referenced Mar 4, 2023
Merged
Merged
|
I dont' know if it's correct to answer on a closed issue, but xrdp has received and update, and after this I can no login with root&dietpi users. I tried to reinstall xrdp but again the same. I run Thank you @MichaIng |
|
This error did never break anything but was only an information that XRDP had no permissions to access the snakeoil certificate, and hence only non-encrypted traffic was possible. This is however negotiated automatically between client and server, unless you enforce TLS at one side. The last update of XRDP was last December, hence before this issue was solved, so since then nothing about the matter has changed. We did never apply the change for running systems, only for fresh XRDP installs or reinstall. You can manually apply it: sudo usermod -aG ssl-cert xrdpWhile this mutes the warning, I guess it does not solve your connection issue. Could you paste the full service log? |
|
I am not saying is a dietpi problem but xrdp. I use it everyday, yesterday was working, and today after the update and restarting the service it broke. This is the full log, and an attempt to log.
EDIT: I format the log better than before. This is the update it came to the system: https://tracker.debian.org/news/1464392/accepted-xrdp-09211-1deb11u1-source-into-oldstable-security/ Other user having the error after the update, the proposed solution is to rebuild xorgxrdp, how can we do that @MichaIng? |
|
We don't build these packages ourselves. We use upstream packages provided by Debian repository. |
|
Oh, this version was not yet visible in the online database yesterday. Let me see whether I can replicate the issue. So the issue is that XRDP is now our of sync with |
|
That's correct @MichaIng 2 options, waiting for Debian to update it or rebuilding it manually. |
|
Jep, or installing TigerVNC and use Xvnc login method. I'll try to re-assign the Debian bug report to the xorgxrdp package as the xrdp maintainer does not seem to be aware that xorgxrdp is provided by Debian as well. |
|
Already fixed 👍 |
|
That was fast indeed. They did not pushed a new (upstream) version but backported the particular needed patch. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Creating a bug report/issue
Required Information
Linux DietPi 5.19.17-meson64 #22.11.1 SMP PREEMPT Wed Nov 30 11:05:42 UTC 2022 aarch64 GNU/LinuxRandomly I've found this error on xRDP log:
[20221214-09:43:09] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
As I can read, the problem is because the user xrdp don't have access to ssl folder to read the real cert that is linked.
https://c-nergy.be/blog/?p=13708
The solution is to add user xrdp into ssl-cert group
The text was updated successfully, but these errors were encountered: