XRDP - доступ к альт сервер 8 (не работает)

[deus]

Доброго времени суток друзья!
Недавно начал изучение среды Alt Linux server, и следуя мануалу решил организовать удаленный доступ к ней из под Win7 через стандартный удаленный рабочий стол.
Фаерволл на альте - выключен. С компьютера с Win7 адрес пингуется, порт 3389 открыт. При попытке подключения выдает текст: соединение прервано из за сетевой ошибки.
Дополнительно на альте установлен и сконфигурирован OpenSSL, в конфиг добавлен метод TLS 1.0, юзер добавлен в группу tsusers. В общем все возможные (даже по звуку) настройки выполнены. Результат отрицательный. Прошу Вашего совета и помощи, чтобы понять - где упущение.
Прилагаю логи.

xrdp.log

Код: [Выделить]

[20191020-15:52:26] [DEBUG] Testing if xrdp can listen on 0.0.0.0 port 3389.
[20191020-15:52:26] [DEBUG] Closed socket 7 (AF_INET 0.0.0.0:3389)
[20191020-15:52:28] [INFO ] starting xrdp with pid 784
[20191020-15:52:28] [INFO ] listening to port 3389 on 0.0.0.0
[20191020-15:55:11] [INFO ] Socket 12: AF_INET connection received from 192.168.0.100 port 49639
[20191020-15:55:11] [DEBUG] Closed socket 12 (AF_INET 192.168.0.133:3389)
[20191020-15:55:11] [DEBUG] Closed socket 11 (AF_INET 0.0.0.0:3389)
[20191020-15:55:11] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20191020-15:55:11] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20191020-15:55:11] [WARN ] TLSv1.3 enabled by config, but not supported by system OpenSSL
[20191020-15:55:11] [DEBUG] TLSv1.2 enabled
[20191020-15:55:11] [DEBUG] Security layer: requested 3, selected 1
[20191020-15:55:11] [DEBUG] Closed socket 12 (AF_INET 192.168.0.133:3389)
[20191020-15:55:11] [INFO ] Socket 12: AF_INET connection received from 192.168.0.100 port 49640
[20191020-15:55:11] [DEBUG] Closed socket 12 (AF_INET 192.168.0.133:3389)
[20191020-15:55:11] [DEBUG] Closed socket 11 (AF_INET 0.0.0.0:3389)
[20191020-15:55:11] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20191020-15:55:12] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20191020-15:55:12] [WARN ] TLSv1.3 enabled by config, but not supported by system OpenSSL
[20191020-15:55:12] [DEBUG] TLSv1.2 enabled
[20191020-15:55:12] [DEBUG] Security layer: requested 3, selected 1
[20191020-15:55:12] [DEBUG] Closed socket 12 (AF_INET 192.168.0.133:3389)
[20191020-15:55:33] [INFO ] Socket 12: AF_INET connection received from 192.168.0.100 port 49642
[20191020-15:55:33] [DEBUG] Closed socket 12 (AF_INET 192.168.0.133:3389)
[20191020-15:55:33] [DEBUG] Closed socket 11 (AF_INET 0.0.0.0:3389)
[20191020-15:55:33] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20191020-15:55:33] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20191020-15:55:33] [WARN ] TLSv1.3 enabled by config, but not supported by system OpenSSL
[20191020-15:55:33] [DEBUG] TLSv1.2 enabled
[20191020-15:55:33] [DEBUG] Security layer: requested 3, selected 1
[20191020-15:55:33] [DEBUG] Closed socket 12 (AF_INET 192.168.0.133:3389)
