1xrdp.ini(5) xrdp.ini(5)
2
6 xrdp.ini - Configuration file for xrdp(8)
7
10 This is the man page for xrdp.ini, xrdp(8) configuration file. It is
11 composed by a number of sections, each one composed by a section name,
12 enclosed by square brackets, followed by a list of <parameter>=<value>
13 lines.
14 xrdp.ini supports the following sections:
16 [Globals] - sets some global configuration settings for xrdp(8).
19 [Logging] - logging subsystem parameters
22 [Channels] - channel subsystem parameters
25 All options and values (except for file names and paths) are case in‐
28 sensitive, and are described in detail below.
29
32 The options to be specified in the [Globals] section are the following:
33 autorun=session_name
36 Section name for automatic login. If set and the client supplies
37 valid username and password, the user will be logged in automat‐
38 ically using the connection specified by session_name.
39 If session_name is empty, the LOGIN DOMAIN from the client with
41 be used to select the section. If no domain name is supplied,
42 the first suitable section will be used for automatic login.
43 bitmap_cache=[true|false]
46 If set to 1, true or yes this option enables bitmap caching in
47 xrdp(8).
48 bitmap_compression=[true|false]
51 If set to 1, true or yes this option enables bitmap compression
52 in xrdp(8).
53 bulk_compression=[true|false]
56 If set to 1, true or yes this option enables compression of bulk
57 data in xrdp(8).
58 certificate=/path/to/certificate
61 key_file=/path/to/private_key
63 Set location of TLS certificate and private key. They must be
64 written in PEM format. If not specified, defaults to
65 /etc/xrdp/cert.pem, /etc/xrdp/key.pem.
66 This parameter is effective only if security_layer is set to tls
68 or negotiate.
69 channel_code=[true|false]
72 If set to 0, false or no this option disables all channels
73 xrdp(8). See section CHANNELS below for more fine grained op‐
74 tions.
75 crypt_level=[low|medium|high|fips]
78 Regulate encryption level of Standard RDP Security. This param‐
79 eter is effective only if security_layer is set to rdp or nego‐
80 tiate.
81 Encryption in Standard RDP Security is controlled by two set‐
83 tings: Encryption Level and Encryption Method. The only sup‐
84 ported Encryption Method are 40BIT_ENCRYPTION and 128BIT_ENCRYP‐
85 TION. 56BIT_ENCRYPTION is not supported. This option controls
86 the Encryption Level:
87 low All data sent from the client to the server is protected
89 by encryption based on the maximum key strength sup‐
90 ported by the client. This is the only level that the
91 traffic sent by the server to client is not encrypted.
92 medium All data sent between the client and the server is pro‐
94 tected by encryption based on the maximum key strength
95 supported by the client (client compatible).
96 high All data sent between the client and the server is pro‐
98 tected by encryption based on the server's maximum key
99 strength (sever compatible).
100 fips All data sent between the client and server is protected
102 using Federal Information Processing Standard 140-1 val‐
103 idated encryption methods. This level is required for
104 Windows clients (mstsc.exe) if the client's group policy
105 enforces FIPS-compliance mode.
106 fork=[true|false]
109 If set to 1, true or yes for each incoming connection xrdp(8)
110 forks a sub-process instead of using threads.
111 hidelogwindow=[true|false]
114 If set to 1, true or yes, xrdp will not show a window for log
115 messages. If not specified, defaults to false.
116 max_bpp=[8|15|16|24|32]
119 Limit the color depth by specifying the maximum number of bits
120 per pixel. If not specified or set to 0, unlimited.
121 pamerrortxt=error_text
124 Specify text passed to PAM when authentication failed. The maxi‐
125 mum length is 256.
126 port=port
129 Specify TCP port and interface to listen on for incoming connec‐
130 tions. Specifying only the port means that xrdp will listen on
131 all interfaces. The default port for RDP is 3389. Multiple ad‐
132 dress:port instances must be separated by spaces or commas.
133 Check the .ini file for examples. Specifying interfaces re‐
134 quires said interfaces to be UP before xrdp starts.
135 require_credentials=[true|false]
138 If set to 1, true or yes, xrdp will scan the user name provided
139 by the client for the ASCII field separator character (0x1F). It
140 will then copy over what is after the separator as the password
141 supplied by the user and treats it as autologon. If not speci‐
142 fied, defaults to false.
