Ubuntu – xrdp setup over ssh

sshxrdp

Here are the steps to install xrdp on ubuntu 12.04 and get it working:

http://www.ubuntututorials.com/remote-desktop-ubuntu-12-04-windows-7/

However, I want a secure xrdp connection over ssh and I am able to achieve it by using port forwarding in the software putty as below:

L1234 ==> localhost:3389

But I am still able to remote login to the ubuntu through xrdp connection when I am not connected using SSH.

It is supposed to deny remote login when SSH is not present.

In the file

/etc/xrdp/xrdp.ini

I tried to change the [global] section by adding "ip=127.0.0.1" and it didn't work.

Best Answer

I think that the xrdp.ini parameter that controls the listening interface IP is called 'address' not 'ip' i.e. in the globals section:

[globals]
address=127.0.0.1

At least, this works for me - however note that I am using a source-built xrdp from http://scarygliders.net/x11rdp-o-matic-central-downloads-page/ so I can't guarantee it is supported in the default packaged version.

The closure of the port can be confirmed by running netstat on the remote host, or using nmap i.e. before adding 'address=127.0.0.1' to the [globals] section:

$ sudo nmap -p 3389 192.168.1.16

Starting Nmap 5.21 ( http://nmap.org ) at 2013-08-05 02:08 UTC
Nmap scan report for 192.168.1.16
Host is up (0.0065s latency).
PORT     STATE SERVICE
3389/tcp open  ms-term-serv

After adding the 'address' parameter and restarting the service

$ sudo nmap -p 3389 192.168.1.16

Starting Nmap 5.21 ( http://nmap.org ) at 2013-08-05 02:10 UTC
Nmap scan report for 192.168.1.16
Host is up (0.030s latency).
PORT     STATE  SERVICE
3389/tcp closed ms-term-serv

Also note that at least in Windows 7, the native Remote Desktop Connection client appears to have trouble if the remote server is tunneled to localhost:3389 (the default xrdp port), I ended up setting my putty tunnel as 

L33389    localhost:3389

and then specifying localhost:33389 in the Remote Desktop Connection dialog (although any suitably high numbered free port should work as well)

Related Question