[20191020-15:55:33] [INFO ] Socket 12: AF_INET connection received from 192.168.0.100 port 49643
[20191020-15:55:33] [DEBUG] Closed socket 12 (AF_INET 192.168.0.133:3389)
[20191020-15:55:33] [DEBUG] Closed socket 11 (AF_INET 0.0.0.0:3389)
[20191020-15:55:33] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20191020-15:55:33] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20191020-15:55:33] [WARN ] TLSv1.3 enabled by config, but not supported by system OpenSSL
[20191020-15:55:33] [DEBUG] TLSv1.2 enabled
[20191020-15:55:33] [DEBUG] Security layer: requested 3, selected 1
[20191020-15:55:33] [DEBUG] Closed socket 12 (AF_INET 192.168.0.133:3389)
[20191020-15:57:08] [INFO ] Socket 12: AF_INET connection received from 192.168.0.100 port 49755
[20191020-15:57:08] [DEBUG] Closed socket 12 (AF_INET 192.168.0.133:3389)
[20191020-15:57:08] [DEBUG] Closed socket 11 (AF_INET 0.0.0.0:3389)
[20191020-15:57:08] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20191020-15:57:08] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20191020-15:57:08] [WARN ] TLSv1.3 enabled by config, but not supported by system OpenSSL
[20191020-15:57:08] [DEBUG] TLSv1.2 enabled
[20191020-15:57:09] [DEBUG] Closed socket 12 (AF_INET 192.168.0.133:3389)
[20191020-15:57:09] [INFO ] Socket 12: AF_INET connection received from 192.168.0.100 port 49769
[20191020-15:57:09] [DEBUG] Closed socket 12 (AF_INET 192.168.0.133:3389)
[20191020-15:57:09] [DEBUG] Closed socket 11 (AF_INET 0.0.0.0:3389)
[20191020-15:57:09] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20191020-15:57:09] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20191020-15:57:09] [WARN ] TLSv1.3 enabled by config, but not supported by system OpenSSL
[20191020-15:57:09] [DEBUG] TLSv1.2 enabled
[20191020-15:57:09] [DEBUG] Closed socket 12 (AF_INET 192.168.0.133:3389)
[20191020-15:57:10] [INFO ] Socket 12: AF_INET connection received from 192.168.0.100 port 49782
[20191020-15:57:10] [DEBUG] Closed socket 12 (AF_INET 192.168.0.133:3389)
[20191020-15:57:10] [DEBUG] Closed socket 11 (AF_INET 0.0.0.0:3389)
[20191020-15:57:10] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20191020-15:57:10] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20191020-15:57:10] [WARN ] TLSv1.3 enabled by config, but not supported by system OpenSSL
[20191020-15:57:10] [DEBUG] TLSv1.2 enabled
[20191020-15:57:10] [DEBUG] Closed socket 12 (AF_INET 192.168.0.133:3389)
[20191020-15:57:11] [INFO ] Socket 12: AF_INET connection received from 192.168.0.100 port 49788
[20191020-15:57:11] [DEBUG] Closed socket 12 (AF_INET 192.168.0.133:3389)
[20191020-15:57:11] [DEBUG] Closed socket 11 (AF_INET 0.0.0.0:3389)
[20191020-15:57:11] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20191020-15:57:11] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20191020-15:57:11] [WARN ] TLSv1.3 enabled by config, but not supported by system OpenSSL
[20191020-15:57:11] [DEBUG] TLSv1.2 enabled
[20191020-15:57:11] [DEBUG] Closed socket 12 (AF_INET 192.168.0.133:3389)