143 omain_user_separator=arator
146 If specified the domain name supplied by the client is appended
147 to the username separated by separator.
148 \nable_token_login=[true|false]
151 If set to 1, true or yes, xrdp requires clients to include user‐
152 name and password initial connection phase. In other words, xrdp
153 doesn't allow clients to show login screen if set to true. If
154 not specified, defaults to false.
155 security_layer=[tls|rdp|negotiate]
158 Regulate security methods. If not specified, defaults to negoti‐
159 ate.
160 tls Enhanced RDP Security is used. All security operations
162 (encryption, decryption, data integrity verification,
163 and server authentication) are implemented by TLS.
164 rdp Standard RDP Security, which is not safe from man-in-
167 the-middle attack, is used. The encryption level of
168 Standard RDP Security is controlled by crypt_level.
169 negotiate
172 Negotiate these security methods with clients.
173 ssl_protocols=[SSLv3] [TLSv1] [TLSv1.1] [TLSv1.2] [TLSv1.3]
176 Enables the specified SSL/TLS protocols. Each value should be
177 separated by comma. SSLv2 is always disabled. At least one pro‐
178 tocol should be given to accept TLS connections. This parameter
179 is effective only if security_layer is set to tls or negotiate.
180 tcp_keepalive=[true|false]
183 Regulate if the listening socket uses socket option
184 SO_KEEPALIVE. If set to 1, true or yes and the network connec‐
185 tion disappears without closing messages, the connection will be
186 closed.
187 tcp_nodelay=[true|false]
190 Regulate if the listening socket uses socket option TCP_NODELAY.
191 If set to 1, true or yes, no buffering will be performed in the
192 TCP stack.
193 tcp_send_buffer_bytes=buffer_size
196 tcp_recv_buffer_bytes=buffer_size
198 Specify send/recv buffer sizes in bytes. The default value de‐
199 pends on operating system.
200 tls_ciphers=cipher_suite
203 Specifies TLS cipher suite. The format of this parameter is
204 equivalent to which openssl(1) ciphers subcommand accepts.
205 (ex. $ openssl ciphers 'HIGH:!ADH:!SHA1')
207 This parameter is effective only if security_layer is set to tls
209 or negotiate.
210 use_fastpath=[input|output|both|none]
213 If not specified, defaults to none.
214 black=000000
217 grey=c0c0c0
219 dark_grey=808080
221 blue=0000ff
223 dark_blue=00007f
225 white=ffffff
227 red=ff0000
229 green=00ff00
231 background=000000
233 These options override the colors used internally by xrdp(8) to
234 draw the login and log windows. Colors are defined using a
235 hexadecimal (hex) notation for the combination of Red, Green,
236 and Blue color values (RGB). The lowest value that can be given
237 to one of the light sources is 0 (hex 00). The highest value is
238 255 (hex FF).
239
242 The following parameters can be used in the [Logging] section:
243 LogFile=/var/log/xrdp.log
246 This options contains the path to logfile. It can be either ab‐
247 solute or relative.
248 LogLevel=level
251 This option can have one of the following values:
252 CORE or 0 - Log only core messages. these messages are _always_
254 logged, regardless the logging level selected.
255 ERROR or 1 - Log only error messages
257 WARNING, WARN or 2 - Logs warnings and error messages
259 INFO or 3 - Logs errors, warnings and informational messages
261 DEBUG or 4 - Log everything. If xrdp-sesman is compiled in debug
263 mode, this options will output many more low-level message, use‐
264 ful for developers
265 EnableSyslog=[true|false]
268 If set to 1, true or yes this option enables logging to syslog.
269 Otherwise syslog is disabled.
270 SyslogLevel=level
273 This option sets the logging level for syslog. It can have the
274 same values of LogLevel. If SyslogLevel is greater than
275 LogLevel, its value is lowered to that of LogLevel.
276 EnableConsole=[true|false]
279 If set to 1, true or yes, this option enables logging to the
280 console (ie. stdout).
281 ConsoleLevel=level
284 Logging level for the console. It can have the same values as
285 LogLevel. Defaults to DEBUG.
286 EnableProcessId=[true|false]
289 If set to 1, true or yes, this option enables logging the
290 process id in all log messages. Defaults to false.
