diff --git a/configure.ac b/configure.ac index 3a470ab366..0ba5fdbb47 100644 --- a/configure.ac +++ b/configure.ac @@ -618,6 +618,7 @@ AC_CONFIG_FILES([ tools/Makefile tools/devel/Makefile tools/devel/tcp_proxy/Makefile + tools/scripts/Makefile vnc/Makefile xrdpapi/Makefile xrdp/Makefile diff --git a/docs/man/xrdp.ini.5.in b/docs/man/xrdp.ini.5.in index af99776e84..9d28cba162 100644 --- a/docs/man/xrdp.ini.5.in +++ b/docs/man/xrdp.ini.5.in @@ -127,9 +127,21 @@ User name and group to run the xrdp daemon under. After xrdp starts, it sets its UID and GID to values derived from these settings, so that it's running without system privilege. + The \fBruntime_group\fP MUST be set to the same value as \fBSessionSockdirGroup\fP in \fBsesman.ini\fP if you want to run sessions. +A suitable user and group can be added with a command like this (Linux):- + +useradd xrdp -d / -c 'xrdp daemon' -s /usr/sbin/nologin + +In order to establish secure connections, the xrdp daemon needs permission +to access sensitive cryptographic files. After changing either or both +of these values, check that xrdp has access to required files by running +this script:- + +@xrdpdatadir@/xrdp-chkpriv + .TP \fBenable_token_login\fP=\fI[true|false]\fP If set to \fB1\fP, \fBtrue\fP or \fByes\fP, \fBxrdp\fP will scan the user name provided by the diff --git a/tools/Makefile.am b/tools/Makefile.am index c4f7c462ca..15bcb443b1 100644 --- a/tools/Makefile.am +++ b/tools/Makefile.am @@ -1,3 +1,4 @@ SUBDIRS = \ - devel + devel \ + scripts diff --git a/tools/scripts/Makefile.am b/tools/scripts/Makefile.am new file mode 100644 index 0000000000..d43ee20e24 --- /dev/null +++ b/tools/scripts/Makefile.am @@ -0,0 +1,4 @@ +xrdppkgdatadir=$(datadir)/xrdp + +dist_xrdppkgdata_SCRIPTS = \ + xrdp-chkpriv diff --git a/tools/scripts/xrdp-chkpriv b/tools/scripts/xrdp-chkpriv new file mode 100755 index 0000000000..b9e33769d7 --- /dev/null +++ b/tools/scripts/xrdp-chkpriv @@ -0,0 +1,206 @@ +#!/bin/sh +# +# xrdp: A Remote Desktop Protocol server. +# +# Copyright (C) Jay Sorg and contributors 2004-2024 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Program to check permissions for xrdp when running in a non-privileged +# mode + +# Change these if they do not match your installation +CONF_DIR=/etc/xrdp +XRDP_INI="$CONF_DIR"/xrdp.ini +SESMAN_INI="$CONF_DIR"/sesman.ini +RSAKEYS_INI="$CONF_DIR"/rsakeys.ini + +# ----------------------------------------------------------------------------- +# G E T I N I V A L U E +# +# Gets a value from an ini file. +# +# Params [ini_file] [key] +# ----------------------------------------------------------------------------- +GetIniValue() +{ + # Look for a line matching 'key=' with optional whitespace + # either side of the key. When we find one, strip everything + # up to and including the first '=', print it, and quit + # + # This doesn't take sections into account + sed -n -e '/^ *'$2' *=/{ + s/^[^=]*=//p + q + }' $1 +} + +# ----------------------------------------------------------------------------- +# M A I N +# ----------------------------------------------------------------------------- + +if [ `id -u` != 0 ]; then + echo "** Must run this script as root" >&2 + exit 1 +fi + +SUDO=$(command -v sudo) +if [ -z "$SUDO" ]; then + echo "** Need the sudo utility installed to run this script" >&2 + exit 1 +fi + +OS=$(uname) +case "$OS" in + FreeBSD | Linux) ;; + *) echo "Unsupported operating system $OS" >&2 + exit 1 +esac + +errors=0 + +runtime_user=$(GetIniValue "$XRDP_INI" runtime_user) +runtime_group=$(GetIniValue "$XRDP_INI" runtime_group) +certificate=$(GetIniValue "$XRDP_INI" certificate) +key_file=$(GetIniValue "$XRDP_INI" key_file) +SessionSockdirGroup=$(GetIniValue "$SESMAN_INI" SessionSockdirGroup) + +case "$certificate" in + '') certificate="$CONF_DIR"/cert.pem ;; + /*) ;; + *) certificate="$CONF_DIR"/"$certificate" +esac + +case "$key_file" in + '') key_file="$CONF_DIR"/key.pem ;; + /*) ;; + *) key_file="$CONF_DIR"/"$key_file" +esac + +echo "Settings" +echo " - [xrdp.ini] runtime_user : $runtime_user" +echo " - [xrdp.ini] runtime_group : $runtime_group" +echo " - [xrdp.ini] certificate : $certificate" +echo " - [xrdp.ini] key_file : $key_file" +echo " - [sesman.ini] SessionSockdirGroup : $SessionSockdirGroup" +echo + +# Basic checks on runtime user/group +if [ -z "$runtime_user" -o -z "$runtime_group" ]; then + echo "-Info- This system is not configured to run xrdp without privilege" + exit 0 +fi + +if [ -z "$runtime_user" -o -z "$runtime_group" ]; then + echo "-Error- Both 'runtime_user' and 'runtime_group' must be set" + errors=$(expr $errors + 1) + exit 1 +fi + +if getent passwd "$runtime_user" >/dev/null ; then + echo "-Info- runtime_user '$runtime_user' appears to exist" +else + echo "-Error- runtime_user '$runtime_user' does not exist" + errors=$(expr $errors + 1) +fi + +GID= +if getent group "$runtime_group" >/dev/null ; then + echo "-Info- runtime_group '$runtime_group' appears to exist" + GID=$(getent group xrdp | cut -d: -f3) +else + echo "-Error- runtime_group '$runtime_group' does not exist" + errors=$(expr $errors + 1) +fi + +# Groups agree between sesman and xrdp? +if [ "$runtime_user" = "$SessionSockdirGroup" ]; then + echo "-Info- xrdp.ini and sesman.ini agree on group ownbership" +else + echo "-Error- xrdp.ini and sesman.ini do not agree on group ownbership" + errors=$(expr $errors + 1) +fi + +# Check we can access rsakeys.ini +# +# This is our file, so we can be completely prescriptive about +# the permissions +if [ -e $RSAKEYS_INI ]; then + # Only check if we have a GID + if [ -n "$GID" ]; then + # Get the permissions, UID and GID in $1..$3 + case "$OS" in + FreeBSD) set -- $(stat -f "%Lp %u %g" $RSAKEYS_INI) ;; + *) set -- $(stat -c "%a %u %g" $RSAKEYS_INI) ;; + esac + if [ "$1/$2/$3" = 640/0/$GID ]; then + echo "-Info- $RSAKEYS_INI has correct permissions" + else + if [ "$1" != 640 ]; then + echo "-Error- $RSAKEYS_INI should have permissions -rw-r-----" + errors=$(expr $errors + 1) + fi + if [ "$2" != 0 ]; then + echo "-Error- $RSAKEYS_INI should be owned by root" + errors=$(expr $errors + 1) + fi + if [ "$3" != $GID ]; then + echo "-Error- $RSAKEYS_INI should be in the $runtime_group group" + errors=$(expr $errors + 1) + fi + fi + fi +else + echo "-Error- $RSAKEYS_INI does not exist" + errors=$(expr $errors + 1) +fi + +# Are cert and key readable by the user? +# +# These aren't necessarily our files, so we can't be prescriptive about +# privileges. On Debian for example, we might be using the 'ssl-cert' +# group to obtain access to /etc/ssl/private/ssl-cert-snakeoil.key +if ! [ -e $certificate ]; then + echo "-Error- $certificate does not exist" + errors=$(expr $errors + 1) +elif $SUDO -u "$runtime_user" -g "$runtime_group" \ + sh -c '[ -r '"$certificate"' ]' +then + echo "-Info- $certificate is readable by $runtime_user:$runtime_group" +else + echo "-Error- $certificate is not readable by $runtime_user:$runtime_group" + errors=$(expr $errors + 1) +fi + +if ! [ -e $key_file ]; then + echo "-Error- $key_file does not exist" + errors=$(expr $errors + 1) +elif $SUDO -u "$runtime_user" -g "$runtime_group" \ + sh -c '[ -r '"$key_file"' ]' +then + echo "-Info- $key_file is readable by $runtime_user:$runtime_group" +else + echo "-Error- $key_file is not readable by $runtime_user:$runtime_group" + errors=$(expr $errors + 1) +fi + +echo +if [ $errors -eq 0 ]; then + echo "-Summary- Permissions appear to be correct to run xrdp unprivileged" + status=0 +else + echo "-Summary- $errors error(s) found. Please correct these and try again" + status=1 +fi + +exit $status diff --git a/xrdp/xrdp.ini.in b/xrdp/xrdp.ini.in index 073db1559c..6cf870b57e 100644 --- a/xrdp/xrdp.ini.in +++ b/xrdp/xrdp.ini.in @@ -28,11 +28,8 @@ port=3389 use_vsock=false ; Unprivileged User name and group to run the xrdp daemon. -; It is HIGHLY RECOMMENDED you set these values. -; A suitable user and group can be added with a command like this (Linux):- -; useradd xrdp -d / -c 'xrdp daemon' -s /usr/sbin/nologin -; Be aware that runtime_group here, and SessionSockdirGroup in sesman.ini -; MUST be the same if you want to run sessions. +; It is HIGHLY RECOMMENDED you set these values. See the xrdp.ini(5) +; manpage for more information on setting and checking these. #runtime_user=xrdp #runtime_group=xrdp