xrdp-sesman.log

Код: [Выделить]

[20191020-00:22:23] [DEBUG] libscp initialized
[20191020-00:22:23] [DEBUG] Testing if xrdp-sesman can listen on 127.0.0.1 port 3350.
[20191020-00:22:23] [DEBUG] Closed socket 1 (AF_INET 127.0.0.1:3350)
[20191020-00:22:23] [INFO ] starting xrdp-sesman with pid 3475
[20191020-00:22:23] [INFO ] listening to port 3350 on 127.0.0.1
[20191020-00:29:14] [INFO ] shutting down sesman 1
[20191020-00:29:14] [INFO ] shutting down sesman 1
[20191020-00:29:14] [DEBUG] Closed socket 7 (AF_INET 127.0.0.1:3350)
[20191020-00:29:14] [DEBUG] libscp initialized
[20191020-00:29:14] [DEBUG] Testing if xrdp-sesman can listen on 127.0.0.1 port 3350.
[20191020-00:29:14] [DEBUG] Closed socket 1 (AF_INET 127.0.0.1:3350)
[20191020-00:29:14] [INFO ] starting xrdp-sesman with pid 3715
[20191020-00:29:14] [INFO ] listening to port 3350 on 127.0.0.1
[20191020-01:16:14] [INFO ] shutting down sesman 1
[20191020-01:16:14] [INFO ] shutting down sesman 1
[20191020-01:16:14] [DEBUG] Closed socket 7 (AF_INET 127.0.0.1:3350)
[20191020-01:17:19] [DEBUG] libscp initialized
[20191020-01:17:19] [DEBUG] Testing if xrdp-sesman can listen on 127.0.0.1 port 3350.
[20191020-01:17:20] [DEBUG] Closed socket 1 (AF_INET 127.0.0.1:3350)
[20191020-01:17:20] [INFO ] starting xrdp-sesman with pid 671
[20191020-01:17:20] [INFO ] listening to port 3350 on 127.0.0.1
[20191020-01:42:58] [INFO ] shutting down sesman 1
[20191020-01:42:58] [INFO ] shutting down sesman 1
[20191020-01:42:58] [DEBUG] Closed socket 7 (AF_INET 127.0.0.1:3350)
[20191020-15:52:24] [DEBUG] libscp initialized
[20191020-15:52:25] [DEBUG] Testing if xrdp-sesman can listen on 127.0.0.1 port 3350.
[20191020-15:52:25] [DEBUG] Closed socket 1 (AF_INET 127.0.0.1:3350)
[20191020-15:52:25] [INFO ] starting xrdp-sesman with pid 763
[20191020-15:52:25] [INFO ] listening to port 3350 on 127.0.0.1

xrdp.ini

Код: [Выделить]

[Globals]
; xrdp.ini file version number
ini_version=1

; fork a new process for each incoming connection
fork=true
; tcp port to listen
port=3389
; 'port' above should be connected to with vsock instead of tcp
use_vsock=false
; regulate if the listening socket use socket option tcp_nodelay
; no buffering will be performed in the TCP stack
tcp_nodelay=true
; regulate if the listening socket use socket option keepalive
; if the network connection disappear without close messages the connection will be closed
tcp_keepalive=true
#tcp_send_buffer_bytes=32768
#tcp_recv_buffer_bytes=32768

; security layer can be 'tls', 'rdp' or 'negotiate'
; for client compatible layer
security_layer=negotiate
; minimum security level allowed for client
; can be 'none', 'low', 'medium', 'high', 'fips'
crypt_level=high
; X.509 certificate and private key
; openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365
certificate=
key_file=
; set SSL protocols
; can be comma separated list of 'SSLv3', 'TLSv1', 'TLSv1.1', 'TLSv1.2', 'TLSv1.3'
ssl_protocols=TLSv1.2, TLSv1.2, TLSv1.3
; For Windows XP we need to add TLSv1.1 to ssl_protocols
;ssl_protocols=TLSv1.1, TLSv1.2, TLSv1.3
; set TLS cipher suites
#tls_ciphers=HIGH

; Section name to use for automatic login if the client sends username
; and password. If empty, the domain name sent by the client is used.
; If empty and no domain name is given, the first suitable section in
; this file will be used.
autorun=

allow_channels=true
allow_multimon=true
bitmap_cache=true
bitmap_compression=true
bulk_compression=true
#hidelogwindow=true
max_bpp=32
new_cursors=true
; fastpath - can be 'input', 'output', 'both', 'none'
use_fastpath=both
; when true, userid/password *must* be passed on cmd line
#require_credentials=true
; You can set the PAM error text in a gateway setup (MAX 256 chars)
#pamerrortxt=change your password according to policy at http://url

;
; colors used by windows in RGB format
;
blue=009cb5
grey=dedede
#black=000000
#dark_grey=808080
#blue=08246b
#dark_blue=08246b
#white=ffffff
#red=ff0000
#green=00ff00
#background=626c72

;
; configure login screen
;

; Login Screen Window Title
#ls_title=My Login Title

; top level window background color in RGB format
ls_top_window_bg_color=009cb5

; width and height of login screen
ls_width=350
ls_height=430

; login screen background color in RGB format
ls_bg_color=dedede

; optional background image filename (bmp format).
#ls_background_image=

; logo
; full path to bmp-file or file in shared folder
ls_logo_filename=
ls_logo_x_pos=55
ls_logo_y_pos=50

; for positioning labels such as username, password etc
ls_label_x_pos=30
ls_label_width=65