291
294 The Remote Desktop Protocol supports several channels, which are used
295 to transfer additional data like sound, clipboard data and others.
296 Channel names not listed here will be blocked by xrdp. Not all chan‐
297 nels are supported in all cases, so setting a value to true is a pre‐
298 requisite, but does not force its use.
299 Channels can also be enabled or disabled on a per connection basis by
300 prefixing each setting with channel. in the channel section.
301 rdpdr=[true|false]
304 If set to 1, true or yes using the RDP channel for device redi‐
305 rection is allowed.
306 rdpsnd=[true|false]
309 If set to 1, true or yes using the RDP channel for sound is al‐
310 lowed.
311 drdynvc=[true|false]
314 If set to 1, true or yes using the RDP channel to initiate addi‐
315 tional dynamic virtual channels is allowed.
316 cliprdr=[true|false]
319 If set to 1, true or yes using the RDP channel for clipboard re‐
320 direction is allowed.
321 rail=[true|false]
324 If set to 1, true or yes using the RDP channel for remote appli‐
325 cations integrated locally (RAIL) is allowed.
326 xrdpvr=[true|false]
329 If set to 1, true or yes using the RDP channel for XRDP Video
330 streaming is allowed.
331
334 A connection section is made of a section name, enclosed in square
335 brackets, and the following entries:
336 name=<session name>
339 The name displayed in xrdp(8) login window's combo box.
340 lib=../vnc/libvnc.so
343 Sets the library to be used with this connection.
344 username=<username>|{base64}<base64-encoded-username>|ask
347 Specifies the username used for authenticating in the connec‐
348 tion. If set to ask, user name should be provided in the login
349 window.
350 If the username includes comment out symbols such as '#', or
352 ';', the username can be provided in base64 form prefixing
353 "{base64}".
354 password=<password>|{base64}<base64-encoded-password>|ask
357 Specifies the password used for authenticating in the connec‐
358 tion. If set to ask, password should be provided in the login
359 window.
360 This parameter can be provided in base64 form as well as user‐
362 name. See also examples below.
363 ip=127.0.0.1
366 Specifies the ip address of the host to connect to.
367 port=<number>|-1
370 Specifies the port number to connect to. If set to -1, the de‐
371 fault port for the specified library is used.
372 xserverbpp=<number>
375 Specifies color depth of the backend X server. The default is
376 the color depth of the client. Only Xvnc and X11rdp use that
377 setting. Xorg runs at 24 bpp.
378 disabled_encodings_mask=<number>
381 Set this bitmask to a non-zero value to prevent xrdp(8) request‐
382 ing some features from the Xvnc server. You should only need to
383 set this to a non-zero value to work around bugs in your Xvnc
384 server. The bit values supported for a particular release of
385 xrdp(8) are documented in xrdp.ini.
386 code=<number>|0
389 Specifies the session type. The default, 0, is Xvnc, 10 is
390 X11rdp, and 20 is Xorg with xorgxrdp modules.
391 chansrvport=DISPLAY(n)|/path/to/domain-socket
394 Asks xrdp to connect to a manually started xrdp-chansrv in‐
395 stance. This can be useful if you wish to use to use xrdp to
396 connect to a VNC session which has been started other than by
397 xrdp-sesman, as you can then make use of xrdp-chansrv facilities
398 in the VNC session.
399 The first form of this setting is recommended, replacing n with
401 the X11 display number of the session.
402
405 This is an example xrdp.ini:
406 [Globals]
408 bitmap_cache=true
409 bitmap_compression=true
410 [Xorg]
412 name=Xorg
413 lib=libxup.so
414 username=ask
415 password=ask
416 ip=127.0.0.1
417 port=-1
418 code=20
419 [vnc-any]
421 name=vnc-any
422 lib=libvnc.so
423 ip=ask
424 port=ask5900
425 username=na
426 password={base64}cGFzc3dvcmQhCg==
427
430 /etc/xrdp/xrdp.ini
431
434 xrdp(8), xrdp-chansrv(8), xrdp-sesman(8), xrdp-sesrun(8), sesman.ini(5)
435 For more info on xrdp see ⟨http://www.xrdp.org/⟩
437xrdp team 0.9.21 xrdp.ini(5)