; for positioning text and combo boxes next to above labels
ls_input_x_pos=110
ls_input_width=210

; y pos for first label and combo box
ls_input_y_pos=220

; OK button
ls_btn_ok_x_pos=142
ls_btn_ok_y_pos=370
ls_btn_ok_width=85
ls_btn_ok_height=30

; Cancel button
ls_btn_cancel_x_pos=237
ls_btn_cancel_y_pos=370
ls_btn_cancel_width=85
ls_btn_cancel_height=30

[Logging]
LogFile=xrdp.log
LogLevel=DEBUG
EnableSyslog=true
SyslogLevel=DEBUG
; LogLevel and SysLogLevel could by any of: core, error, warning, info or debug

[Channels]
; Channel names not listed here will be blocked by XRDP.
; You can block any channel by setting its value to false.
; IMPORTANT! All channels are not supported in all use
; cases even if you set all values to true.
; You can override these settings on each session type
; These settings are only used if allow_channels=true
rdpdr=true
rdpsnd=true
drdynvc=true
cliprdr=true
rail=true
xrdpvr=true
tcutils=true

; for debugging xrdp, in section xrdp1, change port=-1 to this:
#port=/tmp/.xrdp/xrdp_display_10

; for debugging xrdp, add following line to section xrdp1
#chansrvport=/tmp/.xrdp/xrdp_chansrv_socket_7210


;
; Session types
;

; Some session types such as Xorg, X11rdp and Xvnc start a display server.
; Startup command-line parameters for the display server are configured
; in sesman.ini. See and configure also sesman.ini.
[Xorg]
name=Xorg
lib=libxup.so
username=ask
password=ask
ip=127.0.0.1
port=-1
code=20

#[Xvnc]
#name=Xvnc
#lib=libvnc.so
#username=ask
#password=ask
#ip=127.0.0.1
#port=-1
#xserverbpp=24
#delay_ms=2000

#[vnc-any]
#name=vnc-any
#lib=libvnc.so
#ip=ask
#port=ask5900
#username=na
#password=ask
#pamusername=asksame
#pampassword=asksame
#pamsessionmng=127.0.0.1
#delay_ms=2000

#[neutrinordp-any]
#name=neutrinordp-any
#lib=libxrdpneutrinordp.so
#ip=ask
#port=ask3389
#username=ask
#password=ask

; You can override the common channel settings for each session type
#channel.rdpdr=true
#channel.rdpsnd=true
#channel.drdynvc=true
#channel.cliprdr=true
#channel.rail=true
#channel.xrdpvr=true


[Skull]

Под Линуксом сначала попробуйте через xfreerdp. И обновите систему целиком, для актуального xrdp нужен xorg-server.

[deus]

Я сразу же обновил ядро и пакеты. Xorg установлен. Попробую с другого ПК на линуксе, отпишусь.

[deus]

Под Линуксом сначала попробуйте через xfreerdp. И обновите систему целиком, для актуального xrdp нужен xorg-server.

Через Линукс попробовал (remmina), результат такой же. Невозможно соединиться. Логи проверил, ничего нового ошибки такие же...

[Skull]

Я разве предлагал remmina? Вы невнимательно читаете.

[deus]

Код: [Выделить]

ubuntu@ubuntu:~$ ping 192.168.0.100
PING 192.168.0.100 (192.168.0.100) 56(84) bytes of data.
64 bytes from 192.168.0.100: icmp_seq=1 ttl=64 time=0.048 ms
64 bytes from 192.168.0.100: icmp_seq=2 ttl=64 time=0.038 ms
64 bytes from 192.168.0.100: icmp_seq=3 ttl=64 time=0.034 ms
64 bytes from 192.168.0.100: icmp_seq=4 ttl=64 time=0.035 ms
^C
--- 192.168.0.100 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3068ms
rtt min/avg/max/mdev = 0.034/0.038/0.048/0.009 ms
ubuntu@ubuntu:~$ xfreerdp /u:хххх /p:хххххх /w:1366 /h:768 /v:192.168.0.100:3389
unable to connect to 192.168.0.100:3389
Error: protocol security negotiation or connection failure
ubuntu@ubuntu:~$
Подключение не удалось, в общем все по прежнему

[z79av]

Xorg установлен.

Одного Xorg мало. К серверу обязательно поставьте xinit и какое-нибудь DE.
У Вас по startx графика запускается?

[Skull]

Запустите с ключом /sec:rdp

[Skull]

Проверьте, запущены ли службы xrdp-sesman и xrdp и смотрите логи. Клиент при первом подключении должен принять сертификат сервера.

[Mr.Madguy]

Сколько не пытался использовать всякие средства удаленного подключения, всегда что то шло не так. Или изображение криво отображается или текст не в той кодировке. Для меня лучше всего работает просто подключение по SSH через Cygwin.

[rits]

Я всегда так ставлю:
(yes | apt-get install xrdp && usermod -a -G tsusers ИмяПользователяПодКоторымВход && yes | apt-get reinstall xrdp && systemctl enable xrdp && systemctl start xrdp  && systemctl status xrdp)
обязательно apt-get reinstall xrdp

[Skull]

Почему reinstall? Скрипты создания сертификатов не работают что ли?

[z79av]

Alt Linux server

Поподробнее бы...
Я почему-то подумал на стартеркит. А что на самом деле? И какая платформа? p7, p8, p9?

[rits]

Почему reinstall? Скрипты создания сертификатов не работают что ли?

session менеджер, что-то там барагозит и повторная установка, до сосздает новые каталоги какие то, которые при первом запуске не находит.

[deus]

Добрый день.
Спасибо всем за Ваши ответы. Отсутствовал в связи с переходом с 8=>9 версию сервера альты.
По вопросу xrdp, я добился работы терминального сервера. Заодно проделал Ваши рекомендации ниже.

Я всегда так ставлю:
(yes | apt-get install xrdp && usermod -a -G tsusers ИмяПользователяПодКоторымВход && yes | apt-get reinstall xrdp && systemctl enable xrdp && systemctl start xrdp  && systemctl status xrdp)
обязательно apt-get reinstall xrdp

Вот такой лог выдал терминал.

Код: [Выделить]

ноя 02 14:52:45 localhost.localdomain xrdp[4300]: (4300)(140163829382464)[DEBUG] Closed socket 7 (AF_INET 0.0.0.0:3389)
ноя 02 14:52:45 localhost.localdomain systemd[1]: xrdp.service: Can't open PID file /run/xrdp.pid (yet?) after start: No such file or directory
ноя 02 14:52:46 localhost.localdomain systemd[1]: Started xrdp daemon.
ноя 02 14:52:47 localhost.localdomain xrdp[4301]: (4301)(140163829382464)[INFO ] starting xrdp with pid 4301
ноя 02 14:52:48 localhost.localdomain xrdp[4301]: (4301)(140163829382464)[INFO ] address [0.0.0.0] port [3389] mode 1
ноя 02 14:52:48 localhost.localdomain xrdp[4301]: (4301)(140163829382464)[INFO ] listening to port 3389 on 0.0.0.0
ноя 02 14:52:48 localhost.localdomain xrdp[4301]: (4301)(140163829382464)[INFO ] xrdp_listen_pp done
ноя 02 14:52:50 localhost.localdomain systemd[1]: /lib/systemd/system/xrdp.service:9: PIDFile= references a path below legacy directory /var/run/, updating /var/run/xrdp.pid → /run/xrdp.pid; please update the unit file accordingly.
ноя 02 14:52:50 localhost.localdomain systemd[1]: /lib/systemd/system/xrdp.service:9: PIDFile= references a path below legacy directory /var/run/, updating /var/run/xrdp.pid → /run/xrdp.pid; please update the unit file accordingly.
ноя 02 14:52:51 localhost.localdomain systemd[1]: /lib/systemd/system/xrdp.service:9: PIDFile= references a path below legacy directory /var/run/, updating /var/run/xrdp.pid → /run/xrdp.pid; please update the unit file accordingly.Сейчас при доступе через xfreeedp у меня появляется заставка (см вложение), также прилагаю скрин с логом из терминала.
Графическая оболочка не стартует, или около того. При настройке xrdp я указывал ему на использование существующей оболочки Mate.
Не знаю, стоит ли установить KDE, или что то подобное и настроить eе использование xrdp?